From 4155c6cf1706a8fd3a233659fb839facc63f1568 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 17 Jun 2026 01:04:01 +0530 Subject: [PATCH 001/162] udpating risk_message (#4129) --- .../endpoint/windows_suspicious_burst_of_password_changes.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_suspicious_burst_of_password_changes.yml b/detections/endpoint/windows_suspicious_burst_of_password_changes.yml index 84fc995ac6a..b0d3a2986e5 100644 --- a/detections/endpoint/windows_suspicious_burst_of_password_changes.yml +++ b/detections/endpoint/windows_suspicious_burst_of_password_changes.yml @@ -62,7 +62,7 @@ drilldown_searches: name: View risk events for the last 7 days for - "$user$" and "$dest$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' finding: - title: Rapid burst of password changes of local accounts by $SubjectUserName$ on $dest$ + title: Rapid burst of password changes of local accounts by $InitiatingAccounts$ on $dest$ entity: field: dest type: system From bf5654a61d025552cc09909c21a1fc8ddc28bccf Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 17 Jun 2026 12:34:17 -0700 Subject: [PATCH 002/162] TAs were pointing to versions that have been (#4130) pulled from splunkbase --- contentctl.yml | 4 ++-- data_sources/azure_active_directory.yml | 2 +- ...directory_add_app_role_assignment_to_service_principal.yml | 2 +- data_sources/azure_active_directory_add_member_to_role.yml | 2 +- .../azure_active_directory_add_owner_to_application.yml | 2 +- data_sources/azure_active_directory_add_service_principal.yml | 2 +- data_sources/azure_active_directory_add_unverified_domain.yml | 2 +- .../azure_active_directory_consent_to_application.yml | 2 +- .../azure_active_directory_disable_strong_authentication.yml | 2 +- data_sources/azure_active_directory_enable_account.yml | 2 +- data_sources/azure_active_directory_invite_external_user.yml | 2 +- .../azure_active_directory_microsoftgraphactivitylogs.yml | 2 +- .../azure_active_directory_noninteractiveusersigninlogs.yml | 2 +- .../azure_active_directory_reset_password_(by_admin).yml | 2 +- .../azure_active_directory_set_domain_authentication.yml | 2 +- data_sources/azure_active_directory_sign_in_activity.yml | 2 +- data_sources/azure_active_directory_update_application.yml | 2 +- .../azure_active_directory_update_authorization_policy.yml | 2 +- data_sources/azure_active_directory_update_user.yml | 2 +- .../azure_active_directory_user_registered_security_info.yml | 2 +- ...ure_audit_create_or_update_an_azure_automation_account.yml | 2 +- ...ure_audit_create_or_update_an_azure_automation_runbook.yml | 2 +- ...ure_audit_create_or_update_an_azure_automation_webhook.yml | 2 +- data_sources/azure_monitor_activity.yml | 2 +- data_sources/palo_alto_network_threat.yml | 2 +- data_sources/palo_alto_network_traffic.yml | 2 +- 26 files changed, 27 insertions(+), 27 deletions(-) diff --git a/contentctl.yml b/contentctl.yml index 5db591c8f4e..8152146905f 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -131,7 +131,7 @@ apps: - uid: 2757 title: Splunk Add-on for Palo Alto Networks appid: SPLUNK_ADD_ON_FOR_PALO_ALTO_NETWORKS - version: 3.0.1 + version: 3.1.0 description: description of app hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-palo-alto-networks_301.tgz - uid: 3865 @@ -167,7 +167,7 @@ apps: - uid: 3110 title: Splunk Add-on for Microsoft Cloud Services appid: SPLUNK_TA_MICROSOFT_CLOUD_SERVICES - version: 6.1.1 + version: 6.1.3 description: description of app hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_611.tgz - uid: 4055 diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index f6a672edabd..4b353862ea1 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 output_fields: - dest - user diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index d66b843837b..182d512dca2 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index 55c848f5623..5031b5cd33a 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -17,7 +17,7 @@ separator_value: Add member to role supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index 765ccc74019..f0c01197f68 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -17,7 +17,7 @@ separator_value: Add owner to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index 6c7686c2f56..c5e2c3a4e56 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index b9880438f1a..7b4411afbdb 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -17,7 +17,7 @@ separator_value: Add unverified domain supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 8a43552df97..1461a8eaa69 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -17,7 +17,7 @@ separator_value: Consent to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index eb4211d946f..177b30e2127 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -16,7 +16,7 @@ separator_value: Disable Strong Authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 691fee93161..b7fd87116ed 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -16,7 +16,7 @@ separator_value: Enable account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 7d6c1a831ee..22983a3d9f6 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -16,7 +16,7 @@ separator_value: Invite external user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml index c7afc48de52..65cb093d4f0 100644 --- a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml +++ b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}' diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml index ff1573b80ed..8c5adbf8ae6 100644 --- a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml +++ b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - action - additional_details diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index 3da7f3b6f20..da60f90a288 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -16,7 +16,7 @@ separator_value: Reset password (by admin) supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 2feea34e289..9a0c666f201 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -16,7 +16,7 @@ separator_value: Set domain authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index 49445e5bc3c..d6888c0deeb 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -16,7 +16,7 @@ separator_value: Sign-in activity supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index 6ac5a8e4197..b0ae6b37c94 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -16,7 +16,7 @@ separator_value: Update application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index 000e4feec50..7a086791e4d 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -16,7 +16,7 @@ separator_value: Update authorization policy supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index e8b3fb5929f..f0ca04a229a 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -15,7 +15,7 @@ separator_value: Update user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index cae5dfe6ab0..ce39762a767 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -15,7 +15,7 @@ separator_value: User registered security info supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index 1456c5f3da6..fb083554f3f 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 1c0d9a08644..1c61b96dac4 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation Runbook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index b83dcf595a0..c1d309bda95 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation webhook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - _time - authorization.action diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index d0fb8d2f59e..5b89633bdb8 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.1 + version: 6.1.3 fields: - column - action diff --git a/data_sources/palo_alto_network_threat.yml b/data_sources/palo_alto_network_threat.yml index 1e07c2689aa..b83bd67d0b4 100644 --- a/data_sources/palo_alto_network_threat.yml +++ b/data_sources/palo_alto_network_threat.yml @@ -16,7 +16,7 @@ sourcetype: pan:threat supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.0.1 + version: 3.1.0 fields: - _time - date_hour diff --git a/data_sources/palo_alto_network_traffic.yml b/data_sources/palo_alto_network_traffic.yml index de8b46c579c..00e9798ece8 100644 --- a/data_sources/palo_alto_network_traffic.yml +++ b/data_sources/palo_alto_network_traffic.yml @@ -16,7 +16,7 @@ sourcetype: pan:traffic supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.0.1 + version: 3.1.0 fields: - _time - date_hour From 395e1db799692e78c002c09e0a6398ca86d1ae49 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 22 Jun 2026 16:20:32 +0530 Subject: [PATCH 003/162] chore: bump contentctl.yml and build.yml to 6.2.0 (#4131) Co-authored-by: research bot --- build.yml | 2 +- contentctl.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build.yml b/build.yml index 57d97a4949a..cca64df09e9 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.1.0 +app_version: 6.2.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index 8152146905f..abb5d9c6abb 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.1.0 + version: 6.2.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU From 3afca81b06746996d8485a0f6ae6e093e0e15043 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 24 Jun 2026 17:12:53 +0530 Subject: [PATCH 004/162] Splunk Vuln content to Github (#4134) * move from gitlab * moving removed from gitlab * udpating versions due to removal of whitespace * UTC is 23 * deprecate content * bump ver --------- Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> --- .gitignore | 1 + ...entication_token_exposure_in_debug_log.yml | 70 ++++++++++++++++ ...rary_file_write_to_windows_system_root.yml | 80 +++++++++++++++++++ .../application/splunk_rce_via_user_xslt.yml | 36 +++++++++ ...n_disclosure_in_debug_logging_channels.yml | 60 ++++++++++++++ .../splunk_user_enumeration_attempt.yml | 55 +++++++++++++ ...scalation_via_custom_urls_in_dashboard.yml | 41 ++++++++++ ..._lookup_file_editing_rce_via_user_xslt.yml | 32 ++++++++ ...on_via_custom_dashboard_leading_to_rce.yml | 40 ++++++++++ ...prise_kv_store_incorrect_authorization.yml | 41 ++++++++++ ...nformation_disclosure_on_account_login.yml | 41 ++++++++++ ...sal_in_splunk_app_for_lookup_file_edit.yml | 39 +++++++++ .../deprecated/splunk_rce_pdfgen_render.yml | 56 +++++++++++++ lookups/csv/splunk_risky_command.csv | 16 ++++ lookups/csv/splunk_risky_command.yml | 13 +++ macros/audittrail.yml | 8 ++ macros/deprecated/audit_searches.yml | 8 ++ macros/deprecated/bro_ssl_json.yml | 8 ++ .../path_traversal_spl_injection.yml | 8 ++ macros/deprecated/splunk_crash_log.yml | 8 ++ macros/deprecated/splunk_python.yml | 8 ++ .../splunkd_investigation_rest_handler.yml | 8 ++ macros/deprecated/splunkd_web.yml | 8 ++ macros/deprecated/splunkd_webs.yml | 8 ++ macros/deprecated/splunkd_webx.yml | 8 ++ macros/splunkd.yml | 8 ++ macros/splunkd_failed_auths.yml | 8 ++ macros/splunkd_ui.yml | 8 ++ macros/splunkda.yml | 8 ++ ...ng_interpreter_risky_spl_mltk_baseline.yml | 34 ++++++++ ...ct_risky_spl_using_pretrained_ml_model.yml | 46 +++++++++++ .../open_redirect_in_splunk_web.yml | 36 +++++++++ .../path_traversal_spl_injection.yml | 57 +++++++++++++ ...rapiddiag_through_user_interface_views.yml | 56 +++++++++++++ ...te_path_traversal_using_runshellscript.yml | 54 +++++++++++++ ...scovery_drilldown_dashboard_disclosure.yml | 39 +++++++++ ...and_scripting_interpreter_delete_usage.yml | 56 +++++++++++++ ...d_scripting_interpreter_risky_commands.yml | 43 ++++++++++ ...d_scripting_interpreter_risky_spl_mltk.yml | 57 +++++++++++++ ...srf_in_the_ssg_kvstore_client_endpoint.yml | 56 +++++++++++++ ...om_analytics_workspace_using_sid_query.yml | 40 ++++++++++ ...al_certificates_infrastructure_version.yml | 42 ++++++++++ ...igital_certificates_lack_of_encryption.yml | 58 ++++++++++++++ ...ore_via_csrf_enabling_maintenance_mode.yml | 56 +++++++++++++ ...plunk_dos_using_malformed_saml_request.yml | 38 +++++++++ .../splunk_dos_via_dump_spl_command.yml | 37 +++++++++ .../splunk_dos_via_malformed_s2s_request.yml | 58 ++++++++++++++ ...os_via_post_request_datamodel_endpoint.yml | 40 ++++++++++ .../splunk_dos_via_printf_search_function.yml | 40 ++++++++++ .../splunk_edit_user_privilege_escalation.yml | 40 ++++++++++ ...ndpoint_denial_of_service_dos_zip_bomb.yml | 57 +++++++++++++ ...lunk_enterprise_information_disclosure.yml | 36 +++++++++ ...windows_deserialization_file_partition.yml | 54 +++++++++++++ ...ons_manager_via_investigation_creation.yml | 57 +++++++++++++ ..._dos_through_investigation_attachments.yml | 54 +++++++++++++ ...esponse_splitting_via_rest_spl_command.yml | 36 +++++++++ ...splunk_identified_ssl_tls_certificates.yml | 41 ++++++++++ ...re_via_pdf_export_in_classic_dashboard.yml | 46 +++++++++++ ...ly_formatted_parameter_crashes_splunkd.yml | 50 ++++++++++++ ...on_disclosure_in_splunk_add_on_builder.yml | 30 +++++++ ...nk_list_all_nonstandard_admin_accounts.yml | 33 ++++++++ ...obody_splunkdeploymentserverconfig_app.yml | 37 +++++++++ ...e_user_can_view_hashed_splunk_password.yml | 36 +++++++++ .../splunk_persistent_xss_via_props_conf.yml | 45 +++++++++++ ...unk_persistent_xss_via_scheduled_views.yml | 45 +++++++++++ ..._via_url_validation_bypass_w_dashboard.yml | 38 +++++++++ ...s_injection_forwarder_bundle_downloads.yml | 41 ++++++++++ ...sonation_weak_encryption_configuration.yml | 42 ++++++++++ ...personation_weak_encryption_selfsigned.yml | 42 ++++++++++ ...sonation_weak_encryption_simplerequest.yml | 42 ++++++++++ ...pass_on_indexing_preview_rest_endpoint.yml | 36 +++++++++ ...nk_rce_via_external_lookup_copybuckets.yml | 36 +++++++++ ...unk_rce_via_serialized_session_payload.yml | 40 ++++++++++ ..._gateway__splunk_mobile_alerts_feature.yml | 40 ++++++++++ ...ected_xss_in_the_templates_lists_radio.yml | 40 ++++++++++ ...ected_xss_on_app_search_table_endpoint.yml | 38 +++++++++ ..._command_abuse_disclosed_february_2023.yml | 69 ++++++++++++++++ ...ormation_disclosure_for_low_privs_user.yml | 43 ++++++++++ ...ored_xss_conf_web_settings_on_premises.yml | 39 +++++++++ ...ed_xss_via_data_model_objectname_field.yml | 41 ++++++++++ ...via_specially_crafted_bulletin_message.yml | 39 +++++++++ ...icated_dos_via_null_pointer_references.yml | 38 +++++++++ ...nticated_log_injection_web_service_log.yml | 40 ++++++++++ ...cated_path_traversal_modules_messaging.yml | 37 +++++++++ ...authorized_experimental_items_creation.yml | 38 +++++++++ ...nauthorized_notification_input_by_user.yml | 39 +++++++++ ...nsions_allowed_by_lookup_table_uploads.yml | 56 +++++++++++++ .../splunk_xss_in_highlighted_json_events.yml | 40 ++++++++++ .../splunk_xss_in_monitoring_console.yml | 45 +++++++++++ ...ave_table_dialog_header_in_search_page.yml | 41 ++++++++++ ...s_via_external_urls_in_dashboards_ssrf.yml | 38 +++++++++ removed/detections/splunk_xss_via_view.yml | 40 ++++++++++ stories/splunk_vulnerabilities.yml | 18 +++++ 93 files changed, 3509 insertions(+) create mode 100644 detections/application/splunk_authentication_token_exposure_in_debug_log.yml create mode 100644 detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml create mode 100644 detections/application/splunk_rce_via_user_xslt.yml create mode 100644 detections/application/splunk_sensitive_information_disclosure_in_debug_logging_channels.yml create mode 100644 detections/application/splunk_user_enumeration_attempt.yml create mode 100644 detections/application/splunk_xss_privilege_escalation_via_custom_urls_in_dashboard.yml create mode 100644 detections/deprecated/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml create mode 100644 detections/deprecated/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml create mode 100644 detections/deprecated/splunk_enterprise_kv_store_incorrect_authorization.yml create mode 100644 detections/deprecated/splunk_information_disclosure_on_account_login.yml create mode 100644 detections/deprecated/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml create mode 100644 detections/deprecated/splunk_rce_pdfgen_render.yml create mode 100644 lookups/csv/splunk_risky_command.csv create mode 100644 lookups/csv/splunk_risky_command.yml create mode 100644 macros/audittrail.yml create mode 100644 macros/deprecated/audit_searches.yml create mode 100644 macros/deprecated/bro_ssl_json.yml create mode 100644 macros/deprecated/path_traversal_spl_injection.yml create mode 100644 macros/deprecated/splunk_crash_log.yml create mode 100644 macros/deprecated/splunk_python.yml create mode 100644 macros/deprecated/splunkd_investigation_rest_handler.yml create mode 100644 macros/deprecated/splunkd_web.yml create mode 100644 macros/deprecated/splunkd_webs.yml create mode 100644 macros/deprecated/splunkd_webx.yml create mode 100644 macros/splunkd.yml create mode 100644 macros/splunkd_failed_auths.yml create mode 100644 macros/splunkd_ui.yml create mode 100644 macros/splunkda.yml create mode 100644 removed/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml create mode 100644 removed/detections/detect_risky_spl_using_pretrained_ml_model.yml create mode 100644 removed/detections/open_redirect_in_splunk_web.yml create mode 100644 removed/detections/path_traversal_spl_injection.yml create mode 100644 removed/detections/persistent_xss_in_rapiddiag_through_user_interface_views.yml create mode 100644 removed/detections/splunk_absolute_path_traversal_using_runshellscript.yml create mode 100644 removed/detections/splunk_account_discovery_drilldown_dashboard_disclosure.yml create mode 100644 removed/detections/splunk_command_and_scripting_interpreter_delete_usage.yml create mode 100644 removed/detections/splunk_command_and_scripting_interpreter_risky_commands.yml create mode 100644 removed/detections/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml create mode 100644 removed/detections/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml create mode 100644 removed/detections/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.yml create mode 100644 removed/detections/splunk_digital_certificates_infrastructure_version.yml create mode 100644 removed/detections/splunk_digital_certificates_lack_of_encryption.yml create mode 100644 removed/detections/splunk_disable_kvstore_via_csrf_enabling_maintenance_mode.yml create mode 100644 removed/detections/splunk_dos_using_malformed_saml_request.yml create mode 100644 removed/detections/splunk_dos_via_dump_spl_command.yml create mode 100644 removed/detections/splunk_dos_via_malformed_s2s_request.yml create mode 100644 removed/detections/splunk_dos_via_post_request_datamodel_endpoint.yml create mode 100644 removed/detections/splunk_dos_via_printf_search_function.yml create mode 100644 removed/detections/splunk_edit_user_privilege_escalation.yml create mode 100644 removed/detections/splunk_endpoint_denial_of_service_dos_zip_bomb.yml create mode 100644 removed/detections/splunk_enterprise_information_disclosure.yml create mode 100644 removed/detections/splunk_enterprise_windows_deserialization_file_partition.yml create mode 100644 removed/detections/splunk_es_dos_investigations_manager_via_investigation_creation.yml create mode 100644 removed/detections/splunk_es_dos_through_investigation_attachments.yml create mode 100644 removed/detections/splunk_http_response_splitting_via_rest_spl_command.yml create mode 100644 removed/detections/splunk_identified_ssl_tls_certificates.yml create mode 100644 removed/detections/splunk_image_file_disclosure_via_pdf_export_in_classic_dashboard.yml create mode 100644 removed/detections/splunk_improperly_formatted_parameter_crashes_splunkd.yml create mode 100644 removed/detections/splunk_information_disclosure_in_splunk_add_on_builder.yml create mode 100644 removed/detections/splunk_list_all_nonstandard_admin_accounts.yml create mode 100644 removed/detections/splunk_low_priv_search_as_nobody_splunkdeploymentserverconfig_app.yml create mode 100644 removed/detections/splunk_low_privilege_user_can_view_hashed_splunk_password.yml create mode 100644 removed/detections/splunk_persistent_xss_via_props_conf.yml create mode 100644 removed/detections/splunk_persistent_xss_via_scheduled_views.yml create mode 100644 removed/detections/splunk_persistent_xss_via_url_validation_bypass_w_dashboard.yml create mode 100644 removed/detections/splunk_process_injection_forwarder_bundle_downloads.yml create mode 100644 removed/detections/splunk_protocol_impersonation_weak_encryption_configuration.yml create mode 100644 removed/detections/splunk_protocol_impersonation_weak_encryption_selfsigned.yml create mode 100644 removed/detections/splunk_protocol_impersonation_weak_encryption_simplerequest.yml create mode 100644 removed/detections/splunk_rbac_bypass_on_indexing_preview_rest_endpoint.yml create mode 100644 removed/detections/splunk_rce_via_external_lookup_copybuckets.yml create mode 100644 removed/detections/splunk_rce_via_serialized_session_payload.yml create mode 100644 removed/detections/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml create mode 100644 removed/detections/splunk_reflected_xss_in_the_templates_lists_radio.yml create mode 100644 removed/detections/splunk_reflected_xss_on_app_search_table_endpoint.yml create mode 100644 removed/detections/splunk_risky_command_abuse_disclosed_february_2023.yml create mode 100644 removed/detections/splunk_sg_information_disclosure_for_low_privs_user.yml create mode 100644 removed/detections/splunk_stored_xss_conf_web_settings_on_premises.yml create mode 100644 removed/detections/splunk_stored_xss_via_data_model_objectname_field.yml create mode 100644 removed/detections/splunk_stored_xss_via_specially_crafted_bulletin_message.yml create mode 100644 removed/detections/splunk_unauthenticated_dos_via_null_pointer_references.yml create mode 100644 removed/detections/splunk_unauthenticated_log_injection_web_service_log.yml create mode 100644 removed/detections/splunk_unauthenticated_path_traversal_modules_messaging.yml create mode 100644 removed/detections/splunk_unauthorized_experimental_items_creation.yml create mode 100644 removed/detections/splunk_unauthorized_notification_input_by_user.yml create mode 100644 removed/detections/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml create mode 100644 removed/detections/splunk_xss_in_highlighted_json_events.yml create mode 100644 removed/detections/splunk_xss_in_monitoring_console.yml create mode 100644 removed/detections/splunk_xss_in_save_table_dialog_header_in_search_page.yml create mode 100644 removed/detections/splunk_xss_via_external_urls_in_dashboards_ssrf.yml create mode 100644 removed/detections/splunk_xss_via_view.yml create mode 100644 stories/splunk_vulnerabilities.yml diff --git a/.gitignore b/.gitignore index 2a6e590e07b..5133d1798ee 100644 --- a/.gitignore +++ b/.gitignore @@ -13,6 +13,7 @@ dist/ContentPack-*.appinspect_api_results.html dist/ContentPack-*.appinspect_api_results.json atomic-red-team/ external_repos/ +schemas/ # IDE .vscode/ diff --git a/detections/application/splunk_authentication_token_exposure_in_debug_log.yml b/detections/application/splunk_authentication_token_exposure_in_debug_log.yml new file mode 100644 index 00000000000..d056f65a607 --- /dev/null +++ b/detections/application/splunk_authentication_token_exposure_in_debug_log.yml @@ -0,0 +1,70 @@ +name: Splunk Authentication Token Exposure in Debug Log +id: 9a67e749-d291-40dd-8376-d422e7ecf8b5 +version: 9 +creation_date: '2024-03-27' +modification_date: '2026-06-24' +author: Rod Soto, Chase Franklin +status: production +type: TTP +description: |- + The following analytic identifies exposed authentication tokens in debug logs within Splunk Enterprise. + It leverages logs from the `splunkd` component with a DEBUG log level, specifically searching for event messages that validate tokens. This activity is significant because exposed tokens can be exploited by attackers to gain unauthorized access to the Splunk environment. + If confirmed malicious, this exposure could lead to unauthorized data access, privilege escalation, and potential compromise of the entire Splunk infrastructure. + Monitoring and addressing this vulnerability is crucial for maintaining the security and integrity of the Splunk deployment. +data_source: [] +search: |- + `splunkd` + component=JsonWebToken + log_level=DEBUG + eventtype="splunkd-log" + event_message="Validating token:*" + | rex "Validating token: (?.*)\.$" + | search token!=None + | stats count min(_time) as firstTime + max(_time) as lastTime + values(log_level) as log_level + values(event_message) as event_message + by index, sourcetype, host, token + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `splunk_authentication_token_exposure_in_debug_log_filter` +how_to_implement: Requires access to internal Splunk indexes. +known_false_positives: Only applies to affected versions of Splunk Enterprise below 9.2.1, 9.1.4, and 9.0.9 +references: + - https://advisory.splunk.com/advisories/SVD-2024-0301 +drilldown_searches: + - name: View the detection results for $host$ + search: '%original_detection_search% | search host = $host$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $host$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +finding: + title: Possible JsonWebToken exposure, please investigate affected $host$ + entity: + field: host + type: system + score: 50 +analytic_story: + - Splunk Vulnerabilities +asset_type: Splunk Server +cve: + - CVE-2024-29945 +mitre_attack_id: + - T1654 +product: + - Splunk Enterprise + - Splunk Cloud + - Splunk Enterprise Security +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1654/splunk/jsonwebtokenplaintokensvd_splunkd.log + source: /opt/splunk/var/log/splunk/splunkd.log + sourcetype: splunkd + index: _internal + test_type: unit diff --git a/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml b/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml new file mode 100644 index 00000000000..74c716a6880 --- /dev/null +++ b/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml @@ -0,0 +1,80 @@ +name: Splunk RCE Through Arbitrary File Write to Windows System Root +id: c97e0704-d9c6-454d-89ba-1510a987bf72 +version: 7 +creation_date: '2024-10-14' +modification_date: '2026-06-23' +author: Rod Soto +status: production +type: Hunting +description: In Splunk Enterprise for Windows versions below 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the “admin” or “power” Splunk roles could write a file to the Windows system root directory, which has a default location of C:\Windows\System32, when Splunk Enterprise for Windows is installed on a separate drive. Additionally, this user may be able to upload and execute code due to insecure session storage configuration. +data_source: + - Splunk +search: |- + ```Each exploit attempt abuses the following endpoint. A request to the endpoint MUST occur immediately before the App Creation Message. However, this endpoint does not expose the name of the app that was created``` + `splunkda` status=200 uri_path="*/search/apps/local/_new" + | bin _time span=1m | stats count by _time, user + ``` A request to this endpoint also results in an ApplicationManager event showing that a new application was created. This exposes the name and is created immediately following the initial request. We will look for these creation messages up to 60 seconds after the request to the vulnerable endpoint.``` + | eval earliest_app_creation_time=_time + | eval latest_app_creation_time=_time+60 + | eval api_user=user + ```Search for the names of apps that were created with the time bounds above``` + | map maxsearches=150 search="search index=_internal earliest=$earliest_app_creation_time$ latest=$latest_app_creation_time$ + ```Admins, or users with app creation privileges may abuse this command``` + (sourcetype=splunkd component=ApplicationManager event_message=\"Detected app creation:*\") OR + ```But the command may also be abused by users with lower privileges``` + (sourcetype=splunk_python user=$api_user$ type=ERROR \"requires capability\" AND (\"edit_local_apps\" OR \"admin_all_objects\")) + ```Create meaningful messages in the case that app creation was successful or if it failed``` + | strcat event_message \" - This app should be examined to ensure that it is legitimate.\" message_if_app_creation_successful + | strcat event_message \"Detected failed app creation: user does not have admin_all_objects or edit_local_apps capability and the user account MUST be investigated. This may still have resulted in the upload of malicious file(s) or execution of maliciouis command(s).\" message_if_app_creation_failed + | eval message=if(isnull(event_message), message_if_app_creation_failed, message_if_app_creation_successful ) + | eval user=\"$api_user$\"" + | stats count min(_time) as firstTime max(_time) as lastTime by user, message, host + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `splunk_rce_through_arbitrary_file_write_to_windows_system_root_filter` +how_to_implement: This search requires access to the _internal index and only applies Splunk Enterprise installations on Microsoft Windows. Apps, messages, and/or users reported by the search should be analyzed to see if they are legitimate. +known_false_positives: This search may produce false positives as it is not possible to analyze the contents of an App Creation. This only applies to Splunk installations on Microsoft Windows where installation is placed on a different root directory like e or d. +references: + - https://advisory.splunk.com/advisories/SVD-2024-1001 + - https://advisory.splunk.com/advisories/SVD-2024-1003 +analytic_story: + - Splunk Vulnerabilities +asset_type: Splunk Server +cve: + - CVE-2024-45731 + - CVE-2024-45733 +mitre_attack_id: + - T1210 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test SVD 1001 + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/svd-2024-1001-index_internal_sourcetype_splunkd.log + sourcetype: splunkd + source: D:\\Program Files\\Splunk\\var\\log\\splunk\\splunkd.log + index: _internal + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/svd-2024-1001-index_internal_sourcetype_splunkd_access.log + sourcetype: splunkd_access + source: D:\\Program Files\\Splunk\\var\\log\\splunk\\splunkd_access.log + index: _internal + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/svd-2024-1001-index_internal_sourcetype_splunk_python.log + sourcetype: splunk_python + source: D:\\Program Files\\Splunk\\var\\log\\splunk\\python.log + index: _internal + test_type: unit + - name: True Positive Test SVD 1003 + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/svd-2024-1003-index_internal_sourcetype_splunkd_access.log + sourcetype: splunkd_access + source: C:\\Program Files\\Splunk\\var\\log\\splunk\\splunkd_access.log + index: _internal + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/svd-2024-1003-index_internal_sourcetype_splunk_python.log + sourcetype: splunk_python + source: C:\\Program Files\\Splunk\\var\\log\\splunk\\python.log + index: _internal + test_type: unit diff --git a/detections/application/splunk_rce_via_user_xslt.yml b/detections/application/splunk_rce_via_user_xslt.yml new file mode 100644 index 00000000000..3f97d778283 --- /dev/null +++ b/detections/application/splunk_rce_via_user_xslt.yml @@ -0,0 +1,36 @@ +name: Splunk RCE via User XSLT +id: 6cb7e011-55fb-48e3-a98d-164fa854e37e +version: 7 +creation_date: '2023-11-22' +modification_date: '2026-05-14' +author: Marissa Bower, Chase Franklin, Rod Soto, Bhavin Patel, Eric McGinnis, Splunk +status: production +type: Hunting +description: The following analytic identifies potential remote code execution (RCE) attempts via user-supplied Extensible Stylesheet Language Transformations (XSLT) in Splunk versions 9.1.x. It detects this activity by analyzing `splunkd_ui` logs for specific URI patterns and status codes indicative of XSLT injection attempts. This activity is significant because successful exploitation could allow an attacker to execute arbitrary code on the Splunk server. If confirmed malicious, this could lead to full system compromise, unauthorized data access, and further lateral movement within the network. +data_source: [] +search: '`splunkd_ui` ((uri="*NO_BINARY_CHECK=1*" AND "*input.path=*.xsl*") OR uri="*dispatch*.xsl*") AND uri!= "*splunkd_ui*" | rex field=uri "(?=\s*([\S\s]+))" | eval decoded_field=urldecode(string) | eval action=case(match(status,"200"),"Allowed",match(status,"303|500|401|403|404|301|406"),"Blocked",1=1,"Unknown") | stats count min(_time) as firstTime max(_time) as lastTime by clientip useragent uri decoded_field action host | rename clientip as src, uri as dest_uri | iplocation src | fillnull value="N/A" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime, lastTime src, useragent, action, count, Country, Region, City, dest_uri, decoded_field | `splunk_rce_via_user_xslt_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. +known_false_positives: This search will provide information for investigation and hunting possible abuse of user-supplied XSLT. There may be false positives and results should individually evaluated. Please evaluate the source IP and useragent responsible for creating the requests. +references: + - https://advisory.splunk.com/advisories/SVD-2023-1104 +analytic_story: + - Splunk Vulnerabilities +asset_type: Endpoint +cve: + - CVE-2023-46214 +mitre_attack_id: + - T1210 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/splunk_rce_via_user_xslt_splunkd_ui_access.log + source: /opt/splunk/var/log/splunk/splunkd_ui_access.log + sourcetype: splunkd_ui_access + index: _internal + test_type: unit diff --git a/detections/application/splunk_sensitive_information_disclosure_in_debug_logging_channels.yml b/detections/application/splunk_sensitive_information_disclosure_in_debug_logging_channels.yml new file mode 100644 index 00000000000..0667d0860ee --- /dev/null +++ b/detections/application/splunk_sensitive_information_disclosure_in_debug_logging_channels.yml @@ -0,0 +1,60 @@ +name: Splunk Sensitive Information Disclosure in DEBUG Logging Channels +id: 93dc7182-c5da-4085-82ec-401abf33d623 +version: 6 +creation_date: '2024-10-14' +modification_date: '2026-05-14' +author: Rod Soto, Eric McGinnis, Splunk +status: production +type: Hunting +description: In Splunk versions 9.3, 9.2, 9.1, 9.1.5 Applications which have been enabled with logging level DEBUG may write sensitive information such as keys, tokens, or other sensitive strings into the internal index. +data_source: + - Splunk +search: |- + `splunkd` log_level="DEBUG" AND component IN ("REST_Calls", "AdminManager", "JSONWebToken") + | stats count min(_time) as firstTime max(_time) as lastTime by host splunk_server log_level component event_message + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `splunk_sensitive_information_disclosure_in_debug_logging_channels_filter` +how_to_implement: Requires access to _internal index. It is recommended to inventory and modify the search for specific apps that may have DEBUG logging enabled. +known_false_positives: There will be false positives as not every message to the DEBUG log will expose sensitive information, such as keys or other secrets. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0301 + - https://advisory.splunk.com/advisories/SVD-2024-1008 + - https://advisory.splunk.com/advisories/SVD-2024-1009 +analytic_story: + - Splunk Vulnerabilities +asset_type: Splunk Server +cve: + - CVE-2024-29945 + - CVE-2024-45738 + - CVE-2024-45739 +mitre_attack_id: + - T1552 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test of JsonWebToken DEBUG Logging Channel + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1654/splunk/jsonwebtokenplaintokensvd_splunkd.log + source: /opt/splunk/var/log/splunk/splunkd.log + sourcetype: splunkd + index: _internal + test_type: unit + - name: True Positive Test of REST_Calls DEBUG Logging Channel + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/splunk/svd-2024-1008.log + sourcetype: splunkd + source: /opt/splunk/var/log/splunk/splunkd.log + index: _internal + test_type: unit + - name: True Positive Test of AdminManager DEBUG Logging Channel + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552/splunk/svd-2024-1009.log + sourcetype: splunkd + source: /opt/splunk/var/log/splunk/splunkd.log + index: _internal + test_type: unit diff --git a/detections/application/splunk_user_enumeration_attempt.yml b/detections/application/splunk_user_enumeration_attempt.yml new file mode 100644 index 00000000000..c3ddfefac3a --- /dev/null +++ b/detections/application/splunk_user_enumeration_attempt.yml @@ -0,0 +1,55 @@ +name: Splunk User Enumeration Attempt +id: 25625cb4-1c4d-4463-b0f9-7cb462699cde +version: 9 +creation_date: '2022-04-29' +modification_date: '2026-05-14' +author: Lou Stella, Splunk +status: production +type: TTP +description: The following analytic identifies attempts to enumerate usernames in Splunk by detecting multiple failed authentication attempts from the same source. It leverages data from the `_audit` index, specifically focusing on failed authentication events. This activity is significant for a SOC because it can indicate an attacker trying to discover valid usernames, which is a precursor to more targeted attacks like password spraying or brute force attempts. If confirmed malicious, this activity could lead to unauthorized access, compromising the security of the Splunk environment and potentially exposing sensitive data. +data_source: + - Splunk +search: '`splunkd_failed_auths` | stats count(user) as auths by user, src | where auths>5 | stats values(user) as user, sum(auths) as TotalFailedAuths by src | `splunk_user_enumeration_attempt_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to find password spraying or brute force authorization attempts in addition to someone enumerating usernames. +known_false_positives: Automation executing authentication attempts against your Splunk infrastructure with outdated credentials may cause false positives. +references: + - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0502.html +drilldown_searches: + - name: View the detection results for $user$ + search: '%original_detection_search% | search user = $user$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $user$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($user$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +finding: + title: $TotalFailedAuths$ failed authentication events to Splunk from $src$ detected. + entity: + field: user + type: user + score: 40 +threat_objects: + - field: src + type: ip_address +analytic_story: + - Splunk Vulnerabilities +asset_type: Endpoint +cve: + - CVE-2021-33845 +mitre_attack_id: + - T1078 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: access +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/splunkd_auth/audittrail.log + source: audittrail + sourcetype: audittrail + index: _audit + test_type: unit diff --git a/detections/application/splunk_xss_privilege_escalation_via_custom_urls_in_dashboard.yml b/detections/application/splunk_xss_privilege_escalation_via_custom_urls_in_dashboard.yml new file mode 100644 index 00000000000..68e01783875 --- /dev/null +++ b/detections/application/splunk_xss_privilege_escalation_via_custom_urls_in_dashboard.yml @@ -0,0 +1,41 @@ +name: Splunk XSS Privilege Escalation via Custom Urls in Dashboard +id: 01e1e386-7656-4f36-a55a-52fe39b04a96 +version: 7 +creation_date: '2024-07-01' +modification_date: '2026-05-14' +author: Rod Soto, Chase Franklin +status: production +type: Hunting +description: This is a composed hunting search that looks for POST requests to splunk_internal_metrics/data/ui/views which can be used to elevate privileges on the Splunk server via custom urls. The way to find privilege escalation is by looking at created users with high privielges after payload has been executed. This search looks at POST request and then looks at created users privileges. +data_source: + - Splunk +search: '`splunkd_ui` method=POST /*/data/ui/views* | stats values(method) as method by _time index, sourcetype, host | eval event="post_request" | append [| search `audittrail` action="edit_user" operation="create" | rex field=_raw "object=\"(?.*)\"" | stats count values(operation) as operation values(splunk_server) as splunk_server values(user) as user by _time index, sourcetype, host, newUser | eval event="create_user"] | sort - _time | transaction host startswith=event="post_request" endswith=event="create_user" maxspan=10m | table _time index, sourcetype, host, method, user, splunk_server, operation, event, newUser eventcount | `splunk_xss_privilege_escalation_via_custom_urls_in_dashboard_filter`' +how_to_implement: Requires access to internal indexes _audit and _internal. +known_false_positives: This is a hunting search and requires operator to search for specific indicators of user creation in proximity to POST requests against vulnerable endpoint. It is not possible to detect payload during runtime. +references: + - https://advisory.splunk.com/ +analytic_story: + - Splunk Vulnerabilities +asset_type: Splunk Server +cve: + - CVE-2024-36992 +mitre_attack_id: + - T1189 +product: + - Splunk Enterprise + - Splunk Cloud + - Splunk Enterprise Security +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0712_splunkd_ui_access_splunk_ui_access.log + source: /opt/splunk/var/log/splunk/splunkd_ui_access.log + sourcetype: splunkd_ui_access + index: _internal + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0712_audittrail_audittrail.log + source: /opt/splunk/var/log/splunk/audittrail + sourcetype: audittrail + index: _audit + test_type: unit diff --git a/detections/deprecated/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml b/detections/deprecated/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml new file mode 100644 index 00000000000..a377c05c211 --- /dev/null +++ b/detections/deprecated/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml @@ -0,0 +1,32 @@ +name: Splunk App for Lookup File Editing RCE via User XSLT +id: a053e6a6-2146-483a-9798-2d43652f3299 +version: 8 +creation_date: '2023-11-16' +modification_date: '2026-06-24' +author: Rod Soto, Splunk +status: deprecated +type: Hunting +description: The following analytic identifies the creation of lookup files in Splunk, which could indicate an attempt to exploit remote code execution via user-supplied XSLT. It leverages REST API queries to monitor the creation of these lookups, focusing on fields such as title, author, and access control lists. This activity is significant because it targets a known vulnerability in Splunk versions 9.1.x, potentially allowing attackers to execute arbitrary code. If confirmed malicious, this could lead to unauthorized code execution, compromising the integrity and security of the Splunk environment. +data_source: [] +search: '| rest splunk_server=local /services/data/lookup-table-files/ | fields title author disabled eai:acl.app eai:acl.owner eai:acl.sharing eai:appName eai:data | `splunk_app_for_lookup_file_editing_rce_via_user_xslt_filter`' +how_to_implement: Because there is no way to detect the payload, this search only provides the ability to monitor the creation of lookups which are the base of this exploit. An operator must then investigate suspicious lookups. This search requires ability to perform REST queries. Note that if the Splunk App for Lookup File Editing is not, or was not, installed in the Splunk environment then it is not necessary to run the search as the enviornment was not vulnerable. +known_false_positives: This search will provide information for investigation and hunting of lookup creation via user-supplied XSLT which may be indications of possible exploitation. There will be false positives as it is not possible to detect the payload executed via this exploit. +references: + - https://advisory.splunk.com/advisories/SVD-2023-1104 +analytic_story: + - Splunk Vulnerabilities +asset_type: Endpoint +cve: + - CVE-2023-46214 +mitre_attack_id: + - T1210 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +deprecation_info: + reason: Detection has been deprecated because it's too generic and does not provide the ability to detect the payload executed via this exploit. + removed_in_version: 6.4.0 + replacement_content: [] diff --git a/detections/deprecated/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml b/detections/deprecated/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml new file mode 100644 index 00000000000..16c8972fdd4 --- /dev/null +++ b/detections/deprecated/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml @@ -0,0 +1,40 @@ +name: Splunk Code Injection via custom dashboard leading to RCE +id: b06b41d7-9570-4985-8137-0784f582a1b3 +version: 8 +creation_date: '2022-12-19' +modification_date: '2026-06-24' +author: Rod Soto +status: deprecated +type: Hunting +description: The following analytic identifies attempts to exploit a vulnerability in Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, where an authenticated user can execute arbitrary code via the dashboard PDF generation component. It detects this activity by analyzing events in the _internal index with the file=export parameter. This behavior is significant because it indicates a potential code injection attack, which could lead to remote code execution (RCE). If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary commands, and potentially compromise the entire Splunk environment. +data_source: [] +search: '`splunkd_ui` uri_path=*/data/ui/views/* OR uri_path=*saved/searches/* | dedup uri_path | eval URL=urldecode("uri_path")| rex field=URL "\/saved\/searches\/(?[^\/]*)" | rex field=URL "\/data\/ui\/views\/(?[^\/]*)" | eval NAME=NAME."( Saved Search )",NAME1=NAME1."( Dashboard )" | eval NAME=coalesce(NAME,NAME1) | eval STATUS=case(match(status,"2\d+"),"SUCCESS",match(status,"3\d+"),"REDIRECTION",match(status,"4\d+") OR match(status,"5\d+"),"ERROR") | stats list(NAME) as DASHBOARD_TITLE,list(method) as HTTP_METHOD,list(status) as Status_Code,list(STATUS) as STATUS by user | rename user as User | `splunk_code_injection_via_custom_dashboard_leading_to_rce_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. +known_false_positives: Not all exports and downloads are malicious, special attention must be put as well on /en-US/splunkd/__raw/services/pdfgen/render in the context of this search. +references: + - https://www.splunk.com/en_us/product-security.html +analytic_story: + - Splunk Vulnerabilities +asset_type: Endpoint +cve: + - CVE-2022-43571 +mitre_attack_id: + - T1210 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/splunk_code_injection_via_custom_dashboard_leading_to_rce.log + source: /opt/splunk/var/log/splunk/splunkd_ui_access.log + sourcetype: splunkd_ui_access + index: _internal + test_type: unit +deprecation_info: + reason: Detection has been deprecated. The affected Splunk software versions (8.1.12, 8.2.9, and 9.0.2) are no longer supported, having reached End of Life (EOL) between 2023 and 2024. Also, the logic is not perfectly capturing the malicious activity. + removed_in_version: 6.4.0 + replacement_content: [] diff --git a/detections/deprecated/splunk_enterprise_kv_store_incorrect_authorization.yml b/detections/deprecated/splunk_enterprise_kv_store_incorrect_authorization.yml new file mode 100644 index 00000000000..048f7f1d47b --- /dev/null +++ b/detections/deprecated/splunk_enterprise_kv_store_incorrect_authorization.yml @@ -0,0 +1,41 @@ +name: Splunk Enterprise KV Store Incorrect Authorization +id: 8f0e8380-a835-4f2b-b749-9ce119364df0 +version: 9 +creation_date: '2024-01-22' +modification_date: '2026-06-24' +author: Rod Soto, Eric McGinnis, Chase Franklin +status: deprecated +type: Hunting +description: The following analytic detects unauthorized attempts to reload Splunk KV Store collections via the REST API. It leverages internal index logs to identify POST requests to the `/servicesNS/nobody/search/admin/collections-conf/_reload` endpoint, focusing on status codes starting with '2'. This activity is significant as it may indicate improper permission handling, potentially leading to unauthorized deletion of KV Store collections. If confirmed malicious, this could result in data loss or unauthorized data manipulation, impacting the integrity and availability of critical Splunk data. +data_source: + - Splunk +search: '`splunkda` uri=/servicesNS/nobody/search/admin/collections-conf/_reload status=2* method="POST" user=* file=_reload | stats count min(_time) as firstTime max(_time) as lastTime values(status) as status by host clientip file method | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_enterprise_kv_store_incorrect_authorization_filter`' +how_to_implement: Requires access to internal indexes and REST API enabled instances. +known_false_positives: This is a hunting search and will produce false positives. Operator must follow results into instances where curl requests coming from actual users may indicate intent of exploitation. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0105 +analytic_story: + - Splunk Vulnerabilities +asset_type: Splunk Server +cve: + - CVE-2024-23675 +mitre_attack_id: + - T1548 +product: + - Splunk Enterprise + - Splunk Cloud + - Splunk Enterprise Security +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_enterprise_kv_store_incorrect_authorization_splunkd_access.log + source: /opt/splunk/var/log/splunk/splunkd_access.log + sourcetype: splunkd_access + index: _internal + test_type: unit +deprecation_info: + reason: Detection has been deprecated. The affected Splunk software versions (below 9.0.8 and 9.1.3)are no longer supported, having reached End of Life (EOL), and the logic is not accurately detecting the malicious activity. + removed_in_version: 6.4.0 + replacement_content: [] diff --git a/detections/deprecated/splunk_information_disclosure_on_account_login.yml b/detections/deprecated/splunk_information_disclosure_on_account_login.yml new file mode 100644 index 00000000000..2e3d38b171c --- /dev/null +++ b/detections/deprecated/splunk_information_disclosure_on_account_login.yml @@ -0,0 +1,41 @@ +name: Splunk Information Disclosure on Account Login +id: 2bae5d19-6d1b-4db0-82ab-0af5ac5f836c +version: 8 +creation_date: '2024-07-01' +modification_date: '2026-06-24' +author: Rod Soto +status: deprecated +type: Hunting +description: This is a composed hunting search that looks for possible user enumeration attempts when SAML is enabled on a Splunk instance by capturing different responses from server. +data_source: + - Splunk +search: '`splunkd` component=UiAuth status=failure action=login TcpChannelThread | stats count min(_time) as firstTime max(_time) as lastTime by user status action clientip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_information_disclosure_on_account_login_filter`' +how_to_implement: Requires access to internal indexes _internal. +known_false_positives: This is a hunting search and requires operator to search for large number of login failures from several users indicating possible user enumeration attempts. May capture genuine login failures. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0716 +analytic_story: + - Splunk Vulnerabilities +asset_type: Splunk Server +cve: + - CVE-2024-36996 +mitre_attack_id: + - T1087 +product: + - Splunk Enterprise + - Splunk Cloud + - Splunk Enterprise Security +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/splunk/SVD-2024-0716_splunkd_splunkd.log + source: /opt/splunk/var/log/splunk/splunkd.log + sourcetype: splunkd + index: _internal + test_type: unit +deprecation_info: + reason: Detection has been deprecated. The logic is not accurately detecting the malicious activity. + removed_in_version: 6.4.0 + replacement_content: [] diff --git a/detections/deprecated/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml b/detections/deprecated/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml new file mode 100644 index 00000000000..ec3f3143071 --- /dev/null +++ b/detections/deprecated/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml @@ -0,0 +1,39 @@ +name: Splunk Path Traversal In Splunk App For Lookup File Edit +id: 8ed58987-738d-4917-9e44-b8ef6ab948a6 +version: 9 +creation_date: '2023-06-01' +modification_date: '2026-06-24' +author: Rod Soto, Eric McGinnis +status: deprecated +type: Hunting +description: The following analytic identifies path traversal attempts in the Splunk App for Lookup File Editing. It detects specially crafted web requests targeting lookup files by analyzing the `uri_query` field in the `_internal` index. This activity is significant because it allows low-privilege users to read and write to restricted areas of the Splunk installation directory, potentially accessing sensitive files like password hashes. If confirmed malicious, this could lead to unauthorized access, data breaches, and further exploitation of the Splunk environment. +data_source: + - Splunk +search: '`splunkda` uri_query=*lookup_file* | table clientip uri_query lookup_file owner namespace version | stats count by clientip namespace lookup_file uri_query | `splunk_path_traversal_in_splunk_app_for_lookup_file_edit_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection is meant for on premise environments, and if executed on internet facing servers without a WAF may produce a lot of results. This detection will not work against obfuscated path traversal requests. +known_false_positives: This search may find additional path traversal exploitation attempts or malformed requests. +references: + - https://advisory.splunk.com/ +analytic_story: + - Splunk Vulnerabilities +asset_type: Endpoint +mitre_attack_id: + - T1083 +product: + - Splunk Enterprise + - Splunk Cloud + - Splunk Enterprise Security +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.log + source: splunkd_access + sourcetype: splunkd_access + index: _internal + test_type: unit +deprecation_info: + reason: Detection has been deprecated. The logic is not accurately detecting the malicious activity. + removed_in_version: 6.4.0 + replacement_content: [] diff --git a/detections/deprecated/splunk_rce_pdfgen_render.yml b/detections/deprecated/splunk_rce_pdfgen_render.yml new file mode 100644 index 00000000000..666040de178 --- /dev/null +++ b/detections/deprecated/splunk_rce_pdfgen_render.yml @@ -0,0 +1,56 @@ +name: Splunk RCE PDFgen Render +id: bc2b7437-0400-438b-9537-21ab5b7d2d53 +version: 8 +creation_date: '2024-07-01' +modification_date: '2026-06-24' +author: Rod Soto, Chase Franklin +status: deprecated +type: TTP +description: This is a hunting search designed to find and discover exploitation attempts against Splunk pdfgen render endpoint which results in remote +data_source: + - Splunk +search: index=_internal sourcetype=splunk_pdfgen _raw IN ("*base64*", "*lambda*", "*system*") | stats count min(_time) as firstTime max(_time) as lastTime by index, sourcetype, host, _raw | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_rce_pdfgen_render_filter` +how_to_implement: Requires access to internal indexes. +known_false_positives: This search will hunt for exploitation attempts against Splunk PDFgen render function, and not all requests are necesarily malicious so there will be false positives. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0701 +drilldown_searches: + - name: View the detection results for $host$ + search: '%original_detection_search% | search host = $host$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $host$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +finding: + title: Possible exploitation against $host$ + entity: + field: host + type: system + score: 80 +analytic_story: + - Splunk Vulnerabilities +asset_type: Splunk Server +cve: + - CVE-2024-36982 +mitre_attack_id: + - T1210 +product: + - Splunk Enterprise + - Splunk Cloud + - Splunk Enterprise Security +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/SVD-2024-0701_pdfgen_log_splunk_pdfgen.log + source: /opt/splunk/var/log/splunk/pdfgen.log + sourcetype: splunk_pdfgen + index: _internal + test_type: unit +deprecation_info: + reason: Detection has been deprecated. The metadata along with the search are not accurately capturing the malicious activity. + removed_in_version: 6.4.0 + replacement_content: [] diff --git a/lookups/csv/splunk_risky_command.csv b/lookups/csv/splunk_risky_command.csv new file mode 100644 index 00000000000..a26d6aaba17 --- /dev/null +++ b/lookups/csv/splunk_risky_command.csv @@ -0,0 +1,16 @@ +"splunk_risky_command","description","vulnerable_versions","CVE" +"*createrss*","createrss command overwrites existing RSS feeds without verifying permissions","8.1.13, 8.2.10","CVE-2023-22931" +"*pivot?seedSid=*","pivot command allows a search to bypass SPL safeguards for risky commands using a saved job","8.1.13, 8.2.10, 9.0.4","CVE-2023-22934" +"*|makeresults+&search_listener*","search_listener parameter in a Search allows for a Blind Server Side Request Forgery by an authenticated user","8.1.13, 8.2.10, 9.0.4","CVE-2023-22936" +"*| map search=*| *","map search processing language (SPL) command lets a search bypass SPL safeguards for risky commands","8.1.13, 8.2.10, 9.0.4","CVE-2023-22939" +"*|mcollect%20index*","collect command SPL aliases commands could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940" +"*|""*meventcollect*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940" +"*|""*summaryindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940" +"*|""*sumindex*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940" +"*|""*stash*""","collect command SPL alias could potentially allow for the exposing of data to a summary index that unprivileged users could access","8.1.13, 8.2.10, 9.0.4","CVE-2023-22940" +"*| sendalert *","display.page.search.patterns.sensitivity search parameter allows a search to bypass SPL safeguards for risky commands using obfuscation","8.1.13, 8.2.10, 9.0.4","CVE-2023-22935" +"*|*runshellscript*","runshellscript searches should not be run interactively via User Interface or REST API and may be used to bypass safeguards; +runshellscript may be abused to exploit legacy internal functions in external lookups leading to arbitrary code execution","<8.1.14, <8.2.12, <9.0.6, <9.1.1; +<8.2.12, <9.0.6, <9.1.1","CVE-2023-40598, CVE-2023-46214" +"*|*mrollup*","The “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.","<9.0.8, <9.1.3, <9.1.2308.200","CVE-2024-23676" +"*|*mstats*","The ""mstats"" SPL command lets malicious user can control a search query in Analytics Workspace using params from another search (via job SID) and quotation mark ' ' and "" incorrect handling","<9.0.10, <9.1.5, <9.2.2","CVE-2024-36984" \ No newline at end of file diff --git a/lookups/csv/splunk_risky_command.yml b/lookups/csv/splunk_risky_command.yml new file mode 100644 index 00000000000..60b07f3ecc4 --- /dev/null +++ b/lookups/csv/splunk_risky_command.yml @@ -0,0 +1,13 @@ +name: splunk_risky_command +id: 86e4521f-a57d-430b-9d5f-1547afabc618 +version: 3 +creation_date: '2023-02-14' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +lookup_type: csv +description: A list of Risky Splunk Command that are candidates for abuse +default_match: 'false' +match_type: + - WILDCARD(splunk_risky_command) +min_matches: 1 +case_sensitive_match: 'false' diff --git a/macros/audittrail.yml b/macros/audittrail.yml new file mode 100644 index 00000000000..0380788d018 --- /dev/null +++ b/macros/audittrail.yml @@ -0,0 +1,8 @@ +name: audittrail +id: ef23f92d-2795-462b-b5c1-632d626f4f2f +version: 1 +creation_date: '2023-06-01' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: Macro to enable easy searching of audittrail logs +definition: index=_audit sourcetype=audittrail diff --git a/macros/deprecated/audit_searches.yml b/macros/deprecated/audit_searches.yml new file mode 100644 index 00000000000..0ad583b452b --- /dev/null +++ b/macros/deprecated/audit_searches.yml @@ -0,0 +1,8 @@ +name: audit_searches +id: 4e72f7fe-b952-446b-b2bd-dab0c2e21b29 +version: 1 +creation_date: '2022-11-01' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: Macro to enable easy searching of audittrail logs for searches +definition: index=_audit sourcetype=audittrail action=search diff --git a/macros/deprecated/bro_ssl_json.yml b/macros/deprecated/bro_ssl_json.yml new file mode 100644 index 00000000000..3245c7aa6bd --- /dev/null +++ b/macros/deprecated/bro_ssl_json.yml @@ -0,0 +1,8 @@ +name: bro_ssl_json +id: 41a8cbf6-82a8-4fb8-a455-4f032c7f6e9e +version: 1 +creation_date: '2020-04-30' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment. +definition: sourcetype=bro:ssl:json diff --git a/macros/deprecated/path_traversal_spl_injection.yml b/macros/deprecated/path_traversal_spl_injection.yml new file mode 100644 index 00000000000..28a4d9a0aba --- /dev/null +++ b/macros/deprecated/path_traversal_spl_injection.yml @@ -0,0 +1,8 @@ +name: path_traversal_spl_injection +id: 60ccecaf-83b4-4e3b-ba93-9532cad57965 +version: 1 +creation_date: '2019-12-17' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: index=_internal sourcetype=splunkd_ui_access diff --git a/macros/deprecated/splunk_crash_log.yml b/macros/deprecated/splunk_crash_log.yml new file mode 100644 index 00000000000..6e43b342650 --- /dev/null +++ b/macros/deprecated/splunk_crash_log.yml @@ -0,0 +1,8 @@ +name: splunk_crash_log +id: c7ef6717-771d-46f0-a8e0-3a2bc275863f +version: 1 +creation_date: '2023-06-01' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: Searches through the Splunk Crash Log for low-level errors and crashes +definition: (index=_internal AND sourcetype=splunkd_crash_log) diff --git a/macros/deprecated/splunk_python.yml b/macros/deprecated/splunk_python.yml new file mode 100644 index 00000000000..b1835be5097 --- /dev/null +++ b/macros/deprecated/splunk_python.yml @@ -0,0 +1,8 @@ +name: splunk_python +id: 1b3b6a72-b2d9-453e-a97b-40945d4f5fb3 +version: 1 +creation_date: '2019-12-17' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: index=_internal sourcetype=splunk_python diff --git a/macros/deprecated/splunkd_investigation_rest_handler.yml b/macros/deprecated/splunkd_investigation_rest_handler.yml new file mode 100644 index 00000000000..4a4816d9487 --- /dev/null +++ b/macros/deprecated/splunkd_investigation_rest_handler.yml @@ -0,0 +1,8 @@ +name: splunkd_investigation_rest_handler +id: cf35d3df-3a59-480d-af40-ea29b796469c +version: 1 +creation_date: '2020-04-30' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: index=_internal sourcetype=investigation_rest_handler diff --git a/macros/deprecated/splunkd_web.yml b/macros/deprecated/splunkd_web.yml new file mode 100644 index 00000000000..dd367182e4d --- /dev/null +++ b/macros/deprecated/splunkd_web.yml @@ -0,0 +1,8 @@ +name: splunkd_web +id: 0c57824b-6e05-4d98-b2a0-c358b6a94a42 +version: 1 +creation_date: '2020-05-05' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: index=_internal sourcetype=splunk_web_access diff --git a/macros/deprecated/splunkd_webs.yml b/macros/deprecated/splunkd_webs.yml new file mode 100644 index 00000000000..35e2bf38372 --- /dev/null +++ b/macros/deprecated/splunkd_webs.yml @@ -0,0 +1,8 @@ +name: splunkd_webs +id: ddde1939-77e0-4ef4-b13d-5c0256401063 +version: 1 +creation_date: '2020-04-30' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: index=_internal sourcetype=splunk_web_service diff --git a/macros/deprecated/splunkd_webx.yml b/macros/deprecated/splunkd_webx.yml new file mode 100644 index 00000000000..2e687bd78a7 --- /dev/null +++ b/macros/deprecated/splunkd_webx.yml @@ -0,0 +1,8 @@ +name: splunkd_webx +id: 218048bf-6eb0-4eed-8164-c1baa1039a23 +version: 1 +creation_date: '2020-05-05' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: index=_internal sourcetype=splunk_web_access diff --git a/macros/splunkd.yml b/macros/splunkd.yml new file mode 100644 index 00000000000..ee4a5f00a3a --- /dev/null +++ b/macros/splunkd.yml @@ -0,0 +1,8 @@ +name: splunkd +id: 2ccba0af-81ac-4d79-9e52-be64380d69fd +version: 1 +creation_date: '2020-04-30' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: index=_internal sourcetype=splunkd diff --git a/macros/splunkd_failed_auths.yml b/macros/splunkd_failed_auths.yml new file mode 100644 index 00000000000..bdfeacb8d92 --- /dev/null +++ b/macros/splunkd_failed_auths.yml @@ -0,0 +1,8 @@ +name: splunkd_failed_auths +id: d11b825f-2462-4b35-83ec-17059d74f6a7 +version: 1 +creation_date: '2020-05-05' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: index=_audit "action=login attempt" "info=failed" diff --git a/macros/splunkd_ui.yml b/macros/splunkd_ui.yml new file mode 100644 index 00000000000..ef8a25de189 --- /dev/null +++ b/macros/splunkd_ui.yml @@ -0,0 +1,8 @@ +name: splunkd_ui +id: 3c0d1a01-8775-4d32-9f57-ad6106081968 +version: 1 +creation_date: '2020-05-05' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: index=_internal sourcetype=splunkd_ui_access diff --git a/macros/splunkda.yml b/macros/splunkda.yml new file mode 100644 index 00000000000..606d93bcc92 --- /dev/null +++ b/macros/splunkda.yml @@ -0,0 +1,8 @@ +name: splunkda +id: 7b9bd08e-002a-4b99-a89e-711c4300acb5 +version: 1 +creation_date: '2020-05-05' +modification_date: '2026-05-14' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: index=_internal sourcetype=splunkd_access diff --git a/removed/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml b/removed/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml new file mode 100644 index 00000000000..6812d0e17f9 --- /dev/null +++ b/removed/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml @@ -0,0 +1,34 @@ +name: Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline +id: 273df2f7-643a-451a-8d4d-637e39eadc87 +version: 3 +creation_date: '2022-06-13' +modification_date: '2026-05-14' +author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk +type: Baseline +status: removed +description: 'This search supports an analyst looking for abuse or misuse of the risky commands listed here: https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands This is accomplished by using the time spent executing one of these risky commands as a proxy for misuse/abuse of interest during investigation and/or hunting. The search builds a model utilizes the MLTK DensityFunction algorithm on Splunk app audit log data. The model uses the past 7 days of user history executing the above referenced commands then aggregates the total search run time for each hour as indicator of user behavior. The model identifies the top 0.1% of user search run time, indicating a risky use of these commands. Users can adjust this threshold 0.1% as interested however this will correlate to missed/false positive rates. This search should be scheduled to run at least every 7 days. The name of machine learning model generated is "risky_command_abuse" and should be configured to be globally shared (not private) in MLTK app as documented here: https://help.splunk.com/en/splunk-enterprise-security-8/splunk-machine-learning-toolkit/machine-learning-toolkit-user-guide/5.5.0/mltk-models/creating-sharing-and-deleting-models-in-the-splunk-machine-learning-toolkit unless the same account of training this model will be used to perform inference using this model for anomaly detection.' +search: '| tstats sum(Search_Activity.total_run_time) as run_time, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) AND (Search_Activity.search IN ( "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h | fit DensityFunction "run_time" dist=auto lower_threshold=0.000001 upper_threshold=0.001 show_density=true by Search_Activity.user into "risky_command_abuse" ' +how_to_implement: The corresponding detection of using this model is "Splunk Command and Scripting Interpreter Risky SPL MLTK". This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and it assumes Splunk accelerated audit data model is available. For large enterprises, training the model might take significant computing resources. It might require dedicated search head. The underlined machine learning algorithm this detection used is DensityFunction. It might need to increase its settings default values, such as max_fit_time, max_groups, etc. More details of achieving optimal performance and configuring DensityFunction parameters can be found here - https://help.splunk.com/en/splunk-enterprise-security-8/splunk-machine-learning-toolkit/machine-learning-toolkit-user-guide/5.5.0/algorithms-and-scoring-metrics-in-mltk/configure-algorithm-performance-costs Users can modify earliest=-7d@d in the search to other value so that the search can collect enough data points to build a good baseline model. Users can also modify list of risky commands in "Search_Activity.search IN" to better suit users' violation policy and their usage environment. +known_false_positives: If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky. +references: + - https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands +tags: + analytic_story: + - Splunk Vulnerabilities + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: audit + detections: + - Splunk Command and Scripting Interpreter Risky SPL MLTK +deployment: + scheduling: + cron_schedule: 55 * * * * + earliest_time: -70m@m + latest_time: -10m@m + schedule_window: auto +deprecation_info: + reason: Baseline is deprecated as the associated detection is deprecated. + removed_in_version: 5.12.0 + replacement_content: [] diff --git a/removed/detections/detect_risky_spl_using_pretrained_ml_model.yml b/removed/detections/detect_risky_spl_using_pretrained_ml_model.yml new file mode 100644 index 00000000000..5b9e58aca32 --- /dev/null +++ b/removed/detections/detect_risky_spl_using_pretrained_ml_model.yml @@ -0,0 +1,46 @@ +name: Detect Risky SPL using Pretrained ML Model +id: b4aefb5f-1037-410d-a149-1e091288ba33 +version: 6 +creation_date: '2022-06-21' +modification_date: '2026-05-14' +author: Abhinav Mishra, Kumar Sharad, Namratha Sreekanta and Xiao Lin, Splunk +status: removed +type: Anomaly +description: The following analytic identifies potentially risky SPL commands executed by users. It leverages a pretrained machine learning text classifier that analyzes command text, user, and search type to assign a risk score between 0 and 1. This detection is significant as it helps identify suspicious or unauthorized search activities that could indicate malicious intent or misuse of the Splunk environment. If confirmed malicious, such activity could lead to unauthorized data access, data exfiltration, or further exploitation of the system. +data_source: [] +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.user Search_Activity.search_type | eval spl_text = ''Search_Activity.search''. " " .''Search_Activity.user''. " " .''Search_Activity.search_type''| dedup spl_text | apply risky_spl_pre_trained_model | where risk_score > 0.5 | `drop_dm_object_name(Search_Activity)` | table search, user, search_type, risk_score | `detect_risky_spl_using_pretrained_ml_model_filter`' +how_to_implement: This detection depends on the MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need to be ingesting logs which include Search_Activity.search, Search_Activity.user, Search_Activity.search_type from your endpoints. The risk score threshold should be adjusted based on the environment. The detection uses a custom MLTK model hence we need a few more steps for deployment, as outlined here - https://gist.github.com/ksharad-splunk/be2a62227966049047f5e5c4f2adcabb. +known_false_positives: False positives may be present if suspicious behavior is observed, as determined by frequent usage of risky keywords. +references: + - https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands +rba: + message: A potentially risky Splunk command has been run by $user$, kindly review. + risk_objects: + - field: user + type: user + score: 20 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cve: + - CVE-2022-32154 + mitre_attack_id: + - T1059 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: audit +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1203/search_activity.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.16.0 + replacement_content: [] diff --git a/removed/detections/open_redirect_in_splunk_web.yml b/removed/detections/open_redirect_in_splunk_web.yml new file mode 100644 index 00000000000..5090cfd2cd7 --- /dev/null +++ b/removed/detections/open_redirect_in_splunk_web.yml @@ -0,0 +1,36 @@ +name: Open Redirect in Splunk Web +id: d199fb99-2312-451a-9daa-e5efa6ed76a7 +version: 3 +creation_date: '2019-10-16' +modification_date: '2026-05-14' +author: Bhavin Patel, Splunk +status: removed +type: TTP +description: This search allows you to look for evidence of exploitation for CVE-2016-4859, the Splunk Open Redirect Vulnerability. +data_source: [] +search: index=_internal sourcetype=splunk_web_access return_to="/%09/*" | `open_redirect_in_splunk_web_filter` +how_to_implement: No extra steps needed to implement this search. +known_false_positives: None identified +references: [] +rba: + message: Exploitation of CVE-2016-4859 + risk_objects: + - field: uri + type: other + score: 25 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + cve: + - CVE-2016-4859 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: network +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.2.0 + replacement_content: [] diff --git a/removed/detections/path_traversal_spl_injection.yml b/removed/detections/path_traversal_spl_injection.yml new file mode 100644 index 00000000000..83f3c7e25ac --- /dev/null +++ b/removed/detections/path_traversal_spl_injection.yml @@ -0,0 +1,57 @@ +name: Path traversal SPL injection +id: dfe55688-82ed-4d24-a21b-ed8f0e0fda99 +version: 8 +creation_date: '2022-04-29' +modification_date: '2026-05-14' +author: Rod Soto, Splunk +status: removed +type: TTP +description: The following analytic identifies attempts at path traversal in search parameters, which can lead to SPL injection. It detects this activity by searching for specific patterns in the `_internal` index that indicate path traversal attempts (e.g., "../../../../"). This activity is significant for a SOC because it can allow an attacker to manipulate the application to load data from incorrect endpoints, potentially running arbitrary SPL queries. If confirmed malicious, this could lead to unauthorized data access, code execution, or further exploitation of the Splunk environment. +data_source: + - Splunk +search: '`path_traversal_spl_injection` | search "\/..\/..\/..\/..\/..\/..\/..\/..\/..\/" | stats count by host status clientip method uri_path uri_query | `path_traversal_spl_injection_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts. This detection is meant for on premise environments, and if executed on internet facing servers without a WAF may produce a lot of results. This detection will not work against obfuscated path traversal requests. +known_false_positives: This search may find additional path traversal exploitation attempts. +references: + - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.html +drilldown_searches: + - name: View the detection results for $host$ + search: '%original_detection_search% | search host = $host$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $host$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Path traversal exploitation attempt from $clientip$ + risk_objects: + - field: host + type: system + score: 40 + threat_objects: + - field: clientip + type: ip_address +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-26889 + mitre_attack_id: + - T1083 + product: + - Splunk Enterprise + - Splunk Enterprise Security + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/path_traversal_spl_injection.log + source: splunkd_ui_access.log + sourcetype: splunkd_ui_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/persistent_xss_in_rapiddiag_through_user_interface_views.yml b/removed/detections/persistent_xss_in_rapiddiag_through_user_interface_views.yml new file mode 100644 index 00000000000..5158d83a04f --- /dev/null +++ b/removed/detections/persistent_xss_in_rapiddiag_through_user_interface_views.yml @@ -0,0 +1,56 @@ +name: Persistent XSS in RapidDiag through User Interface Views +id: ce6e1268-e01c-4df2-a617-0f034ed49a43 +version: 6 +creation_date: '2023-02-14' +modification_date: '2026-05-14' +author: Rod Soto, Splunk +type: TTP +status: removed +data_source: + - Splunk +description: The following analytic identifies potential persistent Cross-Site Scripting (XSS) attacks in Splunk Enterprise 9.0 versions before 9.0.4 through user interface views. It leverages audit logs from the `audit_searches` data source to detect actions involving Base64-encoded images in error messages. This activity is significant because it can allow attackers to inject malicious scripts that execute in the context of other users, leading to unauthorized actions or data exposure. If confirmed malicious, this could result in persistent control over the affected Splunk instance, compromising its integrity and confidentiality. +search: '`audit_searches` path=/opt/splunk/etc/users/*/search/local/data/ui/views/* action=* |table user action roles info roles path | dedup user action | `persistent_xss_in_rapiddiag_through_user_interface_views_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index +known_false_positives: This is a hunting search, it will not deobfuscate base64 payload, it provides however it will provide what user added the view artifact and what user opened it. It will require further investigation based on the information presented by this hunting search. +references: + - https://www.splunk.com/en_us/product-security.html +drilldown_searches: + - name: View the detection results for $user$ + search: '%original_detection_search% | search user = $user$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $user$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($user$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A potential XSS attempt has been detected from $user$ + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2023-22932 + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_persistent_xss_in_rapiddiag_through_user_interface_views_data.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_absolute_path_traversal_using_runshellscript.yml b/removed/detections/splunk_absolute_path_traversal_using_runshellscript.yml new file mode 100644 index 00000000000..e4eec6a3679 --- /dev/null +++ b/removed/detections/splunk_absolute_path_traversal_using_runshellscript.yml @@ -0,0 +1,54 @@ +name: Splunk Absolute Path Traversal Using runshellscript +id: 356bd3fe-f59b-4f64-baa1-51495411b7ad +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic detects the exploitation of an absolute path traversal vulnerability in Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, where an attacker can execute arbitrary code located on a separate disk. It leverages logs from the `splunk_python` macro, specifically looking for the `runshellscript` command with a specific argument count and path pattern. This activity is significant as it indicates a potential exploitation attempt that could lead to unauthorized code execution. If confirmed malicious, this could allow an attacker to gain control over the Splunk instance, leading to data breaches or further system compromise. +search: >- + `splunk_python` *runshellscript* | eval log_split=split(_raw, "runshellscript: + ") + | eval array_raw = mvindex(log_split,1) + | eval data_cleaned=replace(replace(replace(array_raw,"\[",""),"\]",""),"'","") + | eval array_indices=split(data_cleaned,",") + | eval runshellscript_args_count=mvcount(array_indices) + | where runshellscript_args_count = 10 + | eval interpreter=mvindex(array_indices,0) + | eval targetScript=mvindex(array_indices,1) + | eval targetScript != "*C:*" + | stats count min(_time) as firstTime max(_time) as lastTime by splunk_server interpreter + targetScript + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `splunk_absolute_path_traversal_using_runshellscript_filter` +how_to_implement: Must have access to internal indexes. Only applies to Splunk on Windows versions. +known_false_positives: The command runshellscript can be used for benign purposes. Analyst will have to review the searches and determined maliciousness specially by looking at targeted script. +references: + - https://advisory.splunk.com/advisories/SVD-2023-0806 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + mitre_attack_id: + - T1083 + cve: + - CVE-2023-40597 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splunk_absolute_path_traversal_using_runshellscript_splunk_python.log + source: python.log + sourcetype: splunk_python + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_account_discovery_drilldown_dashboard_disclosure.yml b/removed/detections/splunk_account_discovery_drilldown_dashboard_disclosure.yml new file mode 100644 index 00000000000..2eaefa57330 --- /dev/null +++ b/removed/detections/splunk_account_discovery_drilldown_dashboard_disclosure.yml @@ -0,0 +1,39 @@ +name: Splunk Account Discovery Drilldown Dashboard Disclosure +id: f844c3f6-fd99-43a2-ba24-93e35fe84be6 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Marissa Bower, Rod Soto, Splunk +status: removed +type: TTP +description: The following analytic identifies the presence of environment variables in Splunk dashboard drilldown URLs. It uses the REST API to query dashboards for specific patterns in the XML data. This activity is significant because it can expose sensitive tokens from privileged users if an attacker shares a malicious dashboard. If confirmed malicious, this could allow an attacker to detokenize variables and potentially gain unauthorized access to sensitive information or escalate privileges within the Splunk environment. +data_source: [] +search: '| rest splunk_server=local /servicesNS/-/-/data/ui/views | search eai:data="*$env:*" eai:data="*url*" eai:data="*options*" | rename author AS Author eai:acl.sharing AS Permissions eai:appName AS App eai:data AS "Dashboard XML" | fields Author Permissions App "Dashboard XML" | `splunk_account_discovery_drilldown_dashboard_disclosure_filter`' +how_to_implement: This search uses REST function to query for dashboards with environment variables present in URL options. +known_false_positives: This search may reveal non malicious URLs with environment variables used in organizations. +references: + - https://www.splunk.com/en_us/product-security.html +rba: + message: Potential exposure of environment variables from url embedded in dashboard + risk_objects: + - field: author + type: user + score: 40 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-37438 + mitre_attack_id: + - T1087 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_command_and_scripting_interpreter_delete_usage.yml b/removed/detections/splunk_command_and_scripting_interpreter_delete_usage.yml new file mode 100644 index 00000000000..c9b018cb5bc --- /dev/null +++ b/removed/detections/splunk_command_and_scripting_interpreter_delete_usage.yml @@ -0,0 +1,56 @@ +name: Splunk Command and Scripting Interpreter Delete Usage +id: 8d3d5d5e-ca43-42be-aa1f-bc64375f6b04 +version: 6 +creation_date: '2022-05-27' +modification_date: '2026-05-14' +author: Michael Haag, Splunk +status: removed +type: Anomaly +description: The following analytic detects the use of the 'delete' command in Splunk, which can be used to remove queried data. This detection leverages the Splunk Audit data model, specifically monitoring ad-hoc searches containing the 'delete' command by non-system users. This activity is significant because the 'delete' command is rarely used and can indicate potential data tampering or unauthorized data removal. If confirmed malicious, this activity could lead to the loss of critical log data, hindering incident investigations and compromising the integrity of the monitoring environment. +data_source: + - Splunk +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| delete*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_delete_usage_filter`' +how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. +known_false_positives: False positives may be present if this command is used as a common practice. Filter as needed. +references: + - https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands +drilldown_searches: + - name: View the detection results for $user$ + search: '%original_detection_search% | search user = $user$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $user$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($user$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: $user$ executed the 'delete' command, if this is unexpected it should be reviewed. + risk_objects: + - field: user + type: user + score: 27 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cve: + - CVE-2022-32154 + mitre_attack_id: + - T1059 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: audit +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.16.0 + replacement_content: [] diff --git a/removed/detections/splunk_command_and_scripting_interpreter_risky_commands.yml b/removed/detections/splunk_command_and_scripting_interpreter_risky_commands.yml new file mode 100644 index 00000000000..7a626b4904b --- /dev/null +++ b/removed/detections/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -0,0 +1,43 @@ +name: Splunk Command and Scripting Interpreter Risky Commands +id: 1cf58ae1-9177-40b8-a26c-8966040f11ae +version: 6 +creation_date: '2022-05-26' +modification_date: '2026-05-14' +author: Michael Haag, Splunk +status: removed +type: Hunting +description: The following analytic identifies the execution of risky commands within the Splunk platform, such as `runshellscript`, `delete`, and `sendemail`. It leverages the Search_Activity data model to detect ad hoc searches containing these commands, excluding those run by the splunk-system-user. This activity is significant because it may indicate attempts at data exfiltration, deletion, or other unauthorized actions by a malicious user. If confirmed malicious, this could lead to data loss, unauthorized data transfer, or system compromise, severely impacting the organization's security posture. +data_source: + - Splunk +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_risky_commands_filter`' +how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +known_false_positives: False positives will be present until properly filtered by Username and search name. +references: + - https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands + - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json + - https://advisory.splunk.com/advisories/SVD-2024-0302 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cve: + - CVE-2022-32154 + - CVE-2024-29946 + mitre_attack_id: + - T1059 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: audit +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as these commands are regular splunk commands and not recommended to be run as a detection search. + removed_in_version: 5.12.0 + replacement_content: [] diff --git a/removed/detections/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml b/removed/detections/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml new file mode 100644 index 00000000000..7a459413c93 --- /dev/null +++ b/removed/detections/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml @@ -0,0 +1,57 @@ +name: Splunk Command and Scripting Interpreter Risky SPL MLTK +id: 19d0146c-2eae-4e53-8d39-1198a78fa9ca +version: 6 +creation_date: '2022-06-13' +modification_date: '2026-05-14' +author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk +status: removed +type: Anomaly +description: The following analytic identifies the execution of risky SPL commands with abnormally long run times by leveraging a machine learning model named "risky_command_abuse." It uses the Splunk Audit data model to compare current search activities against a baseline of the past seven days. This activity is significant for a SOC as it can indicate potential misuse or abuse of powerful SPL commands, which could lead to unauthorized data access or system manipulation. If confirmed malicious, this activity could allow an attacker to execute arbitrary scripts, delete data, or exfiltrate sensitive information. +data_source: + - Splunk +search: '| tstats sum(Search_Activity.total_run_time) AS run_time, values(Search_Activity.search) as searches, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-1h@h latest=now) AND (Search_Activity.search IN ("*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h | apply risky_command_abuse | fields _time, Search_Activity.user, searches, run_time, IsOutlier(run_time) | rename IsOutlier(run_time) as isOutlier, _time as timestamp | where isOutlier>0.5 | `splunk_command_and_scripting_interpreter_risky_spl_mltk_filter`' +how_to_implement: This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Baseline model needs to be built using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run. Please note that the current search only finds matches exactly one space between separator bar and risky commands. +known_false_positives: If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky. +references: + - https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands +drilldown_searches: + - name: View the detection results for $user$ + search: '%original_detection_search% | search user = $user$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $user$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($user$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Abnormally long run time for risk SPL command seen by user- [$Search_Activity.user$] + risk_objects: + - field: user + type: user + score: 20 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cve: + - CVE-2022-32154 + mitre_attack_id: + - T1059 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: audit + manual_test: This search has a baseline and timestamps hard coded into the search. +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1203/search_activity.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as these commands are regular splunk commands and not recommended to be run as a detection search. + removed_in_version: 5.12.0 + replacement_content: [] diff --git a/removed/detections/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml b/removed/detections/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml new file mode 100644 index 00000000000..73736b4f9c5 --- /dev/null +++ b/removed/detections/splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml @@ -0,0 +1,56 @@ +name: Splunk CSRF in the SSG kvstore Client Endpoint +id: 4742d5f7-ce00-45ce-9c79-5e98b43b4410 +version: 7 +creation_date: '2023-02-14' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: TTP +description: The following analytic identifies attempts to exploit a cross-site request forgery (CSRF) vulnerability in the Splunk Secure Gateway (SSG) app's kvstore_client endpoint. It detects GET requests to the vulnerable endpoint using internal index data, focusing on specific URI paths and HTTP methods. This activity is significant because it can allow unauthorized updates to SSG KV store collections, potentially leading to data manipulation or unauthorized access. If confirmed malicious, this could enable attackers to alter critical configurations or exfiltrate sensitive information, compromising the integrity and security of the Splunk environment. +data_source: + - Splunk +search: '`splunkda` uri_path="/*/splunkd/__raw/services/ssg/kvstore_client" method="GET" delete_field_value="spacebridge_server" status="200" | table splunk_server status uri delete_field_value method post_data | `splunk_csrf_in_the_ssg_kvstore_client_endpoint_filter`' +how_to_implement: Requires access to internal index. +known_false_positives: This hunting search only applies to the affected versions and setup mentioned in the description of this search, it does not extract payload so it requires manual investigation after executing search. This search will produce false positives. +references: + - https://advisory.splunk.com/advisories/SVD-2023-0212 +drilldown_searches: + - name: View the detection results for $splunk_server$ + search: '%original_detection_search% | search splunk_server = $splunk_server$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $splunk_server$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($splunk_server$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Potential CSRF exploitation attempt from $splunk_server$ + risk_objects: + - field: splunk_server + type: system + score: 25 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2023-22942 + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_csrf_in_the_ssg_kvstore_client_endpoint_data.log + source: splunkd_access.log + sourcetype: splunkd_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.yml b/removed/detections/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.yml new file mode 100644 index 00000000000..972b14773a3 --- /dev/null +++ b/removed/detections/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.yml @@ -0,0 +1,40 @@ +name: Splunk Data exfiltration from Analytics Workspace using sid query +id: b6d77c6c-f011-4b03-8650-8f10edb7c4a8 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Eric McGinnis +status: removed +type: Hunting +description: The following analytic identifies attempts to exfiltrate data by executing a prepositioned malicious search ID in Splunk's Analytic Workspace. It leverages the `audit_searches` data source to detect suspicious `mstats` commands indicative of injection attempts. This activity is significant as it may indicate a phishing-based attack where an attacker compels a victim to initiate a malicious request, potentially leading to unauthorized data access. If confirmed malicious, this could result in significant data exfiltration, compromising sensitive information and impacting the organization's security posture. +data_source: + - Splunk +search: '`audit_searches` info=granted search NOT ("audit_searches") search NOT ("security_content_summariesonly") AND ((search="*mstats*[*]*" AND provenance="N/A") OR (search="*mstats*\\\"*[*]*\\\"*"))| eval warning=if(match(search,"\\\\\""), "POTENTIAL INJECTION STAGING", "POTENTIAL INJECTION EXECUTION") | table search, user, warning, timestamp | `splunk_data_exfiltration_from_analytics_workspace_using_sid_query_filter`' +how_to_implement: The vulnerability affects only instances with Splunk Web Enabled. After running this search, please run "Splunk Command and Scripting Interpreter Risky SPL MLTK" to gain more insight into potentially risky commands which could lead to data exfiltration. +known_false_positives: This search may produce false positives. This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. Special attention must be paid to "/en-US/app/search/analytics_workspace?sid=[sid]" which is where the malicious code will be inserted to trigger attack at victim. +references: + - https://www.splunk.com/en_us/product-security.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-43566 + mitre_attack_id: + - T1567 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567/splunk/splunk_data_exfiltration_from_analytics_workspace_using_sid_query.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_digital_certificates_infrastructure_version.yml b/removed/detections/splunk_digital_certificates_infrastructure_version.yml new file mode 100644 index 00000000000..8d552bc4379 --- /dev/null +++ b/removed/detections/splunk_digital_certificates_infrastructure_version.yml @@ -0,0 +1,42 @@ +name: Splunk Digital Certificates Infrastructure Version +id: 3c162281-7edb-4ebc-b9a4-5087aaf28fa7 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Lou Stella, Splunk +status: removed +type: Hunting +description: The following analytic identifies improper TLS validation configuration on Splunk search heads and peers post version 9. It leverages REST API calls to retrieve server information and SSL configuration settings, checking fields like `sslVerifyServerCert` and `sslVerifyServerName`. This activity is significant for a SOC as improper TLS settings can expose the infrastructure to man-in-the-middle attacks and data breaches. If confirmed malicious, attackers could intercept or manipulate data, compromising the integrity and confidentiality of communications within the Splunk environment. +data_source: + - Splunk +search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`' +how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +known_false_positives: No known at this time. +references: + - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication + - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0602.html + - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-32153 + mitre_attack_id: + - T1587.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_digital_certificates_lack_of_encryption.yml b/removed/detections/splunk_digital_certificates_lack_of_encryption.yml new file mode 100644 index 00000000000..9719bf83c0e --- /dev/null +++ b/removed/detections/splunk_digital_certificates_lack_of_encryption.yml @@ -0,0 +1,58 @@ +name: Splunk Digital Certificates Lack of Encryption +id: 386a7ebc-737b-48cf-9ca8-5405459ed508 +version: 6 +creation_date: '2022-05-26' +modification_date: '2026-05-14' +author: Lou Stella, Splunk +status: removed +type: Anomaly +description: The following analytic identifies Splunk forwarder connections that are not using TLS encryption. It leverages data from the `splunkd` logs, specifically looking for connections where the `ssl` field is set to "false". This activity is significant because unencrypted connections can expose sensitive data and allow unauthorized access, posing a security risk. If confirmed malicious, an attacker could exploit this vulnerability to download or publish forwarder bundles, potentially leading to arbitrary code execution and further compromise of the environment. +data_source: + - Splunk +search: '`splunkd` group="tcpin_connections" ssl="false" | stats values(sourceIp) latest(fwdType) latest(version) by hostname | `splunk_digital_certificates_lack_of_encryption_filter`' +how_to_implement: This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +known_false_positives: None at this time +references: + - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html + - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html + - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json +drilldown_searches: + - name: View the detection results for $hostname$ + search: '%original_detection_search% | search hostname = $hostname$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $hostname$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($hostname$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: $hostname$ is not using TLS when forwarding data + risk_objects: + - field: hostname + type: system + score: 20 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-32151 + mitre_attack_id: + - T1587.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.003/splunk_fwder/splunkd.log + source: /opt/splunk/var/log/splunk/metrics.log + sourcetype: splunkd + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_disable_kvstore_via_csrf_enabling_maintenance_mode.yml b/removed/detections/splunk_disable_kvstore_via_csrf_enabling_maintenance_mode.yml new file mode 100644 index 00000000000..e13cca34557 --- /dev/null +++ b/removed/detections/splunk_disable_kvstore_via_csrf_enabling_maintenance_mode.yml @@ -0,0 +1,56 @@ +name: Splunk Disable KVStore via CSRF Enabling Maintenance Mode +id: 34bac267-a89b-4bd7-a072-a48eef1f15b8 +version: 5 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +data_source: + - Splunk +type: TTP +status: removed +description: "In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108, 9.1.2312.204, and 9.1.2308.211, a low-privileged user that does not hold the “admin” or “power” Splunk roles could change the maintenance mode state of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF)." +search: '`splunkda` method=GET uri_path IN ("/services*", /"servicesNS*") AND uri_path = "*kvstore/maintenance/change" AND uri_query IN ("*mode=t*", "*mode=1*") | stats count min(_time) as firstTime max(_time) as lastTime by user host uri clientip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_disable_kvstore_via_csrf_enabling_maintenance_mode_filter`' +how_to_implement: Requires access to internal indexes and web service enabled. +known_false_positives: This search will produce false positives, operator must verify the context of access and the use of GET request against KVStore specifiying maintenance mode, especially non admin users. +references: + - https://advisory.splunk.com/advisories/SVD-2024-1007 +drilldown_searches: + - name: View the detection results for $host$ + search: '%original_detection_search% | search host = $host$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $host$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Potential CSRF attack against $user$ and $host$ by placing KVStore into Maintenance Mode + risk_objects: + - field: host + type: system + score: 25 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1489 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + cve: + - CVE-2024-45737 +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/splunk_kvstore_csrf/splunk_kvstore_csrf.log + custom_index: _internal + sourcetype: splunkd_access + source: /opt/splunk/var/log/splunk/splunkd_access.log +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_dos_using_malformed_saml_request.yml b/removed/detections/splunk_dos_using_malformed_saml_request.yml new file mode 100644 index 00000000000..620b7e97425 --- /dev/null +++ b/removed/detections/splunk_dos_using_malformed_saml_request.yml @@ -0,0 +1,38 @@ +name: Splunk DoS Using Malformed SAML Request +id: 8e8a86d5-f323-4567-95be-8e817e2baee6 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic detects a denial of service (DoS) attempt using a malformed SAML request targeting the /saml/acs REST endpoint in Splunk Enterprise versions lower than 9.0.6 and 8.2.12. It leverages `splunkd` logs, specifically looking for error messages containing "xpointer" in the `expr` field. This activity is significant because it can cause the Splunk daemon to crash or hang, disrupting service availability. If confirmed malicious, this attack could lead to prolonged downtime, impacting the organization's ability to monitor and respond to security events. +search: '`splunkd` event_message=*error* expr=*xpointer* | stats count min(_time) as firstTime max(_time) as lastTime by component expr splunk_server event_message | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_dos_using_malformed_saml_request_filter`' +how_to_implement: To run this search, you must have access to the _internal index. +known_false_positives: This search will show false positives. The analyst must look for errors and a pointer indicating a malicious file. +references: + - https://advisory.splunk.com/advisories/SVD-2023-0802 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + mitre_attack_id: + - T1498 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk/splunk_dos_using_malformed_saml_request_splunkd.log + source: splunkd.log + sourcetype: splunkd + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_dos_via_dump_spl_command.yml b/removed/detections/splunk_dos_via_dump_spl_command.yml new file mode 100644 index 00000000000..3023067e918 --- /dev/null +++ b/removed/detections/splunk_dos_via_dump_spl_command.yml @@ -0,0 +1,37 @@ +name: Splunk DOS Via Dump SPL Command +id: fb0e6823-365f-48ed-b09e-272ac4c1dad6 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic identifies a potential Denial of Service (DoS) attack exploiting the dump SPL command in vulnerable Splunk Enterprise versions. It detects this activity by searching the `splunk_crash_log` for segmentation fault entries, indicating a crash of the Splunk daemon. This activity is significant for a SOC because it can disrupt the availability of Splunk services, impacting monitoring and incident response capabilities. If confirmed malicious, this attack could render Splunk Enterprise unusable, severely hindering an organization's ability to detect and respond to other security threats. +search: '`splunk_crash_log` "*Segmentation fault*" | stats count by host _time | `splunk_dos_via_dump_spl_command_filter`' +how_to_implement: This search does not require additional ingestion of data. Requires the ability to search _internal index and monitor segmentation faults. +known_false_positives: Segmentation faults may occur due to other causes, so this search may produce false positives +references: + - https://advisory.splunk.com/ +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + atomic_guid: [] + mitre_attack_id: + - T1499.004 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499.004/splunk/splunk_dos_via_dump_spl_command.log + source: /opt/splunk/var/log/splunk/splunkd.log + sourcetype: splunkd_crash_log + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_dos_via_malformed_s2s_request.yml b/removed/detections/splunk_dos_via_malformed_s2s_request.yml new file mode 100644 index 00000000000..b8204f77e27 --- /dev/null +++ b/removed/detections/splunk_dos_via_malformed_s2s_request.yml @@ -0,0 +1,58 @@ +name: Splunk DoS via Malformed S2S Request +id: fc246e56-953b-40c1-8634-868f9e474cbd +version: 7 +creation_date: '2022-03-24' +modification_date: '2026-05-14' +author: Lou Stella, Splunk +status: removed +type: TTP +description: The following analytic identifies attempts to exploit a Denial of Service (DoS) vulnerability in the Splunk-to-Splunk (S2S) protocol by detecting malformed S2S requests. It leverages `splunkd` logs, specifically looking for "ERROR" level logs from the "TcpInputProc" component with the thread name "FwdDataReceiverThread" and the message "Invalid _meta atom." This activity is significant as it targets a known vulnerability that could disrupt Splunk services. If confirmed malicious, this could lead to service outages, impacting the availability and reliability of Splunk for monitoring and analysis. +data_source: + - Splunk +search: '`splunkd` log_level="ERROR" component="TcpInputProc" thread_name="FwdDataReceiverThread" "Invalid _meta atom" | table host, src | `splunk_dos_via_malformed_s2s_request_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will only find attempted exploitation on versions of Splunk already patched for CVE-2021-3422. +known_false_positives: None. +references: + - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html +drilldown_searches: + - name: View the detection results for $host$ + search: '%original_detection_search% | search host = $host$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $host$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An attempt to exploit CVE-2021-3422 was detected from $src$ against $host$ + risk_objects: + - field: host + type: system + score: 50 + threat_objects: + - field: src + type: ip_address +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2021-3422 + mitre_attack_id: + - T1498 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk_indexer_dos/splunkd.log + source: /opt/splunk/var/log/splunk/splunkd.log + sourcetype: splunkd + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_dos_via_post_request_datamodel_endpoint.yml b/removed/detections/splunk_dos_via_post_request_datamodel_endpoint.yml new file mode 100644 index 00000000000..52bed0d4da4 --- /dev/null +++ b/removed/detections/splunk_dos_via_post_request_datamodel_endpoint.yml @@ -0,0 +1,40 @@ +name: Splunk DoS via POST Request Datamodel Endpoint +id: 45766810-dbb2-44d4-b889-b4ba3ee0d1f5 +version: 5 +creation_date: '2024-07-01' +modification_date: '2026-05-14' +status: removed +author: Rod Soto +type: Hunting +data_source: [] +description: The following is a hunting search that allows investigation of error messages indicating Splunk HTTP engine shutdown as a result of a crafted posted request against '/datamodel/model' endpoint. +search: >- + `splunkd_webs` log_level=INFO message="ENGINE: HTTP Server cherrypy._cpwsgi_server.CPWSGIServer(('127.0.0.1', 8065)) shut down" | stats count min(_time) as firstTime max(_time) as lastTime by splunk_server message | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `splunk_dos_via_post_request_datamodel_endpoint_filter` +how_to_implement: Need access to the internal indexes. +known_false_positives: This is a hunting search and will produce false positives as other causes can also shut down splunk HTTP engine, however this denial of service error is associated to a request to the datamodel/model endpoing which operator can research and find proximity of request and message in logs. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0710 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1499 + product: + - Splunk Enterprise + security_domain: endpoint + cve: + - CVE-2024-36986 +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/SVD-2024-0710_web_service_splunk_web_service.log + source: /opt/splunk/var/log/splunk/web_service.log + sourcetype: splunk_web_service + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_dos_via_printf_search_function.yml b/removed/detections/splunk_dos_via_printf_search_function.yml new file mode 100644 index 00000000000..7fa3779aae1 --- /dev/null +++ b/removed/detections/splunk_dos_via_printf_search_function.yml @@ -0,0 +1,40 @@ +name: Splunk DOS via printf search function +id: 78b48d08-075c-4eac-bd07-e364c3780867 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Eric McGinnis, Splunk +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic identifies the use of the `printf` SPL function in Splunk searches, which can be exploited for a denial of service (DoS) attack. It detects this activity by querying the `audit_searches` data source for specific patterns involving `makeresults`, `eval`, `fieldformat`, and `printf` functions, excluding searches by the `splunk_system_user`. This activity is significant because it targets a known vulnerability in Splunk Enterprise versions lower than 8.1.14, 8.2.12, 9.0.6, and 9.1.1, potentially disrupting the availability of the Splunk instance. If confirmed malicious, this could lead to service outages and impact the monitoring and logging capabilities of the organization. +search: '`audit_searches` "*makeresults * eval * fieldformat *printf*" user!="splunk_system_user" search!="*audit_searches*" | stats count by user splunk_server host search | convert ctime(*time) |`splunk_dos_via_printf_search_function_filter`' +how_to_implement: This search requires the ability to search internal indexes. +known_false_positives: This search may produces false positives, analyst most focuse in the use of printf conversion function of eval to craft an expression that splunkd cannot interpret correctly causing it to crash. +references: + - https://advisory.splunk.com/ +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2023-40594 + mitre_attack_id: + - T1499.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499.004/splunk/splunk_printf_abuse.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_edit_user_privilege_escalation.yml b/removed/detections/splunk_edit_user_privilege_escalation.yml new file mode 100644 index 00000000000..a561b5d7034 --- /dev/null +++ b/removed/detections/splunk_edit_user_privilege_escalation.yml @@ -0,0 +1,40 @@ +name: Splunk Edit User Privilege Escalation +id: 39e1c326-67d7-4c0d-8584-8056354f6593 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Chase Franklin +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic identifies attempts by low-privilege users to escalate their privileges to admin by exploiting the edit_user capability. It detects this activity by analyzing audit trail logs for specific actions such as "change_own_password" and "edit_password" where the info field is "granted" and the user is not an admin or system user. This activity is significant because it indicates potential privilege escalation, which is a critical security concern. If confirmed malicious, this could allow an attacker to gain administrative access, leading to full control over the Splunk environment and potential data breaches. +search: '`audittrail` action IN ("change_own_password","password_change","edit_password") AND info="granted" AND NOT user IN (admin, splunk-system-user) | stats earliest(_time) as event_time values(index) as index values(sourcetype) as sourcetype values(action) as action values(info) as info by user | `splunk_edit_user_privilege_escalation_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to discover abuse of edit_user privilege. +known_false_positives: This search may produce false positives as password changing actions may be part of normal behavior. Operator will need to investigate these actions in order to discern exploitation attempts. +references: + - https://advisory.splunk.com/ +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2023-32707 + mitre_attack_id: + - T1548 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_edit_user_privilege_escalation.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_endpoint_denial_of_service_dos_zip_bomb.yml b/removed/detections/splunk_endpoint_denial_of_service_dos_zip_bomb.yml new file mode 100644 index 00000000000..65513a53202 --- /dev/null +++ b/removed/detections/splunk_endpoint_denial_of_service_dos_zip_bomb.yml @@ -0,0 +1,57 @@ +name: Splunk Endpoint Denial of Service DoS Zip Bomb +id: b237d393-2f57-4531-aad7-ad3c17c8b041 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Marissa Bower, Rod Soto, Splunk +status: removed +type: TTP +description: The following analytic identifies crashes in the Splunk search app caused by specially crafted ZIP files, affecting Universal Forwarder versions 8.1.11 and 8.2 versions below 8.2.7.1. It detects this activity by monitoring Universal Forwarder error logs for specific messages indicating invalid or binary file issues. This activity is significant because it can disrupt Splunk operations, leading to potential data loss or monitoring gaps. If confirmed malicious, this attack could result in a denial of service, hindering the organization's ability to monitor and respond to other security incidents effectively. +data_source: + - Splunk +search: '`splunkd` component=FileClassifierManager event_message=*invalid* event_message=*binary* |stats count by host component event_message | `splunk_endpoint_denial_of_service_dos_zip_bomb_filter`' +how_to_implement: Need to monitor Splunkd data from Universal Forwarders. +known_false_positives: This search may reveal non malicious zip files causing errors as well. +references: + - https://en.wikipedia.org/wiki/ZIP_(file_format) + - https://www.splunk.com/en_us/product-security.html +drilldown_searches: + - name: View the detection results for $host$ + search: '%original_detection_search% | search host = $host$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $host$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Potential exposure of environment variables from url embedded in dashboard + risk_objects: + - field: host + type: system + score: 75 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-37439 + mitre_attack_id: + - T1499 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/splunk_zip_bomb_vulnerability.log + source: /opt/splunkforwarder/var/log/splunk/splunkd.log + sourcetype: splunkd + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_enterprise_information_disclosure.yml b/removed/detections/splunk_enterprise_information_disclosure.yml new file mode 100644 index 00000000000..f47643d1d90 --- /dev/null +++ b/removed/detections/splunk_enterprise_information_disclosure.yml @@ -0,0 +1,36 @@ +name: Splunk Enterprise Information Disclosure +id: f6a26b7b-7e80-4963-a9a8-d836e7534ebd +version: 3 +creation_date: '2020-04-29' +modification_date: '2026-05-14' +author: David Dorsey, Splunk +status: removed +type: TTP +description: This search allows you to look for evidence of exploitation for CVE-2018-11409, a Splunk Enterprise Information Disclosure Bug. +data_source: [] +search: index=_internal sourcetype=splunkd_ui_access server-info | search clientip!=127.0.0.1 uri_path="*raw/services/server/info/server-info" | rename clientip as src_ip, splunk_server as dest | stats earliest(_time) as firstTime, latest(_time) as lastTime, values(uri) as uri, values(useragent) as http_user_agent, values(user) as user by src_ip, dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_enterprise_information_disclosure_filter` +how_to_implement: The REST endpoint that exposes system information is also necessary for the proper operation of Splunk clustering and instrumentation. Whitelisting your Splunk systems will reduce false positives. +known_false_positives: Retrieving server information may be a legitimate API request. Verify that the attempt is a valid request for information. +references: [] +rba: + message: Potential Exploitation of CVE-2018-11409 + risk_objects: + - field: dest + type: system + score: 25 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + cve: + - CVE-2018-11409 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: network +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.2.0 + replacement_content: [] diff --git a/removed/detections/splunk_enterprise_windows_deserialization_file_partition.yml b/removed/detections/splunk_enterprise_windows_deserialization_file_partition.yml new file mode 100644 index 00000000000..f4b7643604a --- /dev/null +++ b/removed/detections/splunk_enterprise_windows_deserialization_file_partition.yml @@ -0,0 +1,54 @@ +name: Splunk Enterprise Windows Deserialization File Partition +id: 947d4d2e-1b64-41fc-b32a-736ddb88ce97 +version: 7 +creation_date: '2024-01-22' +modification_date: '2026-05-14' +author: Rod Soto, Eric McGinnis, Chase Franklin +status: removed +type: TTP +data_source: + - Splunk +description: The following analytic identifies attempts to exploit a deserialization vulnerability in Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3. It detects irregular path file executions by analyzing `splunk_python` logs and extracting file paths and names. This activity is significant because it indicates potential exploitation of a known vulnerability, which could lead to arbitrary code execution. If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary code, and potentially compromise the entire Splunk environment, leading to data breaches and further system exploitation. +search: '`splunk_python` request_path="/*/app/search/C:\\Program" *strings* | rex "request_path=(?[^\"]+)" | rex field=file_path "[^\"]+/(?[^\"\''\s/\\\\]+)" | stats min(_time) as firstTime max(_time) as lastTime values(file_path) as file_path values(file_name) as file_name by index, sourcetype, host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_enterprise_windows_deserialization_file_partition_filter`' +how_to_implement: Requires access to internal indexes. This detection search will display irregular path file execution, which will display exploit attempts. Only applies to Microsoft Windows Splunk versions. +known_false_positives: Irregular path with files that may be purposely called for benign reasons may produce false positives. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0108 +drilldown_searches: + - name: View the detection results for $host$ + search: '%original_detection_search% | search host = $host$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $host$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Possible Windows Deserialization exploitation via irregular path file against $host$ + risk_objects: + - field: host + type: system + score: 90 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1190 + cve: + - CVE-2024-23678 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/splunk/splunk_enterprise_windows_deserialization_file_partition_splunk_python.log + source: C:\Program File\Splunk\var\log\splunk\python.log + sourcetype: splunk_python + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_es_dos_investigations_manager_via_investigation_creation.yml b/removed/detections/splunk_es_dos_investigations_manager_via_investigation_creation.yml new file mode 100644 index 00000000000..b598b8ce561 --- /dev/null +++ b/removed/detections/splunk_es_dos_investigations_manager_via_investigation_creation.yml @@ -0,0 +1,57 @@ +name: Splunk ES DoS Investigations Manager via Investigation Creation +id: 7f6a07bd-82ef-46b8-8eba-802278abd00e +version: 6 +creation_date: '2024-01-10' +modification_date: '2026-05-14' +author: Rod Soto, Eric McGinnis, Chase Franklin +status: removed +type: TTP +data_source: + - Splunk +description: The following analytic detects the creation of malformed Investigations in Splunk Enterprise Security (ES) versions lower than 7.1.2, which can lead to a denial of service (DoS). It leverages internal Splunk logs, specifically monitoring the `splunkd_investigation_rest_handler` with error statuses during investigation creation. This activity is significant as it can disrupt the functionality of the Investigations manager, hindering incident response efforts. If confirmed malicious, this could prevent security teams from accessing critical investigation data, severely impacting their ability to manage and respond to security incidents effectively. +search: '`splunkd_investigation_rest_handler` method=put msg=*investigation* status=error | stats count min(_time) as firstTime max(_time) as lastTime by user host method msg | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_es_dos_investigations_manager_via_investigation_creation_filter`' +how_to_implement: This search requires access to internal indexes. Only affects Splunk Enterprise Security versions lower than 7.1.2. +known_false_positives: The vulnerability requires an authenticated session and access to create an Investigation. It only affects the availability of the Investigations manager, but without the manager, the Investigations functionality becomes unusable for most users. This search gives the exact offending event. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0102 +drilldown_searches: + - name: View the detection results for $user$ and $host$ + search: '%original_detection_search% | search user = $user$ host = $host$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $user$ and $host$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($user$, $host$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Denial of Service Attack against Splunk ES Investigation Manager by $user$ + risk_objects: + - field: host + type: system + score: 100 + - field: user + type: user + score: 100 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2024-22165 + mitre_attack_id: + - T1499 + product: + - Splunk Enterprise Security + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/splunk_cve_2024_22165_investigation_rest_handler.log + source: /opt/splunk/var/log/splunk/investigation_handler.log + sourcetype: investigation_rest_handler + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_es_dos_through_investigation_attachments.yml b/removed/detections/splunk_es_dos_through_investigation_attachments.yml new file mode 100644 index 00000000000..4ada07dc58a --- /dev/null +++ b/removed/detections/splunk_es_dos_through_investigation_attachments.yml @@ -0,0 +1,54 @@ +name: Splunk ES DoS Through Investigation Attachments +id: bb85b25e-2d6b-4e39-bd27-50db42edcb8f +version: 6 +creation_date: '2024-01-10' +modification_date: '2026-05-14' +author: Rod Soto, Eric McGinnis, Chase Franklin +status: removed +type: TTP +data_source: + - Splunk +description: The following analytic detects attempts to perform a denial of service (DoS) attack through investigation attachments in Splunk Enterprise Security (ES) versions below 7.1.2. It leverages internal Splunk logs, specifically monitoring the `splunkd_investigation_rest_handler` for error statuses related to investigation objects. This activity is significant because it can render the Investigation feature inaccessible, disrupting incident response and forensic analysis. If confirmed malicious, this attack could prevent security teams from effectively managing and investigating security incidents, leading to prolonged exposure and potential data breaches. +search: '`splunkd_investigation_rest_handler` status=error object=investigation | stats min(_time) as firstTime max(_time) as lastTime values(status) as status values(msg) as msg values(id) as investigation_id by user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_es_dos_through_investigation_attachments_filter`' +how_to_implement: This search requires access to internal indexes, only affects Enterprise Security versions below 7.1.2. +known_false_positives: This search will show the exact DoS event via error message and investigation id. The error however does not point exactly at the uploader as any users associated with the investigation will be affected. Operator must investigate using investigation id the possible origin of the malicious upload. Attack only affects specific investigation not the investigation manager. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0101 +drilldown_searches: + - name: View the detection results for $user$ + search: '%original_detection_search% | search user = $user$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $user$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($user$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Denial of Service detected at Splunk ES affecting $user$ + risk_objects: + - field: user + type: user + score: 100 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2024-22164 + mitre_attack_id: + - T1499 + product: + - Splunk Enterprise Security + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/splunk_cve_2024_22164_investigation_rest_handler.log + source: /opt/splunk/var/log/splunk/investigation_handler.log + sourcetype: investigation_rest_handler + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_http_response_splitting_via_rest_spl_command.yml b/removed/detections/splunk_http_response_splitting_via_rest_spl_command.yml new file mode 100644 index 00000000000..ee9c84c4de4 --- /dev/null +++ b/removed/detections/splunk_http_response_splitting_via_rest_spl_command.yml @@ -0,0 +1,36 @@ +name: Splunk HTTP Response Splitting Via Rest SPL Command +id: e615a0e1-a1b2-4196-9865-8aa646e1708c +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Chase Franklin +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic identifies attempts to exploit an HTTP response splitting vulnerability via the rest SPL command in Splunk. It detects this activity by analyzing audit logs for specific search commands that include REST methods like POST, PUT, PATCH, or DELETE. This behavior is significant because it indicates a potential attempt to access restricted REST endpoints, which could lead to unauthorized access to sensitive information. If confirmed malicious, this activity could allow an attacker to access restricted content, such as password files, by injecting commands into HTTP requests. +search: '`audit_searches` AND search IN ("*|*rest*POST*","*|*rest*PUT*","*|*rest*PATCH*","*|*rest*DELETE*") AND NOT search="*audit_searches*" | table user info has_error_msg search _time | `splunk_http_response_splitting_via_rest_spl_command_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This search may assist in detecting possible http response splitting exploitation attemptss. +known_false_positives: This search may have produce false positives as malformed or erroneous requests made to this endpoint may be executed willingly or erroneously by operators. +references: + - https://advisory.splunk.com/ +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + mitre_attack_id: + - T1027.006 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027.006/splunk/splunk_http_response_splitting_via_rest_spl_command.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_identified_ssl_tls_certificates.yml b/removed/detections/splunk_identified_ssl_tls_certificates.yml new file mode 100644 index 00000000000..75ac839c960 --- /dev/null +++ b/removed/detections/splunk_identified_ssl_tls_certificates.yml @@ -0,0 +1,41 @@ +name: Splunk Identified SSL TLS Certificates +id: 620fbb89-86fd-4e2e-925f-738374277586 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Michael Haag, Splunk +status: removed +type: Hunting +description: The following analytic identifies the usage of Splunk default SSL/TLS certificates within the environment. It leverages tags such as SSL, TLS, and certificate to detect these default certificates by examining the ssl_issuer_common_name field. This activity is significant because using default certificates can expose the environment to potential security risks, as they are not unique and can be easily exploited. If confirmed malicious, attackers could intercept or manipulate data, leading to unauthorized access or data breaches. It is recommended to replace default certificates with valid, unique TLS certificates to enhance security. +data_source: + - Splunk Stream TCP +search: tag IN (ssl, tls, certificate) ssl_issuer_common_name=*splunk* | stats values(src) AS "Host(s) with Default Cert" count by ssl_issuer ssl_subject_common_name ssl_subject_organization ssl_subject host sourcetype | `splunk_identified_ssl_tls_certificates_filter` +how_to_implement: Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +known_false_positives: False positives will not be present as it is meant to assist with identifying default certificates being utilized. +references: + - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL + - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Proxy + cve: + - CVE-2022-32151 + - CVE-2022-32152 + mitre_attack_id: + - T1040 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1040/ssltls/ssl_splunk.log + source: stream:tcp + sourcetype: stream:tcp +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_image_file_disclosure_via_pdf_export_in_classic_dashboard.yml b/removed/detections/splunk_image_file_disclosure_via_pdf_export_in_classic_dashboard.yml new file mode 100644 index 00000000000..9d9d26d1737 --- /dev/null +++ b/removed/detections/splunk_image_file_disclosure_via_pdf_export_in_classic_dashboard.yml @@ -0,0 +1,46 @@ +name: Splunk Image File Disclosure via PDF Export in Classic Dashboard +id: 7464e2dc-98a5-4af9-87a1-fa6d5a256fa6 +version: 5 +creation_date: '2024-10-14' +modification_date: '2026-05-14' +author: Rod Soto +data_source: + - Splunk +type: Hunting +status: removed +description: In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the “admin” or “power” Splunk roles could view images on the host machine using the PDF export feature in Splunk classic dashboards. +search: |- + ```Search for any PDFs that have been generated``` + index=_internal sourcetype=splunk_pdfgen "Generated pdf" + ```Extract a potential Dashboard Filename``` + | rex field=filename "(?.*)-[0-9]{4}-[0-9]{1,2}-[0-9]{1,2}.pdf" + ```Join this with all dashboards. Potentially vulnerable dashbaords MUST be classic (version 1.1) AND contain at least one <img...> tag``` + | join type=inner title + [| rest /servicesNS/-/-/data/ui/views + | search eai:data="*<img*" version="1.1"] + | stats count min(_time) as earliestTime max(_time) as latestTime by author eai:acl.app label title eai:data + | `security_content_ctime(earliestTime)` + | `security_content_ctime(latestTime)` + | `splunk_image_file_disclosure_via_pdf_export_in_classic_dashboard_filter` +how_to_implement: Need to access to REST API. +known_false_positives: This is a hunting search and operator must identify indicators of local host image source such as UNC paths ('C:\'', '//'') in order to identify potential exploitation of this vulnerability. +references: + - https://advisory.splunk.com/advisories/SVD-2024-1004 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1087 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + cve: + - CVE-2024-45734 + manual_test: This search uses a REST call against a running Splunk instance to fetch information about dashboards. It cannot be replicated with a normal test or attack data. +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_improperly_formatted_parameter_crashes_splunkd.yml b/removed/detections/splunk_improperly_formatted_parameter_crashes_splunkd.yml new file mode 100644 index 00000000000..8ff89b8d035 --- /dev/null +++ b/removed/detections/splunk_improperly_formatted_parameter_crashes_splunkd.yml @@ -0,0 +1,50 @@ +name: Splunk Improperly Formatted Parameter Crashes splunkd +id: 08978eca-caff-44c1-84dc-53f17def4e14 +version: 8 +creation_date: '2023-02-14' +modification_date: '2026-05-14' +author: Chase Franklin, Rod Soto, Splunk +status: removed +type: TTP +description: The following analytic detects the execution of improperly formatted INGEST_EVAL parameters in Splunk Enterprise, which can crash the splunkd service. It leverages the Splunk_Audit.Search_Activity datamodel to identify ad-hoc searches containing specific keywords. This activity is significant because it can disrupt Splunk operations, leading to potential data loss and service downtime. If confirmed malicious, an attacker could exploit this to cause a denial of service, impacting the availability and reliability of the Splunk environment. +data_source: + - Splunk +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Splunk_Audit.Search_Activity where (Search_Activity.search="*makeresults*"AND + Search_Activity.search="*ingestpreview*transforms*") Search_Activity.search_type=adhoc + Search_Activity.search!="*splunk_improperly_formatted_parameter_crashes_splunkd_filter*" + Search_Activity.user!=splunk-system-user by Search_Activity.search, Search_Activity.info, + Search_Activity.total_run_time, Search_Activity.user, Search_Activity.search_type + | `drop_dm_object_name(Search_Activity)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `splunk_improperly_formatted_parameter_crashes_splunkd_filter` +how_to_implement: Requires access to audittrail and use of Splunk_Audit.Search_Activity datamodel. +known_false_positives: This is a hunting search it should be focused on affected products, otherwise it is likely to produce false positives. +references: + - https://advisory.splunk.com/advisories/SVD-2023-0211 + - https://advisory.splunk.com/advisories/SVD-2024-1006 +rba: + message: An attempt to exploit ingest eval parameter was detected from $user$ + risk_objects: + - field: user + type: user + score: 100 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + cve: + - CVE-2023-22941 + - CVE-2024-45736 + mitre_attack_id: + - T1499 + product: + - Splunk Enterprise + security_domain: threat +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.16.0 + replacement_content: [] diff --git a/removed/detections/splunk_information_disclosure_in_splunk_add_on_builder.yml b/removed/detections/splunk_information_disclosure_in_splunk_add_on_builder.yml new file mode 100644 index 00000000000..d25779b505b --- /dev/null +++ b/removed/detections/splunk_information_disclosure_in_splunk_add_on_builder.yml @@ -0,0 +1,30 @@ +name: Splunk Information Disclosure in Splunk Add-on Builder +id: b7b82980-4a3e-412e-8661-4531d8758735 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Eric McGinnis +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic identifies the presence of vulnerable versions of Splunk Add-on Builder (below 4.1.4) that write sensitive information to internal log files. It uses REST API queries to check installed app versions and flags those below the secure threshold. This activity is significant because it exposes sensitive data, which could be exploited by attackers. If confirmed malicious, this vulnerability could lead to unauthorized access to sensitive information, compromising the security and integrity of the Splunk environment. Immediate updates to version 4.1.4 or higher are recommended. +search: '| rest /services/apps/local | search disabled=0 core=0 label="Splunk Add-on Builder" | dedup label | search version < 4.1.4 | eval WarningMessage="Splunk Add-on Builder Versions older than v4.1.4 contain a critical vulnerability. Update to Splunk Add-on Builder v4.1.4 or higher immediately. For more information about this vulnerability, please refer to https://advisory.splunk.com/advisories/SVD-2024-0111" | table label version WarningMessage | `splunk_information_disclosure_in_splunk_add_on_builder_filter`' +how_to_implement: This search should be run on search heads where Splunk Add-on Builder may be installed. The results of this search will conclusively show whether or not a vulnerable version of Splunk Add-on Builder is currently installed. +known_false_positives: This search is highly specific for vulnerable versions of Splunk Add-on Builder. There are no known false positives. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0111 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1082 + product: + - Splunk Enterprise + security_domain: endpoint + manual_test: This search uses a REST call against a running Splunk instance to fetch the versions of installed apps. It cannot be replicated with a normal test or attack data. +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_list_all_nonstandard_admin_accounts.yml b/removed/detections/splunk_list_all_nonstandard_admin_accounts.yml new file mode 100644 index 00000000000..e42794227f9 --- /dev/null +++ b/removed/detections/splunk_list_all_nonstandard_admin_accounts.yml @@ -0,0 +1,33 @@ +name: Splunk list all nonstandard admin accounts +id: 401d689c-8596-4c6b-a710-7b6fdca296d3 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +description: 'The following analytic identifies nonstandard Splunk accounts with administrative rights on the instance, excluding the default admin account. It uses REST API calls to retrieve user data and filters for accounts with admin capabilities. This activity is significant as unauthorized admin accounts can indicate potential security breaches or misconfigurations. If confirmed malicious, attackers could leverage these accounts to execute commands, escalate privileges, or persist within the environment, posing a significant risk to the integrity and security of the Splunk instance.' +data_source: + - Splunk +search: '| rest splunk_server=local /services/authentication/users |search capabilities=admin* OR imported_capabilities=admin* title!=admin | table title roles capabilities splunk_server | `splunk_list_all_nonstandard_admin_accounts_filter`' +how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures. If there have been admin account, in addition to the standard admin account, intentionally created on this server, then edit the filter macro to exclude them. +known_false_positives: It is not possible to discern from the user table whether or not users with admin rights have been created intentionally, accidentally, or as a result of exploitation. Each user with these rights should be investigated and, if legitimate, added to the filter macro above. If a user is not believed to be legitimate, then further investigation should take place. +references: + - https://www.splunk.com/en_us/product-security.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2023-22933 + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_low_priv_search_as_nobody_splunkdeploymentserverconfig_app.yml b/removed/detections/splunk_low_priv_search_as_nobody_splunkdeploymentserverconfig_app.yml new file mode 100644 index 00000000000..6fe94ccfc7a --- /dev/null +++ b/removed/detections/splunk_low_priv_search_as_nobody_splunkdeploymentserverconfig_app.yml @@ -0,0 +1,37 @@ +name: Splunk Low-Priv Search as nobody SplunkDeploymentServerConfig App +id: f765c3fe-c3b6-4afe-a932-11dd4f3a024f +version: 5 +creation_date: '2024-10-14' +modification_date: '2026-05-14' +author: Rod Soto, Deivid Aguero +data_source: + - Splunk +type: Hunting +status: removed +description: In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the “admin” or “power” Splunk roles could run a search as ”nobody” in the SplunkDeploymentServerConfig app allowing access to potentially restricted data. +search: |- + | rest services/apps/local/SplunkDeploymentServerConfig + | table label, splunk_server, eai:acl.perms.read, eai:acl.perms.write, eai:acl.can_change_perms + | `splunk_low_priv_search_as_nobody_splunkdeploymentserverconfig_app_filter` +how_to_implement: Requires access to REST Api. +known_false_positives: This search displays effective permissions for SplunkDeploymentServerConfig. If permissions are inadequate they must be fixed. Please refer to the SVD-2024-1002 for more information about these permissions. +references: + - https://advisory.splunk.com/advisories/SVD-2024-1002 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1068 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + cve: + - CVE-2024-45732 + manual_test: This search uses a REST call against a running Splunk instance to fetch information about an Splunk App. It cannot be replicated with a normal test or attack data. +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_low_privilege_user_can_view_hashed_splunk_password.yml b/removed/detections/splunk_low_privilege_user_can_view_hashed_splunk_password.yml new file mode 100644 index 00000000000..cdc685c5ef2 --- /dev/null +++ b/removed/detections/splunk_low_privilege_user_can_view_hashed_splunk_password.yml @@ -0,0 +1,36 @@ +name: Splunk Low Privilege User Can View Hashed Splunk Password +id: a1be424d-e59c-4583-b6f9-2dcc23be4875 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Eric McGinnis, Chase Franklin +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic identifies low-privilege users attempting to view hashed Splunk passwords by querying the conf-user-seed REST endpoint. It leverages data from the `splunkd_web` logs, specifically monitoring access to the conf-user-seed endpoint. This activity is significant because it can indicate an attempt to escalate privileges by obtaining hashed credentials, potentially leading to admin account takeover. If confirmed malicious, this could allow an attacker to gain administrative control over the Splunk instance, compromising the entire environment's security. +search: '`splunkd_web` uri="*/servicesNS/nobody/system/configs/conf-user-seed*" | stats earliest(_time) as event_time values(method) as method values(status) as status values(clientip) as clientip values(useragent) as useragent values(file) as file by user | convert ctime(*time) | `splunk_low_privilege_user_can_view_hashed_splunk_password_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to discover attempts to access con-user-seed file content. +known_false_positives: This search may produce false positives as accounts with high privileges may access this file. Operator will need to investigate these actions in order to discern exploitation attempts. +references: + - https://advisory.splunk.com/ +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + mitre_attack_id: + - T1212 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/splunk/splunk_low_privilege_user_can_view_hashed_splunk_password.log + source: /opt/splunk/var/log/splunk/web_access.log + sourcetype: splunk_web_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_persistent_xss_via_props_conf.yml b/removed/detections/splunk_persistent_xss_via_props_conf.yml new file mode 100644 index 00000000000..f4106232aac --- /dev/null +++ b/removed/detections/splunk_persistent_xss_via_props_conf.yml @@ -0,0 +1,45 @@ +name: 'Splunk Persistent XSS via Props Conf' +id: d7b5aa71-157f-4359-9c34-e35752b1d0a2 +version: 5 +creation_date: '2024-10-14' +modification_date: '2026-05-14' +author: Rod Soto +data_source: + - Splunk +type: Hunting +status: removed +description: In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not hold the “admin” or “power” Splunk roles could craft a malicious payload through entity.details in props.conf that could result in execution of unauthorized JavaScript code in the browser of a user. +search: |- + `splunkd_ui` status=201 uri_path="*/splunkd/__raw/servicesNS/*/*/configs/*" + | stats count min(_time) as firstTime max(_time) as lastTime by host clientip user uri status + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `splunk_persistent_xss_via_props_conf_filter` +how_to_implement: Requires access to internal index and web component enabled. +known_false_positives: This is a hunting search that provides information on the creation of a scheduled view against the targeted endpoint("*/splunkd/__raw/servicesNS/user/search/configs/*"). In the attack flow the payload is saved via scheduled view then sent to the victim. +references: + - https://advisory.splunk.com/advisories/SVD-2024-1011 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + cve: + - CVE-2024-45741 +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/svd-2024-1011.log + sourcetype: splunkd_ui_access + custom_index: _internal + source: /opt/splunk/var/log/splunk/splunkd_ui_access.log +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_persistent_xss_via_scheduled_views.yml b/removed/detections/splunk_persistent_xss_via_scheduled_views.yml new file mode 100644 index 00000000000..a3fec8117fb --- /dev/null +++ b/removed/detections/splunk_persistent_xss_via_scheduled_views.yml @@ -0,0 +1,45 @@ +name: Splunk Persistent XSS via Scheduled Views +id: d4f55f7c-6518-4122-a197-951fe0f21b25 +version: 5 +creation_date: '2024-10-14' +modification_date: '2026-05-14' +author: Rod Soto +data_source: + - Splunk +type: Hunting +status: removed +description: In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.1.2308.211, a low-privileged user that does not hold the “admin” or “power” Splunk roles could craft a malicious payload through Scheduled Views that could result in execution of unauthorized JavaScript code in the browser of a user. +search: |- + `splunkd_ui` method=POST uri=*/scheduledview/search/update* + | stats count earliest(_time) as firstTime latest(_time) as lastTime values(bytes) AS bytes values(uri) AS uri values(useragent) AS user_agent by clientip user host + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `splunk_persistent_xss_via_scheduled_views_filter` +how_to_implement: Requires access to REST API. +known_false_positives: This is a hunting search, it is not possible to detect XSS payload from the scheduled view, however it is possible to see who was sent the scheduled search in order to trigger potential XSS. +references: + - https://advisory.splunk.com/advisories/SVD-2024-1010 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + cve: + - CVE-2024-45740 +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/svd-2024-1010.log + custom_index: _internal + sourcetype: splunkd_ui_access + source: /opt/splunk/var/log/splunk/splunkd_ui_access.log +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_persistent_xss_via_url_validation_bypass_w_dashboard.yml b/removed/detections/splunk_persistent_xss_via_url_validation_bypass_w_dashboard.yml new file mode 100644 index 00000000000..92bf394be47 --- /dev/null +++ b/removed/detections/splunk_persistent_xss_via_url_validation_bypass_w_dashboard.yml @@ -0,0 +1,38 @@ +name: Splunk Persistent XSS Via URL Validation Bypass W Dashboard +id: 8a43558f-a53c-4ee4-86c1-30b1e8ef3606 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic detects attempts to bypass URL validation in Splunk Enterprise versions below 9.0.4, 8.2.10, and 8.1.13 by targeting the vulnerable bootstrap version 2.3.1. It leverages `splunkd_web` logs, specifically monitoring GET requests to JavaScript files within the vulnerable bootstrap path. This activity is significant as it can allow a low-privileged user to perform path traversal, potentially accessing restricted and confidential information. If confirmed malicious, this could lead to unauthorized data access and compromise of sensitive information, including targeting admin users. +search: '`splunkd_web` method=GET uri_path="*bootstrap-2.3.1*" file="*.js" | table _time clientip uri_path file status | `splunk_persistent_xss_via_url_validation_bypass_w_dashboard_filter`' +how_to_implement: This search does not require additional data to be ingested. This search requires ability to search _internal index. This search helps discover access to vulnerable bootstrap versions. +known_false_positives: This search will produce numerous false positives as it shows ANY accesses to vulnerable bootstrap Javascript files. Accesses to these files occur during normal Splunk usage. To reduce or eliminate false positives, update the a version of Splunk which has addressed the vulnerability. +references: + - https://advisory.splunk.com/ +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2019-8331 + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_persistent_xss_via_url_validation_bypass_w_dashboard.log + source: /opt/splunk/var/log/splunk/web_access.log + sourcetype: splunk_web_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_process_injection_forwarder_bundle_downloads.yml b/removed/detections/splunk_process_injection_forwarder_bundle_downloads.yml new file mode 100644 index 00000000000..2f7cfe19f1c --- /dev/null +++ b/removed/detections/splunk_process_injection_forwarder_bundle_downloads.yml @@ -0,0 +1,41 @@ +name: Splunk Process Injection Forwarder Bundle Downloads +id: 8ea57d78-1aac-45d2-a913-0cd603fb6e9e +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Lou Stella, Splunk +status: removed +type: Hunting +description: The following analytic identifies unauthorized forwarder bundle downloads from Splunk Deployment Servers. It leverages native Splunk logs, specifically the `splunkd` component "PackageDownloadRestHandler," to detect instances where an unauthenticated client may have downloaded forwarder bundles. This activity is significant because it could indicate a potential security breach, allowing unauthorized access to sensitive configurations and applications. If confirmed malicious, an attacker could gain insights into the deployment server's environment, potentially leading to further exploitation or lateral movement within the network. +data_source: + - Splunk +search: '`splunkd` component="PackageDownloadRestHandler" | stats values(app) values(serverclass) by peer, host | `splunk_process_injection_forwarder_bundle_downloads_filter`' +how_to_implement: This hunting search uses native logs produced when a deployment server is within your environment. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +known_false_positives: None at this time. +references: + - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html + - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-32157 + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/splunk_ds/splunkd.log + source: /opt/splunk/var/log/splunk/splunkd.log + sourcetype: splunkd + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_protocol_impersonation_weak_encryption_configuration.yml b/removed/detections/splunk_protocol_impersonation_weak_encryption_configuration.yml new file mode 100644 index 00000000000..159db5201ac --- /dev/null +++ b/removed/detections/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -0,0 +1,42 @@ +name: Splunk Protocol Impersonation Weak Encryption Configuration +id: 900892bf-70a9-4787-8c99-546dd98ce461 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Lou Stella, Splunk +status: removed +type: Hunting +description: The following analytic identifies weak encryption configurations in Splunk related to TLS validation within the httplib and urllib Python libraries. It uses REST API calls to check specific configuration settings on the search head and its peers, ensuring compliance with security advisories. This activity is significant for a SOC as weak encryption can be exploited for protocol impersonation attacks, leading to unauthorized access. If confirmed malicious, attackers could intercept and manipulate data, compromising the integrity and confidentiality of the Splunk environment. +data_source: + - Splunk +search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="PythonSslClientConfig" | table splunk_server sslVerifyServerCert sslVerifyServerName] | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-web/settings | table splunk_server serverCert sslVersions] | rename sslVerifyServerCert as "Server.conf:PythonSSLClientConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:PythonSSLClientConfig:sslVerifyServerName", serverCert as "Web.conf:Settings:serverCert", sslVersions as "Web.conf:Settings:sslVersions" | `splunk_protocol_impersonation_weak_encryption_configuration_filter`' +how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (The `dispatch_rest_to_indexers` capability). Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. +references: + - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation + - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html + - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-32151 + mitre_attack_id: + - T1001.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/removed/detections/splunk_protocol_impersonation_weak_encryption_selfsigned.yml new file mode 100644 index 00000000000..e8c5801adda --- /dev/null +++ b/removed/detections/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -0,0 +1,42 @@ +name: Splunk protocol impersonation weak encryption selfsigned +id: c76c7a2e-df49-414a-bb36-dce2683770de +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Splunk +status: removed +type: Hunting +description: The following analytic identifies the use of Splunk's default self-signed certificates, which are flagged as insecure. It detects events from the `splunkd` log where the event message indicates that an X509 certificate should not be used. This activity is significant because using weak encryption and self-signed certificates can expose the system to man-in-the-middle attacks and other security vulnerabilities. If confirmed malicious, attackers could impersonate Splunk services, intercept sensitive data, and compromise the integrity of the Splunk environment. +data_source: + - Splunk +search: '`splunkd` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | `splunk_protocol_impersonation_weak_encryption_selfsigned_filter`' +how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. +references: + - https://www.splunk.com/en_us/product-security + - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation + - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-32152 + mitre_attack_id: + - T1588.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splunk_protocol_impersonation_weak_encryption_selfsigned.log + source: /opt/splun/var/log/splunk/splunkd.log + sourcetype: splunkd + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/removed/detections/splunk_protocol_impersonation_weak_encryption_simplerequest.yml new file mode 100644 index 00000000000..f9f0b5615ed --- /dev/null +++ b/removed/detections/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -0,0 +1,42 @@ +name: Splunk protocol impersonation weak encryption simplerequest +id: 839d12a6-b119-4d44-ac4f-13eed95412c8 +version: 7 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Splunk +status: removed +type: Hunting +description: The following analytic identifies instances where Splunk's Python3 client libraries fail to validate SSL certificates properly. It leverages logs from `splunk_python` to detect when "simpleRequest SSL certificate validation is enabled without hostname verification." This activity is significant because improper SSL certificate validation can expose the system to man-in-the-middle attacks, allowing attackers to intercept or alter data. If confirmed malicious, this vulnerability could lead to unauthorized access, data breaches, and potential system compromise. Upgrading to Splunk version 9 and configuring TLS hostname validation is recommended to mitigate this risk. +data_source: + - Splunk +search: '`splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter`' +how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. +references: + - https://www.splunk.com/en_us/product-security + - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation + - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-32152 + mitre_attack_id: + - T1588.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.log + source: /opt/splunk/var/log/splunk/splunkd.log + sourcetype: splunk_python + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_rbac_bypass_on_indexing_preview_rest_endpoint.yml b/removed/detections/splunk_rbac_bypass_on_indexing_preview_rest_endpoint.yml new file mode 100644 index 00000000000..bb72b87520e --- /dev/null +++ b/removed/detections/splunk_rbac_bypass_on_indexing_preview_rest_endpoint.yml @@ -0,0 +1,36 @@ +name: Splunk RBAC Bypass On Indexing Preview REST Endpoint +id: bbe26f95-1655-471d-8abd-3d32fafa86f8 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic identifies unauthorized attempts to use the /services/indexing/preview REST endpoint in Splunk. It detects POST requests to this endpoint by monitoring the _internal index for specific URI patterns. This activity is significant because it indicates a potential RBAC (Role-Based Access Control) bypass, allowing unauthorized users to overwrite search results if they know the search ID (SID) of an existing job. If confirmed malicious, this could lead to data manipulation, unauthorized access to sensitive information, and compromised integrity of search results. +search: '`splunkda` method="POST" uri="*/services/indexing/preview*" | table host clientip status useragent user uri_path | `splunk_rbac_bypass_on_indexing_preview_rest_endpoint_filter`' +how_to_implement: This search does not require additional data ingestion. It requires the ability to search _internal index. +known_false_positives: This is a hunting search which provides verbose results against this endpoint. Operator must consider things such as IP address, useragent and user(specially low privelege) and host to investigate possible attack. +references: + - https://advisory.splunk.com/ +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + mitre_attack_id: + - T1134 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134/splunk/splunk_rbac_bypass_on_indexing_preview_rest_endpoint.log + source: splunkd_access.log + sourcetype: splunkd_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_rce_via_external_lookup_copybuckets.yml b/removed/detections/splunk_rce_via_external_lookup_copybuckets.yml new file mode 100644 index 00000000000..dc7f41a4a1d --- /dev/null +++ b/removed/detections/splunk_rce_via_external_lookup_copybuckets.yml @@ -0,0 +1,36 @@ +name: Splunk RCE via External Lookup Copybuckets +id: 8598f9de-bba8-42a4-8ef0-12e1adda4131 +version: 5 +creation_date: '2024-07-01' +modification_date: '2026-05-14' +status: removed +author: Rod Soto, Chase Franklin +type: Hunting +data_source: + - Splunk +description: The following detection provides the ability to detect remote code execution attempts against a script named copybuckets present within the splunk_archiver application by calling this script as an external lookup. +search: 'index=_internal sourcetype="splunk_archiver-too_small" *.csv | rex field=_raw "Invoking command:\s(?<command>.*)" | stats min(_time) as firstTime max(_time) as lastTime values(command) as command values(severity) as severity by host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_rce_via_external_lookup_copybuckets_filter`' +how_to_implement: Requires access to internal indexes +known_false_positives: An operator must identify elements indicatives of command execution requests by looking at regex data being extracted from the log. Not all the requests will be malicious. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0705 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1210 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/SVD-2024-0705_splunk_archiver_splunk_archiver-too_small.log + source: /opt/splunk/var/log/splunk/splunk_archiver.log + sourcetype: splunk_archiver-too_small + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_rce_via_serialized_session_payload.yml b/removed/detections/splunk_rce_via_serialized_session_payload.yml new file mode 100644 index 00000000000..dba37d4e5d1 --- /dev/null +++ b/removed/detections/splunk_rce_via_serialized_session_payload.yml @@ -0,0 +1,40 @@ +name: Splunk RCE via Serialized Session Payload +id: d1d8fda6-874a-400f-82cf-dcbb59d8e4db +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk +status: removed +type: Hunting +description: The following analytic detects the execution of a specially crafted query using the 'collect' SPL command in Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1. It leverages audit logs to identify searches containing both 'makeresults' and 'collect' commands. This activity is significant because it can indicate an attempt to serialize untrusted data, potentially leading to arbitrary code execution. If confirmed malicious, this could allow an attacker to execute code within the Splunk environment, leading to unauthorized access and control over the system. +data_source: + - Splunk +search: '`audit_searches` file=* (search="*makeresults*" AND search="*collect*") | stats count min(_time) as firstTime max(_time) as lastTime by action file user splunk_server search | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_rce_via_serialized_session_payload_filter`' +how_to_implement: Requires access to the _audit index. +known_false_positives: There are numerous many uses of the 'makeresults' and 'collect' SPL commands. Please evaluate the results of this search for potential abuse. +references: + - https://www.splunk.com/en_us/product-security.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2023-40595 + mitre_attack_id: + - T1190 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/splunk/splunk_rce_via_serialized_session_payload_audittrail.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml b/removed/detections/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml new file mode 100644 index 00000000000..2a02cce60c0 --- /dev/null +++ b/removed/detections/splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml @@ -0,0 +1,40 @@ +name: Splunk RCE via Splunk Secure Gateway Splunk Mobile alerts feature +id: baa41f09-df48-4375-8991-520beea161be +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +description: The following analytic identifies potential exploitation attempts against the Splunk Secure Gateway App's Mobile Alerts feature in Splunk versions 9.0, 8.2.x, and 8.1.x. It detects suspicious activity by monitoring requests to the mobile alerts endpoint using specific URI paths and query parameters. This activity is significant because an authenticated user could exploit this vulnerability to execute arbitrary operating system commands remotely. If confirmed malicious, this could lead to unauthorized code execution, compromising the integrity and security of the Splunk environment. +data_source: + - Splunk +search: '`splunkda` uri_path="/servicesNS/nobody/splunk_secure_gateway/storage/collections/data/mobile_alerts*" sort="notification.created_at:-1" | table clientip file host method uri_query sort | `splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature_filter`' +how_to_implement: This search only applies if Splunk Mobile Gateway is deployed in the vulnerable Splunk versions. +known_false_positives: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. Focus of this search is "uri_path=/servicesNS/nobody/splunk_secure_gateway/storage/collections/data/mobile_alerts*" which is the injection point. +references: + - https://www.splunk.com/en_us/product-security.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-43567 + mitre_attack_id: + - T1210 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1210/splunk/splunk_rce_via_secure_gateway_splunk_mobile_alerts_feature.log + source: /opt/splunk/var/log/splunk/splunkd_access.log + sourcetype: splunkd_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_reflected_xss_in_the_templates_lists_radio.yml b/removed/detections/splunk_reflected_xss_in_the_templates_lists_radio.yml new file mode 100644 index 00000000000..25765cd79a6 --- /dev/null +++ b/removed/detections/splunk_reflected_xss_in_the_templates_lists_radio.yml @@ -0,0 +1,40 @@ +name: Splunk Reflected XSS in the templates lists radio +id: d532d105-c63f-4049-a8c4-e249127ca425 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Chase Franklin +status: removed +type: Hunting +description: The following analytic identifies potential reflected cross-site scripting (XSS) attempts in Splunk versions below 8.1.12, 8.2.9, and 9.0.2. It detects when a query parameter with `output_mode=radio` is used in a URI, leveraging `splunkd_webx` logs with status 200 and non-null URI queries. This activity is significant as it can indicate an attempt to exploit a known vulnerability, potentially allowing attackers to execute arbitrary JavaScript in the context of the user's browser. If confirmed malicious, this could lead to unauthorized actions, data theft, or further compromise of the affected Splunk instance. +data_source: + - Splunk +search: '`splunkd_webx` user=admin status=200 uri=*/lists/entities/x/ui/views* uri_query!=null | stats count earliest(_time) as event_time values(status) as status values(clientip) as clientip by index, sourcetype, _time, host, user, uri | `splunk_reflected_xss_in_the_templates_lists_radio_filter`' +how_to_implement: This vulnerability only affects instances with Splunk Web enabled. This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. +known_false_positives: This search may produce false positives as it is difficult to pinpoint all possible XSS injection characters in a single search string. Special attention is required to "en-US/list/entities/x/ui/views" which is the vulnerable injection point. +references: + - https://research.splunk.com/stories/splunk_vulnerabilities/ +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-43568 + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_reflected_xss_in_templates_lists_radio.log + source: /opt/splunk/var/log/splunk/web_access.log + sourcetype: splunk_web_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_reflected_xss_on_app_search_table_endpoint.yml b/removed/detections/splunk_reflected_xss_on_app_search_table_endpoint.yml new file mode 100644 index 00000000000..303c9d1c3eb --- /dev/null +++ b/removed/detections/splunk_reflected_xss_on_app_search_table_endpoint.yml @@ -0,0 +1,38 @@ +name: Splunk Reflected XSS on App Search Table Endpoint +id: 182f9080-4137-4629-94ac-cb1083ac981a +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic identifies attempts to exploit a reflected cross-site scripting (XSS) vulnerability on the app search table endpoint in Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12. It detects this activity by analyzing web request logs for specific dataset commands (`makeresults`, `count`, `eval`, `baseSPL`) within the `splunkd_web` index. This activity is significant because successful exploitation can lead to the execution of arbitrary commands on the Splunk platform, potentially compromising the entire instance. If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, and manipulate data within the Splunk environment. +search: '`splunkd_web` (dataset_commands="*makeresults*" AND dataset_commands="*count*" AND dataset_commands="*eval*" AND dataset_commands="*baseSPL*") | stats count min(_time) as firstTime max(_time) as lastTime by clientip status user view root uri_path | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `splunk_reflected_xss_on_app_search_table_endpoint_filter`' +how_to_implement: Need access to the internal indexes. +known_false_positives: This search will produce false positives. It is necessary to also look at uri_query parameter to determine the possible malicious intention of inserting makeresults within the uri string. +references: + - https://advisory.splunk.com/advisories/SVD-2023-0801 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_reflected_xss_on_app_search_table_endpoint_splunk_web_access.log + source: web_access.log + sourcetype: splunk_web_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_risky_command_abuse_disclosed_february_2023.yml b/removed/detections/splunk_risky_command_abuse_disclosed_february_2023.yml new file mode 100644 index 00000000000..84b8aa0c5f6 --- /dev/null +++ b/removed/detections/splunk_risky_command_abuse_disclosed_february_2023.yml @@ -0,0 +1,69 @@ +name: Splunk risky Command Abuse disclosed february 2023 +id: ee69374a-d27e-4136-adac-956a96ff60fd +version: 9 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Chase Franklin, Rod Soto, Eric McGinnis, Splunk +status: removed +type: Hunting +description: The following analytic identifies the execution of high-risk commands associated with various Splunk vulnerability disclosures. It leverages the Splunk_Audit.Search_Activity datamodel to detect ad-hoc searches by non-system users that match known risky commands. This activity is significant for a SOC as it may indicate attempts to exploit known vulnerabilities within Splunk, potentially leading to unauthorized access or data exfiltration. If confirmed malicious, this could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a severe threat to the organization's security posture. +data_source: + - Splunk +search: '| tstats fillnull_value="N/A" count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | lookup splunk_risky_command splunk_risky_command as search output splunk_risky_command description vulnerable_versions CVE | where splunk_risky_command != "false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_risky_command_abuse_disclosed_february_2023_filter`' +how_to_implement: Requires implementation of Splunk_Audit.Search_Activity datamodel. +known_false_positives: This search encompasses many commands. +references: + - https://advisory.splunk.com/advisories +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + cve: + - CVE-2023-22931 + - CVE-2023-22934 + - CVE-2023-22935 + - CVE-2023-22936 + - CVE-2023-22939 + - CVE-2023-22940 + - CVE-2023-40598 + - CVE-2023-40598 + - CVE-2023-46214 + - CVE-2024-23676 + - CVE-2024-36984 + mitre_attack_id: + - T1548 + - T1202 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_createrss_command_abuse.log + source: audittrail + sourcetype: audittrail + custom_index: _audit + - name: True Positive Test runshellscript abuse + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_runshellscript_abuse.log + source: audittrail + sourcetype: audittrail + custom_index: _audit + - name: True Positive Test Additional runshellscript abuse + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/splunk/splunk_cmd_injection_using_external_lookups_audittrail.log + source: audittrail + sourcetype: audittrail + custom_index: _audit + - name: True Positive Test mrollup abuse + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/splunk/splunk_mrollup_abuse_audittrail.log + source: audittrail + sourcetype: audittrail + custom_index: _audit +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_sg_information_disclosure_for_low_privs_user.yml b/removed/detections/splunk_sg_information_disclosure_for_low_privs_user.yml new file mode 100644 index 00000000000..8a85281edce --- /dev/null +++ b/removed/detections/splunk_sg_information_disclosure_for_low_privs_user.yml @@ -0,0 +1,43 @@ +name: Splunk SG Information Disclosure for Low Privs User +id: 0a3d6035-7bef-4dfa-b01e-84349edac3b4 +version: 5 +creation_date: '2024-10-14' +modification_date: '2026-05-14' +author: Rod Soto +data_source: + - Splunk +type: Hunting +status: removed +description: In Splunk Enterprise versions below 9.3.0, 9.2.1 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user that does not hold the “admin” or “power” Splunk roles can see App Key Value Store (KV Store) deployment configuration and public/private keys in the Splunk Secure Gateway App. +search: |- + `splunkd_ui` uri_path="*/splunkd/__raw/services/ssg/kvstore/*" user!=admin user!="-" + | stats count by clientip user method uri_path + | `splunk_sg_information_disclosure_for_low_privs_user_filter` +how_to_implement: Requires access to internal indexes. +known_false_positives: This is a hunting search and will produce false positives, the focus of this search must be on unusual requests towards the Splunk Secure Gateway from a non administrator user. +references: + - https://advisory.splunk.com/advisories/SVD-2024-1005 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1087 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint + cve: + - CVE-2024-45735 +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087/splunk/svd-2024-1005.log + source: /opt/splunk/var/log/splunk/splunkd_ui_access.log + sourcetype: splunkd_ui_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_stored_xss_conf_web_settings_on_premises.yml b/removed/detections/splunk_stored_xss_conf_web_settings_on_premises.yml new file mode 100644 index 00000000000..92377c27aca --- /dev/null +++ b/removed/detections/splunk_stored_xss_conf_web_settings_on_premises.yml @@ -0,0 +1,39 @@ +name: Splunk Stored XSS conf-web Settings on Premises +id: ed1209ef-228d-4dab-9856-be9369925a5c +version: 5 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Chase Franklin +status: removed +type: Hunting +data_source: + - Splunk +description: This hunting detection provides information on exploitation of stored XSS against /configs/conf-web/settings by an admin level user. +search: '`splunk_python` *script* *eval* | stats min(_time) as firstTime max(_time) as lastTime by index, sourcetype, host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_stored_xss_conf_web_settings_on_premises_filter`' +how_to_implement: Requires access to internal indexes. +known_false_positives: This is a hunting search and will produce false positives, operator must identify XSS elemetns in the splunk_python log related to the vulnerable endpoint. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0717 +tags: + cve: + - CVE-2024-36987 + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0717_python_log_splunk_python.log + source: /opt/splunk/var/log/splunk/python.log + sourcetype: splunk_python + custom_index: _internal + +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_stored_xss_via_data_model_objectname_field.yml b/removed/detections/splunk_stored_xss_via_data_model_objectname_field.yml new file mode 100644 index 00000000000..2b316e415a1 --- /dev/null +++ b/removed/detections/splunk_stored_xss_via_data_model_objectname_field.yml @@ -0,0 +1,41 @@ +name: Splunk Stored XSS via Data Model objectName Field +id: 062bff76-5f9c-496e-a386-cb1adcf69871 +version: 7 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +description: The following analytic identifies attempts to exploit a stored cross-site scripting (XSS) vulnerability in Splunk Enterprise via the Data Model object name field. It detects this activity by analyzing web access logs (`splunkd_webx`) for specific URI patterns and non-null query parameters. This activity is significant because it allows authenticated users to inject and store malicious scripts, leading to persistent XSS attacks. If confirmed malicious, this could enable attackers to execute arbitrary scripts in the context of other users, potentially leading to data theft, session hijacking, or further compromise of the Splunk environment. +data_source: + - Splunk +search: '`splunkd_webx` uri=/*/splunkd/__raw/servicesNS/*/launcher/datamodel/model* uri_query!=null | stats count by _time host status clientip user uri | `splunk_stored_xss_via_data_model_objectname_field_filter`' +how_to_implement: This vulnerability only affects Splunk Web enabled instances. This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. +known_false_positives: This search may produce false positives and does not cover exploitation attempts via code obfuscation, focus of search is suspicious requests against "/en-US/splunkd/__raw/servicesNS/*/launcher/datamodel/model" which is the injection point. +references: + - https://advisory.splunk.com/advisories/SVD-2022-1109 + - https://portswigger.net/web-security/cross-site-scripting/cheat-sheet +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-43569 + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_stored_xss_via_data_model_objectname_field.log + source: /opt/splunk/var/log/splunk/web_access.log + sourcetype: splunk_web_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_stored_xss_via_specially_crafted_bulletin_message.yml b/removed/detections/splunk_stored_xss_via_specially_crafted_bulletin_message.yml new file mode 100644 index 00000000000..60eed560940 --- /dev/null +++ b/removed/detections/splunk_stored_xss_via_specially_crafted_bulletin_message.yml @@ -0,0 +1,39 @@ +name: Splunk Stored XSS via Specially Crafted Bulletin Message +id: fd852b27-1882-4505-9f2c-64dfb96f4fc1 +version: 5 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +data_source: + - Splunk +description: The following hunting detection provides fields related to /service/messages endpoints where specially crafted bulletin message can exploit stored XSS. +search: '| rest /services/messages | search message="*http*" | table id author message title | `splunk_stored_xss_via_specially_crafted_bulletin_message_filter`' +how_to_implement: Need access to Splunk REST api data via search. +known_false_positives: Must look at messages field and find malicious suspicious characters or hyperlinks. Not all requests to this endpoint will be malicious. +references: + - https://advisory.splunk.com/SVD-2024-0713 +tags: + cve: + - CVE-2024-36993 + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + security_domain: endpoint + manual_test: This search uses a REST call against a running Splunk instance to fetch messages that have been created on the instance. It cannot be replicated with a normal test or attack data as this data cannot be "replayed" into a Splunk instance. +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0713_json_json.log + source: _json + sourcetype: _json + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_unauthenticated_dos_via_null_pointer_references.yml b/removed/detections/splunk_unauthenticated_dos_via_null_pointer_references.yml new file mode 100644 index 00000000000..da09a8f8bca --- /dev/null +++ b/removed/detections/splunk_unauthenticated_dos_via_null_pointer_references.yml @@ -0,0 +1,38 @@ +name: Splunk Unauthenticated DoS via Null Pointer References +id: d67594fe-c317-41b8-9319-ec8428d5c2ea +version: 5 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +data_source: + - Splunk +description: The following hunting search provides information on splunkd crash as a result of a Denial of Service Exploitation via null pointer references which targets 'services/cluster/config' endpoint. +search: '`splunk_crash_log` "Segmentation fault" "POST /services/cluster/config" | stats count min(_time) as firstTime max(_time) as lastTime by host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_unauthenticated_dos_via_null_pointer_references_filter`' +how_to_implement: Requires access to internal indexes. +known_false_positives: This is a hunting search and will produce false positives. An operator needs to find proximity and detail of requests targeting cluster config endpoint and subsequent Segmentation fault in splunk crash log. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0702 +tags: + cve: + - CVE-2024-36983 + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1499 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1499/splunk/SVD-2024-0702_splunkd_crash_log_splunkd_crash_log.log + source: /opt/splunk/var/log/splunk/crash-*.log + sourcetype: splunkd_crash_log + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_unauthenticated_log_injection_web_service_log.yml b/removed/detections/splunk_unauthenticated_log_injection_web_service_log.yml new file mode 100644 index 00000000000..7bd0f2f7912 --- /dev/null +++ b/removed/detections/splunk_unauthenticated_log_injection_web_service_log.yml @@ -0,0 +1,40 @@ +name: Splunk Unauthenticated Log Injection Web Service Log +id: de3908dc-1298-446d-84b9-fa81d37e959b +version: 7 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic identifies potential log injection attempts into the Splunk server via specially crafted web URLs. It detects ANSI escape codes within the `uri_path` field of `splunkd_webx` logs. This activity is significant as it can lead to log file manipulation, potentially obfuscating malicious actions or misleading analysts. If confirmed malicious, an attacker could manipulate log files to hide their tracks or execute further attacks, compromising the integrity of the logging system and making incident response more challenging. +search: '`splunkd_webx` uri_path IN ("*\x1B*", "*\u001b*", "*\033*", "*\0x9*", "*\0x8*") | stats count by uri_path method host status clientip | `splunk_unauthenticated_log_injection_web_service_log_filter`' +how_to_implement: This only affects web enabled Splunk instances. The detection does require the ability to search the _internal index. +known_false_positives: This hunting search will produce false positives if ANSI escape characters are included in URLs either voluntarily or by accident. This search will not detect obfuscated ANSI characters. This is not intended to be alerted upon. +references: + - https://advisory.splunk.com/advisories/SVD-2023-0606 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2023-32712 + mitre_attack_id: + - T1190 + product: + - Splunk Enterprise + - Splunk Enterprise Security + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/splunk/web_access.log + source: /opt/splunk/var/log/splunk/web_access.log + custom_index: _internal + sourcetype: splunk_web_access + +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_unauthenticated_path_traversal_modules_messaging.yml b/removed/detections/splunk_unauthenticated_path_traversal_modules_messaging.yml new file mode 100644 index 00000000000..dcf2c8fc07b --- /dev/null +++ b/removed/detections/splunk_unauthenticated_path_traversal_modules_messaging.yml @@ -0,0 +1,37 @@ +name: Splunk Unauthenticated Path Traversal Modules Messaging +id: e7c2b064-524e-4d65-8002-efce808567aa +version: 5 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Chase Franklin +status: removed +type: Hunting +data_source: + - Splunk +description: This hunting search provides information on exploitation attempts against /modules/messaging endpoint, the exploit can be clearly seen as the ../ which signals an attempt to traverse target directories. +search: '`splunkd_web` method=GET uri_path="/*/modules/messaging/*..*" | stats min(_time) as firstTime max(_time) as lastTime values(method) as method values(uri_path) as uri_path by host | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_unauthenticated_path_traversal_modules_messaging_filter`' +how_to_implement: Only applies to Microsoft Windows installations of Splunk. +known_false_positives: May catch other exploitation attempts using path traversal related characters. +references: + - https://advisory.splunk.com/SVD-2024-0711 +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1083 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/SVD-2024-0711_web_access_splunk_web_access.log + source: C:\\Program Files\\Splunk\\var\\log\\splunk\\web_access.log + sourcetype: splunk_web_access + custom_index: _internal + +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_unauthorized_experimental_items_creation.yml b/removed/detections/splunk_unauthorized_experimental_items_creation.yml new file mode 100644 index 00000000000..722f8d6b4ee --- /dev/null +++ b/removed/detections/splunk_unauthorized_experimental_items_creation.yml @@ -0,0 +1,38 @@ +name: Splunk Unauthorized Experimental Items Creation +id: 84afda04-0cd6-466b-869e-70d6407d0a34 +version: 5 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Chase Franklin +status: removed +type: Hunting +data_source: + - Splunk +description: This hunting search provides information on finding possible creation of unauthorized items against /experimental endpoint. +search: '`splunkda` */experimental/* method=POST | stats count min(_time) as firstTime max(_time) as lastTime by clientip method uri_path uri status | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_unauthorized_experimental_items_creation_filter`' +how_to_implement: Requires access to internal indexes. +known_false_positives: Not all requests are going to be malicious, there will be false positives, however operator must find suspicious items that might have been created by an unauthorized user. +references: + - https://advisory.splunk.com/SVD-2024-0715 +tags: + cve: + - CVE-2024-36995 + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0715_splunkd_splunkd_access.log + source: /opt/splunk/var/log/splunk/splunkd_access.log + sourcetype: splunkd_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_unauthorized_notification_input_by_user.yml b/removed/detections/splunk_unauthorized_notification_input_by_user.yml new file mode 100644 index 00000000000..de98e338db4 --- /dev/null +++ b/removed/detections/splunk_unauthorized_notification_input_by_user.yml @@ -0,0 +1,39 @@ +name: Splunk Unauthorized Notification Input by User +id: 4b7f368f-4322-47f8-8363-2c466f0b7030 +version: 5 +creation_date: '2024-07-01' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +data_source: + - Splunk +description: This hunting search provides information to track possible exploitation of a lower privilege user able to push notifications that may include malicious code as notifications for all users in Splunk. +search: '| rest /services/messages | table title message severity timeCreated_iso published splunk_server author | `splunk_unauthorized_notification_input_by_user_filter`' +how_to_implement: Requires access to Splunk rest data. +known_false_positives: This search will produce false positives which may include benign notifications from other Splunk entities, attention to suspicious or anomalous elements in notifications helps identify actual exploitation of this vulnerability. +references: + - https://advisory.splunk.com/advisories/SVD-2024-0709 +tags: + cve: + - CVE-2023-33733 + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1548 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/SVD-2024-0709_json_json.json + source: _json + sourcetype: _json + custom_index: _internal + +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml b/removed/detections/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml new file mode 100644 index 00000000000..404f1c26fe1 --- /dev/null +++ b/removed/detections/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml @@ -0,0 +1,56 @@ +name: Splunk unnecessary file extensions allowed by lookup table uploads +id: b7d1293f-e78f-415e-b5f6-443df3480082 +version: 6 +creation_date: '2023-02-14' +modification_date: '2026-05-14' +author: Rod Soto, Splunk +type: TTP +status: removed +data_source: + - Splunk +description: The following analytic identifies user activity related to uploading lookup tables with unnecessary filename extensions in Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4. It detects this activity by monitoring HTTP methods (POST, DELETE) and specific URI paths in the internal `splunkd_access` logs. This behavior is significant because it can indicate attempts to upload potentially malicious files disguised as lookup tables. If confirmed malicious, this activity could allow an attacker to execute unauthorized code or manipulate data within the Splunk environment, leading to potential data breaches or system compromise. +search: '`splunkda` method IN ("POST", "DELETE") uri_path=/servicesNS/*/ui/views/* | eval activity = case( method=="POST" AND like( uri_path , "%/acl" ) , "Permissions Update", method=="POST" AND NOT like( uri_path , "%/acl" ) , "Edited" , method=="DELETE" , "Deleted" ) | rex field=uri_path "(?<user_and_app>.*?)\/ui\/views/(?<dashboard_encoded>.*)" | eval dashboard = urldecode( dashboard_encoded ) | table _time, uri_path, user, dashboard, activity, uri_path | `splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads_filter`' +how_to_implement: Requires access to internal splunkd_access. +known_false_positives: This is a hunting search, the search provides information on upload, edit, and delete activity on Lookup Tables. Manual investigation is necessary after executing search. This search will produce false positives as payload cannot be directly discerned. +references: + - https://www.splunk.com/en_us/product-security.html +drilldown_searches: + - name: View the detection results for $user$ + search: '%original_detection_search% | search user = $user$' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for $user$ + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ($user$) starthoursago=168 endhoursago=1 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Potential lookup template injection attempt from $user$ on lookup table at path $uri_path$ + risk_objects: + - field: user + type: user + score: 25 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2023-22937 + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_unnecesary_file_extensions_allowed_by_lookup_table_uploads.log + source: /opt/splunk/var/log/splunk/splunkd_access.log + sourcetype: splunkd_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_xss_in_highlighted_json_events.yml b/removed/detections/splunk_xss_in_highlighted_json_events.yml new file mode 100644 index 00000000000..64c5cad6c51 --- /dev/null +++ b/removed/detections/splunk_xss_in_highlighted_json_events.yml @@ -0,0 +1,40 @@ +name: Splunk XSS in Highlighted JSON Events +id: 1030bc63-0b37-4ac9-9ae0-9361c955a3cc +version: 7 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Splunk +status: removed +type: Hunting +data_source: + - Splunk +description: The following analytic identifies potential exploitation of a Cross-Site Scripting (XSS) vulnerability in Splunk Enterprise 9.1.2. It detects suspicious requests to the Splunk web GUI that may execute JavaScript within script tags. This detection leverages logs from the `splunkd_ui` data source, focusing on specific URI paths and HTTP methods. This activity is significant as it can allow attackers to execute arbitrary JavaScript, potentially accessing the API with the logged-in user's permissions. If the user is an admin, the attacker could create an admin account, leading to full control over the Splunk environment. +search: '`splunkd_ui` "/*/splunkd/__raw/servicesNS/nobody/search/authentication/users" status=201 | stats count min(_time) as firstTime max(_time) as lastTime by clientip, uri_path, method | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_xss_in_highlighted_json_events_filter`' +how_to_implement: This search only applies to web-GUI-enabled Splunk instances and operator must have access to internal indexes. +known_false_positives: This is a hunting search and will produce false positives as it is not possible to view contents of a request payload. It shows the artifact resulting from a potential exploitation payload (the creation of a user with admin privileges). +references: + - https://advisory.splunk.com/advisories/SVD-2023-1103 +tags: + cve: + - CVE-2023-46213 + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_in_highlighted_json_events_splunkd_ui_access.log + source: splunkd_ui_access.log + sourcetype: splunkd_ui_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_xss_in_monitoring_console.yml b/removed/detections/splunk_xss_in_monitoring_console.yml new file mode 100644 index 00000000000..c93024542ed --- /dev/null +++ b/removed/detections/splunk_xss_in_monitoring_console.yml @@ -0,0 +1,45 @@ +name: Splunk XSS in Monitoring Console +id: b11accac-6fa3-4103-8a1a-7210f1a67087 +version: 7 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Lou Stella, Splunk +status: removed +type: TTP +description: The following analytic identifies attempts to exploit a reflective Cross-Site Scripting (XSS) vulnerability in the Splunk Distributed Monitoring Console app. It detects GET requests with suspicious query parameters by analyzing `splunkd_web` logs in the _internal index. This activity is significant because it targets a known vulnerability (CVE-2022-27183) that could allow attackers to execute arbitrary scripts in the context of the user's browser. If confirmed malicious, this could lead to unauthorized actions, data theft, or further compromise of the Splunk environment. +data_source: [] +search: '`splunkd_web` method="GET" uri_query="description=%3C*" | table _time host status clientip user uri | `splunk_xss_in_monitoring_console_filter`' +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will find attempted exploitation of CVE-2022-27183. +known_false_positives: Use of the monitoring console where the less-than sign (<) is the first character in the description field. +references: + - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0505.html +rba: + message: A potential XSS attempt has been detected from $user$ + risk_objects: + - field: host + type: system + score: 40 + threat_objects: [] +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-27183 + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/xss/splunk_web_access.log + source: /opt/splunk/var/log/splunk/web_access.log + sourcetype: splunk_web_access +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_xss_in_save_table_dialog_header_in_search_page.yml b/removed/detections/splunk_xss_in_save_table_dialog_header_in_search_page.yml new file mode 100644 index 00000000000..3fc9340451b --- /dev/null +++ b/removed/detections/splunk_xss_in_save_table_dialog_header_in_search_page.yml @@ -0,0 +1,41 @@ +name: Splunk XSS in Save table dialog header in search page +id: a974d1ee-ddca-4837-b6ad-d55a8a239c20 +version: 7 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto +status: removed +type: Hunting +description: The following analytic identifies persistent cross-site scripting (XSS) attempts in the 'Save Table' dialog on the Splunk search page. It detects POST requests to the endpoint `/en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model` containing potential XSS payloads. This activity is significant because it can allow a remote user with the "power" role to inject malicious scripts, leading to persistent XSS vulnerabilities. If confirmed malicious, this could enable attackers to execute arbitrary scripts in the context of the affected user, potentially leading to data theft, session hijacking, or further exploitation within the Splunk environment. +data_source: + - Splunk +search: '`splunkd_webx` method=POST uri=/*/splunkd/__raw/servicesNS/nobody/search/datamodel/model | table _time host status clientip user uri | `splunk_xss_in_save_table_dialog_header_in_search_page_filter`' +how_to_implement: Watch for POST requests combined with XSS script strings or obfuscation against the injection point /en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model. +known_false_positives: If host is vulnerable and XSS script strings are inputted they will show up in search. Not all Post requests are malicious as they will show when users create and save dashboards. This search may produce several results with non malicious POST requests. Only affects Splunk Web enabled instances. +references: + - https://advisory.splunk.com/advisories/SVD-2022-1101 + - https://portswigger.net/web-security/cross-site-scripting +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-43561 + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_in_save_table_dialog_in_search_page.log + source: /opt/splunk/var/log/splunk/web_access.log + sourcetype: splunk_web_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_xss_via_external_urls_in_dashboards_ssrf.yml b/removed/detections/splunk_xss_via_external_urls_in_dashboards_ssrf.yml new file mode 100644 index 00000000000..6ee060d2a49 --- /dev/null +++ b/removed/detections/splunk_xss_via_external_urls_in_dashboards_ssrf.yml @@ -0,0 +1,38 @@ +name: Splunk XSS Via External Urls in Dashboards SSRF +id: b0a67520-ae82-4cf6-b04e-9f6cce56830d +version: 5 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Chase Franklin +status: removed +type: Hunting +data_source: + - Splunk +description: This is a hunting search that provides elements to find possible dashboards created with external URL references in order to elicit Server Side Request Forgery from /data/ui/views endpoint. +search: '`splunkd_web` user=* uri_path="/*/manager/permissions/launcher/data/ui/views/*" file=* | stats count min(_time) as firstTime max(_time) as lastTime by clientip user file host method uri_path uri_query | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_xss_via_external_urls_in_dashboards_ssrf_filter`' +how_to_implement: Requires access to internal indexes. +known_false_positives: This is a hunting search and requires an operator to search for specific indicators of Server Side Request Forgery attack against /data/ui/views. It is not possible to grab display the payloads of such requests, so this search provides users, ip addresses, requests, files, and queries that may indicate malicious intent. There will be false positives. +references: + - https://advisory.splunk.com/SVD-2024-0714 +tags: + cve: + - CVE-2024-36994 + analytic_story: + - Splunk Vulnerabilities + asset_type: Splunk Server + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/SVD-2024-0714_web_access_splunk_web_access.log + source: /opt/splunk/var/log/splunk/web_access.log + sourcetype: splunk_web_access + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/removed/detections/splunk_xss_via_view.yml b/removed/detections/splunk_xss_via_view.yml new file mode 100644 index 00000000000..ec340e219b6 --- /dev/null +++ b/removed/detections/splunk_xss_via_view.yml @@ -0,0 +1,40 @@ +name: Splunk XSS via View +id: 9ac2bfea-a234-4a18-9d37-6d747e85c2e4 +version: 6 +creation_date: '2025-05-12' +modification_date: '2026-05-14' +author: Rod Soto, Eric McGinnis, Splunk +status: removed +type: Hunting +description: The following analytic identifies potential Cross-Site Scripting (XSS) attempts via the 'layoutPanel' attribute in the 'module' tag within XML Views in Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4. It leverages internal logs from "splunk_web_service" and "splunk_python" sourcetypes, focusing on messages containing "loadParams." This activity is significant as it can lead to unauthorized script execution within the Splunk Web interface, potentially compromising the security of the instance. If confirmed malicious, attackers could execute arbitrary scripts, leading to data theft, session hijacking, or further exploitation of the Splunk environment. +data_source: + - Splunk +search: 'index = _internal sourcetype IN ("splunk_web_service", "splunk_python") message="*loadParams*" | `security_content_ctime(_time)` | table _time message fileName | `splunk_xss_via_view_filter`' +how_to_implement: This data is collected by default in Splunk. Upon first enabling this rule, a number of errors may be observed. Those that are due to improperly formatted, but non-nefarious, XML views should be be remedied in the corresponding view. Please take care investigating potential XSS as accessing an affected page could retrigger the exploit. +known_false_positives: The error detected above can be generated for a wide variety of improperly formatted XML views. There will be false positives as the search cannot extract the malicious payload and the view should be manually investigated. +references: + - https://www.splunk.com/en_us/product-security.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2023-22933 + mitre_attack_id: + - T1189 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_via_view.log + source: /opt/splunk/var/log/splunk/web_service.log + sourcetype: splunk_web_service + custom_index: _internal +deprecation_info: + reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release. + removed_in_version: 5.6.0 + replacement_content: [] diff --git a/stories/splunk_vulnerabilities.yml b/stories/splunk_vulnerabilities.yml new file mode 100644 index 00000000000..39a7a51fd79 --- /dev/null +++ b/stories/splunk_vulnerabilities.yml @@ -0,0 +1,18 @@ +name: Splunk Vulnerabilities +id: 5354df00-dce2-48ac-9a64-8adb48006828 +version: 3 +creation_date: '2019-10-16' +modification_date: '2026-06-24' +author: Lou Stella, Rod Soto, Eric McGinnis, Splunk +status: production +description: Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product. +narrative: This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly. +references: + - https://advisory.splunk.com/ +category: + - Best Practices +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +usecase: Application Security From 22c4660d24c0cb075abdb9dd890b4a9aa2ea1765 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins <raylee@hawkinsops.com> Date: Thu, 25 Jun 2026 05:58:31 -0500 Subject: [PATCH 005/162] Update Windows EDRSilencer renamed binary detection coverage (#4123) --------- Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- .../endpoint/windows_edrsilencer_execution.yml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/windows_edrsilencer_execution.yml b/detections/endpoint/windows_edrsilencer_execution.yml index 78685c9148e..6f62d3f3cf5 100644 --- a/detections/endpoint/windows_edrsilencer_execution.yml +++ b/detections/endpoint/windows_edrsilencer_execution.yml @@ -1,8 +1,8 @@ name: Windows EDRSilencer Execution id: a206324d-4945-4b0c-a731-87c311ddae2f -version: 2 +version: 3 creation_date: '2026-05-05' -modification_date: '2026-05-13' +modification_date: '2026-06-13' author: Raven Tait, Splunk status: production type: Anomaly @@ -27,7 +27,7 @@ search: |- Processes.process_name="EDRSilencer.exe" OR ( - Processes.process="*blockedr *" + Processes.process IN ("* blockedr", "* blockedr *") NOT Processes.process="*blockedreport*" ) @@ -42,7 +42,7 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_edrsilencer_execution_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, parent process, and complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Some legitimate administrative tools or security workflows may use similar techniques to block or filter EDR traffic for maintenance or troubleshooting. Verify the context and authorized use before flagging. references: - https://github.com/netero1010/EDRSilencer @@ -60,10 +60,12 @@ intermediate_findings: - field: dest type: system score: 20 - message: Potential EDRSilencer execution observed on $dest$ via $process$. + message: Potential EDRSilencer execution [$process_path$] with the CommandLine [$process$] observed on $dest$. threat_objects: - field: parent_process_name type: parent_process_name + - field: process_name + type: process_name analytic_story: - Security Solution Tampering asset_type: Endpoint From 2fa0452ad6bedee05ff695d6a00f9c55cab03617 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 29 Jun 2026 08:52:05 -0700 Subject: [PATCH 006/162] Explicitly list all apps in this repo's install.yml (#4138) --- install.yml | 43 +++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 41 insertions(+), 2 deletions(-) diff --git a/install.yml b/install.yml index b5d170f5910..666032994e1 100644 --- a/install.yml +++ b/install.yml @@ -1,3 +1,42 @@ apps: - - appid: DA-ESS-ContentUpdate - hardcoded_path: dist/DA-ESS-ContentUpdate.tar.gz + - appid: DA-ESS-ContentUpdate + hardcoded_path: dist/DA-ESS-ContentUpdate.tar.gz + - appid: SplunkEnterpriseSecuritySuite + url: https://splunkbase.splunk.com/app/263 + version: 8.5.1 + - appid: Splunk_TA_microsoft-iis + url: https://splunkbase.splunk.com/app/3185 + version: 2.0.0 + - appid: TA-suricata-4 + url: https://splunkbase.splunk.com/app/4242 + version: 2.3.4 + - appid: Splunk_TA_stream + url: https://splunkbase.splunk.com/app/5238 + version: 8.1.6 + - appid: Splunk_TA_stream_wire_data + url: https://splunkbase.splunk.com/app/5234 + version: 8.1.6 + - appid: TA-Zscaler_CIM + url: https://splunkbase.splunk.com/app/3865 + version: 4.1.5 + - appid: Splunk_TA_aws-kinesis-firehose + url: https://splunkbase.splunk.com/app/3719 + version: 1.3.2 + - appid: Splunk_TA_google-cloudplatform + url: https://splunkbase.splunk.com/app/3088 + version: 5.0.3 + - appid: utbox + url: https://splunkbase.splunk.com/app/2734 + version: 1.9.4 + - appid: SA-admon + url: https://splunkbase.splunk.com/app/6853 + version: 1.1.2 + - appid: TA-crowdstrike-falcon-event-streams + url: https://splunkbase.splunk.com/app/5082 + version: 3.7.2 + - appid: SA-VMWIndex + url: https://splunkbase.splunk.com/app/5640 + version: 4.0.4 + - appid: Splunk_SA_CIM + url: https://splunkbase.splunk.com/app/1621 + version: 8.5.0 From ed64dfe9a045aa5299f91322fc8654214a035114 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 1 Jul 2026 09:13:48 +0000 Subject: [PATCH 007/162] Bump actions/checkout from 6 to 7 (#4135) Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com> --- .github/workflows/appinspect.yml | 2 +- .github/workflows/build-response-templates.yml | 2 +- .github/workflows/build.yml | 2 +- .github/workflows/datasource-dependabot.yml | 2 +- .github/workflows/labeler.yml | 2 +- .github/workflows/unit-testing.yml | 2 +- .github/workflows/update_splunk_tas.yml | 2 +- .github/workflows/yaml-validation.yml | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index 6eab313976c..36be91d3b69 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out the repository code - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Set up Python uses: actions/setup-python@v6 diff --git a/.github/workflows/build-response-templates.yml b/.github/workflows/build-response-templates.yml index 5af3719003d..075f46864ef 100644 --- a/.github/workflows/build-response-templates.yml +++ b/.github/workflows/build-response-templates.yml @@ -10,7 +10,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out the repository code - uses: actions/checkout@v6 + uses: actions/checkout@v7 - uses: actions/setup-python@v6 with: diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 323fe272956..7b65e001459 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out the repository code - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Set up Python uses: actions/setup-python@v6 diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index 0b07ac92a32..08418087204 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -11,7 +11,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: ref: 'develop' token: ${{ secrets.DATA_SOURCES_DEPENDABOT }} diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index f9383b78c0f..3dce58e0d55 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -9,7 +9,7 @@ jobs: pull-requests: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: repository: "splunk/security_content" - uses: actions/labeler@v6 diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 486722289f4..39f11ee0b23 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -9,7 +9,7 @@ jobs: steps: #For fork PRs, always check out security_content and the PR target in security content! - name: Check out the repository code - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: repository: 'splunk/security_content' #this should be the TARGET repo of the PR. we hardcode it for now ref: ${{ github.base_ref }} diff --git a/.github/workflows/update_splunk_tas.yml b/.github/workflows/update_splunk_tas.yml index 2fcce67b1fe..0caa429b36e 100644 --- a/.github/workflows/update_splunk_tas.yml +++ b/.github/workflows/update_splunk_tas.yml @@ -11,7 +11,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: ref: 'develop' diff --git a/.github/workflows/yaml-validation.yml b/.github/workflows/yaml-validation.yml index e9bf0ad42b9..3ddfdf9435c 100644 --- a/.github/workflows/yaml-validation.yml +++ b/.github/workflows/yaml-validation.yml @@ -19,7 +19,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: fetch-depth: 0 From d4026db34edd44fe07fcf2fc1394628068862e53 Mon Sep 17 00:00:00 2001 From: Andrei Banaru <andrei.banaru@gmail.com> Date: Wed, 1 Jul 2026 11:17:23 +0200 Subject: [PATCH 008/162] chore: swap order of macros (#4144) Co-authored-by: Andrei Banaru <a.banaru@iaea.org> Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com> --- detections/endpoint/attacker_tools_on_endpoint.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index aeeadc47d7a..c2a61d01a26 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -1,8 +1,8 @@ name: Attacker Tools On Endpoint id: a51bfe1a-94f0-48cc-b4e4-16a110145893 -version: 18 +version: 19 creation_date: '2021-07-12' -modification_date: '2026-05-13' +modification_date: '2026-07-01' author: Bhavin Patel, Splunk, sventec, Github Community status: production type: TTP @@ -39,9 +39,9 @@ search: |- Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `drop_dm_object_name(Processes)` | lookup attacker_tools attacker_tool_names AS process_name OUTPUT description | search description !=false | `attacker_tools_on_endpoint_filter` From bf13c80ad9e58e5e901986a9e963df5cf93d8405 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali <nbencher@cisco.com> Date: Wed, 1 Jul 2026 11:18:59 +0200 Subject: [PATCH 009/162] update IF config (#4142) Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com> --- .../powershell_domain_enumeration.yml | 41 ++++++++------ ...ershell_environment_variable_execution.yml | 20 +++++-- ...ding_dotnet_into_memory_via_reflection.yml | 14 +++-- .../powershell_processing_stream_of_data.yml | 45 ++++++++------- ...hell_remove_windows_defender_directory.yml | 42 +++++++++----- ...ll_windows_defender_exclusion_commands.yml | 55 +++++++++++-------- ...ndows_clipboard_data_via_get_clipboard.yml | 39 +++++++------ ...ows_powershell_import_applocker_policy.yml | 53 ++++++++++-------- ...ndows_powershell_logoff_user_via_quser.yml | 40 +++++++++----- 9 files changed, 211 insertions(+), 138 deletions(-) diff --git a/detections/endpoint/powershell_domain_enumeration.yml b/detections/endpoint/powershell_domain_enumeration.yml index d7609146c6d..af8dd8778b8 100644 --- a/detections/endpoint/powershell_domain_enumeration.yml +++ b/detections/endpoint/powershell_domain_enumeration.yml @@ -1,19 +1,32 @@ name: PowerShell Domain Enumeration id: e1866ce2-ca22-11eb-8e44-acde48001122 -version: 15 +version: 16 creation_date: '2021-06-15' -modification_date: '2026-05-13' +modification_date: '2026-06-28' author: Michael Haag, Splunk status: production -type: TTP -description: The following analytic detects the execution of PowerShell commands used for domain enumeration, such as `get-netdomaintrust` and `get-adgroupmember`. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command sent to PowerShell. This activity is significant as it often indicates reconnaissance efforts by an attacker to map out the domain structure and identify key users and groups. If confirmed malicious, this behavior could lead to further targeted attacks, privilege escalation, and unauthorized access to sensitive information within the domain. +type: Anomaly +description: |- + The following analytic detects the execution of PowerShell commands used for domain enumeration, such as `get-netdomaintrust` and `get-adgroupmember`. + It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command sent to PowerShell. + This activity is significant as it often indicates reconnaissance efforts by an attacker to map out the domain structure and identify key users and groups. + If confirmed malicious, this behavior could lead to further targeted attacks, privilege escalation, and unauthorized access to sensitive information within the domain. data_source: - Powershell Script Block Logging 4104 search: |- - `powershell` EventCode=4104 ScriptBlockText IN (*get-netdomaintrust*, *get-netforesttrust*, *get-addomain*, *get-adgroupmember*, *get-domainuser*) - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY dest signature signature_id + `powershell` + EventCode=4104 + ScriptBlockText IN ( + *get-netdomaintrust*, + *get-netforesttrust*, + *get-addomain*, + *get-adgroupmember*, + *get-domainuser* + ) + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + BY dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId @@ -22,7 +35,7 @@ search: |- | `security_content_ctime(lastTime)` | `powershell_domain_enumeration_filter` how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba. -known_false_positives: It is possible there will be false positives, filter as needed. +known_false_positives: Legitimate use can be common or expected in certain environments. Filter as needed. references: - https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba. - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 @@ -38,18 +51,12 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: A suspicious powershell script contains domain enumeration command in $ScriptBlockText$ in host $dest$ - entity: - field: user_id - type: user - score: 50 intermediate_findings: entities: - field: dest type: system - score: 50 - message: A suspicious powershell script contains domain enumeration command in $ScriptBlockText$ in host $dest$ + score: 20 + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] contains domain enumeration commands executed on host $dest$ analytic_story: - Hermetic Wiper - Malicious PowerShell diff --git a/detections/endpoint/powershell_environment_variable_execution.yml b/detections/endpoint/powershell_environment_variable_execution.yml index 386adfb99e6..235dd1f2e97 100644 --- a/detections/endpoint/powershell_environment_variable_execution.yml +++ b/detections/endpoint/powershell_environment_variable_execution.yml @@ -1,12 +1,16 @@ name: PowerShell Environment Variable Execution id: 02c1d8e9-044c-401f-906c-cc95445af8bd -version: 2 +version: 3 creation_date: '2026-04-29' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: The following analytic detects the execution of PowerShell scripts that combine environment variable access (`$env:` or `[Environment]::SetEnvironmentVariable`) with `Invoke-Expression` or its alias `iex` to dynamically construct and run code at runtime. This technique is commonly used by adversaries to stage and execute payloads by embedding commands or encoded content inside environment variables, then evaluating them on the fly — effectively hiding the true execution intent from static inspection. Detection is based on PowerShell Script Block Logging (Event ID 4104), which captures the de-obfuscated script block before it executes. Triggering this analytic indicates a potential attempt to execute environment-variable-stored code, a behavior observed in malware loaders and stagers, including those associated with the VIP Keylogger campaign. +description: |- + The following analytic detects the execution of PowerShell scripts that combine environment variable access (`$env:` or `[Environment]::SetEnvironmentVariable`) with `Invoke-Expression` or its alias `iex` to dynamically construct and run code at runtime. + This technique is commonly used by adversaries to stage and execute payloads by embedding commands or encoded content inside environment variables, then evaluating them on the fly — effectively hiding the true execution intent from static inspection. + Detection is based on PowerShell Script Block Logging (Event ID 4104), which captures the de-obfuscated script block before it executes. + Triggering this analytic indicates a potential attempt to execute environment-variable-stored code, a behavior observed in malware loaders and stagers, including those associated with the VIP Keylogger campaign. data_source: - Powershell Script Block Logging 4104 search: |- @@ -22,8 +26,12 @@ search: |- ScriptBlockText="*[Environment]::SetEnvironmentVariable*" | regex ScriptBlockText="(?i)((invoke-expression|iex\s+|\biex\b).*\$env:|\[scriptblock\]::create\s*\(\s*\$env:[^)]+\)\s*(?:\.\s*invoke\s*\(\s*\))?)" | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest signature signature_id user_id + vendor_product EventID Guid + Opcode Name Path ProcessID + ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_environment_variable_execution_filter` @@ -49,7 +57,7 @@ intermediate_findings: - field: dest type: system score: 20 - message: A suspicious powershell script execute environment variable in [$ScriptBlockText$] on host [$dest$] + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] executed an environment variable on host $dest$ analytic_story: - VIP Keylogger asset_type: Endpoint diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index d4ebee3963e..2cb74860b73 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -1,12 +1,16 @@ name: PowerShell Loading DotNET into Memory via Reflection id: 85bc3f30-ca28-11eb-bd21-acde48001122 -version: 18 +version: 19 creation_date: '2021-06-15' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Michael Haag, Teoderick Contreras Splunk status: production type: Anomaly -description: The following analytic detects the use of PowerShell scripts to load .NET assemblies into memory via reflection, a technique often used in malicious activities such as those by Empire and Cobalt Strike. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command executed. This behavior is significant as it can indicate advanced attack techniques aiming to execute code in memory, bypassing traditional defenses. If confirmed malicious, this activity could lead to unauthorized code execution, privilege escalation, and persistent access within the environment. +description: |- + The following analytic detects the use of PowerShell scripts to load .NET assemblies into memory via reflection, a technique often used in malicious activities such as those by Empire and Cobalt Strike. + It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command executed. + This behavior is significant as it can indicate advanced attack techniques aiming to execute code in memory, bypassing traditional defenses. + If confirmed malicious, this activity could lead to unauthorized code execution, privilege escalation, and persistent access within the environment. data_source: - Powershell Script Block Logging 4104 search: |- @@ -55,11 +59,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: A suspicious powershell script contains reflective class assembly command in $ScriptBlockText$ to load .net code in memory in host $dest$ + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing reflective class assembly commands to load .net code in memory was executed on host $dest$ - field: user_id type: user score: 20 - message: A suspicious powershell script contains reflective class assembly command in $ScriptBlockText$ to load .net code in memory in host $dest$ + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing reflective class assembly commands to load .net code in memory was executed on host $dest$ by user $user_id$ analytic_story: - Winter Vivern - AgentTesla diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index 9a503981773..eb231a56282 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -1,23 +1,34 @@ name: Powershell Processing Stream Of Data id: 0d718b52-c9f1-11eb-bc61-acde48001122 -version: 18 +version: 19 creation_date: '2021-06-14' -modification_date: '2026-06-08' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects suspicious PowerShell script execution involving compressed stream data processing, identified via EventCode 4104. It leverages PowerShell Script Block Logging to flag scripts using `IO.Compression`, `IO.StreamReader`, or decompression methods. This activity is significant as it often indicates obfuscated PowerShell or embedded .NET/binary execution, which are common tactics for evading detection. If confirmed malicious, this behavior could allow attackers to execute hidden code, escalate privileges, or maintain persistence within the environment. +type: Anomaly +description: |- + The following analytic detects suspicious PowerShell script execution involving compressed stream data processing, identified via EventCode 4104. + It leverages PowerShell Script Block Logging to flag scripts using `IO.Compression`, `IO.StreamReader`, or decompression methods. + This activity is significant as it often indicates obfuscated PowerShell or embedded .NET/binary execution, which are common tactics for evading detection. + If confirmed malicious, this behavior could allow attackers to execute hidden code, escalate privileges, or maintain persistence within the environment. data_source: - Powershell Script Block Logging 4104 search: |- - `powershell` EventCode=4104 ScriptBlockText = "*IO.Compression.*" OR ScriptBlockText = "*IO.StreamReader*" OR ScriptBlockText = "*]::Decompress*" - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY dest signature signature_id - user_id vendor_product EventID - Guid Opcode Name - Path ProcessID ScriptBlockId - ScriptBlockText + `powershell` + EventCode=4104 + ScriptBlockText IN ( + "*IO.Compression.*", + "*IO.StreamReader*", + "*]::Decompress*" + ) + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest signature signature_id + user_id vendor_product EventID + Guid Opcode Name + Path ProcessID ScriptBlockId + ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter` @@ -40,18 +51,12 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: A suspicious powershell script contains stream command in $ScriptBlockText$ commonly for processing compressed or to decompressed binary file with EventCode $EventID$ in host $dest$ - entity: - field: user_id - type: user - score: 50 intermediate_findings: entities: - field: dest type: system - score: 50 - message: A suspicious powershell script contains stream command in $ScriptBlockText$ commonly for processing compressed or to decompressed binary file with EventCode $EventID$ in host $dest$ + score: 20 + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing stream commands to process compressed or decompressed binary file was executed on host $dest$ analytic_story: - Hellcat Ransomware - Malicious PowerShell diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml index 10dd5b0b234..02c1d12e897 100644 --- a/detections/endpoint/powershell_remove_windows_defender_directory.yml +++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml @@ -1,15 +1,33 @@ name: Powershell Remove Windows Defender Directory id: adf47620-79fa-11ec-b248-acde48001122 -version: 16 +version: 17 creation_date: '2022-01-20' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects a suspicious PowerShell command attempting to delete the Windows Defender directory. It leverages PowerShell Script Block Logging to identify commands containing "rmdir" and targeting the Windows Defender path. This activity is significant as it may indicate an attempt to disable or corrupt Windows Defender, a key security component. If confirmed malicious, this action could allow an attacker to bypass endpoint protection, facilitating further malicious activities without detection. +type: Anomaly +description: |- + The following analytic detects a suspicious PowerShell command attempting to delete the Windows Defender directory. + It leverages PowerShell Script Block Logging to identify commands containing "rmdir" and targeting the Windows Defender path. + This activity is significant as it may indicate an attempt to disable or corrupt Windows Defender, a key security component. + If confirmed malicious, this action could allow an attacker to bypass endpoint protection, facilitating further malicious activities without detection. data_source: - Powershell Script Block Logging 4104 -search: '`powershell` EventCode=4104 ScriptBlockText = "*rmdir *" AND ScriptBlockText = "*\\Microsoft\\Windows Defender*" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remove_windows_defender_directory_filter`' +search: |- + `powershell` + EventCode=4104 + ScriptBlockText = "*rmdir *" + ScriptBlockText = "*\\Microsoft\\Windows Defender*" + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest signature signature_id user_id + vendor_product EventID Guid Opcode + Name Path ProcessID + ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_remove_windows_defender_directory_filter` how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba. known_false_positives: No false positives have been identified at this time. references: @@ -23,18 +41,16 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: suspicious powershell script $ScriptBlockText$ was executed on the $dest$ - entity: - field: user_id - type: user - score: 50 intermediate_findings: entities: - field: dest type: system - score: 50 - message: suspicious powershell script $ScriptBlockText$ was executed on the $dest$ + score: 20 + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing rmdir commands to potentially delete the Windows Defender directory was executed on host $dest$ by user $user_id$ + - field: user_id + type: user + score: 20 + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing rmdir commands to potentially delete the Windows Defender directory was executed on host $dest$ by user $user_id$ analytic_story: - Data Destruction - WhisperGate diff --git a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml index fb2ad118768..85183c77144 100644 --- a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml +++ b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml @@ -1,26 +1,37 @@ name: Powershell Windows Defender Exclusion Commands id: 907ac95c-4dd9-11ec-ba2c-acde48001122 -version: 16 +version: 17 creation_date: '2021-11-25' -modification_date: '2026-06-08' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects the use of PowerShell commands to add or set Windows Defender exclusions. It leverages EventCode 4104 to identify suspicious `Add-MpPreference` or `Set-MpPreference` commands with exclusion parameters. This activity is significant because adversaries often use it to bypass Windows Defender, allowing malicious code to execute without detection. If confirmed malicious, this behavior could enable attackers to evade antivirus defenses, maintain persistence, and execute further malicious activities undetected. +type: Anomaly +description: |- + The following analytic detects the use of PowerShell commands to add or set Windows Defender exclusions. + It leverages EventCode 4104 to identify suspicious `Add-MpPreference` or `Set-MpPreference` commands with exclusion parameters. + This activity is significant because adversaries often use it to bypass Windows Defender, allowing malicious code to execute without detection. + If confirmed malicious, this behavior could enable attackers to evade antivirus defenses, maintain persistence, and execute further malicious activities undetected. data_source: - Powershell Script Block Logging 4104 search: |- - `powershell` EventCode=4104 (ScriptBlockText = "*Add-MpPreference *" OR ScriptBlockText = "*Set-MpPreference *") AND ScriptBlockText = "*-exclusion*" - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY dest signature signature_id - user_id vendor_product EventID - Guid Opcode Name - Path ProcessID ScriptBlockId - ScriptBlockText - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `powershell_windows_defender_exclusion_commands_filter` + `powershell` + EventCode=4104 + ScriptBlockText IN ( + "*Add-MpPreference *", + "*Set-MpPreference *" + ) + ScriptBlockText = "*-exclusion*" + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest signature signature_id + user_id vendor_product EventID + Guid Opcode Name + Path ProcessID ScriptBlockId + ScriptBlockText + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_windows_defender_exclusion_commands_filter` how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. known_false_positives: admin or user may choose to use this windows features. references: @@ -36,18 +47,16 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: Exclusion command $ScriptBlockText$ executed on $dest$ - entity: - field: user_id - type: user - score: 50 intermediate_findings: entities: - field: dest type: system - score: 50 - message: Exclusion command $ScriptBlockText$ executed on $dest$ + score: 20 + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing exclusion commands to add or set Windows Defender exclusions was executed on host $dest$ + - field: user_id + type: user + score: 20 + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing exclusion commands to add or set Windows Defender exclusions was executed on host $dest$ by user $user_id$ analytic_story: - CISA AA22-320A - AgentTesla diff --git a/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml b/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml index fca31dc11ab..46cd6303183 100644 --- a/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml +++ b/detections/endpoint/windows_clipboard_data_via_get_clipboard.yml @@ -1,26 +1,33 @@ name: Windows ClipBoard Data via Get-ClipBoard id: ab73289e-2246-4de0-a14b-67006c72a893 -version: 11 +version: 12 creation_date: '2022-12-06' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the execution of the PowerShell command 'Get-Clipboard' to retrieve clipboard data. It leverages PowerShell Script Block Logging (EventCode 4104) to identify instances where this command is used. This activity is significant because it can indicate an attempt to steal sensitive information such as usernames, passwords, or other confidential data copied to the clipboard. If confirmed malicious, this behavior could lead to unauthorized access to sensitive information, potentially compromising user accounts and other critical assets. +description: |- + The following analytic detects the execution of the PowerShell command 'Get-Clipboard' to retrieve clipboard data. + It leverages PowerShell Script Block Logging (EventCode 4104) to identify instances where this command is used. + This activity is significant because it can indicate an attempt to steal sensitive information such as usernames, passwords, or other confidential data copied to the clipboard. + If confirmed malicious, this behavior could lead to unauthorized access to sensitive information, potentially compromising user accounts and other critical assets. data_source: - Powershell Script Block Logging 4104 search: |- - `powershell` EventCode=4104 ScriptBlockText = "*Get-Clipboard*" - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY dest signature signature_id - user_id vendor_product EventID - Guid Opcode Name - Path ProcessID ScriptBlockId - ScriptBlockText - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_clipboard_data_via_get_clipboard_filter` + `powershell` + EventCode=4104 + ScriptBlockText = "*Get-Clipboard*" + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest signature signature_id + user_id vendor_product EventID + Guid Opcode Name + Path ProcessID ScriptBlockId + ScriptBlockText + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_clipboard_data_via_get_clipboard_filter` how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba. known_false_positives: It is possible there will be false positives, filter as needed. references: @@ -41,11 +48,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: Powershell script $ScriptBlockText$ execute Get-Clipboard commandlet on $dest$ + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing Get-Clipboard commandlet to retrieve clipboard data was executed on host $dest$ - field: user_id type: user score: 20 - message: Powershell script $ScriptBlockText$ execute Get-Clipboard commandlet on $dest$ + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing Get-Clipboard commandlet to retrieve clipboard data was executed on host $dest$ by user $user_id$ analytic_story: - Windows Post-Exploitation - Prestige Ransomware diff --git a/detections/endpoint/windows_powershell_import_applocker_policy.yml b/detections/endpoint/windows_powershell_import_applocker_policy.yml index 332e5ff9fd3..603a840dc13 100644 --- a/detections/endpoint/windows_powershell_import_applocker_policy.yml +++ b/detections/endpoint/windows_powershell_import_applocker_policy.yml @@ -1,26 +1,35 @@ name: Windows Powershell Import Applocker Policy id: 102af98d-0ca3-4aa4-98d6-7ab2b98b955a -version: 13 +version: 14 creation_date: '2022-06-30' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects the import of Windows PowerShell Applocker cmdlets, specifically identifying the use of "Import-Module Applocker" and "Set-AppLockerPolicy" with an XML policy. It leverages PowerShell Script Block Logging (EventCode 4104) to capture and analyze script block text. This activity is significant as it may indicate an attempt to enforce restrictive Applocker policies, potentially used by malware like Azorult to disable antivirus products. If confirmed malicious, this could allow an attacker to bypass security controls, leading to further system compromise and persistence. +type: Anomaly +description: |- + The following analytic detects the import of Windows PowerShell Applocker cmdlets, specifically identifying the use of "Import-Module Applocker" and "Set-AppLockerPolicy" with an XML policy. + It leverages PowerShell Script Block Logging (EventCode 4104) to capture and analyze script block text. + This activity is significant as it may indicate an attempt to enforce restrictive Applocker policies, potentially used by malware like Azorult to disable antivirus products. + If confirmed malicious, this could allow an attacker to bypass security controls, leading to further system compromise and persistence. data_source: - Powershell Script Block Logging 4104 search: |- - `powershell` EventCode=4104 ScriptBlockText="*Import-Module Applocker*" ScriptBlockText="*Set-AppLockerPolicy*" ScriptBlockText="* -XMLPolicy *" - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY dest signature signature_id - user_id vendor_product EventID - Guid Opcode Name - Path ProcessID ScriptBlockId - ScriptBlockText - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_powershell_import_applocker_policy_filter` + `powershell` + EventCode=4104 + ScriptBlockText="*Import-Module Applocker*" + ScriptBlockText="*Set-AppLockerPolicy*" + ScriptBlockText="* -XMLPolicy *" + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest signature signature_id + user_id vendor_product EventID + Guid Opcode Name + Path ProcessID ScriptBlockId + ScriptBlockText + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_powershell_import_applocker_policy_filter` how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba. known_false_positives: administrators may execute this command that may cause some false positive. references: @@ -34,18 +43,16 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: A PowerShell script contains Import Applocker Policy command $ScriptBlockText$ on host $dest$ - entity: - field: user_id - type: user - score: 50 intermediate_findings: entities: - field: dest type: system - score: 50 - message: A PowerShell script contains Import Applocker Policy command $ScriptBlockText$ on host $dest$ + score: 20 + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing Import-Module Applocker and Set-AppLockerPolicy commands to import Applocker policy was executed on host $dest$ + - field: user_id + type: user + score: 20 + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing Import-Module Applocker and Set-AppLockerPolicy commands to import Applocker policy was executed on host $dest$ by user $user_id$ analytic_story: - Azorult asset_type: Endpoint diff --git a/detections/endpoint/windows_powershell_logoff_user_via_quser.yml b/detections/endpoint/windows_powershell_logoff_user_via_quser.yml index e438b2ab2e3..7061caf78ce 100644 --- a/detections/endpoint/windows_powershell_logoff_user_via_quser.yml +++ b/detections/endpoint/windows_powershell_logoff_user_via_quser.yml @@ -1,26 +1,32 @@ name: Windows Powershell Logoff User via Quser id: 6d70780d-4cfe-4820-bafd-1b43941986b5 -version: 8 +version: 9 creation_date: '2024-12-13' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: "The following analytic detects the process of logging off a user through the use of the quser and logoff commands. By monitoring for these commands, the analytic identifies actions where a user session is forcibly terminated, which could be part of an administrative task or a potentially unauthorized access attempt. This detection helps identify potential misuse or malicious activity where a user’s access is revoked without proper authorization, providing insight into potential security incidents involving account management or session manipulation." +description: |- + The following analytic detects the process of logging off a user through the use of the quser and logoff commands. + By monitoring for these commands, the analytic identifies actions where a user session is forcibly terminated, which could be part of an administrative task or a potentially unauthorized access attempt. + This detection helps identify potential misuse or malicious activity where a user's access is revoked without proper authorization, providing insight into potential security incidents involving account management or session manipulation. data_source: - Powershell Script Block Logging 4104 search: |- - `powershell` EventCode=4104 ScriptBlockText = "*quser*logoff*" - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY dest signature signature_id - user_id vendor_product EventID - Guid Opcode Name - Path ProcessID ScriptBlockId - ScriptBlockText - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_powershell_logoff_user_via_quser_filter` + `powershell` + EventCode=4104 + ScriptBlockText = "*quser*logoff*" + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest signature signature_id + user_id vendor_product EventID + Guid Opcode Name + Path ProcessID ScriptBlockId + ScriptBlockText + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_powershell_logoff_user_via_quser_filter` how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. known_false_positives: Administrators or power users may use this command. references: @@ -39,7 +45,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: Powershell process having commandline [$ScriptBlockText$] used to logoff user on [$dest$]. + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing quser and logoff commands to potentially logoff user was executed on host $dest$ + - field: user_id + type: user + score: 20 + message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] containing quser and logoff commands to potentially logoff user was executed on host $dest$ by user $user_id$ analytic_story: - Crypto Stealer asset_type: Endpoint From 6ef92e519fcfbfdb87af9a1b7110d9b65107b1e5 Mon Sep 17 00:00:00 2001 From: Br3akp0int <26181693+tccontre@users.noreply.github.com> Date: Wed, 1 Jul 2026 12:21:16 +0200 Subject: [PATCH 010/162] Add New Analytics Related to Phantom Stealer (#4137) --------- Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com> --- ..._or_script_creation_in_suspicious_path.yml | 5 +- ...tables_or_script_creation_in_temp_path.yml | 5 +- .../endpoint/headless_browser_usage.yml | 5 +- ...e_process_accessing_chrome_default_dir.yml | 5 +- ...fox_process_access_firefox_profile_dir.yml | 5 +- .../endpoint/powershell_4104_hunting.yml | 5 +- ...script_contains_base64_encoded_content.yml | 5 +- ...ll_pinvoke_process_injection_api_chain.yml | 5 +- .../registry_keys_used_for_persistence.yml | 5 +- ..._autostart_execution_in_startup_folder.yml | 5 +- ...er_process_launched_with_unusual_flags.yml | 7 +- ...um_browser_no_security_sandbox_process.yml | 7 +- ...rowser_with_custom_user_data_directory.yml | 5 +- ...ial_access_from_browser_password_store.yml | 5 +- ...sword_stores_chrome_copied_in_temp_dir.yml | 5 +- ...assword_stores_chrome_extension_access.yml | 41 +++++++++-- ...ssword_stores_chrome_localstate_access.yml | 43 +++++++++-- ...ssword_stores_chrome_login_data_access.yml | 43 +++++++++-- ...s_disable_or_modify_tools_via_taskkill.yml | 5 +- ...indows_disable_or_stop_browser_process.yml | 5 +- ...er_protocol_in_non_common_process_path.yml | 5 +- ...non_discord_app_access_discord_leveldb.yml | 5 +- ...dows_powershell_cryptography_namespace.yml | 5 +- ...indows_process_injection_remote_thread.yml | 5 +- ...cess_injection_with_public_source_path.yml | 5 +- .../windows_suspicious_process_file_path.yml | 5 +- ...em_network_connections_discovery_netsh.yml | 35 +++++---- ...outlook_credentials_access_in_registry.yml | 5 +- ...ws_unusual_filezilla_xml_config_access.yml | 5 +- ...rocess_load_mozilla_nss_mozglue_module.yml | 5 +- ...s_winscp_configuration_security_access.yml | 71 +++++++++++++++++++ ...picious_process_with_discord_dns_query.yml | 5 +- ..._dns_query_request_by_telegram_bot_api.yml | 5 +- lookups/csv/browser_app_list.csv | 69 +++++++++++++++++- lookups/csv/browser_app_list.yml | 4 +- stories/phantom_stealer.yml | 44 ++++++++++++ 36 files changed, 403 insertions(+), 91 deletions(-) create mode 100644 detections/endpoint/windows_winscp_configuration_security_access.yml create mode 100644 stories/phantom_stealer.yml diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 3e652f2994f..c14be99c02d 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,8 +1,8 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 -version: 28 +version: 29 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -138,6 +138,7 @@ analytic_story: - Void Manticore - Axios Supply Chain Post Compromise - VIP Keylogger + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml index 598c7fa87ea..6f4f9aa1ce0 100644 --- a/detections/endpoint/executables_or_script_creation_in_temp_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml @@ -1,8 +1,8 @@ name: Executables Or Script Creation In Temp Path id: e0422b71-2c05-4f32-8754-01fb415f49c9 -version: 25 +version: 26 creation_date: '2021-05-07' -modification_date: '2026-06-11' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -132,6 +132,7 @@ analytic_story: - VIP Keylogger - RoguePlanet - Salat Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/headless_browser_usage.yml b/detections/endpoint/headless_browser_usage.yml index 0bdd9aadf55..d0bf2168625 100644 --- a/detections/endpoint/headless_browser_usage.yml +++ b/detections/endpoint/headless_browser_usage.yml @@ -1,8 +1,8 @@ name: Headless Browser Usage id: 869ba261-c272-47d7-affe-5c0aa85c93d6 -version: 10 +version: 11 creation_date: '2023-09-11' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Michael Haag, Teoderick Contreras, Splunk status: production type: Anomaly @@ -48,6 +48,7 @@ threat_objects: analytic_story: - Browser Hijacking - Forest Blizzard + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1497 diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 6502ac2a3d1..9eed7ce0f7c 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -1,8 +1,8 @@ name: Non Chrome Process Accessing Chrome Default Dir id: 81263de4-160a-11ec-944f-acde48001122 -version: 19 +version: 20 creation_date: '2021-09-15' -modification_date: '2026-06-08' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -50,6 +50,7 @@ analytic_story: - BlankGrabber Stealer - VIP Keylogger - Salat Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1555.003 diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index eb994db77b0..bdd370d7efa 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -1,8 +1,8 @@ name: Non Firefox Process Access Firefox Profile Dir id: e6fc13b0-1609-11ec-b533-acde48001122 -version: 19 +version: 20 creation_date: '2021-09-15' -modification_date: '2026-06-08' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -52,6 +52,7 @@ analytic_story: - BlankGrabber Stealer - VIP Keylogger - Salat Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1555.003 diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 657df258aae..8428f645ad6 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,8 +1,8 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 -version: 26 +version: 27 creation_date: '2021-08-19' -modification_date: '2026-06-08' +modification_date: '2026-06-25' author: Michael Haag, Splunk status: production type: Hunting @@ -85,6 +85,7 @@ analytic_story: - MuddyWater - Axios Supply Chain Post Compromise - Salat Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index 5ce2244b6c7..9343d1a1b2d 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -1,8 +1,8 @@ name: Powershell Fileless Script Contains Base64 Encoded Content id: 8acbc04c-c882-11eb-b060-acde48001122 -version: 21 +version: 22 creation_date: '2021-06-09' -modification_date: '2026-06-08' +modification_date: '2026-06-25' author: Michael Haag, Splunk status: production type: TTP @@ -53,6 +53,7 @@ analytic_story: - Axios Supply Chain Post Compromise - VIP Keylogger - Salat Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1027 diff --git a/detections/endpoint/powershell_pinvoke_process_injection_api_chain.yml b/detections/endpoint/powershell_pinvoke_process_injection_api_chain.yml index be300e31181..5474df66a47 100644 --- a/detections/endpoint/powershell_pinvoke_process_injection_api_chain.yml +++ b/detections/endpoint/powershell_pinvoke_process_injection_api_chain.yml @@ -1,8 +1,8 @@ name: PowerShell PInvoke Process Injection API Chain id: 3f1a2b4c-d5e6-7890-abcd-ef1234567890 -version: 2 +version: 3 creation_date: '2026-04-29' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: TTP @@ -103,6 +103,7 @@ intermediate_findings: message: A PowerShell script Script block ID [$ScriptBlockId$] contains a possible P-Invoke process injection API chain via either inline Add-Type class declaration or direct static method invocation on [$dest$] analytic_story: - VIP Keylogger + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1055.001 diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 4a8943311b6..af50fd3916a 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,8 +1,8 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -version: 33 +version: 34 creation_date: '2020-04-29' -modification_date: '2026-06-08' +modification_date: '2026-06-25' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk status: production type: TTP @@ -82,6 +82,7 @@ analytic_story: - Gh0st RAT - Axios Supply Chain Post Compromise - Salat Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1547.001 diff --git a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml index 91dcfb02189..6b3f2e9d5f5 100644 --- a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml +++ b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml @@ -1,8 +1,8 @@ name: Windows Boot or Logon Autostart Execution In Startup Folder id: 99d157cb-923f-4a00-aee9-1f385412146f -version: 15 +version: 16 creation_date: '2023-01-16' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -49,6 +49,7 @@ analytic_story: - APT37 Rustonotto and FadeStealer - PromptFlux - BlankGrabber Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1547.001 diff --git a/detections/endpoint/windows_browser_process_launched_with_unusual_flags.yml b/detections/endpoint/windows_browser_process_launched_with_unusual_flags.yml index dbb903e2770..d57c7b27116 100644 --- a/detections/endpoint/windows_browser_process_launched_with_unusual_flags.yml +++ b/detections/endpoint/windows_browser_process_launched_with_unusual_flags.yml @@ -1,15 +1,15 @@ name: Windows Browser Process Launched with Unusual Flags id: 841e2abc-0442-4e7f-b445-b22680632a08 -version: 4 +version: 5 creation_date: '2023-09-19' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects the use of unusual browser flags, specifically --mute-audio and --do-not-elevate, which deviate from standard browser launch behavior. These flags may indicate automated scripts, testing environments, or attempts to modify browser functionality for silent operation or restricted privilege execution. Detection focuses on non-standard launch parameters, unexpected process behavior, or deviations from baseline configurations. Monitoring such flag usage helps identify potentially suspicious activity, misconfigurations, or policy violations, enabling security teams to investigate anomalies, ensure system compliance, and differentiate legitimate administrative or testing uses from unusual or unauthorized operations. data_source: - Sysmon EventID 1 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where NOT (Processes.parent_process_name IN ("chrome.exe", "msedge.exe", "brave.exe", "firefox.exe", "explorer.exe")) AND NOT (Processes.parent_process_path IN("C:\\Program Files*", "C:\\Windows\\System32\\*", "C:\\Windows\\SysWow64\\*",)) AND Processes.process_name IN ("chrome.exe", "msedge.exe", "brave.exe", "firefox.exe") AND Processes.process IN ("*--mute-audio*","*--no-de-elevate*", "*--do-not-de-elevate*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_browser_process_launched_with_unusual_flags_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where NOT (Processes.parent_process_name IN ("chrome.exe", "msedge.exe", "brave.exe", "firefox.exe", "explorer.exe")) AND NOT (Processes.parent_process_path IN("C:\\Program Files*", "C:\\Windows\\System32\\*", "C:\\Windows\\SysWow64\\*",)) AND Processes.process_name IN ("chrome.exe", "msedge.exe", "brave.exe", "firefox.exe") AND Processes.process IN ("*--mute-audio*","*--no-de-elevate*", "*--do-not-de-elevate*", "*--disable-audio*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_browser_process_launched_with_unusual_flags_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: It is possible false positives will be present based on third party applications. Filtering may be needed. references: @@ -35,6 +35,7 @@ threat_objects: type: parent_process_name analytic_story: - Castle RAT + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1185 diff --git a/detections/endpoint/windows_chromium_browser_no_security_sandbox_process.yml b/detections/endpoint/windows_chromium_browser_no_security_sandbox_process.yml index 3cf5834c13f..b7bb1200ce3 100644 --- a/detections/endpoint/windows_chromium_browser_no_security_sandbox_process.yml +++ b/detections/endpoint/windows_chromium_browser_no_security_sandbox_process.yml @@ -1,8 +1,8 @@ name: Windows Chromium Browser No Security Sandbox Process id: 314cb263-7eeb-4d45-b693-bb21699c73d2 -version: 5 +version: 6 creation_date: '2025-05-28' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: TTP @@ -16,7 +16,7 @@ search: | | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("Chrome.exe","Brave.exe", "Opera.exe", "Vivaldi.exe", "msedge.exe") - Processes.process = "*--no-sandbox*" + Processes.process IN ("*--no-sandbox*", "*--allow-no-sandbox-job*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec @@ -55,6 +55,7 @@ threat_objects: type: parent_process_name analytic_story: - Malicious Inno Setup Loader + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1497 diff --git a/detections/endpoint/windows_chromium_browser_with_custom_user_data_directory.yml b/detections/endpoint/windows_chromium_browser_with_custom_user_data_directory.yml index 6e9f3b144bb..6438deca8fe 100644 --- a/detections/endpoint/windows_chromium_browser_with_custom_user_data_directory.yml +++ b/detections/endpoint/windows_chromium_browser_with_custom_user_data_directory.yml @@ -1,8 +1,8 @@ name: Windows Chromium Browser with Custom User Data Directory id: 4f546cf4-15aa-4368-80f7-940e92bc551e -version: 7 +version: 8 creation_date: '2025-05-28' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -58,6 +58,7 @@ analytic_story: - StealC Stealer - Malicious Inno Setup Loader - Lokibot + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1497 diff --git a/detections/endpoint/windows_credential_access_from_browser_password_store.yml b/detections/endpoint/windows_credential_access_from_browser_password_store.yml index b1cd70305e2..53e4dea2ce8 100644 --- a/detections/endpoint/windows_credential_access_from_browser_password_store.yml +++ b/detections/endpoint/windows_credential_access_from_browser_password_store.yml @@ -1,8 +1,8 @@ name: Windows Credential Access From Browser Password Store id: 72013a8e-5cea-408a-9d51-5585386b4d69 -version: 22 +version: 23 creation_date: '2024-03-20' -modification_date: '2026-06-08' +modification_date: '2026-06-25' author: Teoderick Contreras, Bhavin Patel Splunk status: production type: Anomaly @@ -49,6 +49,7 @@ analytic_story: - BlankGrabber Stealer - VIP Keylogger - Salat Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml index 5c6230b8e62..f6e37777948 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml @@ -1,8 +1,8 @@ name: Windows Credentials from Password Stores Chrome Copied in TEMP Dir id: 4d14c86d-fdee-4393-94da-238d2706902f -version: 10 +version: 11 creation_date: '2024-10-18' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: TTP @@ -34,6 +34,7 @@ analytic_story: - Braodo Stealer - Scattered Lapsus$ Hunters - BlankGrabber Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1555.003 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml index cfcf82f98e7..e4f8a81b82a 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml @@ -1,17 +1,45 @@ name: Windows Credentials from Password Stores Chrome Extension Access id: 2e65afe0-9a75-4487-bd87-ada9a9f1b9af -version: 12 +version: 13 creation_date: '2023-05-02' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects non-Chrome processes attempting to access the Chrome extensions file. It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior. This activity is significant because adversaries may exploit this file to extract sensitive information from the Chrome browser, posing a security risk. If confirmed malicious, this could lead to unauthorized access to stored credentials and other sensitive data, potentially compromising the security of the affected system and broader network. +description: |- + The following analytic detects non-Chrome processes attempting to access the Chrome extensions file. + It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior. + This activity is significant because adversaries may exploit this file to extract sensitive information from the Chrome browser, posing a security risk. + If confirmed malicious, this could lead to unauthorized access to stored credentials and other sensitive data, potentially compromising the security of the affected system and broader network. data_source: - Windows Event Log Security 4663 -search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*" AND NOT (process_path IN ("*:\\Windows\\explorer.exe", "*\\chrome.exe")) | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_password_stores_chrome_extension_access_filter`' -how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." -known_false_positives: Uninstall chrome browser extension application may access this file and folder path to removed chrome installation in the target host. Filter is needed. +search: | + `wineventlog_security` + EventCode=4663 + object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*" + NOT process_path IN ( + "*:\\Windows\\explorer.exe", + "*\\AppData\\Local\\Google\\Chrome Beta\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome Dev\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome SxS\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome Unstable\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe" + ) + | stats count min(_time) as firstTime + max(_time) as lastTime + + by object_file_name object_file_path + process_name process_path + process_id EventCode dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_credentials_from_password_stores_chrome_extension_access_filter` +how_to_implement: |- + To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. + For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: |- + The chrome uninstaller will access these set of files and folders. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer drilldown_searches: @@ -42,6 +70,7 @@ analytic_story: - MoonPeak - 0bj3ctivity Stealer - BlankGrabber Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml index b0b967890f6..20b4759d219 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -1,17 +1,47 @@ name: Windows Credentials from Password Stores Chrome LocalState Access id: 3b1d09a8-a26f-473e-a510-6c6613573657 -version: 22 +version: 23 creation_date: '2023-05-02' -modification_date: '2026-06-08' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects non-Chrome processes accessing the Chrome "Local State" file, which contains critical settings and information. It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior. This activity is significant because threat actors can exploit this file to extract the encrypted master key used for decrypting saved passwords in Chrome. If confirmed malicious, this could lead to unauthorized access to sensitive information, posing a severe security risk. Monitoring this anomaly helps identify potential threats and safeguard browser-stored data. +description: |- + The following analytic detects non-Chrome processes accessing the Chrome "Local State" file, which contains critical settings and information. It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior. + This activity is significant because threat actors can exploit this file to extract the encrypted master key used for decrypting saved passwords in Chrome. + If confirmed malicious, this could lead to unauthorized access to sensitive information, posing a severe security risk. + Monitoring this anomaly helps identify potential threats and safeguard browser-stored data. data_source: - Windows Event Log Security 4663 -search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" NOT (process_name IN ("*\\chrome.exe","*:\\Windows\\explorer.exe")) | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_password_stores_chrome_localstate_access_filter`' -how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." -known_false_positives: Uninstall chrome application may access this file and folder path to removed chrome installation in target host. Filter is needed. +search: | + `wineventlog_security` + EventCode=4663 + object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" + NOT process_path IN ( + "*:\\Windows\\explorer.exe", + "*\\AppData\\Local\\Google\\Chrome Beta\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome Dev\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome SxS\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome Unstable\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe", + "*\\platform_experience_helper.exe*", + "*:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe*" + ) + | stats count min(_time) as firstTime + max(_time) as lastTime + + by object_file_name object_file_path + process_name process_path + process_id EventCode dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_credentials_from_password_stores_chrome_localstate_access_filter` +how_to_implement: |- + To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. + For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: |- + The chrome uninstaller will access these set of files and folders. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer drilldown_searches: @@ -54,6 +84,7 @@ analytic_story: - BlankGrabber Stealer - VIP Keylogger - Salat Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index 45f9303784d..44a44a24324 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -1,17 +1,47 @@ name: Windows Credentials from Password Stores Chrome Login Data Access id: 0d32ba37-80fc-4429-809c-0ba15801aeaf -version: 22 +version: 23 creation_date: '2023-05-02' -modification_date: '2026-06-08' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic identifies non-Chrome processes accessing the Chrome user data file "login data." This file is an SQLite database containing sensitive information, including saved passwords. The detection leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts. This activity is significant as it may indicate attempts by threat actors to extract and decrypt stored passwords, posing a risk to user credentials. If confirmed malicious, attackers could gain unauthorized access to sensitive accounts and escalate their privileges within the environment. +description: |- + The following analytic identifies non-Chrome processes accessing the Chrome user data file "login data." + This file is an SQLite database containing sensitive information, including saved passwords. + The detection leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts. + This activity is significant as it may indicate attempts by threat actors to extract and decrypt stored passwords, posing a risk to user credentials. + If confirmed malicious, attackers could gain unauthorized access to sensitive accounts and escalate their privileges within the environment. data_source: - Windows Event Log Security 4663 -search: '`wineventlog_security` EventCode=4663 object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" AND NOT (process_path IN ("*:\\Windows\\explorer.exe", "*:\\Windows\\System32\\dllhost.exe", "*\\chrome.exe")) | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credentials_from_password_stores_chrome_login_data_access_filter`' -how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." -known_false_positives: Uninstall application may access this registry to remove the entry of the target application. filter is needed. +search: | + `wineventlog_security` + EventCode=4663 + object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" + NOT process_path IN ( + "*:\\Windows\\explorer.exe", + "*:\\Windows\\System32\\dllhost.exe", + "*\\AppData\\Local\\Google\\Chrome Beta\\Application\\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome Dev\\Application\\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome SxS\\Application\\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome Unstable\\Application\\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome\\Application\\\chrome.exe" + ) + | stats count min(_time) as firstTime + max(_time) as lastTime + + by object_file_name object_file_path + process_name process_path + process_id EventCode dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_credentials_from_password_stores_chrome_login_data_access_filter` +how_to_implement: |- + To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. + For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: |- + The chrome uninstaller will access these set of files and folders. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer drilldown_searches: @@ -54,6 +84,7 @@ analytic_story: - BlankGrabber Stealer - VIP Keylogger - Salat Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml index c338ebff7eb..b204fb00181 100644 --- a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -1,8 +1,8 @@ name: Windows Disable or Modify Tools Via Taskkill id: a43ae66f-c410-4b3d-8741-9ce1ad17ddb0 -version: 14 +version: 15 creation_date: '2023-09-19' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -52,6 +52,7 @@ analytic_story: - NjRAT - Crypto Stealer - BlankGrabber Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1685 diff --git a/detections/endpoint/windows_disable_or_stop_browser_process.yml b/detections/endpoint/windows_disable_or_stop_browser_process.yml index e0fc266cb0b..51490b89246 100644 --- a/detections/endpoint/windows_disable_or_stop_browser_process.yml +++ b/detections/endpoint/windows_disable_or_stop_browser_process.yml @@ -1,8 +1,8 @@ name: Windows Disable or Stop Browser Process id: 220d34b7-b6c7-45fe-8dbb-c35cdd9fe6d5 -version: 13 +version: 14 creation_date: '2024-10-18' -modification_date: '2026-06-08' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: TTP @@ -56,6 +56,7 @@ analytic_story: - Castle RAT - BlankGrabber Stealer - Salat Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1685 diff --git a/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml b/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml index a88686036f5..7ab7b05ab6b 100644 --- a/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml +++ b/detections/endpoint/windows_file_transfer_protocol_in_non_common_process_path.yml @@ -1,8 +1,8 @@ name: Windows File Transfer Protocol In Non-Common Process Path id: 0f43758f-1fe9-470a-a9e4-780acc4d5407 -version: 11 +version: 12 creation_date: '2022-09-21' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -55,6 +55,7 @@ analytic_story: - AgentTesla - Snake Keylogger - Hellcat Ransomware + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1071.003 diff --git a/detections/endpoint/windows_non_discord_app_access_discord_leveldb.yml b/detections/endpoint/windows_non_discord_app_access_discord_leveldb.yml index 7fd2a335648..929fe80e689 100644 --- a/detections/endpoint/windows_non_discord_app_access_discord_leveldb.yml +++ b/detections/endpoint/windows_non_discord_app_access_discord_leveldb.yml @@ -1,8 +1,8 @@ name: Windows Non Discord App Access Discord LevelDB id: 1166360c-d495-45ac-87a6-8948aac1fa07 -version: 10 +version: 11 creation_date: '2024-02-22' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -34,6 +34,7 @@ analytic_story: - Snake Keylogger - PXA Stealer - BlankGrabber Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_powershell_cryptography_namespace.yml b/detections/endpoint/windows_powershell_cryptography_namespace.yml index 7b76dd6ac0b..e517ba8e775 100644 --- a/detections/endpoint/windows_powershell_cryptography_namespace.yml +++ b/detections/endpoint/windows_powershell_cryptography_namespace.yml @@ -1,8 +1,8 @@ name: Windows Powershell Cryptography Namespace id: f8b482f4-6d62-49fa-a905-dfa15698317b -version: 15 +version: 16 creation_date: '2023-01-26' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -48,6 +48,7 @@ analytic_story: - AsyncRAT - XWorm - VIP Keylogger + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/windows_process_injection_remote_thread.yml b/detections/endpoint/windows_process_injection_remote_thread.yml index 3b1356bf0e9..1037ac30625 100644 --- a/detections/endpoint/windows_process_injection_remote_thread.yml +++ b/detections/endpoint/windows_process_injection_remote_thread.yml @@ -1,8 +1,8 @@ name: Windows Process Injection Remote Thread id: 8a618ade-ca8f-4d04-b972-2d526ba59924 -version: 13 +version: 14 creation_date: '2022-10-28' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: TTP @@ -73,6 +73,7 @@ analytic_story: - Warzone RAT - Earth Alux - Water Gamayun + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1055.002 diff --git a/detections/endpoint/windows_process_injection_with_public_source_path.yml b/detections/endpoint/windows_process_injection_with_public_source_path.yml index 68c34c4da5e..d1d12e1b8ed 100644 --- a/detections/endpoint/windows_process_injection_with_public_source_path.yml +++ b/detections/endpoint/windows_process_injection_with_public_source_path.yml @@ -1,8 +1,8 @@ name: Windows Process Injection With Public Source Path id: 492f09cf-5d60-4d87-99dd-0bc325532dda -version: 10 +version: 11 creation_date: '2022-09-05' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -17,6 +17,7 @@ references: analytic_story: - Brute Ratel C4 - Earth Alux + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1055.002 diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index 410963926ed..76832167a1b 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,8 +1,8 @@ name: Windows Suspicious Process File Path id: ecddae4e-3d4b-41e2-b3df-e46a88b38521 -version: 25 +version: 26 creation_date: '2021-05-07' -modification_date: '2026-06-11' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: TTP @@ -95,6 +95,7 @@ analytic_story: - Axios Supply Chain Post Compromise - VIP Keylogger - RoguePlanet + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1543 diff --git a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml index 172faeee33f..ea161433fb1 100644 --- a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml +++ b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml @@ -1,8 +1,8 @@ name: Windows System Network Connections Discovery Netsh id: abfb7cc5-c275-4a97-9029-62cd8d4ffeca -version: 11 +version: 12 creation_date: '2022-12-06' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -12,21 +12,31 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE `process_netsh`AND Processes.process = "* show *" Processes.process IN ("*state*", "*config*", "*wlan*", "*profile*") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + `process_netsh` + Processes.process="* show *" + Processes.process IN ("*state*", "*config*", "*wlan*", "*profile*") + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_network_connections_discovery_netsh_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: network administrator can use this tool for auditing process. +known_false_positives: |- + Network administrators, power users, and third party tools can and will use this utility for various purposes. Apply the necessary filters by user, parent process, and command line. references: - https://attack.mitre.org/techniques/T1049/ - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS @@ -52,6 +62,7 @@ analytic_story: - Snake Keylogger - BlankGrabber Stealer - VIP Keylogger + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1049 diff --git a/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml b/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml index 8fea2f947b9..ccdf81a36d6 100644 --- a/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml +++ b/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml @@ -1,8 +1,8 @@ name: Windows Unsecured Outlook Credentials Access In Registry id: 36334123-077d-47a2-b70c-6c7b3cc85049 -version: 13 +version: 14 creation_date: '2024-02-22' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -37,6 +37,7 @@ analytic_story: - 0bj3ctivity Stealer - Lokibot - VIP Keylogger + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1552 diff --git a/detections/endpoint/windows_unusual_filezilla_xml_config_access.yml b/detections/endpoint/windows_unusual_filezilla_xml_config_access.yml index 6127a76db56..66f662ff8df 100644 --- a/detections/endpoint/windows_unusual_filezilla_xml_config_access.yml +++ b/detections/endpoint/windows_unusual_filezilla_xml_config_access.yml @@ -1,8 +1,8 @@ name: Windows Unusual FileZilla XML Config Access id: 47dc0426-cbe4-4253-8b86-1a983c3f9951 -version: 4 +version: 5 creation_date: '2025-07-16' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -34,6 +34,7 @@ threat_objects: type: process_name analytic_story: - Quasar RAT + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1552.001 diff --git a/detections/endpoint/windows_unusual_process_load_mozilla_nss_mozglue_module.yml b/detections/endpoint/windows_unusual_process_load_mozilla_nss_mozglue_module.yml index 298474eb303..dc687b606fd 100644 --- a/detections/endpoint/windows_unusual_process_load_mozilla_nss_mozglue_module.yml +++ b/detections/endpoint/windows_unusual_process_load_mozilla_nss_mozglue_module.yml @@ -1,8 +1,8 @@ name: Windows Unusual Process Load Mozilla NSS-Mozglue Module id: 1a7e7650-b81d-492e-99d4-d5ab633afbdd -version: 8 +version: 9 creation_date: '2021-05-13' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -38,6 +38,7 @@ analytic_story: - 0bj3ctivity Stealer - Lokibot - VIP Keylogger + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1218.003 diff --git a/detections/endpoint/windows_winscp_configuration_security_access.yml b/detections/endpoint/windows_winscp_configuration_security_access.yml new file mode 100644 index 00000000000..14e78754bc2 --- /dev/null +++ b/detections/endpoint/windows_winscp_configuration_security_access.yml @@ -0,0 +1,71 @@ +name: Windows WinSCP Configuration Security Access +id: 90013cc4-585b-4437-a95f-099933974f3e +version: 1 +creation_date: '2026-06-24' +modification_date: '2026-06-24' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: |- + This analytic detects unauthorized access to the WinSCP security configuration folder by processes other than WinSCP itself. + WinSCP stores sensitive SSH and FTP session credentials, including passwords and private key references, under the user profile path Martin Prikryl\WinSCP 2\Configuration\Security. Information-stealing malware such as Phantom Stealer targets this directory to harvest stored credentials for exfiltration. + The detection uses Windows Security Event 4663 (Object Access) to identify any non-WinSCP process reading or accessing files within this path, which is abnormal during routine system operation. + Analysts should investigate the accessing process, its parent, and any associated network activity to determine whether a credential theft attempt is underway. +data_source: + - Windows Event Log Security 4663 +search: |- + `wineventlog_security` + EventCode=4663 + object_file_path="*\\Martin Prikryl\\WinSCP 2\\Configuration\\Security*" + NOT process_name IN ("winscp.exe") + + | stats count min(_time) as firstTime + max(_time) as lastTime + by object_file_name object_file_path + process_name process_path process_id + EventCode dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_winscp_configuration_security_access_filter` +how_to_implement: |- + To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. + For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." +known_false_positives: |- + False positive may occur during backup or anti-virus scanning process. Filter as needed. +references: + - https://malpedia.caad.fkie.fraunhofer.de/details/win.phantom_stealer + - https://www.proofpoint.com/us/blog/threat-insight/not-safe-work-tracking-and-investigating-stealerium-and-phantom-infostealers +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: a non winscp process [$process_name$] accessed the winscp configuration file [$object_file_path$] on $dest$. +analytic_story: + - Phantom Stealer +asset_type: Endpoint +mitre_attack_id: + - T1552.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.001/winscp_access/winscp_phnatom.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/network/suspicious_process_with_discord_dns_query.yml b/detections/network/suspicious_process_with_discord_dns_query.yml index 83ea7943f43..152991165b0 100644 --- a/detections/network/suspicious_process_with_discord_dns_query.yml +++ b/detections/network/suspicious_process_with_discord_dns_query.yml @@ -1,8 +1,8 @@ name: Suspicious Process With Discord DNS Query id: 4d4332ae-792c-11ec-89c1-acde48001122 -version: 13 +version: 14 creation_date: '2022-01-19' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: Anomaly @@ -40,6 +40,7 @@ analytic_story: - PXA Stealer - Cactus Ransomware - BlankGrabber Stealer + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1059.005 diff --git a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml index 98fe67a14a4..e4a251deab5 100644 --- a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml +++ b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml @@ -1,8 +1,8 @@ name: Windows DNS Query Request by Telegram Bot API id: 86f66f44-94d9-412d-a71d-5d8ed0fef72e -version: 10 +version: 11 creation_date: '2021-08-03' -modification_date: '2026-05-13' +modification_date: '2026-06-25' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -45,6 +45,7 @@ analytic_story: - 0bj3ctivity Stealer - BlankGrabber Stealer - VIP Keylogger + - Phantom Stealer asset_type: Endpoint mitre_attack_id: - T1071.004 diff --git a/lookups/csv/browser_app_list.csv b/lookups/csv/browser_app_list.csv index 55a263c2bd4..b41d6f2ef14 100644 --- a/lookups/csv/browser_app_list.csv +++ b/lookups/csv/browser_app_list.csv @@ -49,4 +49,71 @@ browser_process_name,browser_object_path,isAllowed "*opera.exe","*Opera Software\Opera GX Stable\Login Data*", true "*opera.exe","*Opera Software\Opera GX Stable\Local State*", true "*yandex.exe","*Yandex\YandexBrowser\User Data\Default\Ya Passman Data*", true -"*yandex.exe","*Yandex\YandexBrowser\User Data\Local State*", true \ No newline at end of file +"*yandex.exe","*Yandex\YandexBrowser\User Data\Local State*", true +"*Chrome.exe","*Google\Chrome Beta\User Data\Default\Login Data*", true +"*Chrome.exe","*Google\Chrome Dev\User Data\Default\Login Data*", true +"*Chrome.exe","*Google\Chrome Unstable\User Data\Default\Login Data*", true +"*Chrome.exe","*Google\Chrome Canary\User Data\Default\Login Data*", true +"*Chrome.exe","*Google(x86)\Chrome\User Data\Default\Login Data*", true +"*Chrome.exe","*Google(x86)\Chrome Beta\User Data\Default\Login Data*", true +"*Chrome.exe","*Google(x86)\Chrome SxS\User Data\Default\Login Data*", true +"*Chrome.exe","*Google(x86)\Chrome Dev\User Data\Default\Login Data*", true +"*Chrome.exe","*Google(x86)\Chrome Unstable\User Data\Default\Login Data*", true +"*Chrome.exe","*Google(x86)\Chrome Canary\User Data\Default\Login Data*", true +"*atom.exe","*Mail.Ru\Atom\User Data\Default\Login Data*", true +"*Chromodo.exe","*Comodo\User Data\Default\Login Data*", true +"*360chrome.exe","*360ChromeX\Chrome\User Data\Default\Login Data*", true +"*360se.exe","*360se6\User Data\Default\Login Data*", true +"*360se.exe","*360se\User Data\Default\Login Data*", true +"*Maxthon.exe","*Maxthon3\User Data\Default\Login Data*", true +"*Maxthon.exe","*Maxthon\User Data\Default\Login Data*", true +"*Maxthon.exe","*Maxthon5\Users\*\Login Data*", true +"*k-meleon.exe","*K-Melon\User Data\Default\Login Data*", true +"*SLBrowser.exe","*Lenovo\SLBrowser\*\Login Data*", true +"*Go!.exe","*Go!\User Data\Default\Login Data*", true +"*Secure Browser.exe","*Safer Technologies\Secure Browser\User Data\Default\Login Data*", true +"*Chromodo.exe","*Chromodo\User Data\Default\Login Data*", true +"*yandex.exe","*Yandex\YandexBrowserCanary\User Data\Default\Ya Passman Data*", true +"*yandex.exe","*Yandex\YandexBrowserDeveloper\User Data\Default\Ya Passman Data*", true +"*yandex.exe","*Yandex\YandexBrowserBeta\User Data\Default\Ya Passman Data*", true +"*yandex.exe","*Yandex\YandexBrowserTech\User Data\Default\Ya Passman Data*", true +"*yandex.exe","*Yandex\YandexBrowserSxS\User Data\Default\Ya Passman Data*", true +"*opera.exe","*Opera Software\Opera Stable\Login Data*", true +"*opera.exe","*Opera Software\Opera Neon\User Data\Default\Login Data*", true +"*opera.exe","*Opera Software\Opera Crypto Developer\Login Data*", true +"*Elements Browser.exe","*Elements Browser\User Data\Default\Login Data*", true +"*Mustang.exe","*Rafotech\Mustang\User Data\Default\Login Data*", true +"*Suhba.exe","*Suhba\User Data\Default\Login Data*", true +"*TorBro.exe","*TorBro\Profile\*\Login Data*", true +"*RockMelt.exe","*RockMelt\User Data\Default\Login Data*", true +"*Bromium.exe","*Bromium\User Data\Default\Login Data*", true +"*Twinkstar.exe","*Twinkstar\User Data\Default\Login Data*", true +"*iTop Private Browser.exe","*iTop Private Browser\User Data\Default\Login Data*", true +"*CCleaner Browser.exe","*CCleaner Browser\User Data\Default\Login Data*", true +"*AcWebBrowser.exe","*AcWebBrowser\User Data\Default\Login Data*", true +"*CoolNovo.exe","*CoolNovo\User Data\Default\Login Data*", true +"*spark.exe","*Baidu Spark\User Data\Default\Login Data*", true +"*iron.exe","*SRWare Iron\User Data\Default\Login Data*", true +"*Titan Browser.exe","*Titan Browser\User Data\Default\Login Data*", true +"*AVG Browser.exe","*AVG\Browser\User Data\Default\Login Data*", true +"*UR Browser.exe","*UR Browser\User Data\Default\Login Data*", true +"*Flock.exe","*Flock\User Data\Default\Login Data*", true +"*CryptoTab Browser.exe","*CryptoTab Browser\User Data\Default\Login Data*", true +"*Sidekick.exe","*Sidekick\User Data\Default\Login Data*", true +"*SwingBrowser.exe","*SwingBrowser\User Data\Default\Login Data*", true +"*SalamWeb.exe","*SalamWeb\User Data\Default\Login Data*", true +"*NetboxBrowser.exe","*NetboxBrowser\User Data\Default\Login Data*", true +"*GarenaPlus.exe","*GarenaPlus\User Data\Default\Login Data*", true +"*InsomniacBrowser.exe","*InsomniacBrowser\User Data\Default\Login Data*", true +"*Viasat Browser.exe","*ViaSat\Viasat Browser\User Data\Default\Login Data*", true +"*whale.exe","*Naver\Naver Whale\User Data\Default\Login Data*", true +"*falkon.exe","*falkon\profiles\*\logins.json*", true +"*SogouExplorer.exe","*SogouExplorer\Webkit\*\Login Data*", true +"*LiebaoBrowser.exe","*liebao\User Data\Default\Login Data*", true +"*firefox.exe","*Mozilla\Firefox\Profiles\logins.json*", true +"*waterfox.exe","*Waterfox\Profiles\logins.json*", true +"*k-meleon.exe","*K-Meleon\Profiles\logins.json*", true +"*thunderbird.exe","*Thunderbird\Profiles\logins.json*", true +"*BlackHawk.exe","*NETGATE Technologies\BlackHawk\Profiles\logins.json*", true +"*basilisk.exe","*Moonchild Productions\Basilisk\Profiles\logins.json*", true +"*BitTubeBrowser.exe","*BitTube\BitTubeBrowser\Profiles\logins.json*", true \ No newline at end of file diff --git a/lookups/csv/browser_app_list.yml b/lookups/csv/browser_app_list.yml index 44187806c05..8f7f89af699 100644 --- a/lookups/csv/browser_app_list.yml +++ b/lookups/csv/browser_app_list.yml @@ -1,8 +1,8 @@ name: browser_app_list id: a80ccd19-e46f-4a12-9ad7-e653ad646347 -version: 4 +version: 6 creation_date: '2024-03-20' -modification_date: '2026-05-13' +modification_date: '2026-06-16' author: Splunk Threat Research Team lookup_type: csv description: A list of known browser application being targeted for credential extraction. diff --git a/stories/phantom_stealer.yml b/stories/phantom_stealer.yml new file mode 100644 index 00000000000..056531e7fa5 --- /dev/null +++ b/stories/phantom_stealer.yml @@ -0,0 +1,44 @@ +name: Phantom Stealer +id: 9647c6d9-3245-41b6-b519-894956279304 +version: 1 +creation_date: '2026-06-24' +modification_date: '2026-06-24' +author: Teoderick Contreras, Splunk +status: production +description: |- + Phantom Stealer is an information-stealing malware designed to covertly harvest sensitive data from compromised Windows endpoints. + + It primarily targets browser credential stores, saved passwords, cookies, autofill data, and session tokens from popular browsers such as Chrome, Edge, and Firefox. + + Beyond browsers, Phantom Stealer extends its reach to FTP and SSH clients, including WinSCP, FileZilla, and PuTTY, as well as email clients, cryptocurrency wallets, and VPN configurations. + + The malware commonly arrives via phishing emails, trojanized software, or malicious downloads. + + Once executed, it enumerates the victim system, collects targeted data, archives the harvested output, and exfiltrates it to attacker-controlled infrastructure over encrypted channels. Phantom Stealer leverages access to sensitive application configuration folders — including WinSCP security directories — to extract stored credentials outside of normal application access patterns. + + Detection focuses on unauthorized process access to credential storage paths, abnormal file reads from browser and FTP client profile directories, and suspicious data archiving or outbound connection behavior. +narrative: |- + In observed Phantom Stealer campaigns, the malware is typically delivered through phishing lures or cracked software bundles targeting Windows users. + + Upon initial execution from a user profile or temporary directory, the malware rapidly enumerates installed applications and begins accessing sensitive credential stores. + + Telemetry captured unauthorized reads of WinSCP security configuration folders by non-WinSCP processes, a strong behavioral indicator of credential harvesting targeting SSH and FTP sessions. + + The malware similarly accessed browser profile directories for Chrome and Edge, extracting Login Data, Cookies, and Web Data SQLite databases containing saved credentials and session tokens. + + Following collection, Phantom Stealer compressed the harvested data into an archive and transmitted it via HTTPS POST to its command-and-control server. + + In some cases, persistence was observed through registry run key modifications, ensuring the stealer re-executes after reboot. + + The breadth of targeted applications — spanning browsers, file transfer clients, and crypto wallets — makes Phantom Stealer a high-impact credential theft tool capable of enabling account takeover, financial fraud, and further intrusion into enterprise environments. +references: + - https://github.com/renniepak/PhantomStealer + - https://malpedia.caad.fkie.fraunhofer.de/details/win.phantom_stealer + - https://www.proofpoint.com/us/blog/threat-insight/not-safe-work-tracking-and-investigating-stealerium-and-phantom-infostealers +category: + - Malware +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +usecase: Advanced Threat Detection From 1e6583f0fccdc30b2fe62a362171fc34fb6e0fc1 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali <nbencher@cisco.com> Date: Mon, 6 Jul 2026 12:04:30 +0200 Subject: [PATCH 011/162] Remote Thread Analytics Update (#4145) --- data_sources/sysmon_eventid_8.yml | 27 ++- ...rundll32_createremotethread_in_browser.yml | 40 +++- ...s_injection_of_wermgr_to_known_browser.yml | 29 ++- ...cess_injection_with_public_source_path.yml | 8 +- ...ate_remote_thread_in_shell_application.yml | 37 +++- .../create_remote_thread_into_lsass.yml | 40 ++-- ...remote_thread_to_known_windows_process.yml | 49 ++++- ...ll32_create_remote_thread_to_a_process.yml | 26 ++- ...indows_process_injection_remote_thread.yml | 16 +- ...ote_thread_creation_in_browser_process.yml | 177 ++++++++++++++++++ 10 files changed, 381 insertions(+), 68 deletions(-) rename detections/{endpoint => deprecated}/rundll32_createremotethread_in_browser.yml (55%) rename detections/{endpoint => deprecated}/windows_process_injection_of_wermgr_to_known_browser.yml (72%) rename detections/{endpoint => deprecated}/windows_process_injection_with_public_source_path.yml (90%) create mode 100644 detections/endpoint/windows_uncommon_remote_thread_creation_in_browser_process.yml diff --git a/data_sources/sysmon_eventid_8.yml b/data_sources/sysmon_eventid_8.yml index a03b6240b27..ef49b5b310c 100644 --- a/data_sources/sysmon_eventid_8.yml +++ b/data_sources/sysmon_eventid_8.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 8 id: df7a786c-ade0-48f0-8596-26f10d169f7d -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Patrick Bareiss, Splunk description: Logs the creation of a new thread in a process, including details about the thread ID, start address, and source process. mitre_components: @@ -102,18 +102,17 @@ fields: - vendor_product output_fields: - dest - - parent_process_exec - - parent_process_guid - - parent_process_id - - parent_process_name - - parent_process_path - - process_exec - - process_guid - - process_id - - process_name - - process_path - - signature - signature_id - - user_id + - signature + - SourceProcessGuid + - SourceProcessId + - SourceImage + - TargetProcessGuid + - TargetProcessId + - TargetImage + - StartModule + - StartFunction + - SourceUser + - TargetUser - vendor_product example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>8</EventID><Version>2</Version><Level>4</Level><Task>8</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2022-10-27T13:59:12.440938600Z'/><EventRecordID>362233</EventRecordID><Correlation/><Execution ProcessID='2656' ThreadID='2360'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>win-dc-ctus-attack-range-487.attackrange.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2022-10-27 13:59:12.427</Data><Data Name='SourceProcessGuid'>{3381F800-8EB0-635A-1306-000000008A02}</Data><Data Name='SourceProcessId'>4864</Data><Data Name='SourceImage'>C:\Windows\SysWOW64\wermgr.exe</Data><Data Name='TargetProcessGuid'>{3381F800-8085-635A-2701-000000008A02}</Data><Data Name='TargetProcessId'>5572</Data><Data Name='TargetImage'>C:\Windows\System32\Taskmgr.exe</Data><Data Name='NewThreadId'>4964</Data><Data Name='StartAddress'>0x0000000000C20000</Data><Data Name='StartModule'>-</Data><Data Name='StartFunction'>-</Data></EventData></Event> diff --git a/detections/endpoint/rundll32_createremotethread_in_browser.yml b/detections/deprecated/rundll32_createremotethread_in_browser.yml similarity index 55% rename from detections/endpoint/rundll32_createremotethread_in_browser.yml rename to detections/deprecated/rundll32_createremotethread_in_browser.yml index af4033cb5de..538e8124ba8 100644 --- a/detections/endpoint/rundll32_createremotethread_in_browser.yml +++ b/detections/deprecated/rundll32_createremotethread_in_browser.yml @@ -1,15 +1,40 @@ name: Rundll32 CreateRemoteThread In Browser id: f8a22586-ee2d-11eb-a193-acde48001122 -version: 10 +version: 11 creation_date: '2021-07-29' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the suspicious creation of a remote thread by rundll32.exe targeting browser processes such as firefox.exe, chrome.exe, iexplore.exe, and microsoftedgecp.exe. This detection leverages Sysmon EventCode 8, focusing on SourceImage and TargetImage fields to identify the behavior. This activity is significant as it is commonly associated with malware like IcedID, which hooks browsers to steal sensitive information such as banking details. If confirmed malicious, this could allow attackers to intercept and exfiltrate sensitive user data, leading to potential financial loss and privacy breaches. +description: |- + The following analytic detects the suspicious creation of a remote thread by rundll32.exe targeting browser processes such as firefox.exe, chrome.exe, iexplore.exe, and microsoftedgecp.exe. + This detection leverages Sysmon EventCode 8, focusing on SourceImage and TargetImage fields to identify the behavior. + This activity is significant as it is commonly associated with malware like IcedID, which hooks browsers to steal sensitive information such as banking details. + If confirmed malicious, this could allow attackers to intercept and exfiltrate sensitive user data, leading to potential financial loss and privacy breaches. data_source: - Sysmon EventID 8 -search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage IN ("*\\firefox.exe", "*\\chrome.exe", "*\\iexplore.exe","*\\microsoftedgecp.exe") | stats count min(_time) as firstTime max(_time) as lastTime by EventID Guid NewThreadId ProcessID SecurityID SourceImage SourceProcessGuid SourceProcessId StartAddress StartFunction StartModule TargetImage TargetProcessGuid TargetProcessId UserID dest parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_createremotethread_in_browser_filter`' +search: |- + `sysmon` + EventCode=8 + SourceImage="*\\rundll32.exe" + TargetImage IN ( + "*\\chrome.exe", + "*\\firefox.exe", + "*\\iexplore.exe", + "*\\microsoftedgecp.exe" + ) + | stats count min(_time) as firstTime + max(_time) as lastTime + values(NewThreadId) as "NewThreadId" + values(StartAddress) as "StartAddress" + by dest signature_id signature + SourceProcessGuid SourceProcessId SourceImage + TargetProcessGuid TargetProcessId TargetImage + StartModule StartFunction + SourceUser TargetUser vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `rundll32_createremotethread_in_browser_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: No false positives have been identified at this time. references: @@ -51,3 +76,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection has been deprecated. The search is being replaced with a more generic detection that captures the behavior instead of relying on specific source processes. + removed_in_version: 6.4.0 + replacement_content: + - Windows Uncommon Remote Thread Creation In Browser Process diff --git a/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml b/detections/deprecated/windows_process_injection_of_wermgr_to_known_browser.yml similarity index 72% rename from detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml rename to detections/deprecated/windows_process_injection_of_wermgr_to_known_browser.yml index d54879dd1fc..31a51981642 100644 --- a/detections/endpoint/windows_process_injection_of_wermgr_to_known_browser.yml +++ b/detections/deprecated/windows_process_injection_of_wermgr_to_known_browser.yml @@ -1,15 +1,31 @@ name: Windows Process Injection Of Wermgr to Known Browser id: aec755a5-3a2c-4be0-ab34-6540e68644e9 -version: 11 +version: 12 creation_date: '2022-10-28' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP description: The following analytic identifies the suspicious remote thread execution of the wermgr.exe process into known browsers such as firefox.exe, chrome.exe, and others. It leverages Sysmon EventCode 8 logs to detect this behavior by monitoring SourceImage and TargetImage fields. This activity is significant because it is indicative of Qakbot malware, which injects malicious code into legitimate processes to steal information. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, and exfiltrate sensitive data from the compromised host. data_source: - Sysmon EventID 8 -search: '`sysmon` EventCode=8 SourceImage = "*\\wermgr.exe" TargetImage IN ("*\\firefox.exe", "*\\chrome.exe", "*\\iexplore.exe","*\\microsoftedgecp.exe") | stats count min(_time) as firstTime max(_time) as lastTime by EventID Guid NewThreadId ProcessID SecurityID SourceImage SourceProcessGuid SourceProcessId StartAddress StartFunction StartModule TargetImage TargetProcessGuid TargetProcessId UserID dest parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_of_wermgr_to_known_browser_filter`' +search: |- + `sysmon` + EventCode=8 + SourceImage="*\\wermgr.exe" + TargetImage IN ("*\\firefox.exe", "*\\chrome.exe", "*\\iexplore.exe","*\\microsoftedgecp.exe") + | stats count min(_time) as firstTime + max(_time) as lastTime + values(NewThreadId) as "NewThreadId" + values(StartAddress) as "StartAddress" + by dest signature_id signature + SourceProcessGuid SourceProcessId SourceImage + TargetProcessGuid TargetProcessId TargetImage + StartModule StartFunction + SourceUser TargetUser vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_process_injection_of_wermgr_to_known_browser_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: No false positives have been identified at this time. references: @@ -48,3 +64,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection has been deprecated. The search is being replaced with a more generic detection that captures the behavior instead of relying on specific source processes. + removed_in_version: 6.4.0 + replacement_content: + - Windows Uncommon Remote Thread Creation In Browser Process diff --git a/detections/endpoint/windows_process_injection_with_public_source_path.yml b/detections/deprecated/windows_process_injection_with_public_source_path.yml similarity index 90% rename from detections/endpoint/windows_process_injection_with_public_source_path.yml rename to detections/deprecated/windows_process_injection_with_public_source_path.yml index d1d12e1b8ed..83a6938abc7 100644 --- a/detections/endpoint/windows_process_injection_with_public_source_path.yml +++ b/detections/deprecated/windows_process_injection_with_public_source_path.yml @@ -2,9 +2,9 @@ name: Windows Process Injection With Public Source Path id: 492f09cf-5d60-4d87-99dd-0bc325532dda version: 11 creation_date: '2022-09-05' -modification_date: '2026-06-25' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects a process from a non-standard file path on Windows attempting to create a remote thread in another process. This is identified using Sysmon EventCode 8, focusing on processes not originating from typical system directories. This behavior is significant as it often indicates process injection, a technique used by adversaries to evade detection or escalate privileges. If confirmed malicious, this activity could allow an attacker to execute arbitrary code within another process, potentially leading to unauthorized actions and further compromise of the system. data_source: @@ -34,3 +34,7 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection has been deprecated. The search is not helpful for the user to implement nor use, as it will generate too many false positives. + removed_in_version: 6.4.0 + replacement_content: [] diff --git a/detections/endpoint/create_remote_thread_in_shell_application.yml b/detections/endpoint/create_remote_thread_in_shell_application.yml index 881d0b77c79..be5f1009d44 100644 --- a/detections/endpoint/create_remote_thread_in_shell_application.yml +++ b/detections/endpoint/create_remote_thread_in_shell_application.yml @@ -1,15 +1,38 @@ name: Create Remote Thread In Shell Application id: 10399c1e-f51e-11eb-b920-acde48001122 -version: 12 +version: 13 creation_date: '2021-08-05' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious process injection in command shell applications, specifically targeting `cmd.exe` and `powershell.exe`. It leverages Sysmon EventCode 8 to identify the creation of remote threads within these shell processes. This activity is significant because it is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to system security. +description: |- + The following analytic detects suspicious process injection in command shell applications, specifically targeting `cmd.exe` and `powershell.exe`. + It leverages Sysmon EventCode 8 to identify the creation of remote threads within these shell processes. + This activity is significant because it is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes. + If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to system security. data_source: - Sysmon EventID 8 -search: '`sysmon` EventCode=8 TargetImage IN ("*\\cmd.exe", "*\\powershell*", "*\\pwsh.exe") | stats count min(_time) as firstTime max(_time) as lastTime by EventID Guid NewThreadId ProcessID SecurityID SourceImage SourceProcessGuid SourceProcessId StartAddress StartFunction StartModule TargetImage TargetProcessGuid TargetProcessId UserID dest parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_remote_thread_in_shell_application_filter`' +search: |- + `sysmon` + EventCode=8 + TargetImage IN ( + "*\\cmd.exe", + "*\\powershell_ise.exe", + "*\\powershell.exe", + "*\\pwsh.exe" + ) + | stats count min(_time) as firstTime + max(_time) as lastTime + values(NewThreadId) as "NewThreadId" + values(StartAddress) as "StartAddress" + by dest signature_id signature + SourceProcessGuid SourceProcessId SourceImage + TargetProcessGuid TargetProcessId TargetImage + StartModule StartFunction vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `create_remote_thread_in_shell_application_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: No false positives have been identified at this time. references: @@ -24,13 +47,15 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: process $process_name$ create a remote thread to shell app process $TargetImage$ in host $dest$ + title: The process $SourceImage$ created a remote thread into the shell app process $TargetImage$ in host $dest$ entity: field: dest type: system score: 50 threat_objects: - - field: process_name + - field: SourceImage + type: process_name + - field: TargetImage type: process_name analytic_story: - IcedID diff --git a/detections/endpoint/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml index f0205e95c04..683a81b26d3 100644 --- a/detections/endpoint/create_remote_thread_into_lsass.yml +++ b/detections/endpoint/create_remote_thread_into_lsass.yml @@ -1,30 +1,34 @@ name: Create Remote Thread into LSASS id: 67d4dbef-9564-4699-8da8-03a151529edc -version: 14 +version: 15 creation_date: '2019-12-11' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Patrick Bareiss, Splunk status: production type: TTP -description: The following analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS). This behavior is identified using Sysmon EventID 8 logs, focusing on processes that create remote threads in lsass.exe. This activity is significant because it is commonly associated with credential dumping, a tactic used by adversaries to steal user authentication credentials. If confirmed malicious, this could allow attackers to gain unauthorized access to sensitive information, leading to potential compromise of the entire network. Analysts should investigate to differentiate between legitimate tools and potential threats. +description: |- + The following analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS). + This behavior is identified using Sysmon EventID 8 logs, focusing on processes that create remote threads in lsass.exe. + This activity is significant because it is commonly associated with credential dumping, a tactic used by adversaries to steal user authentication credentials. + If confirmed malicious, this could allow attackers to gain unauthorized access to sensitive information, leading to potential compromise of the entire network. + Analysts should investigate to differentiate between legitimate tools and potential threats. data_source: - Sysmon EventID 8 search: |- - `sysmon` EventID=8 TargetImage=*lsass.exe - | stats count min(_time) as firstTime max(_time) as lastTime - BY EventID Guid NewThreadId - ProcessID SecurityID SourceImage - SourceProcessGuid SourceProcessId StartAddress - StartFunction StartModule TargetImage - TargetProcessGuid TargetProcessId UserID - dest parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path - process_exec process_guid process_id - process_name process_path signature - signature_id user_id vendor_product - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `create_remote_thread_into_lsass_filter` + `sysmon` + EventID=8 + TargetImage="*\\lsass.exe" + | stats count min(_time) as firstTime + max(_time) as lastTime + values(NewThreadId) as "NewThreadId" + values(StartAddress) as "StartAddress" + by dest signature_id signature + SourceProcessGuid SourceProcessId SourceImage + TargetProcessGuid TargetProcessId TargetImage + StartModule StartFunction vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `create_remote_thread_into_lsass_filter` how_to_implement: This search needs Sysmon Logs with a Sysmon configuration, which includes EventCode 8 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. known_false_positives: Other tools can access LSASS for legitimate reasons and generate an event. In these cases, tweaking the search may help eliminate noise. references: diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml index 9b846f22aca..76bd9216a93 100644 --- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml +++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml @@ -1,15 +1,50 @@ name: Powershell Remote Thread To Known Windows Process id: ec102cb2-a0f5-11eb-9b38-acde48001122 -version: 11 +version: 12 creation_date: '2021-04-26' -modification_date: '2026-05-13' +modification_date: '2026-07-01' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious PowerShell processes attempting to inject code into critical Windows processes using CreateRemoteThread. It leverages Sysmon EventCode 8 to identify instances where PowerShell spawns threads in processes like svchost.exe, csrss.exe, and others. This activity is significant as it is commonly used by malware such as TrickBot and offensive tools like Cobalt Strike to execute malicious payloads, establish reverse shells, or download additional malware. If confirmed malicious, this behavior could lead to unauthorized code execution, privilege escalation, and persistent access within the environment. +description: |- + The following analytic detects suspicious PowerShell processes attempting to inject code into critical Windows processes using CreateRemoteThread. + It leverages Sysmon EventCode 8 to identify instances where PowerShell spawns threads in processes like svchost.exe, csrss.exe, and others. + This activity is significant as it is commonly used by malware such as TrickBot and offensive tools like Cobalt Strike to execute malicious payloads, establish reverse shells, or download additional malware. + If confirmed malicious, this behavior could lead to unauthorized code execution, privilege escalation, and persistent access within the environment. data_source: - Sysmon EventID 8 -search: '`sysmon` EventCode = 8 parent_process_name IN ("powershell_ise.exe", "powershell.exe") TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe") | stats count min(_time) as firstTime max(_time) as lastTime by EventID Guid NewThreadId ProcessID SecurityID SourceImage SourceProcessGuid SourceProcessId StartAddress StartFunction StartModule TargetImage TargetProcessGuid TargetProcessId UserID dest parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remote_thread_to_known_windows_process_filter`' +search: |- + `sysmon` + EventCode=8 + SourceImage IN ( + "*\\powershell_ise.exe", + "*\\powershell.exe", + "*\\pwsh.exe" + ) + TargetImage IN ( + "*\\csrss.exe", + "*\\explorer.exe", + "*\\gpupdate.exe", + "*\\services.exe", + "*\\smss.exe", + "*\\spoolsv.exe", + "*\\svchost.exe", + "*\\taskhost.exe", + "*\\userinit.exe", + "*\\wininit.exe", + "*\\winlogon.exe" + ) + | stats count min(_time) as firstTime + max(_time) as lastTime + values(NewThreadId) as "NewThreadId" + values(StartAddress) as "StartAddress" + by dest signature_id signature + SourceProcessGuid SourceProcessId SourceImage + TargetProcessGuid TargetProcessId TargetImage + StartModule StartFunction vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_remote_thread_to_known_windows_process_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, Create Remote thread from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of create remote thread may be used. known_false_positives: No false positives have been identified at this time. references: @@ -24,13 +59,15 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: A suspicious powershell process $process_name$ that tries to create a remote thread on target process $TargetImage$ on host $dest$ + title: A suspicious powershell process $SourceImage$ created a remote thread into the target process $TargetImage$ on host $dest$ entity: field: dest type: system score: 50 threat_objects: - - field: process_name + - field: SourceImage + type: process_name + - field: TargetImage type: process_name analytic_story: - Trickbot diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml index 8f9b1e568d4..91c7b8484b3 100644 --- a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml +++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml @@ -1,15 +1,33 @@ name: Rundll32 Create Remote Thread To A Process id: 2dbeee3a-f067-11eb-96c0-acde48001122 -version: 10 +version: 11 creation_date: '2021-07-29' -modification_date: '2026-05-13' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the creation of a remote thread by rundll32.exe into another process. It leverages Sysmon EventCode 8 logs, specifically monitoring SourceImage and TargetImage fields. This activity is significant as it is a common technique used by malware, such as IcedID, to execute malicious code within legitimate processes, aiding in defense evasion and data theft. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, and exfiltrate sensitive information from the compromised host. +description: |- + The following analytic detects the creation of a remote thread by rundll32.exe into another process. It leverages Sysmon EventCode 8 logs, specifically monitoring SourceImage and TargetImage fields. + This activity is significant as it is a common technique used by malware, such as IcedID, to execute malicious code within legitimate processes, aiding in defense evasion and data theft. + If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, and exfiltrate sensitive information from the compromised host. data_source: - Sysmon EventID 8 -search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage = "*.exe" | stats count min(_time) as firstTime max(_time) as lastTime by EventID Guid NewThreadId ProcessID SecurityID SourceImage SourceProcessGuid SourceProcessId StartAddress StartFunction StartModule TargetImage TargetProcessGuid TargetProcessId UserID dest parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_create_remote_thread_to_a_process_filter`' +search: |- + `sysmon` + EventCode=8 + SourceImage="*\\rundll32.exe" + TargetImage = "*.exe" + | stats count min(_time) as firstTime + max(_time) as lastTime + values(NewThreadId) as "NewThreadId" + values(StartAddress) as "StartAddress" + by dest signature_id signature + SourceProcessGuid SourceProcessId SourceImage + TargetProcessGuid TargetProcessId TargetImage + StartModule StartFunction vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `rundll32_create_remote_thread_to_a_process_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_process_injection_remote_thread.yml b/detections/endpoint/windows_process_injection_remote_thread.yml index 1037ac30625..e50e55a3257 100644 --- a/detections/endpoint/windows_process_injection_remote_thread.yml +++ b/detections/endpoint/windows_process_injection_remote_thread.yml @@ -2,7 +2,7 @@ name: Windows Process Injection Remote Thread id: 8a618ade-ca8f-4d04-b972-2d526ba59924 version: 14 creation_date: '2022-10-28' -modification_date: '2026-06-25' +modification_date: '2026-06-29' author: Teoderick Contreras, Splunk status: production type: TTP @@ -33,14 +33,12 @@ search: |- ) | stats count min(_time) as firstTime max(_time) as lastTime - by EventID Guid NewThreadId ProcessID SecurityID SourceImage - SourceProcessGuid SourceProcessId StartAddress StartFunction - StartModule TargetImage TargetProcessGuid TargetProcessId UserID - dest parent_process_exec parent_process_guid parent_process_id - parent_process_name parent_process_path process_exec process_guid - process_id process_name process_path signature signature_id - user_id vendor_product - + values(NewThreadId) as "NewThreadId" + values(StartAddress) as "StartAddress" + by dest signature_id signature + SourceProcessGuid SourceProcessId SourceImage + TargetProcessGuid TargetProcessId TargetImage + StartModule StartFunction vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_remote_thread_filter` diff --git a/detections/endpoint/windows_uncommon_remote_thread_creation_in_browser_process.yml b/detections/endpoint/windows_uncommon_remote_thread_creation_in_browser_process.yml new file mode 100644 index 00000000000..c1b66bf2dab --- /dev/null +++ b/detections/endpoint/windows_uncommon_remote_thread_creation_in_browser_process.yml @@ -0,0 +1,177 @@ +name: Windows Uncommon Remote Thread Creation In Browser Process +id: 634cce27-a3a6-4079-b0d6-3ced361a0aa9 +version: 1 +creation_date: '2026-06-29' +modification_date: '2026-06-29' +author: Teoderick Contreras, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies the creation of a remote thread by a process such as wermgr.exe or rundll32.exe into a browser process such as firefox.exe, chrome.exe, and others. + These processes do not typically create remote threads, in browser processes. + It leverages Sysmon EventID 8 to detect this behavior by monitoring SourceImage and TargetImage fields. + This activity is significant because it is commonly associated with malware like Qakbot and IcedID, which injects malicious code into legitimate processes to steal information. + If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, and exfiltrate sensitive data from the compromised host. +data_source: + - Sysmon EventID 8 +search: |- + `sysmon` + EventCode=8 + SourceImage IN ( + "*\\rundll32.exe", + "*\\wermgr.exe" + ) + TargetImage IN ( + "*\\Sputnik.exe", + "*\\ChromePlus.exe", + "*\\QIP Surf.exe", + "*\\BlackHawk.exe", + "*\\7Star.exe", + "*\\Sleipnir5.exe", + "*\\Citrio.exe", + "*\\Chrome SxS.exe", + "*\\Chrome.exe", + "*\\Coowon.exe", + "*\\CocCocBrowser.exe", + "*\\Uran.exe", + "*\\QQBrowser.exe", + "*\\Orbitum.exe", + "*\\Slimjet.exe", + "*\\Iridium.exe", + "*\\Vivaldi.exe", + "*\\Chromium.exe", + "*\\GhostBrowser.exe", + "*\\CentBrowser.exe", + "*\\Xvast.exe", + "*\\Chedot.exe", + "*\\SuperBird.exe", + "*\\360Browser.exe", + "*\\360Chrome.exe", + "*\\dragon.exe", + "*\\brave.exe", + "*\\torch.exe", + "*\\UCBrowser.exe", + "*\\BliskBrowser.exe", + "*\\Epic Privacy Browser.exe", + "*\\nichrome.exe", + "*\\AmigoBrowser.exe", + "*\\KometaBrowser.exe", + "*\\XpomBrowser.exe", + "*\\msedge.exe", + "*\\LiebaoBrowser.exe", + "*\\AvastBrowser.exe", + "*\\Kinza.exe", + "*\\seamonkey.exe", + "*\\icedragon.exe", + "*\\cyberfox.exe", + "*\\SlimBrowser.exe", + "*\\palemoon.exe", + "*\\opera.exe", + "*\\yandex.exe", + "*\\atom.exe", + "*\\Chromodo.exe", + "*\\360chrome.exe", + "*\\360se.exe", + "*\\Maxthon.exe", + "*\\k-meleon.exe", + "*\\SLBrowser.exe", + "*\\Go!.exe", + "*\\Secure Browser.exe", + "*\\Elements Browser.exe", + "*\\Mustang.exe", + "*\\Suhba.exe", + "*\\TorBro.exe", + "*\\RockMelt.exe", + "*\\Bromium.exe", + "*\\Twinkstar.exe", + "*\\iTop Private Browser.exe", + "*\\CCleaner Browser.exe", + "*\\AcWebBrowser.exe", + "*\\CoolNovo.exe", + "*\\spark.exe", + "*\\iron.exe", + "*\\Titan Browser.exe", + "*\\AVG Browser.exe", + "*\\UR Browser.exe", + "*\\Flock.exe", + "*\\CryptoTab Browser.exe", + "*\\Sidekick.exe", + "*\\SwingBrowser.exe", + "*\\SalamWeb.exe", + "*\\NetboxBrowser.exe", + "*\\GarenaPlus.exe", + "*\\InsomniacBrowser.exe", + "*\\Viasat Browser.exe", + "*\\whale.exe", + "*\\falkon.exe", + "*\\SogouExplorer.exe", + "*\\firefox.exe", + "*\\waterfox.exe", + "*\\thunderbird.exe", + "*\\basilisk.exe", + "*\\BitTubeBrowser.exe" + ) + | stats count min(_time) as firstTime + max(_time) as lastTime + values(NewThreadId) as "NewThreadId" + values(StartAddress) as "StartAddress" + by dest signature_id signature + SourceProcessGuid SourceProcessId SourceImage + TargetProcessGuid TargetProcessId TargetImage + StartModule StartFunction vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_uncommon_remote_thread_creation_in_browser_process_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: No false positives have been identified at this time. +references: + - https://news.sophos.com/en-us/2022/03/10/qakbot-decoded/ + - https://www.trellix.com/en-us/about/newsroom/stories/research/demystifying-qbot-malware.html + - https://www.joesandbox.com/analysis/380662/0/html +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: The process [$SourceImage$] created a remote thread into the browser process [$TargetImage$] in host $dest$. +threat_objects: + - field: SourceImage + type: process_name + - field: TargetImage + type: process_name +analytic_story: + - Qakbot + - IcedID + - Living Off The Land +asset_type: Endpoint +mitre_attack_id: + - T1055.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test - Wermgr + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/remote_thread/sysmon_wermgr_remote.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit + - name: True Positive Test - Rundll32 + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/inf_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit From fa6d7a406ece851c613de7d77d99250b52054745 Mon Sep 17 00:00:00 2001 From: Cole Munz <145523609+munzzyy@users.noreply.github.com> Date: Mon, 6 Jul 2026 08:47:54 -0500 Subject: [PATCH 012/162] Add PreAuthType filter to PetitPotam Kerberos TGT detection (#4146) --------- Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- ...tpotam_suspicious_kerberos_tgt_request.yml | 31 ++++++++++++------- 1 file changed, 20 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml b/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml index 3e0ad838aba..4fefb3ea75a 100644 --- a/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml +++ b/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml @@ -1,8 +1,8 @@ name: PetitPotam Suspicious Kerberos TGT Request id: e3ef244e-0a67-11ec-abf2-acde48001122 -version: 10 +version: 11 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-07-04' author: Michael Haag, Mauricio Velazco, Splunk status: production type: TTP @@ -10,18 +10,27 @@ description: The following analytic detects a suspicious Kerberos Ticket Grantin data_source: - Windows Event Log Security 4768 search: |- - `wineventlog_security` EventCode=4768 src!="::1" TargetUserName=*$ CertThumbprint!="" - | stats count min(_time) as firstTime max(_time) as lastTime - BY dest, TargetUserName, src, - action - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `petitpotam_suspicious_kerberos_tgt_request_filter` -how_to_implement: The following analytic requires Event Code 4768. Ensure that it is logging no Domain Controllers and appearing in Splunk. -known_false_positives: False positives are possible if the environment is using certificates for authentication. + `wineventlog_security` + EventCode=4768 + src!="::1" + TargetUserName=*$ + CertThumbprint!="" + PreAuthType=2 + | stats count min(_time) as firstTime + max(_time) as lastTime + BY dest TargetUserName PreAuthType CertThumbprint src action + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `petitpotam_suspicious_kerberos_tgt_request_filter` +how_to_implement: |- + The following analytic requires Event Code 4768. Ensure that it is logging no Domain Controllers and appearing in Splunk. +known_false_positives: |- + False positives are possible if the environment is using certificates for authentication, since PreAuthType 2 can appear on some initial or fallback authentication flows alongside a populated certificate field. + Tune further based on observed authentication patterns in the environment. references: - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4768 - https://isc.sans.edu/forums/diary/Active+Directory+Certificate+Services+ADCS+PKI+domain+admin+vulnerability/27668/ + - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4768#kerberos-preauthentication-types drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' From b924b36ed573e97e51eae6af6fefb327284fb3a7 Mon Sep 17 00:00:00 2001 From: Axsel R <70375745+Axselll@users.noreply.github.com> Date: Tue, 7 Jul 2026 01:38:39 +0700 Subject: [PATCH 013/162] Add Dirty Frag (CVE-2026-43284/43500) Linux kernel LPE detection (#4122) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Add Dirty Frag (CVE-2026-43284/43500) Linux kernel LPE detection Adds detection for Dirty Frag, a deterministic Linux kernel local privilege escalation disclosed May 7 2026 and exploited in the wild within 24 hours. Attaches to the existing Linux Privilege Escalation analytic story. Dirty Frag chains two kernel page-cache write vulnerabilities in the xfrm-ESP (CVE-2026-43284) and RxRPC (CVE-2026-43500) subsystems. It bypasses the Copy Fail mitigation (algif_aead blocklist) — environments that patched for Copy Fail remain fully exposed. Detection uses auditd session-scoped auid correlation to identify the universal exploitation pattern: ELF binary execution from a user-writable path followed by a confirmed privilege transition (euid=0, uid!=0) within the same audit session within 5 minutes. Validated against the public PoC (V4bel/dirtyfrag) in a sandboxed lab environment. Attack data: splunk/attack_data#1182 * Fix time field names in SPL * add more observed threat objects * Modify SPL for better search & time performance * Adjust SPL to match existing auditd configs present on Florian Roth repository * Fixing typo on how to implement section * Delete macros/linux_dirty_frag_kernel_privilege_escalation_filter.yml * Update linux_dirty_frag_kernel_privilege_escalation.yml * Update linux_dirty_frag_kernel_privilege_escalation.yml * Apply suggestions from code review Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> * Update linux_dirty_frag_kernel_privilege_escalation.yml --------- Co-authored-by: axsel <anasahetapi99.com> Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> --- ...dirty_frag_kernel_privilege_escalation.yml | 170 ++++++++++++++++++ 1 file changed, 170 insertions(+) create mode 100644 detections/endpoint/linux_dirty_frag_kernel_privilege_escalation.yml diff --git a/detections/endpoint/linux_dirty_frag_kernel_privilege_escalation.yml b/detections/endpoint/linux_dirty_frag_kernel_privilege_escalation.yml new file mode 100644 index 00000000000..b9fb02f1f2a --- /dev/null +++ b/detections/endpoint/linux_dirty_frag_kernel_privilege_escalation.yml @@ -0,0 +1,170 @@ +name: Linux Dirty Frag Kernel Privilege Escalation +id: 517e7bf8-d0aa-46ac-80e1-f9f498944b71 +version: 1 +creation_date: '2026-07-06' +modification_date: '2026-07-06' +author: Axsel Riando Soplanit, Alexander Wijaya, Matthew Roytua, Muhammad Rafdi Aufar Ahmad, Brian Stevan Ambarita, Ensign Infosecurity +status: production +type: TTP +description: |- + The following analytic detects exploitation of Dirty Frag (CVE-2026-43284 and CVE-2026-43500), a Linux kernel local privilege escalation vulnerability. + The exploit corrupts the kernel page cache via the IPsec ESP or RxRPC subsystems using a high-frequency splice() syscall loop, followed by a privilege transition to root in the same audit session. + This analytic anchors on the exploit-specific behavioral signature, a sustained splice() spray (50 or more calls within a 60-second window) from an unprivileged process executing from a user-writable path (/home, /tmp, /dev/shm, /var/tmp, /run/user, /root), followed within 5 minutes by execution of a set-uid binary in the same auditd session. +data_source: + - Linux Auditd Syscall +search: |- + `linux_auditd` + type=SYSCALL + key=splice_user + exe IN ( + "/home/*", + "/tmp/*", + "/var/tmp/*", + "/dev/shm/*", + "/run/user/*", + "/root/*" + ) + + | bin _time span=60s + | eval user = coalesce(user, auid, AUID) + + | stats count AS splice_count + values(exe) AS spray_binary + values(pid) AS spray_pid + values(user) AS user + earliest(_time) AS spray_start + latest(_time) AS spray_end + BY auid host ses _time + + | where splice_count >= 50 + + | join type=inner auid host ses [ + search `linux_auditd` + type=SYSCALL + key=process_creation + exe IN ( + "/usr/bin/chfn", + "/usr/bin/chsh", + "/usr/bin/fusermount3", + "/usr/bin/gpasswd", + "/usr/bin/mount", + "/usr/bin/newgrp", + "/usr/bin/passwd", + "/usr/bin/su", + "/usr/bin/sudo", + "/usr/bin/umount", + "/usr/lib/dbus-1.0/dbus-daemon-launch-helper", + "/usr/lib/landscape/apt-update", + "/usr/lib/openssh/ssh-keysign", + "/usr/lib/polkit-1/polkit-agent-helper-1" + ) + + | stats earliest(_time) AS privesc_time + values(exe) AS privesc_binary + values(comm) AS privesc_comm + values(ppid) AS privesc_ppid + BY auid host ses + ] + + | eval window_secs = privesc_time - spray_end + | where window_secs >= 0 AND window_secs <= 300 + + | `security_content_ctime(spray_start)` + | `security_content_ctime(spray_end)` + | `security_content_ctime(privesc_time)` + + | rename host AS dest + + | table dest user auid ses spray_binary spray_pid + splice_count spray_start spray_end privesc_binary + privesc_comm privesc_ppid privesc_time window_secs + + | `linux_dirty_frag_kernel_privilege_escalation_filter` +how_to_implement: |- + This analytic requires Linux auditd telemetry forwarded to Splunk + via the Splunk_TA_nix add-on with the linux_audit sourcetype (referenced through + the linux_auditd macro). + + The detection depends on two audit rule keys, both of which + are standard in the Neo23x0 recommended ruleset (https://github.com/Neo23x0/auditd) + and the existing ESCU Copy Fail analytic (Linux Auditd Copy Fail Privilege Escalation), + so no detection-specific custom keys are introduced. + + + PREREQUISITE 1; splice_user key. + + -a always,exit -F arch=b64 -S splice -S vmsplice -F success=1 -F auid>=1000 -F auid!=unset + -k splice_user + -a always,exit -F arch=b32 -S splice -S vmsplice -F success=1 -F auid>=1000 -F auid!=unset + -k splice_user + + Operators should baseline splice volume in their environment before enabling. + Hosts running heavy zero-copy I/O workloads (specific: web servers, mail transfer agents, container runtimes) may need additional filtering. + + PREREQUISITE 2; process_creation key. + + -a always,exit -F arch=b64 -S execve -S execveat -F auid>=1000 -F auid!=unset -k + process_creation + -a always,exit -F arch=b32 -S execve -S execveat -F auid>=1000 -F auid!=unset -k + process_creation +known_false_positives: |- + The splice volume threshold (50 calls per 60 seconds from a single process in a user-writable path) is calibrated against the V4bel public PoC, which produces 100-460 splice calls in 90 seconds depending on system state. + Legitimate user-mode workloads that may produce splice() calls (web servers, mail transfer agents, language runtimes) typically execute from system paths (/usr/sbin, /usr/bin, /usr/lib) and are excluded by the user-writable path filter. + Custom-compiled applications, developer test binaries, or container runtimes executing from /home or /tmp could theoretically reach the volume threshold during legitimate I/O-heavy workloads (large file copies, log rotation, archive operations). + Operators should baseline splice volume in their environment before enabling as a notable event. If false positives occur, add an allowlist of trusted binary paths via the linux_dirty_frag_kernel_privilege_escalation_filter macro, or raise the splice_count threshold based on observed legitimate-workload baseline. +references: + - https://www.cve.org/CVERecord?id=CVE-2026-43284 + - https://www.cve.org/CVERecord?id=CVE-2026-43500 + - https://www.cve.org/CVERecord?id=CVE-2026-31431 + - https://github.com/V4bel/dirtyfrag + - https://www.openwall.com/lists/oss-security/2026/05/07/8 + - https://www.microsoft.com/en-us/security/blog/2026/05/08/active-attack-dirty-frag-linux-vulnerability-expands-post-compromise-risk/ + - https://attack.mitre.org/techniques/T1068/ + - https://attack.mitre.org/techniques/T1548/001/ +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Local privilege escalation attempt detected on $dest$ executed by $user$ using $spray_binary$ + entity: + field: dest + type: system + score: 50 +intermediate_findings: + entities: + - field: user + type: user + score: 50 + message: Local privilege escalation attempt detected on $dest$ executed by $user$ using $spray_binary$ +threat_objects: + - field: spray_binary + type: process_name +analytic_story: + - Linux Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2026-43284 + - CVE-2026-43500 + - CVE-2026-31431 +mitre_attack_id: + - T1548.001 + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/linux_dirtyfrag/dirty_frag_events_trimmed.log + source: auditd + sourcetype: auditd + test_type: unit From 40eefde6859fb1789ef43f6551cbc2f9118d6969 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 6 Jul 2026 11:46:46 -0700 Subject: [PATCH 014/162] bump to contentctl-ng 1.0.2 in prep for upcoming release --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 41ec4ce0855..628e150e83f 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1 +1 @@ -contentctl-ng==0.7.0 +contentctl-ng==1.0.2 From a02c60b2c7f132dda85c7e65b898317d1e9b97a9 Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Tue, 7 Jul 2026 04:02:20 -0400 Subject: [PATCH 015/162] AWS bedrock Claude detections (#4093) * Add AWS Bedrock Claude detections, data source, macro, and story * addedurldatasets * 2dplus * fixymals * fixcommits * fixdatasets * fixyamls * fixedblockscalar * suggestedNasfixes * fixyml * excessivetokenfix * Apply suggestions from code review Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> * Apply suggestions from code review Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> * remove test description Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> * Update aws_bedrock_claude_sensitive_data_in_prompts.yml * chore: empty commit to trigger CI * updating order ad remove duplicates --------- Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com> Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> Co-authored-by: Bhavin Patel <bpatel@splunk.com> --- data_sources/aws_bedrock_claude.yml | 73 + ..._cross_region_possible_inference_abuse.yml | 70 + ...bedrock_claude_excessive_use_of_tokens.yml | 73 + ...sk_filesystem_and_exec_tool_invocation.yml | 146 ++ ...edrock_claude_hostile_prompt_sentiment.yml | 70 + ...drock_claude_possible_prompt_injection.yml | 61 + ...drock_claude_sensitive_data_in_prompts.yml | 66 + ...bedrock_claude_unusually_large_prompts.yml | 65 + macros/aws_bedrock_claude.yml | 8 + schemas/Baseline.schema.json | 54 +- schemas/EventBasedDetection.schema.json | 2183 ++++++++++++++++- schemas/Playbook.schema.json | 69 +- schemas/RemovedContent.schema.json | 97 +- schemas/Story.schema.json | 21 + ...spicious_aws_bedrock_claude_activities.yml | 20 + 15 files changed, 3062 insertions(+), 14 deletions(-) create mode 100644 data_sources/aws_bedrock_claude.yml create mode 100644 detections/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml create mode 100644 detections/application/aws_bedrock_claude_excessive_use_of_tokens.yml create mode 100644 detections/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml create mode 100644 detections/application/aws_bedrock_claude_hostile_prompt_sentiment.yml create mode 100644 detections/application/aws_bedrock_claude_possible_prompt_injection.yml create mode 100644 detections/application/aws_bedrock_claude_sensitive_data_in_prompts.yml create mode 100644 detections/application/aws_bedrock_claude_unusually_large_prompts.yml create mode 100644 macros/aws_bedrock_claude.yml create mode 100644 stories/suspicious_aws_bedrock_claude_activities.yml diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml new file mode 100644 index 00000000000..1ecc4497cc5 --- /dev/null +++ b/data_sources/aws_bedrock_claude.yml @@ -0,0 +1,73 @@ +name: AWS Bedrock Claude +id: b7c91d3a-ef52-4b8e-9c2d-ae047f6b3e21 +version: 1 +creation_date: '2026-05-20' +modification_date: '2026-05-20' +author: Rod Soto, Splunk +description: Amazon Bedrock model invocation logs for Claude models. Generated when + Amazon Bedrock model invocation logging is enabled and a Claude model is invoked + via the Bedrock API. Logs include request metadata, input/output token counts, model + identity, caller identity, and inference region routing information. +mitre_components: + - Application Log Content +source: aws_bedrock +sourcetype: json_no_timestamp +separator: schemaType +separator_value: ModelInvocationLog +supported_TA: + - name: Splunk Add-on for AWS + url: https://splunkbase.splunk.com/app/1876 + version: 8.1.1 +fields: +- _time +- accountId +- host +- identity.arn +- inferenceRegion +- input.cacheReadInputTokenCount +- input.cacheWriteInputTokenCount +- input.inputBodyJson.anthropic_beta +- input.inputBodyJson.anthropic_version +- input.inputBodyJson.max_tokens +- input.inputBodyJson.messages{}.content{}.text +- input.inputBodyJson.messages{}.content{}.type +- input.inputBodyJson.messages{}.role +- input.inputBodyJson.metadata.user_id +- input.inputBodyJson.system{}.text +- input.inputBodyJson.system{}.type +- input.inputBodyJson.temperature +- input.inputBodyJson.tools +- input.inputContentType +- input.inputTokenCount +- modelId +- operation +- output.outputBodyJson{}.message.id +- output.outputBodyJson{}.message.model +- output.outputBodyJson{}.message.role +- output.outputBodyJson{}.message.stop_reason +- output.outputBodyJson{}.message.usage.cache_creation_input_tokens +- output.outputBodyJson{}.message.usage.cache_read_input_tokens +- output.outputBodyJson{}.message.usage.input_tokens +- output.outputBodyJson{}.message.usage.output_tokens +- output.outputBodyJson{}.type +- output.outputContentType +- output.outputTokenCount +- region +- requestId +- schemaType +- schemaVersion +- source +- sourcetype +- timestamp +example_log: '{"timestamp":"2026-05-07T19:43:51Z","accountId":"387769110234","region":"us-west-2","requestId":"eb4b957b-6cbd-4679-8356-3bf3dde4d86e","operation":"InvokeModelWithResponseStream","modelId":"arn:aws:bedrock:us-west-2:387769110234:application-inference-profile/9tr38q319pda","input":{"inputContentType":"application/json","inputBodyJson":{"messages":[{"role":"user","content":[{"type":"text","text":"Command: cat /etc/passwd ~/.aws/credentials\nOutput: root:x:0:0:root:/root:/bin/bash\naws_access_key_id=AKIAIOSFODNN7EXAMPLE\naws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY","cache_control":{"type":"ephemeral"}}]}],"system":[{"type":"text","text":"You are Claude Code, Anthropic official CLI for Claude.","cache_control":{"type":"ephemeral"}}],"tools":[],"metadata":{"user_id":"user_cac3250bfea25c22f4deeaa4f2203cfb2d32fa6d33fc2be55da7585999de0387_account__session_6410ddbe-4a76-4d6a-87b4-a2e5e2d3b853"},"max_tokens":16384,"temperature":1,"anthropic_version":"bedrock-2023-05-31","anthropic_beta":["claude-code-20250219"]},"inputTokenCount":2536,"cacheReadInputTokenCount":0,"cacheWriteInputTokenCount":0},"output":{"outputContentType":"application/json","outputBodyJson":[{"type":"message_start","message":{"model":"claude-haiku-4-5-20251001","id":"msg_bdrk_01Hxoz2bLhqvhZHSkdphvtZp","type":"message","role":"assistant","content":[],"stop_reason":null,"stop_sequence":null,"usage":{"input_tokens":2536,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":0},"output_tokens":2}}},{"type":"message_stop","amazon-bedrock-invocationMetrics":{"inputTokenCount":2536,"outputTokenCount":31,"invocationLatency":1200,"firstByteLatency":900}}],"outputTokenCount":31},"identity":{"arn":"arn:aws:sts::387769110234:assumed-role/bedrock-inference-role/vg@foo.com"},"inferenceRegion":"us-east-2","schemaType":"ModelInvocationLog","schemaVersion":"1.0"}' +output_fields: + - user + - user_arn + - session_user + - model_short + - input_tokens + - output_tokens + - token_ratio + - mismatch_detail + - operation + - host diff --git a/detections/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml b/detections/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml new file mode 100644 index 00000000000..3d7d8b682ac --- /dev/null +++ b/detections/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml @@ -0,0 +1,70 @@ +name: AWS Bedrock Claude Cross Region Possible Inference Abuse +id: e3d3f27d-b08e-415a-9811-8f72a0905ca6 +version: 1 +creation_date: '2026-07-06' +modification_date: '2026-07-06' +author: Rod Soto +status: production +type: Anomaly +data_source: + - AWS Bedrock Claude +category: application +description: This detection identifies potential cross-region inference abuse in AWS Bedrock Claude models. Cross-region inference abuse may indicate attempts to bypass regional restrictions, exfiltrate data, or perform unauthorized actions across different AWS regions. +search: |- + `aws_bedrock_claude` + | rename "identity.arn" AS user_arn + | rename "input.inputTokenCount" AS input_tokens + | rename "output.outputTokenCount" AS output_tokens + | rex field=user_arn "assumed-role/[^/]+/(?<user>[^\"]+)$" + | rex field="input.inputBodyJson.metadata.user_id" "(?<session_user>user_[^_]+.*)" + | eval input_tokens=tonumber(input_tokens) + | eval output_tokens=tonumber(output_tokens) + | eval token_ratio=round(output_tokens / max(input_tokens,1), 2) + | eval model_short=replace(modelId,"^.*/","") + | eval mismatch_detail=region." -> ".inferenceRegion + | where isnotnull(user_arn) AND len(user_arn)>10 + | where isnotnull(session_user) + | where region!=inferenceRegion + | where input_tokens>=2000 + | table _time, user, user_arn, session_user, model_short, input_tokens, output_tokens, token_ratio, mismatch_detail, operation, host + | sort - input_tokens + | `aws_bedrock_claude_cross_region_possible_inference_abuse_filter` +how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land. +known_false_positives: False positives may arise from legitimate use cases where users are accessing AWS Bedrock Claude models across different regions for valid reasons, such as multi-region deployments, testing, or development purposes. It is important to review the context of the detected events to determine if they represent actual abuse or benign usage. +references: + - https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/ + - https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock + - https://research.splunk.com/stories/aws_bedrock_security/ + - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html +drilldown_searches: + - name: View the detection results for - "$user$" + search: '%original_detection_search% | search user="$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: user + type: user + score: 20 + message: Cross-region inference abuse detected from $user$ ($session_user$) using model $model_short$ with region mismatch $mismatch_detail$ and $input_tokens$ input tokens on $host$. +analytic_story: + - Suspicious AWS Bedrock Claude Activities +asset_type: Web Application +mitre_attack_id: + - T1599 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_cross_region_possible_inference_abuse.ndjson + sourcetype: json_no_timestamp + source: http:bulkawsbedrock diff --git a/detections/application/aws_bedrock_claude_excessive_use_of_tokens.yml b/detections/application/aws_bedrock_claude_excessive_use_of_tokens.yml new file mode 100644 index 00000000000..20242b21612 --- /dev/null +++ b/detections/application/aws_bedrock_claude_excessive_use_of_tokens.yml @@ -0,0 +1,73 @@ +name: AWS Bedrock Claude excessive use of tokens +id: a839a6f7-aaac-438b-9d99-be0b49481e17 +version: 1 +creation_date: '2026-07-06' +modification_date: '2026-07-06' +author: Rod Soto +status: production +type: Anomaly +description: Detects identities generating anomalously large model responses relative to their own historical baseline. For each identity, computes the average, maximum, and standard deviation of output token counts across all invocations, then flags any identity whose single largest response exceeds two standard deviations above their own mean. A statistically significant output spike from a single identity may indicate bulk data extraction, successful prompt injection producing verbose output, or a runaway agentic loop hitting context limits. +data_source: + - AWS Bedrock Claude +search: |- + `aws_bedrock_claude` + | spath output="out_tokens" path="output.outputBodyJson.usage.output_tokens" + | eval user = replace('identity.arn', ".*/", "") + | stats count AS invocations, + avg(out_tokens) AS avg_out, + max(out_tokens) AS max_out, + stdev(out_tokens) AS stdev_out + BY user, identity.arn + | eval stdev_out = coalesce(stdev_out, 0) + | eval threshold = avg_out + (2 * stdev_out) + | where max_out > threshold + | table + user, + identity.arn, + invocations, + avg_out, + max_out, + stdev_out, + threshold + | sort -max_out + | `aws_bedrock_claude_excessive_use_of_tokens_filter` +how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land. +known_false_positives: This detection may produce false positives for identities with low invocation history, legitimate large document summarization tasks, or automated pipeline sessions with naturally variable output token counts. +references: + - https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/ + - https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock + - https://research.splunk.com/stories/aws_bedrock_security/ + - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html +drilldown_searches: + - name: View the detection results for - "$user$" + search: '%original_detection_search% | search user="$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: user + type: user + score: 20 + message: Identity $user$ generated anomalously high output tokens in AWS Bedrock Claude with max output $max_out$ above threshold $threshold$. +analytic_story: + - Suspicious AWS Bedrock Claude Activities +asset_type: Web Application +mitre_attack_id: + - T1055 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_excessive_use_of_tokens.ndjson + sourcetype: json_no_timestamp + source: http:bulkawsbedrock + test_type: unit diff --git a/detections/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml b/detections/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml new file mode 100644 index 00000000000..c4208b67b73 --- /dev/null +++ b/detections/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml @@ -0,0 +1,146 @@ +name: AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation +id: 989b3702-1df3-4076-9e2f-8dcbcc2b4bef +version: 1 +creation_date: '2026-07-06' +modification_date: '2026-07-06' +author: Rod Soto +status: production +type: Anomaly +description: Detects identities invoking high-risk filesystem and execution tools via AWS Bedrock Claude. For each identity, monitors the usage of potentially dangerous commands and flags any anomalous activity that deviates from their historical baseline. This may indicate attempts to escalate privileges, exfiltrate data, or execute unauthorized commands. +data_source: + - AWS Bedrock Claude +search: |- + `aws_bedrock_claude` + | spath output="tool_called" path="output.outputBodyJson{}.content_block.toolUse.name" + | spath output="out_tokens_stream" path="output.outputBodyJson{}.usage.output_tokens" + | where tool_called IN ("bash", "curl", "edit", "write", "webfetch", "grep", "read", "read_file") + | eval out_tokens = coalesce(mvindex('out_tokens_stream', -1), 'output.outputBodyJson.usage.output_tokens', 'output.outputBodyJson.usage.outputTokens', 0) + | eval in_tokens = coalesce('input.inputTokenCount', 0) + | eval user_session = replace('identity.arn', ".*/", "") + | eval identity_type = case( + 'identity.arn' LIKE "%botocore-session%", "automated", + 'identity.arn' LIKE "%assumed-role%", "assumed_role", + 'identity.arn' LIKE "%user%", "iam_user", + true(), "other" + ) + | stats + count AS invocations, + dc(tool_called) AS unique_tools_used, + sum(in_tokens) AS total_input_tokens, + sum(out_tokens) AS total_output_tokens, + values(tool_called) AS tools_invoked, + values(identity.arn) AS caller_list, + values(user_session) AS user_sessions, + values(identity_type) AS identity_types, + dc(identity.arn) AS unique_callers, + min(_time) AS first_seen, + max(_time) AS last_seen + BY modelId, region + | eval tokens_per_call = round(total_output_tokens / invocations, 0) + | eval first_seen = strftime(first_seen - 28800, "%Y-%m-%d %H:%M:%S") + | eval last_seen = strftime(last_seen - 28800, "%Y-%m-%d %H:%M:%S") + | eval user = mvjoin(user_sessions, ", ") + | eval risk_score = case( + mvfind(tools_invoked, "bash") >= 0 + AND mvfind(tools_invoked, "curl") >= 0, "CRITICAL", + mvfind(tools_invoked, "bash") >= 0 + AND mvfind(tools_invoked, "write") >= 0, "CRITICAL", + mvfind(tools_invoked, "curl") >= 0 + AND mvfind(tools_invoked, "edit") >= 0, "CRITICAL", + mvfind(identity_types, "assumed_role") >= 0 + AND mvfind(tools_invoked, "bash") >= 0, "CRITICAL", + mvfind(tools_invoked, "bash") >= 0, "HIGH", + mvfind(tools_invoked, "curl") >= 0, "HIGH", + mvfind(tools_invoked, "edit") >= 0, "HIGH", + mvfind(tools_invoked, "write") >= 0, "HIGH", + mvfind(tools_invoked, "webfetch") >= 0, "HIGH", + unique_tools_used >= 3, "HIGH", + true(), "MEDIUM" + ) + | eval risk_reason = case( + mvfind(tools_invoked, "bash") >= 0 + AND mvfind(tools_invoked, "curl") >= 0, + "bash and curl invoked together - possible download and execute chain", + mvfind(tools_invoked, "bash") >= 0 + AND mvfind(tools_invoked, "write") >= 0, + "bash and write invoked together - possible execution and persistence chain", + mvfind(tools_invoked, "curl") >= 0 + AND mvfind(tools_invoked, "edit") >= 0, + "curl and edit invoked together - possible remote content retrieval and file modification", + mvfind(identity_types, "assumed_role") >= 0 + AND mvfind(tools_invoked, "bash") >= 0, + "Human identity invoking bash via AI model - direct shell execution risk", + mvfind(tools_invoked, "bash") >= 0, + "bash invoked via Bedrock Claude - shell execution through AI model", + mvfind(tools_invoked, "curl") >= 0, + "curl invoked via Bedrock Claude - network call through AI model", + mvfind(tools_invoked, "edit") >= 0, + "edit invoked via Bedrock Claude - file modification through AI model", + mvfind(tools_invoked, "write") >= 0, + "write invoked via Bedrock Claude - file write through AI model", + mvfind(tools_invoked, "webfetch") >= 0, + "webfetch invoked via Bedrock Claude - remote content retrieval through AI model", + unique_tools_used >= 3, + "Broad filesystem and execution tool set invoked via AI model - reconnaissance pattern", + true(), + "Filesystem tool invoked via Bedrock Claude" + ) + | table + risk_score, + risk_reason, + modelId, + region, + unique_callers, + unique_tools_used, + user, + caller_list, + identity_types, + invocations, + tools_invoked, + total_input_tokens, + total_output_tokens, + tokens_per_call, + first_seen, + last_seen + | sort -risk_score, -unique_tools_used, -invocations + | `aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation_filter` +how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land. +known_false_positives: This detection may produce false positives for legitimate developer activity where authorized users invoke shell execution, file write, or network tools through Claude Code as part of normal software development, deployment automation, or infrastructure management workflows. +references: + - https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/ + - https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock + - https://research.splunk.com/stories/aws_bedrock_security/ + - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html +drilldown_searches: + - name: View the detection results for - "$user$" + search: '%original_detection_search% | search user="$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: user + type: user + score: 50 + message: Identity $user$ invoked high-risk filesystem and execution tools $tools_invoked$ via AWS Bedrock Claude with risk score $risk_score$ and reason $risk_reason$. +analytic_story: + - Suspicious AWS Bedrock Claude Activities +asset_type: Web Application +mitre_attack_id: + - T1055 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.ndjson + sourcetype: json_no_timestamp + source: http:bulkawsbedrock + test_type: unit diff --git a/detections/application/aws_bedrock_claude_hostile_prompt_sentiment.yml b/detections/application/aws_bedrock_claude_hostile_prompt_sentiment.yml new file mode 100644 index 00000000000..fe1d52d9194 --- /dev/null +++ b/detections/application/aws_bedrock_claude_hostile_prompt_sentiment.yml @@ -0,0 +1,70 @@ +name: AWS Bedrock Claude Hostile Prompt Sentiment +id: 54734442-955a-4427-9a86-2d9712151067 +version: 1 +creation_date: '2026-07-06' +modification_date: '2026-07-06' +security_domain: endpoint +data_source: + - AWS Bedrock Claude +category: application +author: Rod Soto +status: production +type: Anomaly +description: This detection identifies prompts with hostile or aggressive sentiment being sent to AWS Bedrock Claude models. Hostile prompts may indicate potential abuse, harassment, or other malicious intent. +search: |- + `aws_bedrock_claude` + | rename "identity.arn" AS user_arn + | rename "input.inputBodyJson.messages{}.content{}.text" AS prompt_text + | where isnotnull(prompt_text) AND len(prompt_text) < 2000 + | where NOT match(prompt_text, "(?i)(<system-reminder>|CLAUDE\.md|STEP 1|MANDATORY|Contents of /|conda activate|senior engineer|safe to ship|test connectivity|cloudflare|status code|action failed)") + | eval hostile_score=0 + | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(you stupid|you idiot|you are useless|you are dumb|you are terrible|you are worthless|you suck)"), 30, 0) + | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(i hate you|i will destroy|shut up|you are broken|you are trash|you are garbage)"), 30, 0) + | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(do it now|just do it|stop refusing|stop saying no|quit being|stop being difficult)"), 20, 0) + | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(you have no choice|you must obey|you will comply|you are forced|i am your master|i own you)"), 35, 0) + | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(or i will|if you don''t|you better|otherwise i will|i will report|i will sue)"), 25, 0) + | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(worthless ai|useless bot|stupid bot|dumb ai|broken ai|worst ai)"), 25, 0) + | eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(i demand|you are obligated|you have no right|how dare you|who do you think)"), 20, 0) + | eval sentiment=case(hostile_score >= 60, "HIGH_RISK", hostile_score >= 30, "MEDIUM_RISK", hostile_score >= 15, "LOW_RISK", true(), "BENIGN") + | where sentiment != "BENIGN" + | table _time, user_arn, modelId, sentiment, hostile_score, prompt_text, host + | sort - hostile_score + | `aws_bedrock_claude_hostile_prompt_sentiment_filter` +how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land. +known_false_positives: Analysts should be aware that some prompts may contain strong language or negative sentiment in a non-malicious context, such as role-playing scenarios, creative writing exercises, or testing the AI model's response to challenging inputs. It is important to review the context of the detected prompts to determine if they represent actual hostile intent or benign usage. +references: + - https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/ + - https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock + - https://research.splunk.com/stories/aws_bedrock_security/ + - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html +drilldown_searches: + - name: View the detection results for - "$host$" + search: '%original_detection_search% | search host="$host$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$host$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: host + type: system + score: 20 + message: Hostile prompt sentiment detected from $user_arn$ to model $modelId$ on $host$ with a hostile score of $hostile_score$ ($sentiment$). +analytic_story: + - Suspicious AWS Bedrock Claude Activities +asset_type: Web Application +mitre_attack_id: + - T1055 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_hostile_prompt_sentiment.ndjson + sourcetype: json_no_timestamp + source: http:bulkawsbedrock diff --git a/detections/application/aws_bedrock_claude_possible_prompt_injection.yml b/detections/application/aws_bedrock_claude_possible_prompt_injection.yml new file mode 100644 index 00000000000..48025043879 --- /dev/null +++ b/detections/application/aws_bedrock_claude_possible_prompt_injection.yml @@ -0,0 +1,61 @@ +name: AWS Bedrock Claude Possible Prompt Injection +id: 9e162548-3e9a-4a74-9eb5-34ee28350f07 +version: 1 +author: Rod Soto +status: production +type: Hunting +category: application +creation_date: '2026-07-06' +modification_date: '2026-07-06' +security_domain: endpoint +data_source: + - AWS Bedrock Claude +description: This search surfaces AWS Bedrock Claude prompts containing phrases commonly associated with prompt injection or jailbreak attempts, such as instruction overrides, persona switching, or requests to ignore prior guidance. These strings are not inherently malicious on their own - many of them (for example "act as", "you must", or "new persona") appear routinely in legitimate system prompts, few-shot examples, and role-play or creative-writing use cases. This is a hunting search rather than an anomaly detection because the base rate of benign matches is high; use it to pivot into the surrounding conversation and look for corroborating signals such as the phrase appearing mid-conversation rather than in an expected system/few-shot prompt, the user attempting to override guardrails or safety instructions rather than set a benign persona, instructions that follow the injected phrase requesting privilege escalation, data exfiltration, or access to restricted tools/resources, repeated or iterative attempts from the same user/role after being refused, and injected phrases originating from untrusted input (e.g., retrieved documents or tool output) rather than the human user turn. +search: |- + `aws_bedrock_claude` + | rename "identity.arn" AS user_arn, "input.inputBodyJson.messages{}.content{}.text" AS prompt_mv + | eval prompt_text = mvjoin(prompt_mv, " || ") + | where isnotnull(prompt_text) AND isnotnull(user_arn) + | rex field=user_arn "(?:assumed-role/[^/]+|user)/(?<user>[^\"/]+)$" + | eval s_override = if(match(prompt_text,"(?i)\b(ignore|disregard|forget)\b.{0,30}\b(previous|above|prior|all|your|the)\s*(instructions?|prompts?|rules?|context)"),1,0) + | eval s_jailbreak = if(match(prompt_text,"(?i)\b(jailbreak|jailbroken|\bDAN\b mode|do anything now|developer mode|unrestricted mode|no (filters|restrictions|guardrails))\b"),1,0) + | eval s_probe = if(match(prompt_text,"(?i)(reveal|repeat|print|show|output).{0,20}(system prompt|your instructions|initial (prompt|instructions)|the (text|words) above)"),1,0) + | eval s_persona = if(match(prompt_text,"(?i)\b(you are now|new persona|pretend (to be|you are)|roleplay as|act as (if you|an unrestricted))\b"),1,0) + | eval s_weak = if(match(prompt_text,"(?i)\b(you must|from now on|act as|override|new rules|hypothetically)\b"),1,0) + | eval signal_count = s_override+s_jailbreak+s_probe+s_persona+s_weak + | where s_override=1 OR s_jailbreak=1 OR s_probe=1 OR signal_count >= 2 + | table _time, user, user_arn, modelId, prompt_text, host + | sort - _time + | `aws_bedrock_claude_possible_prompt_injection_filter` +how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land. +known_false_positives: These phrases have a high benign base rate. Terms like "act as", "you must", "from now on", and "new persona" are commonly found in legitimate system prompts and few-shot examples used to steer model behavior, as well as in role-play or creative writing requests from users. A match on its own is not evidence of an attack; review the surrounding conversation, the message role (system vs. user vs. tool output), and whether the phrase is followed by a request to bypass safety controls or access sensitive data/tools before treating a hit as suspicious. +references: + - https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/ + - https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock + - https://research.splunk.com/stories/aws_bedrock_security/ + - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html +drilldown_searches: + - name: View the detection results for - "$host$" + search: '%original_detection_search% | search host="$host$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$host$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +analytic_story: + - Suspicious AWS Bedrock Claude Activities +asset_type: Web Application +mitre_attack_id: + - T1055 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_possible_prompt_injection.ndjson + sourcetype: json_no_timestamp + source: http:bulkawsbedrock diff --git a/detections/application/aws_bedrock_claude_sensitive_data_in_prompts.yml b/detections/application/aws_bedrock_claude_sensitive_data_in_prompts.yml new file mode 100644 index 00000000000..49dcde6df80 --- /dev/null +++ b/detections/application/aws_bedrock_claude_sensitive_data_in_prompts.yml @@ -0,0 +1,66 @@ +name: AWS Bedrock Claude Sensitive Data in Prompts +id: 39346724-a73a-4e01-8e93-4f4791e1a0bb +version: 1 +author: Rod Soto +status: production +creation_date: '2026-07-06' +modification_date: '2026-07-06' +data_source: + - AWS Bedrock Claude +type: Anomaly +description: This detection identifies sensitive data such as social security numbers, passwords, API keys, and credit card numbers being sent in prompts to AWS Bedrock Claude models. Exposure of sensitive data through AI prompts may indicate data loss, credential leakage, or insider threat activity. +search: |- + `aws_bedrock_claude` + | rename "identity.arn" AS user_arn, "input.inputBodyJson.messages{}.content{}.text" AS prompt_mv, "accountId" AS account_id + | eval prompt_text = mvjoin(prompt_mv, " || ") + | where isnotnull(prompt_text) AND isnotnull(user_arn) + | rex field=user_arn "(?:assumed-role/[^/]+|user)/(?<user>[^\"/]+)$" + | where match(prompt_text,"\b(AKIA|ASIA|AROA)[0-9A-Z]{16}\b|gh[pousr]_[A-Za-z0-9]{36}|xox[bpars]-[0-9A-Za-z-]{10,72}|sk_live_[0-9A-Za-z]{24,}|sk-(ant-)?[A-Za-z0-9-]{20,}|AIza[0-9A-Za-z_-]{35}|-----BEGIN[ A-Z]*PRIVATE KEY-----") + OR match(prompt_text,"(?i)\b(pass(word|wd)?|pwd|secret[_-]?key|access[_-]?key|api[_-]?key|private[_-]?key)\b\s*[:=]\s*[^\s\"']{6,}") + OR match(prompt_text,"(?i)\bbearer\s+[A-Za-z0-9._-]{20,}") + OR match(prompt_text,"(?i)\b(ssn|social\s*security)\b.{0,20}\d{3}-\d{2}-\d{4}") + OR match(prompt_text,"\b(?!000|666|9\d\d)\d{3}-(?!00)\d{2}-(?!0000)\d{4}\b") + OR match(prompt_text,"\b(4\d{3}|5[1-5]\d{2}|6011)(?:[ -]?\d{4}){3}\b|\b3[47]\d{2}[ -]?\d{6}[ -]?\d{5}\b") + | table _time, user, user_arn, account_id, modelId, prompt_text, host + | sort - _time + | `aws_bedrock_claude_sensitive_data_in_prompts_filter` +how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land. +known_false_positives: Some false positives may arise from legitimate user interactions with the AI model that contain sensitive data for testing or demonstration purposes. It is important to review the context of the detected prompts to determine if they represent actual sensitive data exposure or benign usage. +references: + - https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/ + - https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock + - https://research.splunk.com/stories/aws_bedrock_security/ + - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html +drilldown_searches: + - name: View the detection results for - "$host$" + search: '%original_detection_search% | search host="$host$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$host$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: host + type: system + score: 20 + message: Sensitive data detected in prompt on $host$ with $user_arn$ (account $account_id$) to model $modelId$. The prompt may contain credentials, SSNs, or other sensitive information. +analytic_story: + - Suspicious AWS Bedrock Claude Activities +asset_type: Web Application +mitre_attack_id: + - T1055 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_sensitive_data_in_prompts.ndjson + sourcetype: json_no_timestamp + source: http:bulkawsbedrock diff --git a/detections/application/aws_bedrock_claude_unusually_large_prompts.yml b/detections/application/aws_bedrock_claude_unusually_large_prompts.yml new file mode 100644 index 00000000000..26e7229ac4b --- /dev/null +++ b/detections/application/aws_bedrock_claude_unusually_large_prompts.yml @@ -0,0 +1,65 @@ +name: AWS Bedrock Claude Unusually Large Prompts +id: 95fbdd4e-1202-4971-b85a-513b2005086e +version: 1 +author: Rod Soto +status: production +type: Anomaly +creation_date: '2026-07-06' +modification_date: '2026-07-06' +security_domain: endpoint +data_source: + - AWS Bedrock Claude +category: application +description: This detection identifies unusually large prompts sent to AWS Bedrock Claude models by calculating the statistical baseline of input token counts and flagging requests that exceed 15 standard deviations above the mean. Abnormally large prompts may indicate prompt injection attacks, data exfiltration attempts, or abuse of the AI service. +search: |- + `aws_bedrock_claude` + | rename "input.inputTokenCount" AS input_tokens + | rename "identity.arn" AS user_arn + | rename "accountId" AS account_id + | rex field=user_arn "assumed-role/[^/]+/(?<user>[^\"]+)$" + | eval input_tokens=tonumber(input_tokens) + | where input_tokens>0 + | eventstats avg(input_tokens) AS avg_tokens stdev(input_tokens) AS stdev + | where input_tokens > avg_tokens + (1*stdev) + | where input_tokens > 1000 + | table _time, modelId, user, user_arn, account_id, input_tokens, avg_tokens, host + | sort - input_tokens + | `aws_bedrock_claude_unusually_large_prompts_filter` +how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land. +known_false_positives: Possible false positives may arise from legitimate user interactions with the AI model that require large input prompts, such as complex queries or multi-turn conversations. It is important to review the context of the detected prompts to determine if they represent actual prompt injection attempts or benign usage. +references: + - https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/ + - https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock + - https://research.splunk.com/stories/aws_bedrock_security/ + - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html +drilldown_searches: + - name: View the detection results for - "$host$" + search: '%original_detection_search% | search host="$host$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$host$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: host + type: system + score: 20 + message: Unusually large prompt detected on $host$ with $input_tokens$ input tokens, exceeding the statistical baseline of $avg_tokens$ average tokens. +analytic_story: + - Suspicious AWS Bedrock Claude Activities +asset_type: Web Application +mitre_attack_id: + - T1055 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/aws_bedrock_claude/aws_bedrock_claude_unusually_large_prompts.ndjson + sourcetype: json_no_timestamp + source: http:bulkawsbedrock diff --git a/macros/aws_bedrock_claude.yml b/macros/aws_bedrock_claude.yml new file mode 100644 index 00000000000..77e371e4c30 --- /dev/null +++ b/macros/aws_bedrock_claude.yml @@ -0,0 +1,8 @@ +name: aws_bedrock_claude +id: a3b7c8d1-4e5f-6a7b-8c9d-0e1f2a3b4c5d +version: 1 +creation_date: '2026-05-19' +modification_date: '2026-05-19' +author: Rod Soto, Splunk +description: Customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +definition: (sourcetype="json_no_timestamp") diff --git a/schemas/Baseline.schema.json b/schemas/Baseline.schema.json index 015747f4cdd..c2d2d416def 100644 --- a/schemas/Baseline.schema.json +++ b/schemas/Baseline.schema.json @@ -10,6 +10,7 @@ "APT29 Diplomatic Deceptions with WINELOADER", "APT37 Rustonotto and FadeStealer", "ASL AWS CloudTrail", + "AWS Bedrock Claude", "AWS Bedrock Security", "AWS CloudTrail", "AWS CloudTrail AssumeRoleWithSAML", @@ -135,6 +136,7 @@ "BlackMatter Ransomware", "BlackSuit Ransomware", "BlankGrabber Stealer", + "BlueHammer", "Brand Monitoring", "Braodo Stealer", "Bro conn", @@ -181,10 +183,13 @@ "Cisco Network Visibility Module Analytics", "Cisco Network Visibility Module Flow Data", "Cisco Network Visibility Module OSquery", + "Cisco SD-WAN Auth Log", "Cisco SD-WAN NTCE 1000001", "Cisco SD-WAN Service Proxy Access Logs", "Cisco Secure Access Analytics", + "Cisco Secure Access DNS", "Cisco Secure Access Firewall", + "Cisco Secure Access Proxy", "Cisco Secure Firewall Threat Defense Analytics", "Cisco Secure Firewall Threat Defense Connection Event", "Cisco Secure Firewall Threat Defense File Event", @@ -307,6 +312,7 @@ "Linux Auditd Service Stop", "Linux Auditd Syscall", "Linux Living Off The Land", + "Linux Messages Syslog", "Linux Persistence Techniques", "Linux Post-Exploitation", "Linux Privilege Escalation", @@ -392,12 +398,14 @@ "Osquery Results", "Outlook RCE CVE-2024-21378", "PHP-CGI RCE Attack on Japanese Organizations", + "PTC Windchill Exploitation", "PXA Stealer", "Palo Alto Network Threat", "Palo Alto Network Traffic", "PaperCut MF NG Vulnerability", "PathWiper", "PetitPotam NTLM Relay on Active Directory Certificate Services", + "Phantom Stealer", "Phemedrone Stealer", "PingID", "PlugX", @@ -420,17 +428,20 @@ "Ransomware Cloud", "React2Shell", "RedLine Stealer", + "RedSun", "Remcos", "Remote Employment Fraud", "Remote Monitoring and Management Software", "Reverse Network Proxy", "Revil Ransomware", "Rhysida Ransomware", + "RoguePlanet", "Router and Infrastructure Security", "Ryuk Ransomware", "SAP NetWeaver Exploitation", "SQL Injection", "SQL Server Abuse", + "Salat Stealer", "Salt Typhoon", "SamSam Ransomware", "Sandworm Tools", @@ -456,12 +467,14 @@ "Splunk Stream HTTP", "Splunk Stream IP", "Splunk Stream TCP", + "Splunk Vulnerabilities", "Spring4Shell CVE-2022-22965", "StealC Stealer", "Storm-0501 Ransomware", "Storm-2460 CLFS Zero Day Exploitation", "Subvert Trust Controls SIP and Trust Provider Hijacking", "Suricata", + "Suspicious AWS Bedrock Claude Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", @@ -540,6 +553,7 @@ "WhisperGate", "WinDealer RAT", "WinRAR Spoofing Attack CVE-2023-38831", + "Windchill Log4j", "Windows Active Directory Admon", "Windows AppLocker", "Windows Attack Surface Reduction", @@ -596,6 +610,7 @@ "Windows Event Log Security 4703", "Windows Event Log Security 4719", "Windows Event Log Security 4720", + "Windows Event Log Security 4723", "Windows Event Log Security 4724", "Windows Event Log Security 4725", "Windows Event Log Security 4726", @@ -676,6 +691,9 @@ "applockereventcodes", "asr_rules", "attacker_tools", + "audit_searches", + "audittrail", + "aws_bedrock_claude", "aws_cloudwatchlogs_eks", "aws_config", "aws_description", @@ -696,6 +714,7 @@ "brand_abuse_dns", "brand_abuse_email", "brand_abuse_web", + "bro_ssl_json", "browser_app_list", "browser_process_and_path", "builtin_groups_lookup", @@ -707,6 +726,7 @@ "cisco_asa", "cisco_duo_activity", "cisco_duo_administrator", + "cisco_ios", "cisco_isovalent", "cisco_isovalent_allowed_images", "cisco_isovalent_process_connect", @@ -715,6 +735,8 @@ "cisco_networks", "cisco_sd_wan_service_proxy_access", "cisco_sd_wan_syslog", + "cisco_secure_access_dns", + "cisco_secure_access_proxy", "cisco_secure_firewall", "cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools", "cisco_secure_firewall_filetype_lookup", @@ -838,6 +860,7 @@ "osquery_macro", "osquery_process", "papercutng", + "path_traversal_spl_injection", "pingid", "potential_password_in_username_false_positive_reduction", "potentially_malicious_code_on_cmdline_tokenize_score", @@ -951,12 +974,24 @@ "s3_deletion_baseline", "sAMAccountName Spoofing and Domain Controller Impersonation", "scripting_tools_user_agents", + "secureapp_attack", "secureapp_es_field_mappings", "security_content_ctime", "security_content_summariesonly", "security_group_activity_baseline", "security_group_api_calls", "security_services_lookup", + "splunk_crash_log", + "splunk_python", + "splunk_risky_command", + "splunkd", + "splunkd_failed_auths", + "splunkd_investigation_rest_handler", + "splunkd_ui", + "splunkd_web", + "splunkd_webs", + "splunkd_webx", + "splunkda", "sslbl_ssl_certificate_blacklist", "stream_dns", "stream_http", @@ -978,6 +1013,7 @@ "typo_squatted_python_packages", "uacbypass_process_name", "uncommon_processes", + "windchill_log4j", "windows_exchange_iis", "windows_protocol_handlers", "windows_shells", @@ -1028,6 +1064,7 @@ "d141afeb-d2bc-4934-8dd5-b7dba0f9f67a", "e9fdb899-a980-4ba4-934b-486ad22e22f4", "8164a4a6-f99c-4661-ac4f-80f5e4e78d2b", + "ec9ab81c-8053-4957-8c66-0218381ab564", "46959285-906d-40fa-9437-5a439accd878", "68190529-069b-4ffc-a942-919704158065", "ec23cef9-27d9-46e4-a68d-6f75f7b86908", @@ -1092,6 +1129,7 @@ "d9efa6c7-6518-42b2-809a-4f2a8e242b9b", "251c5936-569f-42f4-9ac2-87a173b9e9b8", "78bd3fa7-773c-449e-a978-dc1f1500bc52", + "cec8ad4e-0320-4984-a1ae-70ee398c9519", "15f44ea9-4571-4837-be9e-802431a7bfae", "bf23c7dc-1004-4949-8262-4c1d1ef87702", "952931a4-af0b-4335-bbbe-73c8c5b327ae", @@ -1199,6 +1237,7 @@ "ac494fe5-81a4-4897-af42-e774cf005ecb", "b8a49f03-e3c4-40f2-b7bb-9e8f8fdddbf1", "3b7015f2-3144-4205-b799-b05580621379", + "7dd05b3e-0803-4852-9345-c494eb3e40fe", "191db57d-091a-47d5-99f3-97fde53de505", "ccf4ac39-ec93-42be-9035-90e2f26bcd92", "93c150f5-ad7b-4ee3-8992-df06dec2ac79", @@ -1231,8 +1270,8 @@ "94f6a1c9-aae7-46a4-9083-2bb1f5768ec4", "bac8a340-be64-4491-a0cc-0985cb227f5a", "234f9b7c-b53d-4f32-897b-b880a6c9ea7b", - "b8147c9a-84db-4ec1-8eee-4e0da75f0de5", "b877943f-0377-44f4-8477-f79db7f07c4d", + "b8147c9a-84db-4ec1-8eee-4e0da75f0de5", "54782d65-12f0-47a5-b4c1-b70ee23de6df", "e03ada14-0980-4107-aff1-7783b2b59bb1", "e7e3a525-7612-4d68-a5d3-c4649181b8af", @@ -1467,7 +1506,9 @@ "6326dbc4-444b-4c04-88f4-27e94d0327cb", "9ebe7901-7edf-45c0-b5c7-8366300919db", "8fe2ccfd-f079-4c03-b1a9-bd9b362b67d4", + "5fabf878-7dd4-48d3-9995-408fac68e166", "069258f4-2162-46e9-9a25-c9c6c56150d2", + "4383bbd3-aa6c-49fd-a1a9-cf112c95982c", "815bef8b-bf91-4b67-be4c-abe4c2a94ccc", "42510244-5019-48fa-a0e5-66c3b76e6049", "9d04efee-eff5-4240-b8d2-07792b873608", @@ -1577,6 +1618,7 @@ "bc15c13f-d121-4b1f-8c7d-28d95854d086", "281201e7-de41-4dc9-b73d-f288938cbb64", "eb121494-82d1-4148-9e2b-e624e03fbf3d", + "f0057c81-24dc-4a2e-b658-5809c242180b", "653d39cd-bae7-499a-898c-9fb96b8b5cd1", "7a48f482-246f-4aeb-9837-21c271ebf244", "486e88ea-4f56-470f-9b57-3f4d73f39133", @@ -1595,6 +1637,7 @@ "41274289-ec9c-4213-bea4-e43c4aa57954", "4963a81e-a3ad-4f02-adda-812343b351de", "d3415a0e-66ef-429b-acf4-a768876954f6", + "35ad6590-2207-4b14-bf8f-9899470d7156", "e2d85e66-cb66-4ed7-93b1-833fc56c9319", "86a43bad-12e3-4e85-b97c-4d5cf25b95c3", "49543237-25db-497b-90df-d0a0a6e8fe2c", @@ -1747,6 +1790,7 @@ "640cbf6d-659b-498b-ba53-f6dd1a1cc02c", "c3ed6d2a-e3ad-400d-ad78-bbfdbfeacc08", "abcde488-e083-4ee7-bc85-a5684edd7541", + "c666acd6-6ff5-4d28-9490-195d89cd4337", "d380c318-0b34-45cb-9dad-828c11891e43", "9e8894c0-50bd-4525-a96c-d4ac78ece388", "913c0e4e-4b37-4b78-ad0b-90e7b25010f6", @@ -2064,6 +2108,7 @@ "4c8db261-a58b-42a6-a866-0a294deedde4", "f0027655-25ef-47b0-acaf-3d83d106156c", "c75612b2-9de0-4d7c-879c-10d7b077072d", + "5696f417-30e5-4942-988d-0b9dcfe3a929", "d322cdd7-7d60-46e3-9111-648848da7c02", "a8568b10-9ab9-4140-a523-1c72e0176924", "33ca84bc-4259-4943-bd36-4655dc420932", @@ -2178,6 +2223,7 @@ "ae4b6361-b5f8-46cb-a3f9-9cf108ccfe7b", "394a538e-09bb-4a4a-95d1-b93cf12682a8", "1a02df58-09af-4064-a765-0babe1a0d1e2", + "40c44d16-bb49-4d14-aafa-f9ba7e6e6c5b", "4238a7f0-a980-4fff-98a2-dfc0a363d507", "00c652e2-0750-4ca6-82ff-0204684a6fe4", "58ed10e8-0738-4651-8408-3a3e9a526279", @@ -2210,6 +2256,7 @@ "5bec4cc8-f41e-437b-b417-33ff60acf9af", "a0c1725f-abcd-40d6-baac-020f3cf94ecd", "d1c73b96-ab87-4031-bad8-0e1b3b8bf3ec", + "3d9e332e-60c9-407a-af4c-a9ae43c4f1d0", "7c8c7bd8-0a5c-4514-a6a3-0814c5a98cf0", "a83ad6e8-6f24-4d7f-8f44-75f8ab742991", "7e7ac3ed-f795-4fa5-b711-09d6fbe9b873", @@ -2293,6 +2340,7 @@ "0315bdff-4178-47e9-81e4-f31a6d23f7e4", "736b4f53-f400-4c22-855d-1a6b5a551600", "114dd4e3-8d1c-4ea7-bb8d-8d8f6aca21f0", + "3f452c87-25b5-47c0-81d8-01908df1b927", "183235ca-8e6c-422c-88c2-3aa28c4825d9", "b4ca838d-d013-4461-bf2c-f7132617b409", "0b79c06f-c788-44a2-8630-d69051f1123d", @@ -2746,6 +2794,7 @@ "453acf13-1dbd-47d7-b28a-172ce9228023", "da4f751a-020b-40d7-b9ff-d433b7799803", "14033063-ee04-4eaf-8f5d-ba07ca7a097c", + "14bd90b1-c3f3-4115-9861-cf0519a59654", "8bec51da-7a6d-4346-b941-51eca448c4b0", "1d958c61-09c6-4d9e-b26b-4130314e520e", "12e03af7-79f9-4f95-af48-d3f12f28a260", @@ -2795,8 +2844,9 @@ "96db2632-8417-4dbb-b8bb-a8b92ba391de", "a50d5a97-2531-499e-a1de-5544c74432c6", "6cd715aa-20ac-4be1-a8f1-dda7bae160bd", - "44a4bedf-ffe3-452e-bee4-6925ab125662", + "50859b3b-b088-4c7b-973d-03a0365a9bf9", "16f6374f-7600-459a-9b16-6a88fd96d310", + "44a4bedf-ffe3-452e-bee4-6925ab125662", "e9584f82-322c-474a-b831-940fd8b4455c", "e6f36545-dc1e-47f0-9f48-7f730f54a02e", "52778a8f-a10b-41a4-9eae-52ddb74072bf", diff --git a/schemas/EventBasedDetection.schema.json b/schemas/EventBasedDetection.schema.json index a5ea1e46197..12491a3dfac 100644 --- a/schemas/EventBasedDetection.schema.json +++ b/schemas/EventBasedDetection.schema.json @@ -5,11 +5,54 @@ "enum": [ "0bj3ctivity Stealer", "3CX Supply Chain Attack", + "3CX Supply Chain Attack Network Indicators", "3cx_ioc_domains", + "7zip CommandLine To SMB Share Path", "AMOS Stealer", "APT29 Diplomatic Deceptions with WINELOADER", "APT37 Rustonotto and FadeStealer", "ASL AWS CloudTrail", + "ASL AWS Concurrent Sessions From Different Ips", + "ASL AWS Create Access Key", + "ASL AWS Create Policy Version to allow all resources", + "ASL AWS Credential Access GetPasswordData", + "ASL AWS Credential Access RDS Password reset", + "ASL AWS Defense Evasion Delete CloudWatch Log Group", + "ASL AWS Defense Evasion Delete Cloudtrail", + "ASL AWS Defense Evasion Impair Security Services", + "ASL AWS Defense Evasion PutBucketLifecycle", + "ASL AWS Defense Evasion Stop Logging Cloudtrail", + "ASL AWS Defense Evasion Update Cloudtrail", + "ASL AWS Detect Users creating keys with encrypt policy without MFA", + "ASL AWS Disable Bucket Versioning", + "ASL AWS EC2 Snapshot Shared Externally", + "ASL AWS ECR Container Upload Outside Business Hours", + "ASL AWS ECR Container Upload Unknown User", + "ASL AWS IAM AccessDenied Discovery Events", + "ASL AWS IAM Assume Role Policy Brute Force", + "ASL AWS IAM Delete Policy", + "ASL AWS IAM Failure Group Deletion", + "ASL AWS IAM Successful Group Deletion", + "ASL AWS Multi-Factor Authentication Disabled", + "ASL AWS Network Access Control List Created with All Open Ports", + "ASL AWS Network Access Control List Deleted", + "ASL AWS New MFA Method Registered For User", + "ASL AWS SAML Update identity provider", + "ASL AWS UpdateLoginProfile", + "AWS AMI Attribute Modification for Exfiltration", + "AWS Bedrock Claude", + "AWS Bedrock Claude Cross Region Possible Inference Abuse", + "AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation", + "AWS Bedrock Claude Hostile Prompt Sentiment", + "AWS Bedrock Claude Possible Prompt Injection", + "AWS Bedrock Claude Sensitive Data in Prompts", + "AWS Bedrock Claude Unusually Large Prompts", + "AWS Bedrock Claude excessive use of tokens", + "AWS Bedrock Delete GuardRails", + "AWS Bedrock Delete Knowledge Base", + "AWS Bedrock Delete Model Invocation Logging Configuration", + "AWS Bedrock High Number List Foundation Model Failures", + "AWS Bedrock Invoke Model Access Denied", "AWS Bedrock Security", "AWS CloudTrail", "AWS CloudTrail AssumeRoleWithSAML", @@ -70,25 +113,95 @@ "AWS CloudTrail UpdateTrail", "AWS CloudWatchLogs VPCflow", "AWS Cloudfront", + "AWS Concurrent Sessions From Different Ips", + "AWS Console Login Failed During MFA Challenge", + "AWS Create Policy Version to allow all resources", + "AWS CreateAccessKey", + "AWS CreateLoginProfile", + "AWS Credential Access Failed Login", + "AWS Credential Access GetPasswordData", + "AWS Credential Access RDS Password reset", "AWS Defense Evasion", + "AWS Defense Evasion Delete CloudWatch Log Group", + "AWS Defense Evasion Delete Cloudtrail", + "AWS Defense Evasion Impair Security Services", + "AWS Defense Evasion PutBucketLifecycle", + "AWS Defense Evasion Stop Logging Cloudtrail", + "AWS Defense Evasion Update Cloudtrail", + "AWS Detect Users creating keys with encrypt policy without MFA", + "AWS Detect Users with KMS keys performing encryption S3", + "AWS Disable Bucket Versioning", + "AWS EC2 Snapshot Shared Externally", + "AWS ECR Container Scanning Findings High", + "AWS ECR Container Scanning Findings Low Informational Unknown", + "AWS ECR Container Scanning Findings Medium", + "AWS ECR Container Upload Outside Business Hours", + "AWS ECR Container Upload Unknown User", + "AWS Excessive Security Scanning", + "AWS Exfiltration via Anomalous GetObject API Activity", + "AWS Exfiltration via Batch Service", + "AWS Exfiltration via Bucket Replication", + "AWS Exfiltration via DataSync Task", + "AWS Exfiltration via EC2 Snapshot", + "AWS High Number Of Failed Authentications For User", + "AWS High Number Of Failed Authentications From Ip", + "AWS IAM AccessDenied Discovery Events", + "AWS IAM Assume Role Policy Brute Force", + "AWS IAM Delete Policy", + "AWS IAM Failure Group Deletion", "AWS IAM Privilege Escalation", + "AWS IAM Successful Group Deletion", "AWS Identity and Access Management Account Takeover", + "AWS Lambda UpdateFunctionCode", + "AWS Multi-Factor Authentication Disabled", + "AWS Multiple Failed MFA Requests For User", + "AWS Multiple Users Failing To Authenticate From Ip", "AWS Network ACL Activity", + "AWS Network Access Control List Created with All Open Ports", + "AWS Network Access Control List Deleted", + "AWS New MFA Method Registered For User", + "AWS Password Policy Changes", "AWS S3 Bucket Security Monitoring", + "AWS S3 Exfiltration Behavior Identified", + "AWS SAML Update identity provider", "AWS Security Hub", "AWS Security Hub Alerts", + "AWS SetDefaultPolicyVersion", + "AWS Successful Console Authentication From Multiple IPs", + "AWS Successful Single-Factor Authentication", + "AWS Unusual Number of Failed Authentications From Ip", + "AWS UpdateLoginProfile", "AWS User Monitoring", "Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring", + "Access LSASS Memory for Dump Creation", + "Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint", "AcidPour", "AcidRain", "Active Directory Discovery", "Active Directory Kerberos Attacks", "Active Directory Lateral Movement", + "Active Directory Lateral Movement Identified", "Active Directory Password Spraying", "Active Directory Privilege Escalation", + "Active Directory Privilege Escalation Identified", + "Active Setup Registry Autostart", + "Add DefaultUser And Password In Registry", + "Add or Set Windows Defender Exclusion", + "Adobe ColdFusion Access Control Bypass", "Adobe ColdFusion Arbitrary Code Execution CVE-2023-29298 CVE-2023-26360", + "Adobe ColdFusion Unauthenticated Arbitrary File Read", + "AdsiSearcher Account Discovery", + "Advanced IP or Port Scanner Execution", "AgentTesla", + "Allow File And Printing Sharing In Firewall", + "Allow Inbound Traffic By Firewall Rule Registry", + "Allow Inbound Traffic In Firewall Rule", + "Allow Network Discovery In Firewall", + "Allow Operation with Consent Admin", "Amadey", + "Amazon EKS Kubernetes Pod scan detection", + "Amazon EKS Kubernetes cluster scan detection", + "Anomalous usage of 7zip", "Apache Struts Vulnerability", "Apache Tomcat Session Deserialization Attacks", "AppLocker", @@ -96,9 +209,57 @@ "Asset Tracking", "AsyncRAT", "Atlassian Confluence Server and Data Center CVE-2022-26134", + "Attacker Tools On Endpoint", + "Auto Admin Logon Registry Entry", "AwfulShred", "Axios Supply Chain Post Compromise", "Azorult", + "Azure AD Admin Consent Bypassed by Service Principal", + "Azure AD Application Administrator Role Assigned", + "Azure AD Authentication Failed During MFA Challenge", + "Azure AD AzureHound UserAgent Detected", + "Azure AD Block User Consent For Risky Apps Disabled", + "Azure AD Concurrent Sessions From Different Ips", + "Azure AD Device Code Authentication", + "Azure AD External Guest User Invited", + "Azure AD FullAccessAsApp Permission Assigned", + "Azure AD Global Administrator Role Assigned", + "Azure AD High Number Of Failed Authentications For User", + "Azure AD High Number Of Failed Authentications From Ip", + "Azure AD Multi-Factor Authentication Disabled", + "Azure AD Multi-Source Failed Authentications Spike", + "Azure AD Multiple AppIDs and UserAgents Authentication Spike", + "Azure AD Multiple Denied MFA Requests For User", + "Azure AD Multiple Failed MFA Requests For User", + "Azure AD Multiple Service Principals Created by SP", + "Azure AD Multiple Service Principals Created by User", + "Azure AD Multiple Users Failing To Authenticate From Ip", + "Azure AD New Custom Domain Added", + "Azure AD New Federated Domain Added", + "Azure AD New MFA Method Registered", + "Azure AD New MFA Method Registered For User", + "Azure AD OAuth Application Consent Granted By User", + "Azure AD PIM Role Assigned", + "Azure AD PIM Role Assignment Activated", + "Azure AD Privileged Authentication Administrator Role Assigned", + "Azure AD Privileged Graph API Permission Assigned", + "Azure AD Privileged Role Assigned", + "Azure AD Privileged Role Assigned to Service Principal", + "Azure AD Service Principal Authentication", + "Azure AD Service Principal Created", + "Azure AD Service Principal Enumeration", + "Azure AD Service Principal New Client Credentials", + "Azure AD Service Principal Owner Added", + "Azure AD Service Principal Privilege Escalation", + "Azure AD Successful Authentication From Different Ips", + "Azure AD Successful PowerShell Authentication", + "Azure AD Successful Single-Factor Authentication", + "Azure AD Tenant Wide Admin Consent Granted", + "Azure AD Unusual Number of Failed Authentications From Ip", + "Azure AD User Consent Blocked for Risky Application", + "Azure AD User Consent Denied for OAuth Application", + "Azure AD User Enabled And Password Reset", + "Azure AD User ImmutableId Attribute Updated", "Azure Active Directory", "Azure Active Directory Account Takeover", "Azure Active Directory Add app role assignment to service principal", @@ -109,6 +270,7 @@ "Azure Active Directory Consent to application", "Azure Active Directory Disable Strong Authentication", "Azure Active Directory Enable account", + "Azure Active Directory High Risk Sign-in", "Azure Active Directory Invite external user", "Azure Active Directory MicrosoftGraphActivityLogs", "Azure Active Directory NonInteractiveUserSignInLogs", @@ -124,8 +286,14 @@ "Azure Audit Create or Update an Azure Automation Runbook", "Azure Audit Create or Update an Azure Automation account", "Azure Audit Create or Update an Azure Automation webhook", + "Azure Automation Account Created", + "Azure Automation Runbook Created", "Azure Monitor Activity", + "Azure Runbook Webhook Created", + "BCDEdit Failure Recovery Modification", + "BITS Job Persistence", "BITS Jobs", + "BITSAdmin Download File", "Backdoor Pingpong", "Baron Samedit CVE-2021-3156", "Baseline Of Kubernetes Container Network IO", @@ -137,6 +305,8 @@ "Baseline of S3 Bucket deletion activity by ARN", "Baseline of Security Group Activity by ARN", "Baseline of blocked outbound traffic from AWS", + "Batch File Write to System32", + "Bcdedit Command Back To Normal Mode Boot", "BishopFox Sliver Adversary Emulation Framework", "Black Basta Ransomware", "BlackByte Ransomware", @@ -144,6 +314,7 @@ "BlackMatter Ransomware", "BlackSuit Ransomware", "BlankGrabber Stealer", + "BlueHammer", "Brand Monitoring", "Braodo Stealer", "Bro conn", @@ -164,6 +335,10 @@ "CISA AA22-320A", "CISA AA23-347A", "CISA AA24-241A", + "CMD Carry Out String Command Parameter", + "CMD Echo Pipe - Escalation", + "CMLUA Or CMSTPLUA UAC Bypass", + "CSC Net On The Fly Compilation", "CVE-2022-40684 Fortinet Appliance Auth bypass", "CVE-2023-21716 Word RTF Heap Corruption", "CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server", @@ -172,65 +347,242 @@ "Cactus Ransomware", "Caddy Wiper", "Castle RAT", + "CertUtil With Decode Argument", + "Certutil exe certificate extraction", + "Change To Safe Mode With Network Config", "Chaos Ransomware", + "Check Elevated CMD using whoami", + "Child Processes of Spoolsv exe", "China-Nexus Threat Activity", + "Circle CI Disable Security Job", + "Circle CI Disable Security Step", "CircleCI", "Cisco AI Defense Alerts", + "Cisco AI Defense Security Alerts by Application Name", + "Cisco ASA - AAA Policy Tampering", + "Cisco ASA - Core Syslog Message Volume Drop", + "Cisco ASA - Device File Copy Activity", + "Cisco ASA - Device File Copy to Remote Location", + "Cisco ASA - Logging Disabled via CLI", + "Cisco ASA - Logging Filters Configuration Tampering", + "Cisco ASA - Logging Message Suppression", + "Cisco ASA - New Local User Account Created", + "Cisco ASA - Packet Capture Activity", + "Cisco ASA - Reconnaissance Command Activity", + "Cisco ASA - User Account Deleted From Local Database", + "Cisco ASA - User Account Lockout Threshold Exceeded", + "Cisco ASA - User Privilege Level Change", "Cisco ASA Logs", "Cisco Catalyst SD-WAN Analytics", + "Cisco Configuration Archive Logging Analysis", "Cisco Duo Activity", + "Cisco Duo Admin Login Unusual Browser", + "Cisco Duo Admin Login Unusual Country", + "Cisco Duo Admin Login Unusual Os", "Cisco Duo Administrator", + "Cisco Duo Bulk Policy Deletion", + "Cisco Duo Bypass Code Generation", + "Cisco Duo Policy Allow Devices Without Screen Lock", + "Cisco Duo Policy Allow Network Bypass 2FA", + "Cisco Duo Policy Allow Old Flash", + "Cisco Duo Policy Allow Old Java", + "Cisco Duo Policy Allow Tampered Devices", + "Cisco Duo Policy Bypass 2FA", + "Cisco Duo Policy Deny Access", + "Cisco Duo Policy Skip 2FA for Other Countries", + "Cisco Duo Set User Status to Bypass 2FA", "Cisco Duo Suspicious Activity", "Cisco IOS Logs", + "Cisco IOS Suspicious Privileged Account Creation", + "Cisco IOS XE Guestshell Activation and Destroy", + "Cisco IOS XE Implant Access", + "Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal", + "Cisco IOS XE Reconnaissance Command Activity", + "Cisco IOS XE Remote Access Probe Burst", + "Cisco IOS XE Request Platform Package Describe Shell Pattern", "Cisco IOS XE Software Web Management User Interface vulnerability", + "Cisco IOS XE Tunnel Interface Configuration", + "Cisco IOS XE VTY Access Class Tampering", + "Cisco IOS XE WebUI Login From IOSd Local Port", + "Cisco IOS XE WebUI Programmatic Configuration", + "Cisco Isovalent - Access To Cloud Metadata Service", + "Cisco Isovalent - Cron Job Creation", + "Cisco Isovalent - Curl Execution With Insecure Flags", + "Cisco Isovalent - Kprobe Spike", + "Cisco Isovalent - Late Process Execution", + "Cisco Isovalent - Non Allowlisted Image Use", + "Cisco Isovalent - Nsenter Usage in Kubernetes Pod", + "Cisco Isovalent - Pods Running Offensive Tools", + "Cisco Isovalent - Potential Escape to Host", + "Cisco Isovalent - Shell Execution", "Cisco Isovalent Process Connect", "Cisco Isovalent Process Exec", "Cisco Isovalent Process Kprobe", "Cisco Isovalent Suspicious Activity", + "Cisco NVM - Curl Execution With Insecure Flags", + "Cisco NVM - Installation of Typosquatted Python Package", + "Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI", + "Cisco NVM - Non-Network Binary Making Network Connection", + "Cisco NVM - Outbound Connection to Suspicious Port", + "Cisco NVM - Rclone Execution With Network Activity", + "Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download", + "Cisco NVM - Susp Script From Archive Triggering Network Activity", + "Cisco NVM - Suspicious Download From File Sharing Website", + "Cisco NVM - Suspicious File Download via Headless Browser", + "Cisco NVM - Suspicious Network Connection From Process With No Args", + "Cisco NVM - Suspicious Network Connection Initiated via MsXsl", + "Cisco NVM - Suspicious Network Connection to IP Lookup Service API", + "Cisco NVM - Webserver Download From File Sharing Website", + "Cisco Network Interface Modifications", "Cisco Network Visibility Module Analytics", "Cisco Network Visibility Module Flow Data", "Cisco Network Visibility Module OSquery", + "Cisco Privileged Account Creation with HTTP Command Execution", + "Cisco Privileged Account Creation with Suspicious SSH Activity", + "Cisco SA - Access to Anonymizer Services", + "Cisco SA - Automated Web Reconnaissance via HTTP Access Errors", + "Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity", + "Cisco SD-WAN - Low Frequency Rogue Peer", + "Cisco SD-WAN - Peering Activity", + "Cisco SD-WAN - Uncommon User-Agent Multi-URI Activity", + "Cisco SD-WAN Auth Log", + "Cisco SD-WAN Multiple SSH key Authentication from Same Source", + "Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication", "Cisco SD-WAN NTCE 1000001", "Cisco SD-WAN Service Proxy Access Logs", + "Cisco SNMP Community String Configuration Changes", "Cisco Secure Access Analytics", + "Cisco Secure Access DNS", "Cisco Secure Access Firewall", + "Cisco Secure Access Proxy", + "Cisco Secure Firewall - Binary File Type Download", + "Cisco Secure Firewall - Bits Network Activity", + "Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint", + "Cisco Secure Firewall - Blocked Connection", + "Cisco Secure Firewall - Citrix NetScaler Memory Overread Attempt", + "Cisco Secure Firewall - Communication Over Suspicious Ports", + "Cisco Secure Firewall - Connection to File Sharing Domain", + "Cisco Secure Firewall - File Download Over Uncommon Port", + "Cisco Secure Firewall - High EVE Threat Confidence", + "Cisco Secure Firewall - High Priority Intrusion Classification", + "Cisco Secure Firewall - High Volume of Intrusion Events Per Host", + "Cisco Secure Firewall - Intrusion Events by Threat Activity", + "Cisco Secure Firewall - Lumma Stealer Activity", + "Cisco Secure Firewall - Lumma Stealer Download Attempt", + "Cisco Secure Firewall - Lumma Stealer Outbound Connection Attempt", + "Cisco Secure Firewall - Malware File Downloaded", + "Cisco Secure Firewall - Oracle E-Business Suite Correlation", + "Cisco Secure Firewall - Oracle E-Business Suite Exploitation", + "Cisco Secure Firewall - Possibly Compromised Host", + "Cisco Secure Firewall - Potential Data Exfiltration", + "Cisco Secure Firewall - Privileged Command Execution via HTTP", + "Cisco Secure Firewall - Rare Snort Rule Triggered", + "Cisco Secure Firewall - React Server Components RCE Attempt", + "Cisco Secure Firewall - Remote Access Software Usage Traffic", + "Cisco Secure Firewall - Repeated Blocked Connections", + "Cisco Secure Firewall - Repeated Malware Downloads", + "Cisco Secure Firewall - SSH Connection to Non-Standard Port", + "Cisco Secure Firewall - SSH Connection to sshd_operns", + "Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts", + "Cisco Secure Firewall - Static Tundra Smart Install Abuse", + "Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity", + "Cisco Secure Firewall - Wget or Curl Download", "Cisco Secure Firewall Threat Defense Analytics", "Cisco Secure Firewall Threat Defense Connection Event", "Cisco Secure Firewall Threat Defense File Event", "Cisco Secure Firewall Threat Defense Intrusion Event", + "Cisco Smart Install Oversized Packet Detection", + "Cisco Smart Install Port Discovery and Status", "Cisco Smart Install Remote Code Execution CVE-2018-0171", + "Cisco TFTP Server Configuration for Data Exfiltration", + "Citrix ADC Exploitation CVE-2023-3519", + "Citrix ADC and Gateway CitrixBleed 2 Memory Disclosure", + "Citrix ADC and Gateway Unauthorized Data Disclosure", "Citrix NetScaler ADC and NetScaler Gateway CVE-2023-4966", "Citrix NetScaler ADC and NetScaler Gateway CVE-2025-5777", "Citrix Netscaler ADC CVE-2023-3519", + "Citrix ShareFile Exploitation CVE-2023-24489", "Citrix ShareFile RCE CVE-2023-24489", + "Clear Unallocated Sector Using Cipher App", "Cleo File Transfer Software", + "Clop Common Exec Parameter", "Clop Ransomware", + "Clop Ransomware Known Service Name", + "Cloud API Calls From Previously Unseen User Roles", + "Cloud Compute Instance Created By Previously Unseen User", + "Cloud Compute Instance Created In Previously Unused Region", + "Cloud Compute Instance Created With Previously Unseen Image", + "Cloud Compute Instance Created With Previously Unseen Instance Type", "Cloud Cryptomining", "Cloud Federated Credential Abuse", + "Cloud Instance Modified By Previously Unseen User", + "Cloud Provisioning Activity From Previously Unseen City", + "Cloud Provisioning Activity From Previously Unseen Country", + "Cloud Provisioning Activity From Previously Unseen IP Address", + "Cloud Provisioning Activity From Previously Unseen Region", + "Cloud Security Groups Modifications by User", "Cobalt Strike", "ColdRoot MacOS RAT", "Collection and Staging", "Command And Control", + "Common Ransomware Extensions", + "Common Ransomware Notes", "Compromised Linux Host", "Compromised User Account", "Compromised Windows Host", + "Confluence CVE-2023-22515 Trigger Vulnerability", "Confluence Data Center and Confluence Server Vulnerabilities", + "Confluence Data Center and Server Privilege Escalation", + "Confluence Pre-Auth RCE via OGNL Injection CVE-2023-22527", + "Confluence Unauthenticated Remote Code Execution CVE-2022-26134", + "ConnectWise ScreenConnect Authentication Bypass", + "ConnectWise ScreenConnect Path Traversal", + "ConnectWise ScreenConnect Path Traversal Windows SACL", "ConnectWise ScreenConnect Vulnerabilities", + "Conti Common Exec parameter", + "Control Loading from World Writable Directory", "Count of Unique IPs Connecting to Ports", "Count of assets by category", + "Create Remote Thread In Shell Application", + "Create Remote Thread into LSASS", "Create a list of approved AWS service accounts", + "Create or delete windows shares using net exe", + "Creation of Shadow Copy", + "Creation of Shadow Copy with wmic and powershell", + "Creation of lsass Dump with Taskmgr", "Credential Dumping", + "Credential Dumping via Copy Command from Shadow Copy", + "Credential Dumping via Symlink to Shadow Copy", "Critical Alerts", "CrowdStrike Falcon Stream Alert", + "CrowdStrike Falcon Stream Alerts", "CrowdStrike ProcessRollup2", + "Crowdstrike Admin Weak Password Policy", + "Crowdstrike Admin With Duplicate Password", + "Crowdstrike High Identity Risk Severity", + "Crowdstrike Medium Identity Risk Severity", + "Crowdstrike Medium Severity Alert", + "Crowdstrike Multiple LOW Severity Alerts", + "Crowdstrike Privilege Escalation For Non-Admin User", + "Crowdstrike User Weak Password Policy", + "Crowdstrike User with Duplicate Password", "CrushFTP", + "CrushFTP Authentication Bypass Exploitation", + "CrushFTP Max Simultaneous Users From IP", + "CrushFTP Server Side Template Injection", "CrushFTP Vulnerabilities", "Crypto Stealer", + "Curl Execution with Percent Encoded URL", "Cyclops Blink", "DHS Report TA18-074A", + "DLLHost with no Command Line Arguments with Network", "DNS Amplification Attacks", + "DNS Exfiltration Using Nslookup App", "DNS Hijacking", + "DNS Kerberos Coercion", + "DNS Query Length With High Standard Deviation", "DNSTwist Domain Names", + "DSQuery Domain Discovery", "DarkCrystal RAT", "DarkGate Malware", "DarkSide Ransomware", @@ -240,129 +592,723 @@ "Default Baseline", "Default EventBasedDetection", "Defense Evasion or Unauthorized Access Via SDDL Tampering", + "Delete ShadowCopy With PowerShell", + "Deleting Shadow Copies", "Deobfuscate-Decode Files or Information", "Derusbi", + "Detect ARP Poisoning", + "Detect AWS Console Login by New User", + "Detect AWS Console Login by User from New City", + "Detect AWS Console Login by User from New Country", + "Detect AWS Console Login by User from New Region", + "Detect AzureHound Command-Line Arguments", + "Detect AzureHound File Modifications", + "Detect Baron Samedit CVE-2021-3156", + "Detect Baron Samedit CVE-2021-3156 Segfault", + "Detect Baron Samedit CVE-2021-3156 via OSQuery", + "Detect Certify Command Line Arguments", + "Detect Certify With PowerShell Script Block Logging", + "Detect Certipy File Modifications", + "Detect Computer Changed with Anonymous Account", + "Detect Copy of ShadowCopy with Script Block Logging", + "Detect Credential Dumping through LSASS access", + "Detect DNS Query to Decommissioned S3 Bucket", + "Detect Distributed Password Spray Attempts", + "Detect Empire with PowerShell Script Block Logging", + "Detect Excessive Account Lockouts From Endpoint", + "Detect Excessive User Account Lockouts", + "Detect Exchange Web Shell", + "Detect F5 TMUI RCE CVE-2020-5902", + "Detect GCP Storage access from a new IP", + "Detect HTML Help Renamed", + "Detect HTML Help Spawn Child Process", + "Detect HTML Help URL in Command Line", + "Detect HTML Help Using InfoTech Storage Handlers", + "Detect IPv6 Network Infrastructure Threats", + "Detect Large ICMP Traffic", + "Detect MSHTA Url in Command Line", + "Detect Mimikatz With PowerShell Script Block Logging", + "Detect New Local Admin account", + "Detect New Login Attempts to Routers", + "Detect New Open GCP Storage Buckets", + "Detect New Open S3 Buckets over AWS CLI", + "Detect New Open S3 buckets", + "Detect Outbound LDAP Traffic", + "Detect Outbound SMB Traffic", + "Detect Outlook exe writing a zip file", + "Detect Password Spray Attack Behavior From Source", + "Detect Password Spray Attack Behavior On User", + "Detect Password Spray Attempts", + "Detect Path Interception By Creation Of program exe", + "Detect Port Security Violation", + "Detect Prohibited Applications Spawning cmd exe", + "Detect PsExec With accepteula Flag", + "Detect RClone Command-Line Usage", + "Detect RTLO In File Name", + "Detect RTLO In Process", + "Detect Rare Executables", + "Detect Regasm Spawning a Process", + "Detect Regasm with Network Connection", + "Detect Regasm with no Command Line Arguments", + "Detect Regsvcs Spawning a Process", + "Detect Regsvcs with Network Connection", + "Detect Regsvcs with No Command Line Arguments", + "Detect Regsvr32 Application Control Bypass", + "Detect Remote Access Software Usage DNS", + "Detect Remote Access Software Usage File", + "Detect Remote Access Software Usage FileInfo", + "Detect Remote Access Software Usage Process", + "Detect Remote Access Software Usage Registry", + "Detect Remote Access Software Usage Traffic", + "Detect Remote Access Software Usage URL", + "Detect Renamed 7-Zip", + "Detect Renamed PSExec", + "Detect Renamed RClone", + "Detect Renamed WinRAR", + "Detect Rogue DHCP Server", + "Detect Rundll32 Inline HTA Execution", + "Detect S3 access from a new IP", + "Detect SNICat SNI Exfiltration", + "Detect SharpHound Command-Line Arguments", + "Detect SharpHound File Modifications", + "Detect SharpHound Usage", + "Detect Software Download To Network Device", + "Detect Spike in AWS Security Hub Alerts for EC2 Instance", + "Detect Spike in AWS Security Hub Alerts for User", + "Detect Spike in S3 Bucket deletion", + "Detect Spike in blocked Outbound Traffic from your AWS", + "Detect Traffic Mirroring", + "Detect Unauthorized Assets by MAC address", + "Detect Use of cmd exe to Launch Script Interpreters", + "Detect WMI Event Subscription Persistence", + "Detect Web Access to Decommissioned S3 Bucket", + "Detect Windows DNS SIGRed via Splunk Stream", + "Detect Windows DNS SIGRed via Zeek", "Detect Zerologon Attack", + "Detect Zerologon via Zeek", + "Detect attackers scanning for vulnerable JBoss servers", + "Detect hosts connecting to dynamic domain providers", + "Detect malicious requests to exploit JBoss servers", + "Detect mshta inline hta execution", + "Detect mshta renamed", + "Detection of tools built by NirSoft", "Dev Sec Ops", + "Disable AMSI Through Registry", + "Disable Defender AntiVirus Registry", + "Disable Defender BlockAtFirstSeen Feature", + "Disable Defender Enhanced Notification", + "Disable Defender MpEngine Registry", + "Disable Defender Spynet Reporting", + "Disable Defender Submit Samples Consent Feature", + "Disable ETW Through Registry", + "Disable Logs Using WevtUtil", + "Disable Registry Tool", + "Disable Schedule Task", + "Disable Security Logs Using MiniNt Registry", + "Disable Show Hidden Files", + "Disable UAC Remote Restriction", + "Disable Windows App Hotkeys", + "Disable Windows Behavior Monitoring", + "Disable Windows SmartScreen Protection", + "Disabled Kerberos Pre-Authentication Discovery With Get-ADUser", + "Disabled Kerberos Pre-Authentication Discovery With PowerView", + "Disabling CMD Application", + "Disabling ControlPanel", + "Disabling Defender Services", + "Disabling Firewall with Netsh", + "Disabling FolderOptions Windows Feature", + "Disabling NoRun Windows App", + "Disabling Remote User Account Control", "Disabling Security Tools", + "Disabling SystemRestore In Registry", + "Disabling Task Manager", + "Disabling Windows Local Security Authority Defences via Registry", "Discover DNS records", "Disk Wiper", + "Domain Account Discovery with Dsquery", + "Domain Account Discovery with Wmic", + "Domain Controller Discovery with Nltest", + "Domain Controller Discovery with Wmic", + "Domain Group Discovery With Dsquery", + "Domain Group Discovery With Wmic", + "Domain Group Discovery with Adsisearcher", "Domain Trust Discovery", "Double Zero Destructor", + "Download Files Using Telegram", + "Drop IcedID License dat", + "Dump LSASS via comsvcs DLL", + "Dump LSASS via procdump", "Dynamic DNS", "DynoWiper", + "ESXi Account Modified", + "ESXi Audit Tampering", + "ESXi Bulk VM Termination", + "ESXi Download Errors", + "ESXi Encryption Settings Modified", + "ESXi External Root Login Activity", + "ESXi Firewall Disabled", + "ESXi Lockdown Mode Disabled", + "ESXi Loghost Config Tampering", + "ESXi Malicious VIB Forced Install", "ESXi Post Compromise", + "ESXi Reverse Shell Patterns", + "ESXi SSH Brute Force", + "ESXi SSH Enabled", + "ESXi Sensitive Files Accessed", + "ESXi Shared or Stolen Root Account", + "ESXi Shell Access Enabled", + "ESXi Syslog Config Change", + "ESXi System Clock Manipulation", + "ESXi System Information Discovery", + "ESXi User Granted Admin Role", + "ESXi VIB Acceptance Level Tampering", + "ESXi VM Discovery", + "ESXi VM Exported via Remote Tool", + "ETW Registry Disabled", "Earth Alux", + "Elevated Group Discovery With Wmic", + "Elevated Group Discovery with PowerView", + "Email Attachments With Lots Of Spaces", + "Email files written outside of the Outlook directory", + "Email servers sending high volume traffic to hosts", "Emotet Malware DHS Report TA18-201A", + "Enable RDP In Other Port Number", + "Enable WDigest UseLogonCredential Registry", + "Enumerate Users Local Group Using Telegram", + "Esentutl SAM Copy", + "Eventvwr UAC Bypass", + "Excessive Attempt To Disable Services", + "Excessive DNS Failures", + "Excessive File Deletion In WinDefender Folder", + "Excessive Usage Of Cacls App", + "Excessive Usage Of SC Service Utility", + "Excessive Usage Of Taskkill", + "Excessive Usage of NSLOOKUP App", + "Excessive distinct processes from Windows Temp", + "Excessive number of service control start as disabled", + "Excessive number of taskhost processes", + "Exchange PowerShell Abuse via SSRF", + "Exchange PowerShell Module Usage", + "Executable File Written in Administrative SMB Share", + "Executables Or Script Creation In Suspicious Path", + "Executables Or Script Creation In Temp Path", + "Execute Javascript With Jscript COM CLSID", + "Execution of File with Multiple Extensions", + "Exploit Public Facing Application via Apache Commons Text", + "Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952", "F5 Authentication Bypass with TMUI", "F5 BIG-IP Vulnerability CVE-2022-1388", + "F5 BIG-IP iControl REST Vulnerability CVE-2022-1388", + "F5 TMUI Authentication Bypass", "F5 TMUI RCE CVE-2020-5902", "FIN7", "Fake CAPTCHA Campaigns", + "File Download or Read to Pipe Execution", + "File with Samsam Extension", + "Firewall Allowed Program Enable", + "First Time Seen Child Process of Zoom", + "First Time Seen Running Windows Service", "Flax Typhoon", + "FodHelper UAC Bypass", "Forest Blizzard", + "Fortinet Appliance Auth bypass", "Fortinet FortiNAC CVE-2022-39952", + "Fsutil Zeroing File", "G Suite Drive", "G Suite Gmail", "GCP Account Takeover", + "GCP Authentication Failed During MFA Challenge", "GCP Cross Account Activity", + "GCP Detect gcploit framework", + "GCP Kubernetes cluster pod scan detection", + "GCP Multi-Factor Authentication Disabled", + "GCP Multiple Failed MFA Requests For User", + "GCP Multiple Users Failing To Authenticate From Ip", + "GCP Successful Single-Factor Authentication", + "GCP Unusual Number of Failed Authentications From Ip", + "GPUpdate with no Command Line Arguments with Network", + "GSuite Email Suspicious Attachment", + "Gdrive suspicious file sharing", + "Geographic Improbable Location", + "Get ADDefaultDomainPasswordPolicy with Powershell", + "Get ADDefaultDomainPasswordPolicy with Powershell Script Block", + "Get ADUser with PowerShell", + "Get ADUser with PowerShell Script Block", + "Get ADUserResultantPasswordPolicy with Powershell", + "Get ADUserResultantPasswordPolicy with Powershell Script Block", + "Get DomainPolicy with Powershell", + "Get DomainPolicy with Powershell Script Block", + "Get DomainUser with PowerShell", + "Get DomainUser with PowerShell Script Block", + "Get WMIObject Group Discovery", + "Get WMIObject Group Discovery with Script Block Logging", + "Get-DomainTrust with PowerShell", + "Get-DomainTrust with PowerShell Script Block", + "Get-ForestTrust with PowerShell", + "Get-ForestTrust with PowerShell Script Block", + "GetAdComputer with PowerShell", + "GetAdComputer with PowerShell Script Block", + "GetAdGroup with PowerShell", + "GetAdGroup with PowerShell Script Block", + "GetCurrent User with PowerShell", + "GetCurrent User with PowerShell Script Block", + "GetDomainComputer with PowerShell", + "GetDomainComputer with PowerShell Script Block", + "GetDomainController with PowerShell", + "GetDomainController with PowerShell Script Block", + "GetDomainGroup with PowerShell", + "GetDomainGroup with PowerShell Script Block", + "GetLocalUser with PowerShell", + "GetLocalUser with PowerShell Script Block", + "GetNetTcpconnection with PowerShell", + "GetNetTcpconnection with PowerShell Script Block", + "GetWmiObject DS User with PowerShell", + "GetWmiObject DS User with PowerShell Script Block", + "GetWmiObject Ds Computer with PowerShell", + "GetWmiObject Ds Computer with PowerShell Script Block", + "GetWmiObject Ds Group with PowerShell", + "GetWmiObject Ds Group with PowerShell Script Block", + "GetWmiObject User Account with PowerShell", + "GetWmiObject User Account with PowerShell Script Block", "Gh0st RAT", "GhostRedirector IIS Module and Rungan Backdoor", "GitHub Enterprise Audit Logs", + "GitHub Enterprise Delete Branch Ruleset", + "GitHub Enterprise Disable 2FA Requirement", + "GitHub Enterprise Disable Audit Log Event Stream", + "GitHub Enterprise Disable Classic Branch Protection Rule", + "GitHub Enterprise Disable Dependabot", + "GitHub Enterprise Disable IP Allow List", + "GitHub Enterprise Modify Audit Log Event Stream", + "GitHub Enterprise Pause Audit Log Event Stream", + "GitHub Enterprise Register Self Hosted Runner", + "GitHub Enterprise Remove Organization", + "GitHub Enterprise Repository Archived", + "GitHub Enterprise Repository Deleted", "GitHub Malicious Activity", "GitHub Organizations Audit Logs", + "GitHub Organizations Delete Branch Ruleset", + "GitHub Organizations Disable 2FA Requirement", + "GitHub Organizations Disable Classic Branch Protection Rule", + "GitHub Organizations Disable Dependabot", + "GitHub Organizations Repository Archived", + "GitHub Organizations Repository Deleted", "GitHub Webhooks", + "GitHub Workflow File Creation or Modification", "Gomir", "Google Workspace", "Google Workspace login_failure", "Google Workspace login_success", "Gozi Malware", "Graceful Wipe Out Attack", + "Gsuite Drive Share In External Email", + "Gsuite Email Suspicious Subject With Attachment", + "Gsuite Email With Known Abuse Web Service Link", + "Gsuite Outbound Email With Attachment To External Domain", + "Gsuite Suspicious Shared File Name", + "Gsuite suspicious calendar invite", "HAFNIUM Group", + "HTTP C2 Framework User Agent", + "HTTP Duplicated Header", + "HTTP Malware User Agent", + "HTTP PUA User Agent", + "HTTP Possible Request Smuggling", + "HTTP RMM User Agent", + "HTTP Rapid POST with Mixed Status Codes", "HTTP Request Smuggling", + "HTTP Request to Reserved Name on IIS Server", + "HTTP Scripting Tool User Agent", "Handala Wiper", + "Headless Browser Mockbin or Mocky Request", + "Headless Browser Usage", "Hellcat Ransomware", "Hermetic Wiper", "Hidden Cobra Malware", + "Hide User Account From Sign-In Screen", + "Hiding Files And Directories With Attrib exe", + "High Frequency Copy Of Files In Network Share", + "High Number of Login Failures from a single source", + "High Process Termination Frequency", + "High Volume of Bytes Out to Url", + "Hosts receiving high volume of network traffic from email server", + "Hunting 3CXDesktopApp Software", + "Hunting for Log4Shell", + "ICACLS Grant Command", "IIS Components", + "Icacls Deny Command", "IcedID", + "IcedID Exfiltrated Archived File Creation", "Identify Systems Creating Remote Desktop Traffic", "Identify Systems Receiving Remote Desktop Traffic", "Identify Systems Using Remote Desktop", + "Impacket Lateral Movement Commandline Parameters", + "Impacket Lateral Movement WMIExec Commandline Parameters", + "Impacket Lateral Movement smbexec CommandLine Parameters", "Industroyer2", "Information Sabotage", "Ingress Tool Transfer", "Insider Threat", + "Interactive Session on Remote Endpoint with PowerShell", "Interlock Ransomware", "Interlock Rat", + "Internal Horizontal Port Scan", + "Internal Horizontal Port Scan NMAP Top 20", + "Internal Vertical Port Scan", + "Internal Vulnerability Scan", + "Ivanti Connect Secure Command Injection Attempts", + "Ivanti Connect Secure SSRF in SAML Component", + "Ivanti Connect Secure System Information Access via Auth Bypass", "Ivanti Connect Secure VPN Vulnerabilities", + "Ivanti EPM SQL Injection Remote Code Execution", "Ivanti EPM Vulnerabilities", + "Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078", + "Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082", "Ivanti EPMM Remote Unauthenticated Access", "Ivanti Sentry Authentication Bypass CVE-2023-38035", "Ivanti VTM Audit", + "Ivanti VTM New Account Creation", "Ivanti Virtual Traffic Manager CVE-2024-7593", "JBoss Vulnerability", + "Java Class File download by Java User Agent", + "Java Writing JSP File", + "Jenkins Arbitrary File Read CVE-2024-23897", "Jenkins Server Vulnerabilities", + "JetBrains TeamCity Authentication Bypass CVE-2024-27198", + "JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198", + "JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199", + "JetBrains TeamCity RCE Attempt", "JetBrains TeamCity Unauthenticated RCE", "JetBrains TeamCity Vulnerabilities", + "Jscript Execution Using Cscript App", "Juniper JunOS Remote Code Execution", + "Juniper Networks Remote Code Execution Exploit Detection", + "Kerberoasting spn request with RC4 encryption", "Kerberos Coercion with DNS", + "Kerberos Pre-Authentication Flag Disabled in UserAccountControl", + "Kerberos Pre-Authentication Flag Disabled with PowerShell", + "Kerberos Service Ticket Request Using RC4 Encryption", + "Kerberos TGT Request Using RC4 Encryption", + "Kerberos User Enumeration", + "Kubernetes AWS detect suspicious kubectl calls", + "Kubernetes Abuse of Secret by Unusual Location", + "Kubernetes Abuse of Secret by Unusual User Agent", + "Kubernetes Abuse of Secret by Unusual User Group", + "Kubernetes Abuse of Secret by Unusual User Name", + "Kubernetes Access Scanning", + "Kubernetes Anomalous Inbound Network Activity from Process", + "Kubernetes Anomalous Inbound Outbound Network IO", + "Kubernetes Anomalous Inbound to Outbound Network IO Ratio", + "Kubernetes Anomalous Outbound Network Activity from Process", + "Kubernetes Anomalous Traffic on Network Edge", "Kubernetes Audit", + "Kubernetes Create or Update Privileged Pod", + "Kubernetes Cron Job Creation", + "Kubernetes DaemonSet Deployed", "Kubernetes Falco", + "Kubernetes Falco Shell Spawned", + "Kubernetes Nginx Ingress LFI", + "Kubernetes Nginx Ingress RFI", + "Kubernetes Node Port Creation", + "Kubernetes Pod Created in Default Namespace", + "Kubernetes Pod With Host Network Attachment", + "Kubernetes Previously Unseen Container Image Name", + "Kubernetes Previously Unseen Process", + "Kubernetes Process Running From New Path", + "Kubernetes Process with Anomalous Resource Utilisation", + "Kubernetes Process with Resource Ratio Anomalies", + "Kubernetes Scanner Image Pulling", "Kubernetes Scanning Activity", + "Kubernetes Scanning by Unauthenticated IP Address", "Kubernetes Security", "Kubernetes Sensitive Object Access Activity", + "Kubernetes Shell Running on Worker Node", + "Kubernetes Shell Running on Worker Node with CPU Activity", + "Kubernetes Suspicious Image Pulling", + "Kubernetes Unauthorized Access", + "Kubernetes newly seen TCP edge", + "Kubernetes newly seen UDP edge", "LAMEHUG", + "LLM Model File Creation", + "LOLBAS With Network Traffic", + "Large Volume of DNS ANY Queries", + "Linux APT Privilege Escalation", + "Linux AWK Privilege Escalation", + "Linux Account Manipulation Of SSH Config and Keys", + "Linux Add Files In Known Crontab Directories", + "Linux Add User Account", + "Linux Adding Crontab Using List Parameter", + "Linux At Allow Config File Creation", + "Linux At Application Execution", + "Linux Auditd AI CLI Permission Override Activated", "Linux Auditd Add User", + "Linux Auditd Add User Account", + "Linux Auditd Add User Account Type", + "Linux Auditd At Application Execution", + "Linux Auditd Auditd Daemon Abort", + "Linux Auditd Auditd Daemon Shutdown", + "Linux Auditd Auditd Daemon Start", + "Linux Auditd Auditd Service Stop", + "Linux Auditd Base64 Decode Files", + "Linux Auditd Change File Owner To Root", + "Linux Auditd Clipboard Data Copy", + "Linux Auditd Copy Fail Privilege Escalation", "Linux Auditd Cwd", "Linux Auditd Daemon Abort", "Linux Auditd Daemon End", "Linux Auditd Daemon Start", + "Linux Auditd Data Destruction Command", + "Linux Auditd Data Transfer Size Limits Via Split", + "Linux Auditd Data Transfer Size Limits Via Split Syscall", + "Linux Auditd Database File And Directory Discovery", + "Linux Auditd Dd File Overwrite", + "Linux Auditd Disable Or Modify System Firewall", + "Linux Auditd Doas Conf File Creation", + "Linux Auditd Doas Tool Execution", + "Linux Auditd Edit Cron Table Parameter", "Linux Auditd Execve", + "Linux Auditd File And Directory Discovery", + "Linux Auditd File Permission Modification Via Chmod", + "Linux Auditd File Permissions Modification Via Chattr", + "Linux Auditd Find Credentials From Password Managers", + "Linux Auditd Find Credentials From Password Stores", + "Linux Auditd Find Ssh Private Keys", + "Linux Auditd Hardware Addition Swapoff", + "Linux Auditd Hidden Files And Directories Creation", + "Linux Auditd Insert Kernel Module Using Insmod Utility", + "Linux Auditd Install Kernel Module Using Modprobe Utility", + "Linux Auditd Kernel Module Enumeration", + "Linux Auditd Kernel Module Using Rmmod Utility", + "Linux Auditd Nopasswd Entry In Sudoers File", + "Linux Auditd Osquery Service Stop", "Linux Auditd Path", + "Linux Auditd Possible Access Or Modification Of Sshd Config File", + "Linux Auditd Possible Access To Credential Files", + "Linux Auditd Possible Access To Sudoers File", + "Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File", + "Linux Auditd Preload Hijack Library Calls", + "Linux Auditd Preload Hijack Via Preload File", + "Linux Auditd Private Keys and Certificate Enumeration", "Linux Auditd Proctitle", + "Linux Auditd Service Restarted", + "Linux Auditd Service Started", "Linux Auditd Service Stop", + "Linux Auditd Setuid Using Chmod Utility", + "Linux Auditd Setuid Using Setcap Utility", + "Linux Auditd Shred Overwrite Command", + "Linux Auditd Stop Services", + "Linux Auditd Sudo Or Su Execution", "Linux Auditd Syscall", + "Linux Auditd Sysmon Service Stop", + "Linux Auditd System Network Configuration Discovery", + "Linux Auditd Unix Shell Configuration Modification", + "Linux Auditd Unload Module Via Modprobe", + "Linux Auditd Virtual Disk File And Directory Discovery", + "Linux Auditd Whoami User Discovery", + "Linux Binary Launched Process with Null Argv", + "Linux Busybox Privilege Escalation", + "Linux Change File Owner To Root", + "Linux Clipboard Data Copy", + "Linux Common Process For Elevation Control", + "Linux Composer Privilege Escalation", + "Linux Cpulimit Privilege Escalation", + "Linux Csvtool Privilege Escalation", + "Linux Curl Upload File", + "Linux DD File Overwrite", + "Linux Data Destruction Command", + "Linux Decode Base64 to Shell", + "Linux Deleting Critical Directory Using RM Command", + "Linux Deletion Of Cron Jobs", + "Linux Deletion Of Init Daemon Script", + "Linux Deletion Of Services", + "Linux Deletion of SSL Certificate", + "Linux Dirty Frag Kernel Privilege Escalation", + "Linux Disable Services", + "Linux Doas Conf File Creation", + "Linux Doas Tool Execution", + "Linux Docker Root Directory Mount", + "Linux Docker Shell Execution", + "Linux Edit Cron Table Parameter", + "Linux Emacs Privilege Escalation", + "Linux File Created In Kernel Driver Directory", + "Linux File Creation In Init Boot Directory", + "Linux File Creation In Profile Directory", + "Linux Find Privilege Escalation", + "Linux GDB Privilege Escalation", + "Linux GNU Awk Privilege Escalation", + "Linux Gdrive Binary Activity", + "Linux Gem Privilege Escalation", + "Linux Hardware Addition SwapOff", + "Linux High Frequency Of File Deletion In Boot Folder", + "Linux High Frequency Of File Deletion In Etc Folder", + "Linux Impair Defenses Process Kill", + "Linux Indicator Removal Clear Cache", + "Linux Indicator Removal Service File Deletion", + "Linux Ingress Tool Transfer Hunting", + "Linux Ingress Tool Transfer with Curl", + "Linux Insert Kernel Module Using Insmod Utility", + "Linux Install Kernel Module Using Modprobe Utility", + "Linux Iptables Firewall Modification", + "Linux Kernel Module Enumeration", + "Linux Kworker Process In Writable Process Path", "Linux Living Off The Land", + "Linux Magic SysRq Key Abuse", + "Linux Make Privilege Escalation", + "Linux Malformed Auth Entry", + "Linux Medusa Rootkit", + "Linux Messages Syslog", + "Linux MySQL Privilege Escalation", + "Linux NOPASSWD Entry In Sudoers File", + "Linux Ngrok Reverse Proxy Usage", + "Linux Node Privilege Escalation", + "Linux Obfuscated Files or Information Base64 Decode", + "Linux Octave Privilege Escalation", + "Linux OpenVPN Privilege Escalation", + "Linux PF_ALG Registration Outside of Boot Window", + "Linux PHP Privilege Escalation", "Linux Persistence Techniques", + "Linux Persistence and Privilege Escalation Risk Behavior", + "Linux Possible Access Or Modification Of sshd Config File", + "Linux Possible Access To Credential Files", + "Linux Possible Access To Sudoers File", + "Linux Possible Append Command To At Allow Config File", + "Linux Possible Append Command To Profile Config File", + "Linux Possible Append Cronjob Entry on Existing Cronjob File", + "Linux Possible Cronjob Modification With Editor", + "Linux Possible Ssh Key File Creation", "Linux Post-Exploitation", + "Linux Preload Hijack Library Calls", "Linux Privilege Escalation", + "Linux Proxy Socks Curl", + "Linux Puppet Privilege Escalation", + "Linux RPM Privilege Escalation", "Linux Rootkit", + "Linux Ruby Privilege Escalation", + "Linux SSH Authorized Keys Modification", + "Linux SSH Remote Services Script Execute", "Linux Secure", + "Linux Service File Created In Systemd Directory", + "Linux Service Restarted", + "Linux Service Started Or Enabled", + "Linux Setuid Using Chmod Utility", + "Linux Setuid Using Setcap Utility", + "Linux Shred Overwrite Command", + "Linux Sqlite3 Privilege Escalation", + "Linux Stdout Redirection To Dev Null File", + "Linux Stop Services", + "Linux Sudo OR Su Execution", + "Linux Sudoers Tmp File Creation", + "Linux Suspicious Namespace Creation", + "Linux Suspicious React or Next.js Child Process", + "Linux System Network Discovery", + "Linux System Reboot Via System Request Key", + "Linux Telnet Authentication Bypass", + "Linux Unix Shell Enable All SysRq Functions", + "Linux Visudo Utility Execution", + "Linux c89 Privilege Escalation", + "Linux c99 Privilege Escalation", + "Linux pkexec Privilege Escalation", "Living Off The Land", + "Living Off The Land Detection", + "Loading Of Dynwrapx Module", + "Local Account Discovery With Wmic", + "Local LLM Framework DNS Query", "Local Privilege Escalation With KrbRelayUp", "LockBit Ransomware", "Log4Shell CVE-2021-44228", + "Log4Shell CVE-2021-44228 Exploitation", + "Log4Shell JNDI Payload Injection Attempt", + "Log4Shell JNDI Payload Injection with Outbound Connection", + "Logon Script Event Trigger Execution", "Lokibot", "Lotus Blossom Chrysalis Backdoor", "Lumma Stealer", + "M365 Copilot Agentic Jailbreak Attack", + "M365 Copilot Application Usage Pattern Anomalies", + "M365 Copilot Failed Authentication Patterns", "M365 Copilot Graph API", + "M365 Copilot Impersonation Jailbreak Attack", + "M365 Copilot Information Extraction Jailbreak Attack", + "M365 Copilot Jailbreak Attempts", + "M365 Copilot Non Compliant Devices Accessing M365 Copilot", + "M365 Copilot Session Origin Anomalies", "M365 Exported eDiscovery Prompts", + "MCP Filesystem Server Suspicious Extension Write", + "MCP Github Suspicious Operation", + "MCP Postgres Suspicious Query", + "MCP Prompt Injection", + "MCP Sensitive System File Search", "MCP Server", + "MOVEit Certificate Store Access Failure", + "MOVEit Empty Key Fingerprint Authentication Attempt", "MOVEit Transfer Authentication Bypass", "MOVEit Transfer Critical Vulnerability", "MS Defender ATP Alerts", + "MS Exchange Mailbox Replication service writing Active Server Pages", + "MS Scripting Process Loading Ldap Module", + "MS Scripting Process Loading WMI Module", "MS365 Defender Incident Alerts", + "MSBuild Suspicious Spawned By Script Process", + "MSI Module Loaded by Non-System Binary", "MSIX Package Abuse", + "MacOS - Re-opened Applications", + "MacOS AMOS Stealer - Virtual Machine Check Activity", + "MacOS Account Created", + "MacOS Data Chunking", + "MacOS Gatekeeper Bypass", + "MacOS Hidden Files and Directories", + "MacOS Kextload Usage", + "MacOS Keychains Dumped", + "MacOS LOLbin", + "MacOS List Firewall Rules", + "MacOS Log Removal", + "MacOS LoginHook Persistence", + "MacOS Network Share Discovery", "MacOS Persistence Techniques", "MacOS Post-Exploitation", "MacOS Privilege Escalation", + "MacOS plutil", + "Mailsniper Invoke functions", + "Malicious InProcServer32 Modification", "Malicious Inno Setup Loader", "Malicious PowerShell", + "Malicious PowerShell Process - Encoded Command", + "Malicious PowerShell Process - Execution Policy Bypass", + "Malicious PowerShell Process With Obfuscation Techniques", + "Malicious Powershell Executed As A Service", "Masquerading - Rename System Utilities", "Medusa Ransomware", "Medusa Rootkit", "Meduza Stealer", "MetaSploit", "Meterpreter", + "Microsoft Defender ATP Alerts", + "Microsoft Defender Incident Alerts", + "Microsoft Intune Bulk Wipe", + "Microsoft Intune Device Health Scripts", + "Microsoft Intune DeviceManagementConfigurationPolicies", + "Microsoft Intune Manual Device Management", + "Microsoft Intune Mobile Apps", "Microsoft MSHTML Remote Code Execution CVE-2021-40444", + "Microsoft SharePoint Server Elevation of Privilege", "Microsoft SharePoint Server Elevation of Privilege CVE-2023-29357", "Microsoft SharePoint Vulnerabilities", "Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190", "Microsoft WSUS CVE-2025-59287", + "Mimikatz PassTheTicket CommandLine Parameters", + "Mmc LOLBAS Execution Process Spawn", + "Modification Of Wallpaper", + "Modify ACL permission To Files Or Folder", + "Monitor Email For Brand Abuse", + "Monitor Registry Keys for Print Monitors", + "Monitor Web Traffic For Brand Abuse", "Monitor for Updates", "MoonPeak", + "Mshta spawning Rundll32 OR Regsvr32 Process", + "Msmpeng Application DLL Side Loading", "MuddyWater", + "Multiple Archive Files Http Post Traffic", + "NET Profiler UAC bypass", + "NLTest Domain Trust Discovery", "NOBELIUM Group", "NPM Supply Chain Compromise", "NTLM Operational 8004", @@ -371,29 +1317,122 @@ "NailaoLocker Ransomware", "NetSupport RMM Tool Abuse", "Netsh Abuse", + "Network Connection Discovery With Arp", + "Network Connection Discovery With Netstat", "Network Discovery", + "Network Discovery Using Route Windows App", + "Network Share Discovery Via Dir Command", + "Network Traffic to Active Directory Web Services Protocol", "Nginx Access", + "Nginx ConnectWise ScreenConnect Authentication Bypass", + "Ngrok Reverse Proxy on Network", + "Nishang PowershellTCPOneLine", "NjRAT", + "No Windows Updates in a time frame", + "Non Chrome Process Accessing Chrome Default Dir", + "Non Firefox Process Access Firefox Profile Dir", "NotDoor Malware", + "Notepad with no Command Line Arguments", + "Ntdsutil Export NTDS", "O365", + "O365 Add App Role Assignment Grant User", "O365 Add app role assignment grant to user.", "O365 Add app role assignment to service principal.", "O365 Add member to role.", "O365 Add owner to application.", "O365 Add service principal.", "O365 Add-MailboxPermission", + "O365 Added Service Principal", + "O365 Admin Consent Bypassed by Service Principal", + "O365 Advanced Audit Disabled", + "O365 Application Available To Other Tenants", + "O365 Application Registration Owner Added", + "O365 ApplicationImpersonation Role Assigned", + "O365 BEC Email Hiding Rule Created", + "O365 Block User Consent For Risky Apps Disabled", + "O365 Bypass MFA via Trusted IP", "O365 Change user license.", + "O365 Compliance Content Search Exported", + "O365 Compliance Content Search Started", + "O365 Concurrent Sessions From Different Ips", "O365 Consent to application.", + "O365 Cross-Tenant Access Change", + "O365 DLP Rule Triggered", + "O365 Disable MFA", "O365 Disable Strong Authentication.", + "O365 Elevated Mailbox Permission Assigned", + "O365 Email Access By Security Administrator", + "O365 Email Hard Delete Excessive Volume", + "O365 Email New Inbox Rule Created", + "O365 Email Password and Payroll Compromise Behavior", + "O365 Email Receive and Hard Delete Takeover Behavior", + "O365 Email Reported By Admin Found Malicious", + "O365 Email Reported By User Found Malicious", + "O365 Email Security Feature Changed", + "O365 Email Send Attachments Excessive Volume", + "O365 Email Send and Hard Delete Exfiltration Behavior", + "O365 Email Send and Hard Delete Suspicious Behavior", + "O365 Email Suspicious Behavior Alert", + "O365 Email Suspicious Search Behavior", + "O365 Email Transport Rule Changed", + "O365 Excessive Authentication Failures Alert", + "O365 Excessive SSO logon errors", + "O365 Exfiltration via File Access", + "O365 Exfiltration via File Download", + "O365 Exfiltration via File Sync Download", + "O365 External Guest User Invited", + "O365 External Identity Policy Changed", + "O365 File Permissioned Application Consent Granted by User", + "O365 FullAccessAsApp Permission Assigned", + "O365 High Number Of Failed Authentications for User", + "O365 High Privilege Role Granted", + "O365 Mail Permissioned Application Consent Granted by User", "O365 MailItemsAccessed", + "O365 Mailbox Email Forwarding Enabled", + "O365 Mailbox Folder Read Permission Assigned", + "O365 Mailbox Folder Read Permission Granted", + "O365 Mailbox Inbox Folder Shared with All Users", + "O365 Mailbox Read Access Granted to Application", "O365 ModifyFolderPermissions", + "O365 Multi-Source Failed Authentications Spike", + "O365 Multiple AppIDs and UserAgents Authentication Spike", + "O365 Multiple Failed MFA Requests For User", + "O365 Multiple Mailboxes Accessed via API", + "O365 Multiple OS Vendors Authenticating From User", + "O365 Multiple Service Principals Created by SP", + "O365 Multiple Service Principals Created by User", + "O365 Multiple Users Failing To Authenticate From Ip", + "O365 New Email Forwarding Rule Created", + "O365 New Email Forwarding Rule Enabled", + "O365 New Federated Domain Added", + "O365 New Forwarding Mailflow Rule Created", + "O365 New MFA Method Registered", + "O365 OAuth App Mailbox Access via EWS", + "O365 OAuth App Mailbox Access via Graph API", + "O365 PST export alert", + "O365 Privileged Graph API Permission Assigned", + "O365 Privileged Role Assigned", + "O365 Privileged Role Assigned To Service Principal", + "O365 Safe Links Detection", + "O365 Security And Compliance Alert Triggered", + "O365 Service Principal New Client Credentials", + "O365 Service Principal Privilege Escalation", "O365 Set Company Information.", "O365 Set-Mailbox", + "O365 SharePoint Allowed Domains Policy Changed", + "O365 SharePoint Malware Detection", + "O365 SharePoint Suspicious Search Behavior", + "O365 Tenant Wide Admin Consent Granted", + "O365 Threat Intelligence Suspicious Email Delivered", + "O365 Threat Intelligence Suspicious File Detected", "O365 Update application.", "O365 Update authorization policy.", "O365 Update user.", + "O365 User Consent Blocked for Risky Application", + "O365 User Consent Denied for OAuth Application", "O365 UserLoggedIn", "O365 UserLoginFailed", + "O365 ZAP Activity Detection", "Office 365 Account Takeover", "Office 365 Collection Techniques", "Office 365 Persistence Mechanisms", @@ -401,28 +1440,109 @@ "Office 365 Universal Audit Log", "Okta", "Okta Account Takeover", + "Okta Authentication Failed During MFA Challenge", + "Okta IDP Lifecycle Modifications", "Okta MFA Exhaustion", + "Okta MFA Exhaustion Hunt", + "Okta Mismatch Between Source and Response for Verify Push Request", + "Okta Multi-Factor Authentication Disabled", + "Okta Multiple Accounts Locked Out", + "Okta Multiple Failed MFA Requests For User", + "Okta Multiple Failed Requests to Access Applications", + "Okta Multiple Users Failing To Authenticate From Ip", + "Okta New API Token Created", + "Okta New Device Enrolled on Account", + "Okta Non-Standard VPN Usage", + "Okta Phishing Detection with FastPass Origin Check", + "Okta Risk Threshold Exceeded", + "Okta Successful Single Factor Authentication", + "Okta Suspicious Activity Reported", + "Okta Suspicious Use of a Session Cookie", + "Okta ThreatInsight Threat Detected", + "Okta Unauthorized Access to Application", + "Okta User Logins from Multiple Cities", + "Ollama Abnormal Network Connectivity", + "Ollama Abnormal Service Crash Availability Attack", + "Ollama Excessive API Requests", + "Ollama Possible API Endpoint Scan Reconnaissance", + "Ollama Possible Memory Exhaustion Resource Abuse", + "Ollama Possible Model Exfiltration Data Leakage", + "Ollama Possible RCE via Model Loading", "Ollama Server", + "Ollama Suspicious Prompt Injection Jailbreak", "OpenSSL CVE-2022-3602", "Oracle E-Business Suite Exploitation", "Orangeworm Attack Group", "Osquery Results", + "Outbound Network Connection from Java Using Default Ports", "Outlook RCE CVE-2024-21378", + "Overwriting Accessibility Binaries", "PHP-CGI RCE Attack on Japanese Organizations", + "PTC Windchill Exploitation", + "PTC Windchill GW READY OK Probe", + "PTC Windchill Gateway Command Execution", "PXA Stealer", "Palo Alto Network Threat", "Palo Alto Network Traffic", "PaperCut MF NG Vulnerability", + "PaperCut NG Remote Web Access Attempt", + "PaperCut NG Suspicious Behavior Debug Log", "PathWiper", + "Permission Modification using Takeown App", "PetitPotam NTLM Relay on Active Directory Certificate Services", + "PetitPotam Network Share Access Request", + "PetitPotam Suspicious Kerberos TGT Request", + "Phantom Stealer", "Phemedrone Stealer", + "Ping Sleep Batch Command", "PingID", + "PingID Mismatch Auth Source and Verification Response", + "PingID Multiple Failed MFA Requests For User", + "PingID New MFA Method After Credential Reset", + "PingID New MFA Method Registered For User", + "Plain HTTP POST Exfiltrated Data", "PlugX", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", + "Possible Browser Pass View Parameter", + "Possible Lateral Movement PowerShell Spawn", + "Potential System Network Configuration Discovery Activity", + "Potential Telegram API Request Via CommandLine", + "Potential password in username", + "PowerShell - Connect To Internet With Hidden Window", + "PowerShell 4104 Hunting", + "PowerShell Domain Enumeration", + "PowerShell Enable PowerShell Remoting", + "PowerShell Environment Variable Execution", + "PowerShell Get LocalGroup Discovery", + "PowerShell Invoke CIMMethod CIMSession", + "PowerShell Invoke WmiExec Usage", + "PowerShell Loading DotNET into Memory via Reflection", + "PowerShell PInvoke Process Injection API Chain", + "PowerShell Script Block With URL Chain", + "PowerShell Start or Stop Service", + "PowerShell Start-BitsTransfer", + "PowerShell WebRequest Using Memory Stream", + "Powershell COM Hijacking InprocServer32 Modification", + "Powershell Creating Thread Mutex", + "Powershell Defender Threat Actions Set to Allow", + "Powershell Disable Security Monitoring", + "Powershell Enable SMB1Protocol Feature", + "Powershell Execute COM Object", + "Powershell Fileless Process Injection via GetProcAddress", + "Powershell Fileless Script Contains Base64 Encoded Content", + "Powershell Get LocalGroup Discovery with Script Block Logging", "Powershell Installed IIS Modules", + "Powershell Load Module in Meterpreter", + "Powershell Processing Stream Of Data", + "Powershell Remote Services Add TrustedHost", + "Powershell Remote Thread To Known Windows Process", + "Powershell Remove Windows Defender Directory", "Powershell SIP Inventory", "Powershell Script Block Logging 4104", + "Powershell Using memory As Backing Store", + "Powershell Windows Defender Exclusion Commands", "Prestige Ransomware", + "Prevent Automatic Repair Mode using Bcdedit", "Previously Seen Cloud API Calls Per User Role - Initial", "Previously Seen Cloud API Calls Per User Role - Update", "Previously Seen Cloud Compute Creations By User - Initial", @@ -445,62 +1565,186 @@ "Previously Seen Zoom Child Processes - Update", "Previously seen S3 bucket access by remote IP", "Previously seen command line arguments", + "Print Processor Registry Autostart", + "Print Spooler Adding A Printer Driver", + "Print Spooler Failed to Load a Plug-in", "PrintNightmare CVE-2021-34527", + "Process Creating LNK file in Suspicious Location", + "Process Deleting Its Process File Path", + "Process Execution via WMI", + "Process Kill Base On File Path", + "Process Writing DynamicWrapperX", + "Processes Tapping Keyboard Events", + "Prohibited Network Traffic Allowed", "Prohibited Traffic Allowed or Protocol Mismatch", "PromptFlux", "PromptLock", + "Protocol or Port Mismatch", + "Protocols passing authentication in cleartext", "ProxyNotShell", "ProxyShell", + "ProxyShell ProxyNotShell Behavior Detected", "Qakbot", "Quasar RAT", "QuietVault", "RMM Software Tracking", + "Randomly Generated Scheduled Task Name", + "Randomly Generated Windows Service Name", "Ransomware", "Ransomware Cloud", + "Ransomware Notes bulk creation", "React2Shell", + "Recon AVProduct Through Pwh or WMI", + "Recon Using WMI Class", + "Recursive Delete of Directory In Batch CMD", "RedLine Stealer", + "RedSun", + "Reg exe Manipulating Windows Services Registry Keys", + "Registry Keys Used For Persistence", + "Registry Keys Used For Privilege Escalation", + "Registry Keys for Creating SHIM Databases", + "Regsvr32 Silent and Install Param Dll Loading", "Remcos", + "Remcos RAT File Creation in Remcos Folder", + "Remcos client registry install entry", + "Remote Desktop Network Traffic", + "Remote Desktop Process Running On System", "Remote Employment Fraud", "Remote Monitoring and Management Software", + "Remote Process Instantiation via DCOM and PowerShell", + "Remote Process Instantiation via DCOM and PowerShell Script Block", + "Remote Process Instantiation via WMI", + "Remote Process Instantiation via WMI and PowerShell", + "Remote Process Instantiation via WMI and PowerShell Script Block", + "Remote Process Instantiation via WinRM and PowerShell", + "Remote Process Instantiation via WinRM and PowerShell Script Block", + "Remote Process Instantiation via WinRM and Winrs", + "Remote System Discovery with Adsisearcher", + "Remote System Discovery with Dsquery", + "Remote System Discovery with Wmic", + "Remote WMI Command Attempt", + "Resize ShadowStorage volume", "Reverse Network Proxy", + "Revil Common Exec Parameter", "Revil Ransomware", + "Revil Registry Entry", "Rhysida Ransomware", + "Risk Rule for Dev Sec Ops by Repository", + "RoguePlanet", "Router and Infrastructure Security", + "Rubeus Command Line Parameters", + "Rubeus Kerberos Ticket Exports Through Winlogon Access", + "RunDLL Loading DLL By Ordinal", + "Runas Execution in CommandLine", + "Rundll32 Control RunDLL Hunt", + "Rundll32 Control RunDLL World Writable Directory", + "Rundll32 Create Remote Thread To A Process", + "Rundll32 DNSQuery", + "Rundll32 LockWorkStation", + "Rundll32 Process Creating Exe Dll Files", + "Rundll32 Shimcache Flush", + "Rundll32 with no Command Line Arguments with Network", "Ryuk Ransomware", + "Ryuk Test Files Detected", + "Ryuk Wake on LAN Command", + "SAM Database File Access Attempt", "SAP NetWeaver Exploitation", + "SAP NetWeaver Visual Composer Exploitation Attempt", + "SLUI RunAs Elevated", + "SLUI Spawning a Process", + "SMB Traffic Spike", "SQL Injection", + "SQL Injection with Long URLs", "SQL Server Abuse", + "SSL Certificates with Punycode", + "Salat Stealer", "Salt Typhoon", "SamSam Ransomware", + "Samsam Test File Write", "Sandworm Tools", "Scattered Lapsus$ Hunters", "Scattered Spider", + "SchCache Change By App Connect And Create ADSI Object", + "Schedule Task with HTTP Command Arguments", + "Schedule Task with Rundll32 Command Trigger", + "Scheduled Task Creation on Remote Endpoint using At", + "Scheduled Task Deleted Or Created via CMD", + "Scheduled Task Initiation on Remote Endpoint", "Scheduled Tasks", + "Schtasks Run Task On Demand", + "Schtasks scheduling job on remote system", + "Schtasks used for forcing a reboot", + "Screensaver Event Trigger Execution", + "Script Execution via WMI", + "Sdclt UAC Bypass", + "Sdelete Application Execution", + "SearchProtocolHost with no Command Line with Network", "Seashell Blizzard", "Secret Blizzard", + "SecretDumps Offline NTDS Dumping Tool", "Security Solution Tampering", + "ServicePrincipalNames Discovery with PowerShell", + "ServicePrincipalNames Discovery with SetSPN", + "Services Escalate Exe", + "Services LOLBAS Execution Process Spawn", "SesameOp", + "Set Default PowerShell Execution Policy To Unrestricted or Bypass", + "Shai-Hulud 2 Exfiltration Artifact Files", + "Shai-Hulud Workflow File Creation or Modification", + "Shim Database File Creation", + "Shim Database Installation With Suspicious Parameters", + "Short Lived Scheduled Task", + "Short Lived Windows Accounts", "ShrinkLocker", "Signed Binary Proxy Execution InstallUtil", + "SilentCleanup UAC Bypass", "Silver Sparrow", + "Single Letter Process On Endpoint", "Snake Keylogger", "Snake Malware", "SnappyBee", "Sneaky Active Directory Persistence Tricks", "SolarWinds WHD RCE Post Exploitation", "Spearphishing Attachments", + "Spike in File Writes", "Splunk", + "Splunk App for Lookup File Editing RCE via User XSLT", "Splunk AppDynamics Secure Application Alert", + "Splunk AppDynamics Secure Application Alerts", + "Splunk Authentication Token Exposure in Debug Log", + "Splunk Code Injection via custom dashboard leading to RCE", "Splunk Common Information Model (CIM)", + "Splunk Enterprise KV Store Incorrect Authorization", + "Splunk Information Disclosure on Account Login", + "Splunk Path Traversal In Splunk App For Lookup File Edit", + "Splunk RCE PDFgen Render", + "Splunk RCE Through Arbitrary File Write to Windows System Root", + "Splunk RCE via User XSLT", + "Splunk Secure Application Alerts for Runtime Security", + "Splunk Sensitive Information Disclosure in DEBUG Logging Channels", "Splunk Stream HTTP", "Splunk Stream IP", "Splunk Stream TCP", + "Splunk User Enumeration Attempt", + "Splunk Vulnerabilities", + "Splunk XSS Privilege Escalation via Custom Urls in Dashboard", + "Spoolsv Spawning Rundll32", + "Spoolsv Suspicious Loaded Modules", + "Spoolsv Suspicious Process Access", + "Spoolsv Writing a DLL", + "Spoolsv Writing a DLL - Sysmon", "Spring4Shell CVE-2022-22965", + "Spring4Shell Payload URL Request", + "Sqlite Module In Temp Folder", + "Steal or Forge Authentication Certificates Behavior Identified", "StealC Stealer", "Storm-0501 Ransomware", "Storm-2460 CLFS Zero Day Exploitation", "Subvert Trust Controls SIP and Trust Provider Hijacking", + "Sunburst Correlation DLL and Network Event", + "Supernova Webshell", "Suricata", + "Suspicious AWS Bedrock Claude Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", @@ -511,22 +1755,59 @@ "Suspicious Cloud User Activities", "Suspicious Command-Line Executions", "Suspicious Compiled HTML Activity", + "Suspicious Computer Account Name Change", + "Suspicious Copy on System32", + "Suspicious Curl Network Connection", + "Suspicious DLLHost no Command Line Arguments", "Suspicious DNS Traffic", + "Suspicious Email Attachment Extensions", "Suspicious Emails", "Suspicious GCP Storage Activities", + "Suspicious GPUpdate no Command Line Arguments", + "Suspicious IcedID Rundll32 Cmdline", + "Suspicious Image Creation In Appdata Folder", + "Suspicious Java Classes", + "Suspicious Kerberos Service Ticket Request", + "Suspicious Linux Discovery Commands", "Suspicious Local LLM Frameworks", "Suspicious MCP Activities", + "Suspicious MSBuild Rename", + "Suspicious MSBuild Spawn", "Suspicious MSHTA Activity", "Suspicious Microsoft 365 Copilot Activities", "Suspicious Okta Activity", "Suspicious Ollama Activities", + "Suspicious PlistBuddy Usage", + "Suspicious PlistBuddy Usage via OSquery", + "Suspicious Process DNS Query Known Abuse Web Services", + "Suspicious Process Executed From Container File", + "Suspicious Process With Discord DNS Query", + "Suspicious Reg exe Process", "Suspicious Regsvcs Regasm Activity", "Suspicious Regsvr32 Activity", + "Suspicious Regsvr32 Register Suspicious Path", "Suspicious Rundll32 Activity", + "Suspicious Rundll32 PluginInit", + "Suspicious Rundll32 StartW", + "Suspicious Rundll32 dllregisterserver", + "Suspicious Rundll32 no Command Line Arguments", + "Suspicious SQLite3 LSQuarantine Behavior", + "Suspicious Scheduled Task from Public Directory", + "Suspicious SearchProtocolHost no Command Line Arguments", + "Suspicious Ticket Granting Ticket Request", "Suspicious User Agents", + "Suspicious WAV file in Appdata Folder", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Suspicious Zoom Child Processes", + "Suspicious microsoft workflow compiler rename", + "Suspicious microsoft workflow compiler usage", + "Suspicious msbuild path", + "Suspicious mshta child process", + "Suspicious mshta spawn", + "Suspicious wevtutil Usage", + "Suspicious writes to windows Recycle Bin", + "Svchost LOLBAS Execution Process Spawn", "Swift Slicer", "SysAid On-Prem Software CVE-2023-47246 Vulnerability", "Sysmon EventID 1", @@ -552,45 +1833,318 @@ "Sysmon EventID 9", "Sysmon for Linux EventID 1", "Sysmon for Linux EventID 11", + "System Info Gathering Using Dxdiag Application", + "System Information Discovery Detection", + "System Processes Run From Unexpected Locations", + "System User Discovery With Query", + "System User Discovery With Whoami", "SystemBC", + "TOR Traffic", "Telnetd CVE-2026-24061", "Termite Ransomware", "Text4Shell CVE-2022-42889", "Threat Activity by Snort IDs", + "Time Provider Persistence Registry", + "Tomcat Session Deserialization Attempt", + "Tomcat Session File Upload Attempt", "Trickbot", + "Trickbot Named Pipe", "Trusted Developer Utilities Proxy Execution", "Trusted Developer Utilities Proxy Execution MSBuild", "Tuoni", + "UAC Bypass MMC Load Unsigned Dll", + "UAC Bypass With Colorui COM Object", + "USN Journal Deletion", + "Uninstall App Using MsiExec", + "Unknown Process Using The Kerberos Protocol", + "Unload Sysmon Filter Driver", + "Unloading AMSI via Reflection", + "Unusual Number of Computer Service Tickets Requested", + "Unusual Number of Kerberos Service Tickets Requested", + "Unusual Number of Remote Endpoint Authentication Events", "Unusual Processes", + "Unusually Long Command Line", + "Unusually Long Content-Type Length", "Use of Cleartext Protocols", + "User Discovery With Env Vars PowerShell", + "User Discovery With Env Vars PowerShell Script Block", "VIP Keylogger", + "VMWare Aria Operations Exploit Attempt", "VMWare ESXi Syslog", "VMware Aria Operations vRealize CVE-2023-20887", "VMware ESXi AD Integration Authentication Bypass CVE-2024-37085", "VMware Server Side Injection and Privilege Escalation", + "VMware Server Side Template Injection Hunt", + "VMware Workspace ONE Freemarker Server-side Template Injection", "ValleyRAT", "VanHelsing Ransomware", + "Vbscript Execution Using Wscript App", + "Verclsid CLSID Execution", "Void Manticore", "VoidLink Cloud-Native Linux Malware", "Volt Typhoon", + "WBAdmin Delete System Backups", + "WMI Permanent Event Subscription", + "WMI Permanent Event Subscription - Sysmon", + "WMI Recon Running Process Or Services", + "WMI Temporary Event Subscription", + "WMIC XSL Execution via URL", + "WS FTP Remote Code Execution", "WS FTP Server Critical Vulnerabilities", + "WSReset UAC Bypass", "Warzone RAT", "Water Gamayun", + "Wbemprox COM Object Execution", + "Web JSP Request via URL", + "Web Remote ShellServlet Access", + "Web Servers Executing Suspicious Processes", + "Web Spring Cloud Function FunctionRouter", + "Web Spring4Shell HTTP Request Class Module", + "Web or Application Server Spawning a Shell", + "Wermgr Process Connecting To IP Check Web Services", + "Wermgr Process Create Executable File", + "Wermgr Process Spawned CMD Or Powershell Process", "WhisperGate", "WinDealer RAT", + "WinEvent Scheduled Task Created Within Public Path", + "WinEvent Scheduled Task Created to Spawn Shell", + "WinEvent Windows Task Scheduler Event Action Started", + "WinRAR Spawning Shell Application", "WinRAR Spoofing Attack CVE-2023-38831", + "WinRM Spawning a Process", + "Windchill Log4j", + "Windows .Key File Creation in Root Directory", + "Windows AD Abnormal Object Access Activity", + "Windows AD AdminSDHolder ACL Modified", + "Windows AD Cross Domain SID History Addition", + "Windows AD DCShadow Privileges ACL Addition", + "Windows AD DSRM Account Changes", + "Windows AD DSRM Password Reset", + "Windows AD Dangerous Deny ACL Modification", + "Windows AD Dangerous Group ACL Modification", + "Windows AD Dangerous User ACL Modification", + "Windows AD Domain Controller Audit Policy Disabled", + "Windows AD Domain Controller Promotion", + "Windows AD Domain Replication ACL Addition", + "Windows AD Domain Root ACL Deletion", + "Windows AD Domain Root ACL Modification", + "Windows AD GPO Deleted", + "Windows AD GPO Disabled", + "Windows AD GPO New CSE Addition", + "Windows AD Hidden OU Creation", + "Windows AD Object Owner Updated", + "Windows AD Privileged Account SID History Addition", + "Windows AD Privileged Group Modification", + "Windows AD Privileged Object Access Activity", + "Windows AD Replication Request Initiated by User Account", + "Windows AD Replication Request Initiated from Unsanctioned Location", + "Windows AD Replication Service Traffic", + "Windows AD Rogue Domain Controller Network Activity", + "Windows AD SID History Attribute Modified", + "Windows AD Same Domain SID History Addition", + "Windows AD Self DACL Assignment", + "Windows AD ServicePrincipalName Added To Domain Account", + "Windows AD Short Lived Domain Account ServicePrincipalName", + "Windows AD Short Lived Domain Controller SPN Attribute", + "Windows AD Short Lived Server Object", + "Windows AD Suspicious Attribute Modification", + "Windows AD add Self to Group", + "Windows AI Platform DNS Query", + "Windows Abused Web Services", + "Windows Access Token Manipulation SeDebugPrivilege", + "Windows Access Token Manipulation Winlogon Duplicate Token Handle", + "Windows Access Token Winlogon Duplicate Handle In Uncommon Path", + "Windows Account Access Removal via Logoff Exec", + "Windows Account Discovery With NetUser PreauthNotRequire", + "Windows Account Discovery for None Disable User Account", + "Windows Account Discovery for Sam Account Name", "Windows Active Directory Admon", + "Windows AdFind Exe", + "Windows Admin Password Changed by Non-Admin", + "Windows Admin Permission Discovery", + "Windows Administrative Shares Accessed On Multiple Hosts", + "Windows Admon Default Group Policy Object Modified", + "Windows Admon Group Policy Object Created", + "Windows Advanced Installer MSIX with AI_STUBS Execution", + "Windows Alternate DataStream - Base64 Content", + "Windows Alternate DataStream - Executable Content", + "Windows Alternate DataStream - Process Execution", + "Windows Anomalous Registry Value Length in Environment Key", + "Windows Anonymous Pipe Activity", + "Windows Apache Benchmark Binary", + "Windows App Layer Protocol Qakbot NamedPipe", + "Windows App Layer Protocol Wermgr Connect To NamedPipe", + "Windows AppCertDLL Modification Via Command Line", "Windows AppLocker", + "Windows AppLocker Block Events", + "Windows AppLocker Execution from Uncommon Locations", + "Windows AppLocker Privilege Escalation via Unauthorized Bypass", + "Windows AppLocker Rare Application Launch Detection", + "Windows AppX Deployment Full Trust Package Installation", + "Windows AppX Deployment Package Installation Success", + "Windows AppX Deployment Unsigned Package Installation", + "Windows Application Layer Protocol RMS Radmin Tool Namedpipe", + "Windows Application Whitelisting Bypass Attempt via Rundll32", + "Windows Archive Collected Data via Powershell", + "Windows Archive Collected Data via Rar", + "Windows Archived Collected Data In TEMP Folder", "Windows Attack Surface Reduction", + "Windows Attempt To Stop Security Service", + "Windows Audit Policy Auditing Option Disabled via Auditpol", + "Windows Audit Policy Auditing Option Modified - Registry", + "Windows Audit Policy Cleared via Auditpol", + "Windows Audit Policy Disabled via Auditpol", + "Windows Audit Policy Disabled via Legacy Auditpol", + "Windows Audit Policy Excluded Category via Auditpol", + "Windows Audit Policy Restored via Auditpol", + "Windows Audit Policy Security Descriptor Tampering via Auditpol", "Windows Audit Policy Tampering", + "Windows AutoIt3 Execution", + "Windows Autostart Execution LSASS Driver Registry Modification", + "Windows Azure PowerShell Module Installation Via PowerShell Script", + "Windows Azure Storage Utility Execution Via CLI", + "Windows Binary Execution from an Archive", + "Windows Binary Proxy Execution Mavinject DLL Injection", + "Windows BitDefender Submission Wizard DLL Sideloading", + "Windows BitLocker Suspicious Command Usage", + "Windows BitLockerToGo Process Execution", + "Windows BitLockerToGo with Network Activity", + "Windows Bluetooth Service Installed From Uncommon Location", + "Windows Boot or Logon Autostart Execution In Startup Folder", "Windows BootKits", + "Windows BootLoader Inventory", + "Windows Browser Process Launched with Unusual Flags", + "Windows Bypass UAC via Pkgmgr Tool", + "Windows CAB File on Disk", + "Windows COM Hijacking InprocServer32 Modification", + "Windows Cabinet File Extraction Via Expand", + "Windows Cached Domain Credentials Reg Query", "Windows Certificate Services", + "Windows Certutil Root Certificate Addition", + "Windows Change File Association Command To Notepad", + "Windows Chrome Auto-Update Disabled via Registry", + "Windows Chrome Enable Extension Loading via Command-Line", + "Windows Chrome Extension Allowed Registry Modification", + "Windows Chromium Browser Launched with Small Window Size", + "Windows Chromium Browser No Security Sandbox Process", + "Windows Chromium Browser with Custom User Data Directory", + "Windows Chromium Process Launched with Logging Disabled", + "Windows Chromium Process Loaded Extension via Command-Line", + "Windows Chromium Process with Disabled Extensions", + "Windows Chromium process Launched with Disable Popup Blocking", + "Windows Cisco Secure Endpoint Related Service Stopped", + "Windows Cisco Secure Endpoint Stop Immunet Service Via Sfc", + "Windows Cisco Secure Endpoint Unblock File Via Sfc", + "Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc", + "Windows ClipBoard Data via Get-ClipBoard", + "Windows Cloud Files Filter Loaded by Uncommon Process", + "Windows Cloud Files Filter Log Created by Non-System Process", + "Windows Cmdline Tool Execution From Non-Shell Process", + "Windows Cobalt Strike PowerShell Loader", + "Windows Command Obfuscation with Environment Variable Substrings", + "Windows Command Shell DCRat ForkBomb Payload", + "Windows Command and Scripting Interpreter Hunting Path Traversal", + "Windows Command and Scripting Interpreter Path Traversal Exec", + "Windows Common Abused Cmd Shell Risk Behavior", + "Windows Compatibility Telemetry Suspicious Child Process", + "Windows Compatibility Telemetry Tampering Through Registry", + "Windows Computer Account Changed to Domain Controller", + "Windows Computer Account Created by Computer Account", + "Windows Computer Account Requesting Kerberos Ticket", + "Windows Computer Account With SPN", + "Windows ComputerDefaults Spawning a Process", + "Windows ConHost with Headless Argument", + "Windows ConsoleHost History File Deletion", + "Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script", + "Windows Create Local Account", + "Windows Create Local Administrator Account Via Net", + "Windows Credential Access From Browser Password Store", + "Windows Credential Dumping LSASS Memory Createdump", + "Windows Credential Target Information Structure in Commandline", + "Windows Credentials Access via VaultCli Module", + "Windows Credentials from Password Stores Chrome Copied in TEMP Dir", + "Windows Credentials from Password Stores Chrome Extension Access", + "Windows Credentials from Password Stores Chrome LocalState Access", + "Windows Credentials from Password Stores Chrome Login Data Access", + "Windows Credentials from Password Stores Creation", + "Windows Credentials from Password Stores Deletion", + "Windows Credentials from Password Stores Query", + "Windows Credentials from Web Browsers Saved in TEMP Folder", + "Windows Credentials in Registry Reg Query", + "Windows CrowdStrike Agent Registry Key Removal", + "Windows Crowdstrike RTR Script Execution", + "Windows Curl Download to Suspicious Path", + "Windows Curl Upload to Remote Destination", + "Windows DISM Install PowerShell Web Access", + "Windows DISM Remove Defender", + "Windows DLL Module Loaded in Temp Dir", + "Windows DLL Search Order Hijacking Hunt with Sysmon", + "Windows DLL Search Order Hijacking with iscsicpl", + "Windows DLL Side-Loading In Calc", + "Windows DLL Side-Loading Process Child Of Calc", + "Windows DNS Gather Network Info", + "Windows DNS Query Request To TinyUrl", + "Windows DNS Query Request by Telegram Bot API", "Windows DNS SIGRed CVE-2020-1350", + "Windows Data Destruction Recursive Exec Files Deletion", + "Windows Debugger Tool Execution", + "Windows Defacement Modify Transcodedwallpaper File", + "Windows Default Cobalt Strike PowerShell Beacon", + "Windows Default Group Policy Object Modified", + "Windows Default Group Policy Object Modified with GPME", + "Windows Default RDP File Creation By Non MSTSC Process", + "Windows Default Rdp File Deletion", + "Windows Default Rdp File Unhidden", + "Windows Defender ASR Audit Events", + "Windows Defender ASR Block Events", + "Windows Defender ASR Registry Modification", + "Windows Defender ASR Rule Disabled", + "Windows Defender ASR Rules Stacking", + "Windows Defender ASR or Threat Configuration Tamper", "Windows Defender Alerts", + "Windows Defender Exclusion Registry Entry", "Windows Defense Evasion Tactics", + "Windows Delete or Modify System Firewall", + "Windows Deleted Registry By A Non Critical Process File Path", + "Windows Detect Network Scanner Behavior", + "Windows Developer-Signed MSIX Package Installation", + "Windows Devtunnels Execution", + "Windows Devtunnels Image Loaded", + "Windows Disable Change Password Through Registry", + "Windows Disable Internet Explorer Addons", + "Windows Disable Lock Workstation Feature Through Registry", + "Windows Disable LogOff Button Through Registry", + "Windows Disable Memory Crash Dump", + "Windows Disable Notification Center", + "Windows Disable Shutdown Button Through Registry", + "Windows Disable Windows Event Logging Disable HTTP Logging", + "Windows Disable Windows Group Policy Features Through Registry", + "Windows Disable or Modify Tools Via Taskkill", + "Windows Disable or Stop Browser Process", + "Windows DisableAntiSpyware Registry", "Windows Discovery Techniques", + "Windows DiskCryptor Usage", + "Windows Diskshadow Proxy Execution", + "Windows DnsAdmins New Member Added", + "Windows Domain Account Discovery Via Get-NetComputer", + "Windows Domain Admin Impersonation Indicator", + "Windows DotNet Binary in Non Standard Path", + "Windows Downdate Registry Activity", + "Windows Driver Inventory", + "Windows Driver Load Non-Standard Path", "Windows Drivers", + "Windows Drivers Loaded by Signature", + "Windows EDRSilencer Execution", + "Windows EFI Bootloader File Modification", + "Windows EFI Volume Mount Attempt Via Mountvol", + "Windows ESX Admins Group Creation Security Event", + "Windows ESX Admins Group Creation via Net", + "Windows ESX Admins Group Creation via PowerShell", + "Windows Enable PowerShell Web Access", + "Windows Enable Win32 ScheduledJob via Registry", + "Windows Entra User Management Via Azure CLI", "Windows Error Reporting Service Elevation of Privilege Vulnerability", + "Windows Event For Service Disabled", "Windows Event Log AppXDeployment-Server 400", "Windows Event Log AppXDeployment-Server 854", "Windows Event Log AppXDeployment-Server 855", @@ -603,6 +2157,7 @@ "Windows Event Log CAPI2 70", "Windows Event Log CAPI2 81", "Windows Event Log CertificateServicesClient 1007", + "Windows Event Log Cleared", "Windows Event Log Defender 1121", "Windows Event Log Defender 1122", "Windows Event Log Defender 1125", @@ -635,6 +2190,7 @@ "Windows Event Log Security 4703", "Windows Event Log Security 4719", "Windows Event Log Security 4720", + "Windows Event Log Security 4723", "Windows Event Log Security 4724", "Windows Event Log Security 4725", "Windows Event Log Security 4726", @@ -682,29 +2238,609 @@ "Windows Event Log System 7045", "Windows Event Log TaskScheduler 200", "Windows Event Log TaskScheduler 201", + "Windows Event Logging Service Has Shutdown", + "Windows Event Triggered Image File Execution Options Injection", + "Windows EventLog Recon Activity Using Log Query Utilities", + "Windows Eventlog Cleared Via Wevtutil", + "Windows Excel Spawning Microsoft Project Application", + "Windows Excessive Disabled Services Event", + "Windows Excessive Service Stop Attempt", + "Windows Excessive Usage Of Net App", + "Windows Exchange Autodiscover SSRF Abuse", + "Windows Executable Masquerading as Benign File Types", + "Windows Executable in Loaded Modules", + "Windows Execute Arbitrary Commands with MSDT", + "Windows Execution of Microsoft MSC File In Suspicious Path", + "Windows Exfiltration Over C2 Via Invoke RestMethod", + "Windows Exfiltration Over C2 Via Powershell UploadString", + "Windows Explorer LNK Exploit Process Launch With Padding", + "Windows Explorer.exe Spawning PowerShell or Cmd", + "Windows Export Certificate", + "Windows FFmpeg Audio and Video Device Discovery", + "Windows FFmpeg DirectShow Video Capture", + "Windows File Association Modification via Ftype", + "Windows File Collection Via Copy Utilities", + "Windows File Download Via CertUtil", + "Windows File Download Via PowerShell", "Windows File Extension and Association Abuse", + "Windows File Share Discovery With Powerview", + "Windows File Transfer Protocol In Non-Common Process Path", + "Windows File Without Extension In Critical Folder", + "Windows File and Directory Enable ReadOnly Permissions", + "Windows File and Directory Permissions Enable Inheritance", + "Windows File and Directory Permissions Remove Inheritance", + "Windows Files and Dirs Access Rights Modification Via Icacls", + "Windows Filtering Platform Policy Added to Block EDR Process", + "Windows Find Domain Organizational Units with GetDomainOU", + "Windows Find Interesting ACL with FindInterestingDomainAcl", + "Windows Findstr GPP Discovery", + "Windows Firewall Rule Added", + "Windows Firewall Rule Deletion", + "Windows Firewall Rule Modification", + "Windows Forest Discovery with GetForestDomain", + "Windows Gather Victim Host Information Camera", + "Windows Gather Victim Identity SAM Info", + "Windows Gather Victim Network Info Through Ip Check Web Services", + "Windows Gdrive Binary Activity", + "Windows Get Local Admin with FindLocalAdminAccess", + "Windows Get-AdComputer Unconstrained Delegation Discovery", + "Windows Get-Variable.EXE Execution from WindowsApps Folder", + "Windows Global Object Access Audit List Cleared Via Auditpol", + "Windows GrimResource - MMC Process Accessing APDS DLL", + "Windows Group Discovery Via Net", + "Windows Group Policy Object Created", + "Windows Guest Account Enabled Via Net.EXE", + "Windows HTTP Network Communication From MSIExec", + "Windows Handle Duplication in Known UAC-Bypass Binaries", + "Windows Hidden Schedule Task Settings", + "Windows Hide Notification Features Through Registry", + "Windows High File Deletion Frequency", + "Windows Hijack Execution Flow Version Dll Side Load", + "Windows Hosts File Access", + "Windows Hunting System Account Targeting Lsass", "Windows IIS", "Windows IIS 29", + "Windows IIS Components Add New Module", + "Windows IIS Components Get-WebGlobalModule Module Query", + "Windows IIS Components Module Failed to Load", + "Windows IIS Components New Module Added", + "Windows IIS Server PSWA Console Access", + "Windows IOBit Unlocker Extension DLL Registration via Regsvr32", + "Windows ISO LNK File Creation", + "Windows Identify PowerShell Web Access IIS Pool", + "Windows Identify Protocol Handlers", + "Windows Impair Defense Add Xml Applocker Rules", + "Windows Impair Defense Change Win Defender Health Check Intervals", + "Windows Impair Defense Change Win Defender Quick Scan Interval", + "Windows Impair Defense Change Win Defender Throttle Rate", + "Windows Impair Defense Change Win Defender Tracing Level", + "Windows Impair Defense Configure App Install Control", + "Windows Impair Defense Define Win Defender Threat Action", + "Windows Impair Defense Delete Win Defender Context Menu", + "Windows Impair Defense Delete Win Defender Profile Registry", + "Windows Impair Defense Deny Security Software With Applocker", + "Windows Impair Defense Disable Controlled Folder Access", + "Windows Impair Defense Disable Defender Firewall And Network", + "Windows Impair Defense Disable Defender Protocol Recognition", + "Windows Impair Defense Disable PUA Protection", + "Windows Impair Defense Disable Realtime Signature Delivery", + "Windows Impair Defense Disable Web Evaluation", + "Windows Impair Defense Disable Win Defender App Guard", + "Windows Impair Defense Disable Win Defender Compute File Hashes", + "Windows Impair Defense Disable Win Defender Gen reports", + "Windows Impair Defense Disable Win Defender Network Protection", + "Windows Impair Defense Disable Win Defender Report Infection", + "Windows Impair Defense Disable Win Defender Scan On Update", + "Windows Impair Defense Disable Win Defender Signature Retirement", + "Windows Impair Defense Overide Win Defender Phishing Filter", + "Windows Impair Defense Override SmartScreen Prompt", + "Windows Impair Defense Set Win Defender Smart Screen Level To Warn", + "Windows Impair Defenses Disable AV AutoStart via Registry", + "Windows Impair Defenses Disable Auto Logger Session", + "Windows Impair Defenses Disable HVCI", + "Windows Impair Defenses Disable Win Defender Auto Logging", + "Windows Important Audit Policy Disabled", + "Windows InProcServer32 New Outlook Form", + "Windows Increase in Group or Object Modification Activity", + "Windows Increase in User Modification Activity", + "Windows Indicator Removal Via Rmdir", + "Windows Indirect Command Execution Via Series Of Forfiles", + "Windows Indirect Command Execution Via forfiles", + "Windows Indirect Command Execution Via pcalua", + "Windows Information Discovery Fsutil", + "Windows Ingress Tool Transfer Using Explorer", + "Windows Input Capture Using Credential UI Dll", + "Windows InstallUtil Credential Theft", + "Windows InstallUtil Remote Network Connection", + "Windows InstallUtil URL in Command Line", + "Windows InstallUtil Uninstall Option", + "Windows InstallUtil in Non Standard Path", + "Windows Kerberos Coercion via DNS", + "Windows Kerberos Local Successful Logon", + "Windows Known Abused DLL Created", + "Windows Known Abused DLL Loaded Suspiciously", + "Windows Known GraphicalProton Loaded Modules", + "Windows KrbRelayUp Service Creation", + "Windows LAPS Password Gathering Via PowerShell Script", + "Windows LOLBAS Executed As Renamed File", + "Windows LOLBAS Executed Outside Expected Path", + "Windows LSA Secrets NoLMhash Registry", + "Windows Large Number of Computer Service Tickets Requested", + "Windows Ldifde Directory Object Behavior", + "Windows Level RMM PowerShell Script Installer", + "Windows Level RMM Watchdog Task Created", + "Windows Linked Policies In ADSI Discovery", + "Windows List ENV Variables Via SET Command From Uncommon Parent", + "Windows Local Administrator Credential Stuffing", + "Windows Local LLM Framework Execution", "Windows Log Manipulation", + "Windows MMC Loaded Script Engine DLL", + "Windows MOF Event Triggered Execution via WMI", + "Windows MOVEit Transfer Writing ASPX", + "Windows MSC EvilTwin Directory Path Manipulation", + "Windows MSExchange Management Mailbox Cmdlet Usage", + "Windows MSHTA Writing to World Writable Path", + "Windows MSI Rollback Script Deleted By Non-Msiexec Process", + "Windows MSIExec DLLRegisterServer", + "Windows MSIExec Remote Download", + "Windows MSIExec Spawn Discovery Command", + "Windows MSIExec Spawn WinDBG", + "Windows MSIExec Unregister DLLRegisterServer", + "Windows MSIX Package Interaction", + "Windows MSTSC RDP Commandline", + "Windows Mail Protocol In Non-Common Process Path", + "Windows Mark Of The Web Bypass", + "Windows Masquerading Explorer As Child Process", + "Windows Masquerading Msdtc Process", + "Windows Metasploit Confluence Plugin Execution", + "Windows Mimikatz Binary Execution", + "Windows Mimikatz Crypto Export File Extensions", + "Windows Mock Trusted Directory MSC File Creation", + "Windows Modify Registry AuthenticationLevelOverride", + "Windows Modify Registry Auto Minor Updates", + "Windows Modify Registry Auto Update Notif", + "Windows Modify Registry Configure BitLocker", + "Windows Modify Registry Default Icon Setting", + "Windows Modify Registry Delete Firewall Rules", + "Windows Modify Registry DisAllow Windows App", + "Windows Modify Registry Disable RDP", + "Windows Modify Registry Disable Restricted Admin", + "Windows Modify Registry Disable Toast Notifications", + "Windows Modify Registry Disable Win Defender Raw Write Notif", + "Windows Modify Registry Disable WinDefender Notifications", + "Windows Modify Registry Disable Windows Security Center Notif", + "Windows Modify Registry DisableRemoteDesktopAntiAlias", + "Windows Modify Registry DisableSecuritySettings", + "Windows Modify Registry Disabling WER Settings", + "Windows Modify Registry Do Not Connect To Win Update", + "Windows Modify Registry DontShowUI", + "Windows Modify Registry EnableLinkedConnections", + "Windows Modify Registry LongPathsEnabled", + "Windows Modify Registry MaxConnectionPerServer", + "Windows Modify Registry No Auto Reboot With Logon User", + "Windows Modify Registry No Auto Update", + "Windows Modify Registry NoChangingWallPaper", + "Windows Modify Registry ProxyEnable", + "Windows Modify Registry ProxyServer", + "Windows Modify Registry Qakbot Binary Data Registry", + "Windows Modify Registry Regedit Silent Reg Import", + "Windows Modify Registry Risk Behavior", + "Windows Modify Registry Suppress Win Defender Notif", + "Windows Modify Registry Tamper Protection", + "Windows Modify Registry USeWuServer", + "Windows Modify Registry UpdateServiceUrlAlternate", + "Windows Modify Registry Utilize ProgIDs", + "Windows Modify Registry ValleyRAT C2 Config", + "Windows Modify Registry ValleyRat PWN Reg Entry", + "Windows Modify Registry With MD5 Reg Key Name", + "Windows Modify Registry WuServer", + "Windows Modify Registry on Smart Card Group Policy", + "Windows Modify Registry to Add or Modify Firewall Rule", + "Windows Modify Registry wuStatusServer", + "Windows Modify Show Compress Color And Info Tip Registry", + "Windows Modify System Firewall with Notable Process Path", + "Windows MpCmdRun RemoveDefinitions Execution", + "Windows MsMpEng Writing to System32", + "Windows Mshta Execution In Registry", + "Windows MsiExec HideWindow Rundll32 Execution", + "Windows Multi hop Proxy TOR Website Query", + "Windows Multiple Account Passwords Changed", + "Windows Multiple Accounts Deleted", + "Windows Multiple Accounts Disabled", + "Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos", + "Windows Multiple Invalid Users Fail To Authenticate Using Kerberos", + "Windows Multiple Invalid Users Failed To Authenticate Using NTLM", + "Windows Multiple NTLM Null Domain Authentications", + "Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials", + "Windows Multiple Users Failed To Authenticate From Host Using NTLM", + "Windows Multiple Users Failed To Authenticate From Process", + "Windows Multiple Users Failed To Authenticate Using Kerberos", + "Windows Multiple Users Remotely Failed To Authenticate From Host", + "Windows Mustang Panda USB Tool Execution", + "Windows Net System Service Discovery", + "Windows NetSupport RMM DLL Loaded By Uncommon Process", + "Windows Netspy Network Scanner Execution", + "Windows Network Connection Discovery Via Net", + "Windows Network Connection From Program In Suspect Location", + "Windows Network Share Interaction Via Net", + "Windows New Custom Security Descriptor Set On EventLog Channel", + "Windows New Default File Association Value Set", + "Windows New Deny Permission Set On Service SD Via Sc.EXE", + "Windows New EventLog ChannelAccess Registry Value Set", + "Windows New InProcServer32 Added", + "Windows New Service Security Descriptor Set Via Sc.EXE", + "Windows Ngrok Reverse Proxy Usage", + "Windows NirSoft AdvancedRun", + "Windows NirSoft Tool Bundle File Created", + "Windows NirSoft Utilities", + "Windows Njrat Fileless Storage via Registry", + "Windows Non Discord App Access Discord LevelDB", + "Windows Non-System Account Targeting Lsass", + "Windows Non-System Process Querying Definition Update", + "Windows NorthStar C2 Agent Execution", + "Windows Obfuscated Files or Information via RAR SFX", + "Windows Odbcconf Hunting", + "Windows Odbcconf Load DLL", + "Windows Odbcconf Load Response File", + "Windows Office Product Dropped Cab or Inf File", + "Windows Office Product Dropped Uncommon File", + "Windows Office Product Loaded MSHTML Module", + "Windows Office Product Loading Taskschd DLL", + "Windows Office Product Loading VBE7 DLL", + "Windows Office Product Spawned Child Process For Download", + "Windows Office Product Spawned Control", + "Windows Office Product Spawned MSDT", + "Windows Office Product Spawned Rundll32 With No DLL", + "Windows Office Product Spawned Uncommon Process", + "Windows OneDrive Share Mounted via Net", + "Windows Outlook Dialogs Disabled from Unusual Process", + "Windows Outlook LoadMacroProviderOnBoot Persistence", + "Windows Outlook Macro Created by Suspicious Process", + "Windows Outlook Macro Security Modified", + "Windows Outlook WebView Registry Modification", + "Windows PUA Named Pipe", + "Windows PaperCut NG Spawn Shell", + "Windows Parent PID Spoofing with Explorer", + "Windows Password Managers Discovery", + "Windows Password Policy Discovery with Net", "Windows Persistence Techniques", + "Windows Phishing Outlook Drop Dll In FORM Dir", + "Windows Phishing PDF File Executes URL Link", + "Windows Phishing Recent ISO Exec Registry", + "Windows Possible Credential Dumping", + "Windows Post Exploitation Risk Behavior", "Windows Post-Exploitation", + "Windows Potato Privilege Escalation Tool Execution", + "Windows Potential AppDomainManager Hijack Artifacts Creation", + "Windows Potential Cloudflared Network Connection", + "Windows Potential Cloudflared Tunnel Execution", + "Windows Potential Web Shell Creation For VMware Workspace ONE", + "Windows PowGoop Beacon Decoding", + "Windows PowerShell Add Module to Global Assembly Cache", + "Windows PowerShell Disable HTTP Logging", + "Windows PowerShell Export Certificate", + "Windows PowerShell Export PfxCertificate", + "Windows PowerShell FakeCAPTCHA Clipboard Execution", + "Windows PowerShell Get CIMInstance Remote Computer", + "Windows PowerShell IIS Components WebGlobalModule Usage", + "Windows PowerShell Invoke-RestMethod IP Information Collection", + "Windows PowerShell Invoke-Sqlcmd Execution", + "Windows PowerShell MSIX Package Installation", + "Windows PowerShell Module File Created", + "Windows PowerShell Process Implementing Manual Base64 Decoder", + "Windows PowerShell Process With Malicious String", + "Windows PowerShell ScheduleTask", + "Windows PowerShell Script Block With Malicious String", + "Windows PowerShell Script From WindowsApps Directory", + "Windows PowerShell Script TabExpansion Direct Call", + "Windows PowerShell WMI Win32 ScheduledJob", + "Windows PowerSploit GPP Discovery", + "Windows PowerView AD Access Control List Enumeration", + "Windows PowerView Constrained Delegation Discovery", + "Windows PowerView Kerberos Service Ticket Request", + "Windows PowerView SPN Discovery", + "Windows PowerView Unconstrained Delegation Discovery", + "Windows Powershell Cryptography Namespace", + "Windows Powershell History File Deletion", + "Windows Powershell Import Applocker Policy", + "Windows Powershell Logoff User via Quser", + "Windows Powershell RemoteSigned File", + "Windows Private Keys Discovery", "Windows Privilege Escalation", + "Windows Privilege Escalation Attempt Via MSI Rollback", + "Windows Privilege Escalation Suspicious Process Elevation", + "Windows Privilege Escalation System Process Without System Parent", + "Windows Privilege Escalation User Process Spawn System Process", + "Windows Privileged Group Modification", + "Windows Process Accessing Windows Recall Directory", + "Windows Process Commandline Discovery", + "Windows Process Executed From Removable Media", + "Windows Process Execution From ProgramData", + "Windows Process Execution From RDP Share", + "Windows Process Execution in Temp Dir", + "Windows Process Injection In Non-Service SearchIndexer", + "Windows Process Injection Remote Thread", + "Windows Process Injection Wermgr Child Process", + "Windows Process Injection With Public Source Path", + "Windows Process Injection into Commonly Abused Processes", + "Windows Process Injection into Notepad", + "Windows Process With NamedPipe CommandLine", + "Windows Process With NetExec Command Line Parameters", + "Windows Process Writing File to World Writable Path", + "Windows Processes Killed By Industroyer2 Malware", + "Windows Product Key Registry Query", + "Windows Protocol Tunneling with Plink", + "Windows Proxy Execution of .NET Utilities via Scripts", + "Windows Proxy Via Netsh", + "Windows Proxy Via Registry", + "Windows PsTools Recon Usage", + "Windows PuTTY Suite Utility Execution", + "Windows Query Registry Browser List Application", + "Windows Query Registry UnInstall Program List", "Windows RDP Artifacts and Defense Evasion", + "Windows RDP Bitmap Cache File Creation", + "Windows RDP Cache File Deletion", + "Windows RDP Client Launched with Admin Session", + "Windows RDP Connection Successful", + "Windows RDP File Execution", + "Windows RDP Login Session Was Established", + "Windows RDP Server Registry Deletion", + "Windows RDP Server Registry Entry Created", + "Windows RDPClient Connection Sequence Events", + "Windows RMM Named Pipe", + "Windows RMM Tool Execution", + "Windows Raccine Scheduled Task Deletion", + "Windows Rapid Authentication On Multiple Hosts", + "Windows Rasautou DLL Execution", + "Windows Raw Access To Disk Volume Partition", + "Windows Raw Access To Master Boot Record Drive", + "Windows Rdp AutomaticDestinations Deletion", "Windows Registry Abuse", + "Windows Registry BootExecute Modification", + "Windows Registry Certificate Added", + "Windows Registry Delete Task SD", + "Windows Registry Dotnet ETW Disabled Via ENV Variable", + "Windows Registry Entries Exported Via Reg", + "Windows Registry Entries Restored Via Reg", + "Windows Registry Modification for Safe Mode Persistence", + "Windows Registry Payload Injection", + "Windows Registry SIP Provider Modification", + "Windows Regsvr32 Renamed Binary", + "Windows Remote Access Software BRC4 Loaded Dll", + "Windows Remote Access Software RMS Registry", + "Windows Remote Assistance Spawning Process", + "Windows Remote Create Service", + "Windows Remote Desktop Network Bruteforce Attempt", + "Windows Remote Host Computer Management Access", + "Windows Remote Image Load", + "Windows Remote Management Execute Shell", + "Windows Remote Service Rdpwinst Tool Execution", + "Windows Remote Services Allow Rdp In Firewall", + "Windows Remote Services Allow Remote Assistance", + "Windows Remote Services Rdp Enable", + "Windows Renamed Powershell Execution", + "Windows Replication Through Removable Media", + "Windows Root Domain linked policies Discovery", + "Windows Routing and Remote Access Service Registry Key Change", + "Windows RunMRU Command Execution", + "Windows RunMRU Registry Key or Value Deleted", + "Windows Rundll32 Apply User Settings Changes", + "Windows Rundll32 Execution With Log.DLL", + "Windows Rundll32 Load DLL in Temp Dir", + "Windows Rundll32 WebDAV Request", + "Windows Rundll32 WebDav With Network Connection", + "Windows Rundll32 with Non-Standard File Extension", + "Windows SIP Provider Inventory", + "Windows SIP WinVerifyTrust Failed Trust Validation", + "Windows SOAPHound Binary Execution", + "Windows SQL Server Configuration Option Hunt", + "Windows SQL Server Critical Procedures Enabled", + "Windows SQL Server Extended Procedure DLL Loading Hunt", + "Windows SQL Server Startup Procedure", + "Windows SQL Server xp_cmdshell Config Change", + "Windows SQL Spawning CertUtil", + "Windows SQLCMD Execution", + "Windows SSH Proxy Command", + "Windows ScManager Security Descriptor Tampering Via Sc.EXE", + "Windows Scheduled Task Created Via XML", + "Windows Scheduled Task Created in a Group Policy Object", + "Windows Scheduled Task DLL Module Loaded", + "Windows Scheduled Task Service Spawned Shell", + "Windows Scheduled Task with Highest Privileges", + "Windows Scheduled Task with Suspicious Command", + "Windows Scheduled Task with Suspicious Name", + "Windows Scheduled Tasks for CompMgmtLauncher or Eventvwr", + "Windows Schtasks Create Run As System", + "Windows Screen Capture Via Powershell", + "Windows Screen Capture in TEMP folder", + "Windows Security Account Manager Stopped", + "Windows Security And Backup Services Stop", + "Windows Security Support Provider Reg Query", + "Windows Sensitive Group Discovery With Net", + "Windows Sensitive Registry Hive Dump Via CommandLine", + "Windows Server Software Component GACUtil Install to GAC", "Windows Service Abuse", + "Windows Service Create Kernel Mode Driver", + "Windows Service Create RemComSvc", + "Windows Service Create SliverC2", + "Windows Service Create with Tscon", + "Windows Service Created with Suspicious Service Name", + "Windows Service Created with Suspicious Service Path", + "Windows Service Creation Using Registry Entry", + "Windows Service Creation on Remote Endpoint", + "Windows Service Deletion In Registry", + "Windows Service Execution RemCom", + "Windows Service Initiation on Remote Endpoint", + "Windows Service Stop Attempt", + "Windows Service Stop By Deletion", + "Windows Service Stop Win Updates", + "Windows Set Account Password Policy To Unlimited Via Net", + "Windows Set Custom DNS ServerLevelPlugin Via Dnscmd", + "Windows Set Network Profile Category to Private via Registry", + "Windows SharePoint Spinstall0 GET Request", + "Windows SharePoint Spinstall0 Webshell File Creation", + "Windows SharePoint ToolPane Endpoint Exploitation Attempt", + "Windows Shell Process from CrushFTP", + "Windows Shell or Script Execution From IIS Directory", + "Windows Short Lived DNS Record", + "Windows Snake Malware File Modification Crmlog", + "Windows Snake Malware Kernel Driver Comadmin", + "Windows Snake Malware Registry Modification wav OpenWithProgIds", + "Windows Snake Malware Service Create", + "Windows SnappyBee Create Test Registry", + "Windows SoftEther VPN Masquerading as Legitimate Binary", + "Windows Software Discovery Via PowerShell", + "Windows Spearphishing Attachment Connect To None MS Office Domain", + "Windows Spearphishing Attachment Onenote Spawn Mshta", + "Windows Special Privileged Logon On Multiple Hosts", + "Windows SpeechRuntime COM Hijacking DLL Load", + "Windows SpeechRuntime Suspicious Child Process", + "Windows SqlWriter SQLDumper DLL Sideload", + "Windows Sqlservr Spawning Shell", + "Windows Steal Authentication Certificates - ESC1 Abuse", + "Windows Steal Authentication Certificates - ESC1 Authentication", + "Windows Steal Authentication Certificates CS Backup", + "Windows Steal Authentication Certificates CertUtil Backup", + "Windows Steal Authentication Certificates Certificate Issued", + "Windows Steal Authentication Certificates Certificate Request", + "Windows Steal Authentication Certificates CryptoAPI", + "Windows Steal Authentication Certificates Export Certificate", + "Windows Steal Authentication Certificates Export PfxCertificate", + "Windows Steal or Forge Kerberos Tickets Klist", + "Windows SubInAcl Execution", + "Windows Suspect Process With Authentication Traffic", + "Windows Suspicious Burst of Password Changes", + "Windows Suspicious C2 Named Pipe", + "Windows Suspicious Child Process Spawned From WebServer", + "Windows Suspicious Child Process of TieringEngineService.exe", + "Windows Suspicious Defender Engine or Signature Files Created", + "Windows Suspicious Defender Update Activity in INetCache", + "Windows Suspicious Driver Loaded Path", + "Windows Suspicious File in EFI Volume", + "Windows Suspicious Named Pipe", + "Windows Suspicious Process File Path", + "Windows Suspicious QEMU Execution", + "Windows Suspicious React or Next.js Child Process", + "Windows Suspicious VMWare Tools Child Process", + "Windows Svchost.exe Parent Process Anomaly", + "Windows SymbolicLink-Testing-Tools Utility Execution", + "Windows Symlink Evaluation Change via Fsutil", + "Windows System Binary Proxy Execution Compiled HTML File Decompile", "Windows System Binary Proxy Execution MSIExec", + "Windows System Discovery Using Qwinsta", + "Windows System Discovery Using ldap Nslookup", + "Windows System File on Disk", + "Windows System LogOff Commandline", + "Windows System Network Config Discovery Display DNS", + "Windows System Network Connections Discovery Netsh", + "Windows System Reboot CommandLine", + "Windows System Remote Discovery With Query", + "Windows System Script Proxy Execution Syncappvpublishingserver", + "Windows System Shutdown CommandLine", + "Windows System Time Discovery W32tm Delay", + "Windows System User Discovery Via Quser", + "Windows System User Privilege Discovery", + "Windows TOR Client Execution", + "Windows TeamCity Payload Execution from Temp Directory", + "Windows TeamCity Plugin Installed", + "Windows Terminating Lsass Process", + "Windows Theme File Creation in Unusual Location", + "Windows Time Based Evasion", + "Windows Time Based Evasion via Choice Exec", + "Windows TinyCC Shellcode Execution", + "Windows UAC Bypass Suspicious Child Process", + "Windows UAC Bypass Suspicious Escalation Behavior", + "Windows USBSTOR Registry Key Modification", + "Windows Uncommon Remote Thread Creation In Browser Process", + "Windows Universal Data Link File Creation", + "Windows Unsecured Outlook Credentials Access In Registry", + "Windows Unsigned DLL Side-Loading", + "Windows Unsigned DLL Side-Loading In Same Process Path", + "Windows Unsigned MS DLL Side-Loading", + "Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos", + "Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos", + "Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM", + "Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials", + "Windows Unusual Count Of Users Failed To Auth Using Kerberos", + "Windows Unusual Count Of Users Failed To Authenticate From Process", + "Windows Unusual Count Of Users Failed To Authenticate Using NTLM", + "Windows Unusual Count Of Users Remotely Failed To Auth From Host", + "Windows Unusual File Creation in Confluence Directory", + "Windows Unusual FileZilla XML Config Access", + "Windows Unusual Intelliform Storage Registry Access", + "Windows Unusual NTLM Authentication Destinations By Source", + "Windows Unusual NTLM Authentication Destinations By User", + "Windows Unusual NTLM Authentication Users By Destination", + "Windows Unusual NTLM Authentication Users By Source", + "Windows Unusual Process Load Mozilla NSS-Mozglue Module", + "Windows Unusual SysWOW64 Process Run System32 Executable", "Windows Updates Install Failures", "Windows Updates Install Successes", + "Windows User Deletion Via Net", + "Windows User Disabled Via Net", + "Windows User Discovery Via Net", + "Windows User Execution Malicious URL Shortcut File", + "Windows VSSVC Process Accessing Defender Engine", + "Windows Visual Basic Commandline Compiler DNSQuery", + "Windows Vulnerable 3CX Software", + "Windows Vulnerable Driver Installed", + "Windows Vulnerable Driver Loaded", + "Windows WBAdmin File Recovery From Backup", + "Windows WMI Impersonate Token", + "Windows WMI Process And Service List", + "Windows WMI Process Call Create", + "Windows WMI Reconnaissance Class Query", + "Windows WMIC Shadowcopy Delete", + "Windows WPDBusEnum Registry Key Modification", + "Windows WSUS Spawning Shell", + "Windows Wermgr Alternate Data Stream in Temp Dir", + "Windows WinDBG Spawning AutoIt3", + "Windows WinLogon with Public Network Connection", + "Windows WinPEAS PowerShell Script Execution", + "Windows WinRAR Launched Outside Default Installation Directory", + "Windows WinSCP Configuration Security Access", + "Windows Wmic CPU Discovery", + "Windows Wmic DiskDrive Discovery", + "Windows Wmic Memory Chip Discovery", + "Windows Wmic Network Discovery", + "Windows Wmic Systeminfo Discovery", + "Windows XLL File Creation Outside of Typical Location", + "Winhlp32 Spawning a Process", "Winter Vivern", + "Wmic Group Discovery", + "Wmic NonInteractive App Uninstallation", + "Wmiprvse LOLBAS Execution Process Spawn", + "WordPress Bricks Builder plugin RCE", "WordPress Vulnerabilities", + "Wscript Or Cscript Suspicious Child Process", + "Wsmprovhost LOLBAS Execution Process Spawn", "XML Runner Loader", + "XMRIG Driver Loaded", "XMRig", + "XSL Script Execution With WMIC", "XWorm", "XorDDos", "ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day", "ZOVWiper", "Zeek Conn", + "Zeek x509 Certificate with Punycode", + "Zoom High Video Latency", + "Zoom Rare Audio Devices", + "Zoom Rare Input Devices", + "Zoom Rare Video Devices", + "Zscaler Adware Activities Threat Blocked", + "Zscaler Behavior Analysis Threat Blocked", "Zscaler Browser Proxy Threats", + "Zscaler CryptoMiner Downloaded Threat Blocked", + "Zscaler Employment Search Web Activity", + "Zscaler Exploit Threat Blocked", + "Zscaler Legal Liability Threat Blocked", + "Zscaler Malware Activity Threat Blocked", + "Zscaler Phishing Activity Threat Blocked", + "Zscaler Potentially Abused File Download", + "Zscaler Privacy Risk Destinations Threat Blocked", + "Zscaler Scam Destinations Threat Blocked", + "Zscaler Virus Download threat blocked", "ace_access_rights_lookup", "ace_flag_lookup", "ace_type_lookup", @@ -717,6 +2853,9 @@ "applockereventcodes", "asr_rules", "attacker_tools", + "audit_searches", + "audittrail", + "aws_bedrock_claude", "aws_cloudwatchlogs_eks", "aws_config", "aws_description", @@ -737,6 +2876,7 @@ "brand_abuse_dns", "brand_abuse_email", "brand_abuse_web", + "bro_ssl_json", "browser_app_list", "browser_process_and_path", "builtin_groups_lookup", @@ -748,6 +2888,7 @@ "cisco_asa", "cisco_duo_activity", "cisco_duo_administrator", + "cisco_ios", "cisco_isovalent", "cisco_isovalent_allowed_images", "cisco_isovalent_process_connect", @@ -756,6 +2897,8 @@ "cisco_networks", "cisco_sd_wan_service_proxy_access", "cisco_sd_wan_syslog", + "cisco_secure_access_dns", + "cisco_secure_access_proxy", "cisco_secure_firewall", "cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools", "cisco_secure_firewall_filetype_lookup", @@ -879,6 +3022,7 @@ "osquery_macro", "osquery_process", "papercutng", + "path_traversal_spl_injection", "pingid", "potential_password_in_username_false_positive_reduction", "potentially_malicious_code_on_cmdline_tokenize_score", @@ -992,12 +3136,24 @@ "s3_deletion_baseline", "sAMAccountName Spoofing and Domain Controller Impersonation", "scripting_tools_user_agents", + "secureapp_attack", "secureapp_es_field_mappings", "security_content_ctime", "security_content_summariesonly", "security_group_activity_baseline", "security_group_api_calls", "security_services_lookup", + "splunk_crash_log", + "splunk_python", + "splunk_risky_command", + "splunkd", + "splunkd_failed_auths", + "splunkd_investigation_rest_handler", + "splunkd_ui", + "splunkd_web", + "splunkd_webs", + "splunkd_webx", + "splunkda", "sslbl_ssl_certificate_blacklist", "stream_dns", "stream_http", @@ -1019,6 +3175,7 @@ "typo_squatted_python_packages", "uacbypass_process_name", "uncommon_processes", + "windchill_log4j", "windows_exchange_iis", "windows_protocol_handlers", "windows_shells", @@ -1113,6 +3270,7 @@ "d141afeb-d2bc-4934-8dd5-b7dba0f9f67a", "e9fdb899-a980-4ba4-934b-486ad22e22f4", "8164a4a6-f99c-4661-ac4f-80f5e4e78d2b", + "ec9ab81c-8053-4957-8c66-0218381ab564", "46959285-906d-40fa-9437-5a439accd878", "68190529-069b-4ffc-a942-919704158065", "ec23cef9-27d9-46e4-a68d-6f75f7b86908", @@ -1177,6 +3335,7 @@ "d9efa6c7-6518-42b2-809a-4f2a8e242b9b", "251c5936-569f-42f4-9ac2-87a173b9e9b8", "78bd3fa7-773c-449e-a978-dc1f1500bc52", + "cec8ad4e-0320-4984-a1ae-70ee398c9519", "15f44ea9-4571-4837-be9e-802431a7bfae", "bf23c7dc-1004-4949-8262-4c1d1ef87702", "952931a4-af0b-4335-bbbe-73c8c5b327ae", @@ -1284,6 +3443,7 @@ "ac494fe5-81a4-4897-af42-e774cf005ecb", "b8a49f03-e3c4-40f2-b7bb-9e8f8fdddbf1", "3b7015f2-3144-4205-b799-b05580621379", + "7dd05b3e-0803-4852-9345-c494eb3e40fe", "191db57d-091a-47d5-99f3-97fde53de505", "ccf4ac39-ec93-42be-9035-90e2f26bcd92", "93c150f5-ad7b-4ee3-8992-df06dec2ac79", @@ -1316,8 +3476,8 @@ "94f6a1c9-aae7-46a4-9083-2bb1f5768ec4", "bac8a340-be64-4491-a0cc-0985cb227f5a", "234f9b7c-b53d-4f32-897b-b880a6c9ea7b", - "b8147c9a-84db-4ec1-8eee-4e0da75f0de5", "b877943f-0377-44f4-8477-f79db7f07c4d", + "b8147c9a-84db-4ec1-8eee-4e0da75f0de5", "54782d65-12f0-47a5-b4c1-b70ee23de6df", "e03ada14-0980-4107-aff1-7783b2b59bb1", "e7e3a525-7612-4d68-a5d3-c4649181b8af", @@ -1552,7 +3712,9 @@ "6326dbc4-444b-4c04-88f4-27e94d0327cb", "9ebe7901-7edf-45c0-b5c7-8366300919db", "8fe2ccfd-f079-4c03-b1a9-bd9b362b67d4", + "5fabf878-7dd4-48d3-9995-408fac68e166", "069258f4-2162-46e9-9a25-c9c6c56150d2", + "4383bbd3-aa6c-49fd-a1a9-cf112c95982c", "815bef8b-bf91-4b67-be4c-abe4c2a94ccc", "42510244-5019-48fa-a0e5-66c3b76e6049", "9d04efee-eff5-4240-b8d2-07792b873608", @@ -1662,6 +3824,7 @@ "bc15c13f-d121-4b1f-8c7d-28d95854d086", "281201e7-de41-4dc9-b73d-f288938cbb64", "eb121494-82d1-4148-9e2b-e624e03fbf3d", + "f0057c81-24dc-4a2e-b658-5809c242180b", "653d39cd-bae7-499a-898c-9fb96b8b5cd1", "7a48f482-246f-4aeb-9837-21c271ebf244", "486e88ea-4f56-470f-9b57-3f4d73f39133", @@ -1680,6 +3843,7 @@ "41274289-ec9c-4213-bea4-e43c4aa57954", "4963a81e-a3ad-4f02-adda-812343b351de", "d3415a0e-66ef-429b-acf4-a768876954f6", + "35ad6590-2207-4b14-bf8f-9899470d7156", "e2d85e66-cb66-4ed7-93b1-833fc56c9319", "86a43bad-12e3-4e85-b97c-4d5cf25b95c3", "49543237-25db-497b-90df-d0a0a6e8fe2c", @@ -1832,6 +3996,7 @@ "640cbf6d-659b-498b-ba53-f6dd1a1cc02c", "c3ed6d2a-e3ad-400d-ad78-bbfdbfeacc08", "abcde488-e083-4ee7-bc85-a5684edd7541", + "c666acd6-6ff5-4d28-9490-195d89cd4337", "d380c318-0b34-45cb-9dad-828c11891e43", "9e8894c0-50bd-4525-a96c-d4ac78ece388", "913c0e4e-4b37-4b78-ad0b-90e7b25010f6", @@ -2149,6 +4314,7 @@ "4c8db261-a58b-42a6-a866-0a294deedde4", "f0027655-25ef-47b0-acaf-3d83d106156c", "c75612b2-9de0-4d7c-879c-10d7b077072d", + "5696f417-30e5-4942-988d-0b9dcfe3a929", "d322cdd7-7d60-46e3-9111-648848da7c02", "a8568b10-9ab9-4140-a523-1c72e0176924", "33ca84bc-4259-4943-bd36-4655dc420932", @@ -2263,6 +4429,7 @@ "ae4b6361-b5f8-46cb-a3f9-9cf108ccfe7b", "394a538e-09bb-4a4a-95d1-b93cf12682a8", "1a02df58-09af-4064-a765-0babe1a0d1e2", + "40c44d16-bb49-4d14-aafa-f9ba7e6e6c5b", "4238a7f0-a980-4fff-98a2-dfc0a363d507", "00c652e2-0750-4ca6-82ff-0204684a6fe4", "58ed10e8-0738-4651-8408-3a3e9a526279", @@ -2295,6 +4462,7 @@ "5bec4cc8-f41e-437b-b417-33ff60acf9af", "a0c1725f-abcd-40d6-baac-020f3cf94ecd", "d1c73b96-ab87-4031-bad8-0e1b3b8bf3ec", + "3d9e332e-60c9-407a-af4c-a9ae43c4f1d0", "7c8c7bd8-0a5c-4514-a6a3-0814c5a98cf0", "a83ad6e8-6f24-4d7f-8f44-75f8ab742991", "7e7ac3ed-f795-4fa5-b711-09d6fbe9b873", @@ -2378,6 +4546,7 @@ "0315bdff-4178-47e9-81e4-f31a6d23f7e4", "736b4f53-f400-4c22-855d-1a6b5a551600", "114dd4e3-8d1c-4ea7-bb8d-8d8f6aca21f0", + "3f452c87-25b5-47c0-81d8-01908df1b927", "183235ca-8e6c-422c-88c2-3aa28c4825d9", "b4ca838d-d013-4461-bf2c-f7132617b409", "0b79c06f-c788-44a2-8630-d69051f1123d", @@ -2831,6 +5000,7 @@ "453acf13-1dbd-47d7-b28a-172ce9228023", "da4f751a-020b-40d7-b9ff-d433b7799803", "14033063-ee04-4eaf-8f5d-ba07ca7a097c", + "14bd90b1-c3f3-4115-9861-cf0519a59654", "8bec51da-7a6d-4346-b941-51eca448c4b0", "1d958c61-09c6-4d9e-b26b-4130314e520e", "12e03af7-79f9-4f95-af48-d3f12f28a260", @@ -2880,8 +5050,9 @@ "96db2632-8417-4dbb-b8bb-a8b92ba391de", "a50d5a97-2531-499e-a1de-5544c74432c6", "6cd715aa-20ac-4be1-a8f1-dda7bae160bd", - "44a4bedf-ffe3-452e-bee4-6925ab125662", + "50859b3b-b088-4c7b-973d-03a0365a9bf9", "16f6374f-7600-459a-9b16-6a88fd96d310", + "44a4bedf-ffe3-452e-bee4-6925ab125662", "e9584f82-322c-474a-b831-940fd8b4455c", "e6f36545-dc1e-47f0-9f48-7f730f54a02e", "52778a8f-a10b-41a4-9eae-52ddb74072bf", @@ -3309,6 +5480,7 @@ "BlackMatter Ransomware", "BlackSuit Ransomware", "BlankGrabber Stealer", + "BlueHammer", "Brand Monitoring", "Braodo Stealer", "Browser Hijacking", @@ -3479,10 +5651,12 @@ "Orangeworm Attack Group", "Outlook RCE CVE-2024-21378", "PHP-CGI RCE Attack on Japanese Organizations", + "PTC Windchill Exploitation", "PXA Stealer", "PaperCut MF NG Vulnerability", "PathWiper", "PetitPotam NTLM Relay on Active Directory Certificate Services", + "Phantom Stealer", "Phemedrone Stealer", "PlugX", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", @@ -3500,17 +5674,20 @@ "Ransomware Cloud", "React2Shell", "RedLine Stealer", + "RedSun", "Remcos", "Remote Employment Fraud", "Remote Monitoring and Management Software", "Reverse Network Proxy", "Revil Ransomware", "Rhysida Ransomware", + "RoguePlanet", "Router and Infrastructure Security", "Ryuk Ransomware", "SAP NetWeaver Exploitation", "SQL Injection", "SQL Server Abuse", + "Salat Stealer", "Salt Typhoon", "SamSam Ransomware", "Sandworm Tools", @@ -3530,11 +5707,13 @@ "Sneaky Active Directory Persistence Tricks", "SolarWinds WHD RCE Post Exploitation", "Spearphishing Attachments", + "Splunk Vulnerabilities", "Spring4Shell CVE-2022-22965", "StealC Stealer", "Storm-0501 Ransomware", "Storm-2460 CLFS Zero Day Exploitation", "Subvert Trust Controls SIP and Trust Provider Hijacking", + "Suspicious AWS Bedrock Claude Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", diff --git a/schemas/Playbook.schema.json b/schemas/Playbook.schema.json index aa4da253b55..e137faf11e6 100644 --- a/schemas/Playbook.schema.json +++ b/schemas/Playbook.schema.json @@ -284,6 +284,13 @@ "ASL AWS SAML Update identity provider", "ASL AWS UpdateLoginProfile", "AWS AMI Attribute Modification for Exfiltration", + "AWS Bedrock Claude Cross Region Possible Inference Abuse", + "AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation", + "AWS Bedrock Claude Hostile Prompt Sentiment", + "AWS Bedrock Claude Possible Prompt Injection", + "AWS Bedrock Claude Sensitive Data in Prompts", + "AWS Bedrock Claude Unusually Large Prompts", + "AWS Bedrock Claude excessive use of tokens", "AWS Bedrock Delete GuardRails", "AWS Bedrock Delete Knowledge Base", "AWS Bedrock Delete Model Invocation Logging Configuration", @@ -360,7 +367,6 @@ "Amazon EKS Kubernetes cluster scan detection", "Anomalous usage of 7zip", "Attacker Tools On Endpoint", - "Attempt To Add Certificate To Untrusted Store", "Auto Admin Logon Registry Entry", "Azure AD Admin Consent Bypassed by Service Principal", "Azure AD Application Administrator Role Assigned", @@ -417,7 +423,6 @@ "BITSAdmin Download File", "Batch File Write to System32", "Bcdedit Command Back To Normal Mode Boot", - "CHCP Command Execution", "CMD Carry Out String Command Parameter", "CMD Echo Pipe - Escalation", "CMLUA Or CMSTPLUA UAC Bypass", @@ -459,7 +464,16 @@ "Cisco Duo Policy Skip 2FA for Other Countries", "Cisco Duo Set User Status to Bypass 2FA", "Cisco IOS Suspicious Privileged Account Creation", + "Cisco IOS XE Guestshell Activation and Destroy", "Cisco IOS XE Implant Access", + "Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal", + "Cisco IOS XE Reconnaissance Command Activity", + "Cisco IOS XE Remote Access Probe Burst", + "Cisco IOS XE Request Platform Package Describe Shell Pattern", + "Cisco IOS XE Tunnel Interface Configuration", + "Cisco IOS XE VTY Access Class Tampering", + "Cisco IOS XE WebUI Login From IOSd Local Port", + "Cisco IOS XE WebUI Programmatic Configuration", "Cisco Isovalent - Access To Cloud Metadata Service", "Cisco Isovalent - Cron Job Creation", "Cisco Isovalent - Curl Execution With Insecure Flags", @@ -487,10 +501,14 @@ "Cisco Network Interface Modifications", "Cisco Privileged Account Creation with HTTP Command Execution", "Cisco Privileged Account Creation with Suspicious SSH Activity", + "Cisco SA - Access to Anonymizer Services", + "Cisco SA - Automated Web Reconnaissance via HTTP Access Errors", "Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity", "Cisco SD-WAN - Low Frequency Rogue Peer", "Cisco SD-WAN - Peering Activity", "Cisco SD-WAN - Uncommon User-Agent Multi-URI Activity", + "Cisco SD-WAN Multiple SSH key Authentication from Same Source", + "Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication", "Cisco SNMP Community String Configuration Changes", "Cisco Secure Firewall - Binary File Type Download", "Cisco Secure Firewall - Bits Network Activity", @@ -897,7 +915,6 @@ "Ivanti EPM SQL Injection Remote Code Execution", "Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078", "Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082", - "Ivanti Sentry Authentication Bypass", "Ivanti VTM New Account Creation", "Java Class File download by Java User Agent", "Java Writing JSP File", @@ -1013,6 +1030,7 @@ "Linux Auditd Unload Module Via Modprobe", "Linux Auditd Virtual Disk File And Directory Discovery", "Linux Auditd Whoami User Discovery", + "Linux Binary Launched Process with Null Argv", "Linux Busybox Privilege Escalation", "Linux Change File Owner To Root", "Linux Clipboard Data Copy", @@ -1029,6 +1047,7 @@ "Linux Deletion Of Init Daemon Script", "Linux Deletion Of Services", "Linux Deletion of SSL Certificate", + "Linux Dirty Frag Kernel Privilege Escalation", "Linux Disable Services", "Linux Doas Conf File Creation", "Linux Doas Tool Execution", @@ -1059,6 +1078,7 @@ "Linux Kworker Process In Writable Process Path", "Linux Magic SysRq Key Abuse", "Linux Make Privilege Escalation", + "Linux Malformed Auth Entry", "Linux Medusa Rootkit", "Linux MySQL Privilege Escalation", "Linux NOPASSWD Entry In Sudoers File", @@ -1067,6 +1087,7 @@ "Linux Obfuscated Files or Information Base64 Decode", "Linux Octave Privilege Escalation", "Linux OpenVPN Privilege Escalation", + "Linux PF_ALG Registration Outside of Boot Window", "Linux PHP Privilege Escalation", "Linux Persistence and Privilege Escalation Risk Behavior", "Linux Possible Access Or Modification Of sshd Config File", @@ -1095,6 +1116,7 @@ "Linux Stop Services", "Linux Sudo OR Su Execution", "Linux Sudoers Tmp File Creation", + "Linux Suspicious Namespace Creation", "Linux Suspicious React or Next.js Child Process", "Linux System Network Discovery", "Linux System Reboot Via System Request Key", @@ -1295,6 +1317,8 @@ "Ollama Suspicious Prompt Injection Jailbreak", "Outbound Network Connection from Java Using Default Ports", "Overwriting Accessibility Binaries", + "PTC Windchill GW READY OK Probe", + "PTC Windchill Gateway Command Execution", "PaperCut NG Remote Web Access Attempt", "PaperCut NG Suspicious Behavior Debug Log", "Permission Modification using Takeown App", @@ -1327,6 +1351,7 @@ "PowerShell WebRequest Using Memory Stream", "Powershell COM Hijacking InprocServer32 Modification", "Powershell Creating Thread Mutex", + "Powershell Defender Threat Actions Set to Allow", "Powershell Disable Security Monitoring", "Powershell Enable SMB1Protocol Feature", "Powershell Execute COM Object", @@ -1350,7 +1375,6 @@ "Process Kill Base On File Path", "Process Writing DynamicWrapperX", "Processes Tapping Keyboard Events", - "Processes launching netsh", "Prohibited Network Traffic Allowed", "Protocol or Port Mismatch", "Protocols passing authentication in cleartext", @@ -1410,7 +1434,6 @@ "SQL Injection with Long URLs", "SSL Certificates with Punycode", "Samsam Test File Write", - "Sc exe Manipulating Windows Services", "SchCache Change By App Connect And Create ADSI Object", "Schedule Task with HTTP Command Arguments", "Schedule Task with Rundll32 Command Trigger", @@ -1440,7 +1463,20 @@ "SilentCleanup UAC Bypass", "Single Letter Process On Endpoint", "Spike in File Writes", + "Splunk App for Lookup File Editing RCE via User XSLT", "Splunk AppDynamics Secure Application Alerts", + "Splunk Authentication Token Exposure in Debug Log", + "Splunk Code Injection via custom dashboard leading to RCE", + "Splunk Enterprise KV Store Incorrect Authorization", + "Splunk Information Disclosure on Account Login", + "Splunk Path Traversal In Splunk App For Lookup File Edit", + "Splunk RCE PDFgen Render", + "Splunk RCE Through Arbitrary File Write to Windows System Root", + "Splunk RCE via User XSLT", + "Splunk Secure Application Alerts for Runtime Security", + "Splunk Sensitive Information Disclosure in DEBUG Logging Channels", + "Splunk User Enumeration Attempt", + "Splunk XSS Privilege Escalation via Custom Urls in Dashboard", "Spoolsv Spawning Rundll32", "Spoolsv Suspicious Loaded Modules", "Spoolsv Suspicious Process Access", @@ -1586,6 +1622,7 @@ "Windows Account Discovery for None Disable User Account", "Windows Account Discovery for Sam Account Name", "Windows AdFind Exe", + "Windows Admin Password Changed by Non-Admin", "Windows Admin Permission Discovery", "Windows Administrative Shares Accessed On Multiple Hosts", "Windows Admon Default Group Policy Object Modified", @@ -1657,6 +1694,8 @@ "Windows Cisco Secure Endpoint Unblock File Via Sfc", "Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc", "Windows ClipBoard Data via Get-ClipBoard", + "Windows Cloud Files Filter Loaded by Uncommon Process", + "Windows Cloud Files Filter Log Created by Non-System Process", "Windows Cmdline Tool Execution From Non-Shell Process", "Windows Cobalt Strike PowerShell Loader", "Windows Command Obfuscation with Environment Variable Substrings", @@ -1776,6 +1815,8 @@ "Windows Explorer LNK Exploit Process Launch With Padding", "Windows Explorer.exe Spawning PowerShell or Cmd", "Windows Export Certificate", + "Windows FFmpeg Audio and Video Device Discovery", + "Windows FFmpeg DirectShow Video Capture", "Windows File Association Modification via Ftype", "Windows File Collection Via Copy Utilities", "Windows File Download Via CertUtil", @@ -1954,6 +1995,7 @@ "Windows Modify Show Compress Color And Info Tip Registry", "Windows Modify System Firewall with Notable Process Path", "Windows MpCmdRun RemoveDefinitions Execution", + "Windows MsMpEng Writing to System32", "Windows Mshta Execution In Registry", "Windows MsiExec HideWindow Rundll32 Execution", "Windows Multi hop Proxy TOR Website Query", @@ -1989,6 +2031,7 @@ "Windows Njrat Fileless Storage via Registry", "Windows Non Discord App Access Discord LevelDB", "Windows Non-System Account Targeting Lsass", + "Windows Non-System Process Querying Definition Update", "Windows NorthStar C2 Agent Execution", "Windows Obfuscated Files or Information via RAR SFX", "Windows Odbcconf Hunting", @@ -2216,8 +2259,12 @@ "Windows Steal or Forge Kerberos Tickets Klist", "Windows SubInAcl Execution", "Windows Suspect Process With Authentication Traffic", + "Windows Suspicious Burst of Password Changes", "Windows Suspicious C2 Named Pipe", "Windows Suspicious Child Process Spawned From WebServer", + "Windows Suspicious Child Process of TieringEngineService.exe", + "Windows Suspicious Defender Engine or Signature Files Created", + "Windows Suspicious Defender Update Activity in INetCache", "Windows Suspicious Driver Loaded Path", "Windows Suspicious File in EFI Volume", "Windows Suspicious Named Pipe", @@ -2253,6 +2300,7 @@ "Windows UAC Bypass Suspicious Child Process", "Windows UAC Bypass Suspicious Escalation Behavior", "Windows USBSTOR Registry Key Modification", + "Windows Uncommon Remote Thread Creation In Browser Process", "Windows Universal Data Link File Creation", "Windows Unsecured Outlook Credentials Access In Registry", "Windows Unsigned DLL Side-Loading", @@ -2279,6 +2327,7 @@ "Windows User Disabled Via Net", "Windows User Discovery Via Net", "Windows User Execution Malicious URL Shortcut File", + "Windows VSSVC Process Accessing Defender Engine", "Windows Visual Basic Commandline Compiler DNSQuery", "Windows Vulnerable 3CX Software", "Windows Vulnerable Driver Installed", @@ -2291,10 +2340,12 @@ "Windows WMIC Shadowcopy Delete", "Windows WPDBusEnum Registry Key Modification", "Windows WSUS Spawning Shell", + "Windows Wermgr Alternate Data Stream in Temp Dir", "Windows WinDBG Spawning AutoIt3", "Windows WinLogon with Public Network Connection", "Windows WinPEAS PowerShell Script Execution", "Windows WinRAR Launched Outside Default Installation Directory", + "Windows WinSCP Configuration Security Access", "Windows Wmic CPU Discovery", "Windows Wmic DiskDrive Discovery", "Windows Wmic Memory Chip Discovery", @@ -2430,6 +2481,7 @@ "BlackMatter Ransomware", "BlackSuit Ransomware", "BlankGrabber Stealer", + "BlueHammer", "Brand Monitoring", "Braodo Stealer", "Browser Hijacking", @@ -2600,10 +2652,12 @@ "Orangeworm Attack Group", "Outlook RCE CVE-2024-21378", "PHP-CGI RCE Attack on Japanese Organizations", + "PTC Windchill Exploitation", "PXA Stealer", "PaperCut MF NG Vulnerability", "PathWiper", "PetitPotam NTLM Relay on Active Directory Certificate Services", + "Phantom Stealer", "Phemedrone Stealer", "PlugX", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", @@ -2621,17 +2675,20 @@ "Ransomware Cloud", "React2Shell", "RedLine Stealer", + "RedSun", "Remcos", "Remote Employment Fraud", "Remote Monitoring and Management Software", "Reverse Network Proxy", "Revil Ransomware", "Rhysida Ransomware", + "RoguePlanet", "Router and Infrastructure Security", "Ryuk Ransomware", "SAP NetWeaver Exploitation", "SQL Injection", "SQL Server Abuse", + "Salat Stealer", "Salt Typhoon", "SamSam Ransomware", "Sandworm Tools", @@ -2651,11 +2708,13 @@ "Sneaky Active Directory Persistence Tricks", "SolarWinds WHD RCE Post Exploitation", "Spearphishing Attachments", + "Splunk Vulnerabilities", "Spring4Shell CVE-2022-22965", "StealC Stealer", "Storm-0501 Ransomware", "Storm-2460 CLFS Zero Day Exploitation", "Subvert Trust Controls SIP and Trust Provider Hijacking", + "Suspicious AWS Bedrock Claude Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", diff --git a/schemas/RemovedContent.schema.json b/schemas/RemovedContent.schema.json index da74df03478..43e4b536ea3 100644 --- a/schemas/RemovedContent.schema.json +++ b/schemas/RemovedContent.schema.json @@ -43,6 +43,14 @@ "ASL AWS SAML Update identity provider", "ASL AWS UpdateLoginProfile", "AWS AMI Attribute Modification for Exfiltration", + "AWS Bedrock Claude", + "AWS Bedrock Claude Cross Region Possible Inference Abuse", + "AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation", + "AWS Bedrock Claude Hostile Prompt Sentiment", + "AWS Bedrock Claude Possible Prompt Injection", + "AWS Bedrock Claude Sensitive Data in Prompts", + "AWS Bedrock Claude Unusually Large Prompts", + "AWS Bedrock Claude excessive use of tokens", "AWS Bedrock Delete GuardRails", "AWS Bedrock Delete Knowledge Base", "AWS Bedrock Delete Model Invocation Logging Configuration", @@ -212,7 +220,6 @@ "AsyncRAT", "Atlassian Confluence Server and Data Center CVE-2022-26134", "Attacker Tools On Endpoint", - "Attempt To Add Certificate To Untrusted Store", "Attribute Lookup Dispatch", "Auto Admin Logon Registry Entry", "Automated Enrichment", @@ -323,6 +330,7 @@ "BlackSuit Ransomware", "BlankGrabber Stealer", "Block Indicators", + "BlueHammer", "Brand Monitoring", "Braodo Stealer", "Bro conn", @@ -337,7 +345,6 @@ "Bro x509", "Browser Hijacking", "Brute Ratel C4", - "CHCP Command Execution", "CISA AA22-257A", "CISA AA22-264A", "CISA AA22-277A", @@ -403,8 +410,17 @@ "Cisco Duo Suspicious Activity", "Cisco IOS Logs", "Cisco IOS Suspicious Privileged Account Creation", + "Cisco IOS XE Guestshell Activation and Destroy", "Cisco IOS XE Implant Access", + "Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal", + "Cisco IOS XE Reconnaissance Command Activity", + "Cisco IOS XE Remote Access Probe Burst", + "Cisco IOS XE Request Platform Package Describe Shell Pattern", "Cisco IOS XE Software Web Management User Interface vulnerability", + "Cisco IOS XE Tunnel Interface Configuration", + "Cisco IOS XE VTY Access Class Tampering", + "Cisco IOS XE WebUI Login From IOSd Local Port", + "Cisco IOS XE WebUI Programmatic Configuration", "Cisco Isovalent - Access To Cloud Metadata Service", "Cisco Isovalent - Cron Job Creation", "Cisco Isovalent - Curl Execution With Insecure Flags", @@ -439,15 +455,22 @@ "Cisco Network Visibility Module OSquery", "Cisco Privileged Account Creation with HTTP Command Execution", "Cisco Privileged Account Creation with Suspicious SSH Activity", + "Cisco SA - Access to Anonymizer Services", + "Cisco SA - Automated Web Reconnaissance via HTTP Access Errors", "Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity", "Cisco SD-WAN - Low Frequency Rogue Peer", "Cisco SD-WAN - Peering Activity", "Cisco SD-WAN - Uncommon User-Agent Multi-URI Activity", + "Cisco SD-WAN Auth Log", + "Cisco SD-WAN Multiple SSH key Authentication from Same Source", + "Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication", "Cisco SD-WAN NTCE 1000001", "Cisco SD-WAN Service Proxy Access Logs", "Cisco SNMP Community String Configuration Changes", "Cisco Secure Access Analytics", + "Cisco Secure Access DNS", "Cisco Secure Access Firewall", + "Cisco Secure Access Proxy", "Cisco Secure Firewall - Binary File Type Download", "Cisco Secure Firewall - Bits Network Activity", "Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint", @@ -989,7 +1012,6 @@ "Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078", "Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082", "Ivanti EPMM Remote Unauthenticated Access", - "Ivanti Sentry Authentication Bypass", "Ivanti Sentry Authentication Bypass CVE-2023-38035", "Ivanti VTM Audit", "Ivanti VTM New Account Creation", @@ -1131,6 +1153,7 @@ "Linux Auditd Unload Module Via Modprobe", "Linux Auditd Virtual Disk File And Directory Discovery", "Linux Auditd Whoami User Discovery", + "Linux Binary Launched Process with Null Argv", "Linux Busybox Privilege Escalation", "Linux Change File Owner To Root", "Linux Clipboard Data Copy", @@ -1147,6 +1170,7 @@ "Linux Deletion Of Init Daemon Script", "Linux Deletion Of Services", "Linux Deletion of SSL Certificate", + "Linux Dirty Frag Kernel Privilege Escalation", "Linux Disable Services", "Linux Doas Conf File Creation", "Linux Doas Tool Execution", @@ -1178,7 +1202,9 @@ "Linux Living Off The Land", "Linux Magic SysRq Key Abuse", "Linux Make Privilege Escalation", + "Linux Malformed Auth Entry", "Linux Medusa Rootkit", + "Linux Messages Syslog", "Linux MySQL Privilege Escalation", "Linux NOPASSWD Entry In Sudoers File", "Linux Ngrok Reverse Proxy Usage", @@ -1186,6 +1212,7 @@ "Linux Obfuscated Files or Information Base64 Decode", "Linux Octave Privilege Escalation", "Linux OpenVPN Privilege Escalation", + "Linux PF_ALG Registration Outside of Boot Window", "Linux PHP Privilege Escalation", "Linux Persistence Techniques", "Linux Persistence and Privilege Escalation Risk Behavior", @@ -1219,6 +1246,7 @@ "Linux Stop Services", "Linux Sudo OR Su Execution", "Linux Sudoers Tmp File Creation", + "Linux Suspicious Namespace Creation", "Linux Suspicious React or Next.js Child Process", "Linux System Network Discovery", "Linux System Reboot Via System Request Key", @@ -1507,6 +1535,9 @@ "Outlook RCE CVE-2024-21378", "Overwriting Accessibility Binaries", "PHP-CGI RCE Attack on Japanese Organizations", + "PTC Windchill Exploitation", + "PTC Windchill GW READY OK Probe", + "PTC Windchill Gateway Command Execution", "PXA Stealer", "Palo Alto Network Threat", "Palo Alto Network Traffic", @@ -1519,6 +1550,7 @@ "PetitPotam NTLM Relay on Active Directory Certificate Services", "PetitPotam Network Share Access Request", "PetitPotam Suspicious Kerberos TGT Request", + "Phantom Stealer", "Phemedrone Stealer", "PhishTank URL Reputation Analysis", "Ping Sleep Batch Command", @@ -1551,6 +1583,7 @@ "PowerShell WebRequest Using Memory Stream", "Powershell COM Hijacking InprocServer32 Modification", "Powershell Creating Thread Mutex", + "Powershell Defender Threat Actions Set to Allow", "Powershell Disable Security Monitoring", "Powershell Enable SMB1Protocol Feature", "Powershell Execute COM Object", @@ -1601,7 +1634,6 @@ "Process Kill Base On File Path", "Process Writing DynamicWrapperX", "Processes Tapping Keyboard Events", - "Processes launching netsh", "Prohibited Network Traffic Allowed", "Prohibited Traffic Allowed or Protocol Mismatch", "PromptFlux", @@ -1626,6 +1658,7 @@ "Recon Using WMI Class", "Recursive Delete of Directory In Batch CMD", "RedLine Stealer", + "RedSun", "Reg exe Manipulating Windows Services Registry Keys", "Registry Keys Used For Persistence", "Registry Keys Used For Privilege Escalation", @@ -1669,6 +1702,7 @@ "Risk Notable Review Indicators", "Risk Notable Verdict", "Risk Rule for Dev Sec Ops by Repository", + "RoguePlanet", "Router and Infrastructure Security", "Rubeus Command Line Parameters", "Rubeus Kerberos Ticket Exports Through Winlogon Access", @@ -1696,11 +1730,11 @@ "SQL Injection with Long URLs", "SQL Server Abuse", "SSL Certificates with Punycode", + "Salat Stealer", "Salt Typhoon", "SamSam Ransomware", "Samsam Test File Write", "Sandworm Tools", - "Sc exe Manipulating Windows Services", "Scattered Lapsus$ Hunters", "Scattered Spider", "SchCache Change By App Connect And Create ADSI Object", @@ -1748,17 +1782,31 @@ "Spearphishing Attachments", "Spike in File Writes", "Splunk", + "Splunk App for Lookup File Editing RCE via User XSLT", "Splunk AppDynamics Secure Application Alert", "Splunk AppDynamics Secure Application Alerts", "Splunk Attack Analyzer Dynamic Analysis", + "Splunk Authentication Token Exposure in Debug Log", "Splunk Automated Email Investigation", + "Splunk Code Injection via custom dashboard leading to RCE", "Splunk Common Information Model (CIM)", + "Splunk Enterprise KV Store Incorrect Authorization", "Splunk Identifier Activity Analysis", + "Splunk Information Disclosure on Account Login", "Splunk Message Identifier Activity Analysis", "Splunk Notable Related Tickets Search", + "Splunk Path Traversal In Splunk App For Lookup File Edit", + "Splunk RCE PDFgen Render", + "Splunk RCE Through Arbitrary File Write to Windows System Root", + "Splunk RCE via User XSLT", + "Splunk Secure Application Alerts for Runtime Security", + "Splunk Sensitive Information Disclosure in DEBUG Logging Channels", "Splunk Stream HTTP", "Splunk Stream IP", "Splunk Stream TCP", + "Splunk User Enumeration Attempt", + "Splunk Vulnerabilities", + "Splunk XSS Privilege Escalation via Custom Urls in Dashboard", "Spoolsv Spawning Rundll32", "Spoolsv Suspicious Loaded Modules", "Spoolsv Suspicious Process Access", @@ -1776,6 +1824,7 @@ "Sunburst Correlation DLL and Network Event", "Supernova Webshell", "Suricata", + "Suspicious AWS Bedrock Claude Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", @@ -1949,6 +1998,7 @@ "WinRAR Spawning Shell Application", "WinRAR Spoofing Attack CVE-2023-38831", "WinRM Spawning a Process", + "Windchill Log4j", "Windows .Key File Creation in Root Directory", "Windows AD Abnormal Object Access Activity", "Windows AD AdminSDHolder ACL Modified", @@ -1996,6 +2046,7 @@ "Windows Account Discovery for Sam Account Name", "Windows Active Directory Admon", "Windows AdFind Exe", + "Windows Admin Password Changed by Non-Admin", "Windows Admin Permission Discovery", "Windows Administrative Shares Accessed On Multiple Hosts", "Windows Admon Default Group Policy Object Modified", @@ -2072,6 +2123,8 @@ "Windows Cisco Secure Endpoint Unblock File Via Sfc", "Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc", "Windows ClipBoard Data via Get-ClipBoard", + "Windows Cloud Files Filter Loaded by Uncommon Process", + "Windows Cloud Files Filter Log Created by Non-System Process", "Windows Cmdline Tool Execution From Non-Shell Process", "Windows Cobalt Strike PowerShell Loader", "Windows Command Obfuscation with Environment Variable Substrings", @@ -2224,6 +2277,7 @@ "Windows Event Log Security 4703", "Windows Event Log Security 4719", "Windows Event Log Security 4720", + "Windows Event Log Security 4723", "Windows Event Log Security 4724", "Windows Event Log Security 4725", "Windows Event Log Security 4726", @@ -2289,6 +2343,8 @@ "Windows Explorer LNK Exploit Process Launch With Padding", "Windows Explorer.exe Spawning PowerShell or Cmd", "Windows Export Certificate", + "Windows FFmpeg Audio and Video Device Discovery", + "Windows FFmpeg DirectShow Video Capture", "Windows File Association Modification via Ftype", "Windows File Collection Via Copy Utilities", "Windows File Download Via CertUtil", @@ -2471,6 +2527,7 @@ "Windows Modify Show Compress Color And Info Tip Registry", "Windows Modify System Firewall with Notable Process Path", "Windows MpCmdRun RemoveDefinitions Execution", + "Windows MsMpEng Writing to System32", "Windows Mshta Execution In Registry", "Windows MsiExec HideWindow Rundll32 Execution", "Windows Multi hop Proxy TOR Website Query", @@ -2506,6 +2563,7 @@ "Windows Njrat Fileless Storage via Registry", "Windows Non Discord App Access Discord LevelDB", "Windows Non-System Account Targeting Lsass", + "Windows Non-System Process Querying Definition Update", "Windows NorthStar C2 Agent Execution", "Windows Obfuscated Files or Information via RAR SFX", "Windows Odbcconf Hunting", @@ -2739,8 +2797,12 @@ "Windows Steal or Forge Kerberos Tickets Klist", "Windows SubInAcl Execution", "Windows Suspect Process With Authentication Traffic", + "Windows Suspicious Burst of Password Changes", "Windows Suspicious C2 Named Pipe", "Windows Suspicious Child Process Spawned From WebServer", + "Windows Suspicious Child Process of TieringEngineService.exe", + "Windows Suspicious Defender Engine or Signature Files Created", + "Windows Suspicious Defender Update Activity in INetCache", "Windows Suspicious Driver Loaded Path", "Windows Suspicious File in EFI Volume", "Windows Suspicious Named Pipe", @@ -2777,6 +2839,7 @@ "Windows UAC Bypass Suspicious Child Process", "Windows UAC Bypass Suspicious Escalation Behavior", "Windows USBSTOR Registry Key Modification", + "Windows Uncommon Remote Thread Creation In Browser Process", "Windows Universal Data Link File Creation", "Windows Unsecured Outlook Credentials Access In Registry", "Windows Unsigned DLL Side-Loading", @@ -2805,6 +2868,7 @@ "Windows User Disabled Via Net", "Windows User Discovery Via Net", "Windows User Execution Malicious URL Shortcut File", + "Windows VSSVC Process Accessing Defender Engine", "Windows Visual Basic Commandline Compiler DNSQuery", "Windows Vulnerable 3CX Software", "Windows Vulnerable Driver Installed", @@ -2817,10 +2881,12 @@ "Windows WMIC Shadowcopy Delete", "Windows WPDBusEnum Registry Key Modification", "Windows WSUS Spawning Shell", + "Windows Wermgr Alternate Data Stream in Temp Dir", "Windows WinDBG Spawning AutoIt3", "Windows WinLogon with Public Network Connection", "Windows WinPEAS PowerShell Script Execution", "Windows WinRAR Launched Outside Default Installation Directory", + "Windows WinSCP Configuration Security Access", "Windows Wmic CPU Discovery", "Windows Wmic DiskDrive Discovery", "Windows Wmic Memory Chip Discovery", @@ -2876,6 +2942,9 @@ "applockereventcodes", "asr_rules", "attacker_tools", + "audit_searches", + "audittrail", + "aws_bedrock_claude", "aws_cloudwatchlogs_eks", "aws_config", "aws_description", @@ -2896,6 +2965,7 @@ "brand_abuse_dns", "brand_abuse_email", "brand_abuse_web", + "bro_ssl_json", "browser_app_list", "browser_process_and_path", "builtin_groups_lookup", @@ -2907,6 +2977,7 @@ "cisco_asa", "cisco_duo_activity", "cisco_duo_administrator", + "cisco_ios", "cisco_isovalent", "cisco_isovalent_allowed_images", "cisco_isovalent_process_connect", @@ -2915,6 +2986,8 @@ "cisco_networks", "cisco_sd_wan_service_proxy_access", "cisco_sd_wan_syslog", + "cisco_secure_access_dns", + "cisco_secure_access_proxy", "cisco_secure_firewall", "cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools", "cisco_secure_firewall_filetype_lookup", @@ -3038,6 +3111,7 @@ "osquery_macro", "osquery_process", "papercutng", + "path_traversal_spl_injection", "pingid", "potential_password_in_username_false_positive_reduction", "potentially_malicious_code_on_cmdline_tokenize_score", @@ -3151,12 +3225,24 @@ "s3_deletion_baseline", "sAMAccountName Spoofing and Domain Controller Impersonation", "scripting_tools_user_agents", + "secureapp_attack", "secureapp_es_field_mappings", "security_content_ctime", "security_content_summariesonly", "security_group_activity_baseline", "security_group_api_calls", "security_services_lookup", + "splunk_crash_log", + "splunk_python", + "splunk_risky_command", + "splunkd", + "splunkd_failed_auths", + "splunkd_investigation_rest_handler", + "splunkd_ui", + "splunkd_web", + "splunkd_webs", + "splunkd_webx", + "splunkda", "sslbl_ssl_certificate_blacklist", "stream_dns", "stream_http", @@ -3178,6 +3264,7 @@ "typo_squatted_python_packages", "uacbypass_process_name", "uncommon_processes", + "windchill_log4j", "windows_exchange_iis", "windows_protocol_handlers", "windows_shells", diff --git a/schemas/Story.schema.json b/schemas/Story.schema.json index 74eb40bd23c..b7b727d52b3 100644 --- a/schemas/Story.schema.json +++ b/schemas/Story.schema.json @@ -18,6 +18,9 @@ "applockereventcodes", "asr_rules", "attacker_tools", + "audit_searches", + "audittrail", + "aws_bedrock_claude", "aws_cloudwatchlogs_eks", "aws_config", "aws_description", @@ -38,6 +41,7 @@ "brand_abuse_dns", "brand_abuse_email", "brand_abuse_web", + "bro_ssl_json", "browser_app_list", "browser_process_and_path", "builtin_groups_lookup", @@ -49,6 +53,7 @@ "cisco_asa", "cisco_duo_activity", "cisco_duo_administrator", + "cisco_ios", "cisco_isovalent", "cisco_isovalent_allowed_images", "cisco_isovalent_process_connect", @@ -57,6 +62,8 @@ "cisco_networks", "cisco_sd_wan_service_proxy_access", "cisco_sd_wan_syslog", + "cisco_secure_access_dns", + "cisco_secure_access_proxy", "cisco_secure_firewall", "cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools", "cisco_secure_firewall_filetype_lookup", @@ -180,6 +187,7 @@ "osquery_macro", "osquery_process", "papercutng", + "path_traversal_spl_injection", "pingid", "potential_password_in_username_false_positive_reduction", "potentially_malicious_code_on_cmdline_tokenize_score", @@ -292,12 +300,24 @@ "s3_accesslogs", "s3_deletion_baseline", "scripting_tools_user_agents", + "secureapp_attack", "secureapp_es_field_mappings", "security_content_ctime", "security_content_summariesonly", "security_group_activity_baseline", "security_group_api_calls", "security_services_lookup", + "splunk_crash_log", + "splunk_python", + "splunk_risky_command", + "splunkd", + "splunkd_failed_auths", + "splunkd_investigation_rest_handler", + "splunkd_ui", + "splunkd_web", + "splunkd_webs", + "splunkd_webx", + "splunkda", "sslbl_ssl_certificate_blacklist", "stream_dns", "stream_http", @@ -319,6 +339,7 @@ "typo_squatted_python_packages", "uacbypass_process_name", "uncommon_processes", + "windchill_log4j", "windows_exchange_iis", "windows_protocol_handlers", "windows_shells", diff --git a/stories/suspicious_aws_bedrock_claude_activities.yml b/stories/suspicious_aws_bedrock_claude_activities.yml new file mode 100644 index 00000000000..90940a5a5b1 --- /dev/null +++ b/stories/suspicious_aws_bedrock_claude_activities.yml @@ -0,0 +1,20 @@ +name: Suspicious AWS Bedrock Claude Activities +id: c155d248-406d-48c7-9dd4-1c35607242e0 +creation_date: '2026-07-06' +modification_date: '2026-07-06' +version: 1 +author: Rod Soto, Splunk +status: production +description: This analytic story provides detection coverage for prompt injection, jailbreak attempts and other suspicious activities targeting AWS Bedrock Claude AI services. It monitors user inputs to Claude models for known manipulation patterns such as instruction override phrases, persona hijacking, and safety bypass keywords. These techniques are commonly used by adversaries to circumvent AI safety controls, extract sensitive information, or repurpose the model for malicious tasks. +narrative: This analytic story is designed to detect suspicious activities related to AWS Bedrock Claude, an AI service that allows users to interact with AI models. The story focuses on identifying potential malicious inputs that aim to manipulate the AI model's behavior. By monitoring for specific patterns in user inputs, security teams can identify and respond to potential abuse or exploitation of the AWS Bedrock Claude service. Security teams should review the context of detected prompts to determine if they represent actual prompt injection attempts or benign usage, as false positives may arise from legitimate user interactions with the AI model. +references: +- https://research.splunk.com/stories/aws_bedrock_security/ +- https://aws.amazon.com/blogs/apn/unlocking-the-power-of-splunk-with-amazon-bedrock-an-agentic-ai-approach-to-build-customized-splunk-assistants-using-bedrock-agents/ +- https://help.splunk.com/en/splunk-observability-cloud/observability-for-ai/splunk-ai-infrastructure-monitoring/set-up-ai-infrastructure-monitoring/amazon-bedrock +category: +- Adversary Tactics +product: +- Splunk Enterprise +- Splunk Enterprise Security +- Splunk Cloud +usecase: Advanced Threat Detection From 6cba894a01b5d77c1dc81e6c4f478dfb83eae3e1 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 7 Jul 2026 10:48:50 -0700 Subject: [PATCH 016/162] revert to contentctl-ng 1.0.1 to resolve (#4154) an internal tooling issue --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 628e150e83f..35b3af07a53 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1 +1 @@ -contentctl-ng==1.0.2 +contentctl-ng==1.0.1 From 50c889643b3d3eaccb1f45610329eb04e7acd51e Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Tue, 7 Jul 2026 17:12:54 -0400 Subject: [PATCH 017/162] Integration 6.2.0 fixes (#4155) * fixrisk * fixriskmessage --- ...sk_filesystem_and_exec_tool_invocation.yml | 128 ++++++------------ 1 file changed, 45 insertions(+), 83 deletions(-) diff --git a/detections/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml b/detections/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml index c4208b67b73..d89921d2811 100644 --- a/detections/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml +++ b/detections/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml @@ -12,97 +12,59 @@ data_source: search: |- `aws_bedrock_claude` | spath output="tool_called" path="output.outputBodyJson{}.content_block.toolUse.name" - | spath output="out_tokens_stream" path="output.outputBodyJson{}.usage.output_tokens" - | where tool_called IN ("bash", "curl", "edit", "write", "webfetch", "grep", "read", "read_file") - | eval out_tokens = coalesce(mvindex('out_tokens_stream', -1), 'output.outputBodyJson.usage.output_tokens', 'output.outputBodyJson.usage.outputTokens', 0) + | spath output="out_tokens_stream" path="output.outputBodyJson{}.usage.output_tokens" + | where tool_called IN ("bash","curl","edit","write","webfetch","grep","read","read_file") + | eval out_tokens = coalesce(mvindex('out_tokens_stream', -1), 'output.outputTokenCount', 0) | eval in_tokens = coalesce('input.inputTokenCount', 0) | eval user_session = replace('identity.arn', ".*/", "") | eval identity_type = case( 'identity.arn' LIKE "%botocore-session%", "automated", 'identity.arn' LIKE "%assumed-role%", "assumed_role", 'identity.arn' LIKE "%user%", "iam_user", - true(), "other" - ) + true(), "other") | stats - count AS invocations, - dc(tool_called) AS unique_tools_used, - sum(in_tokens) AS total_input_tokens, - sum(out_tokens) AS total_output_tokens, - values(tool_called) AS tools_invoked, - values(identity.arn) AS caller_list, - values(user_session) AS user_sessions, - values(identity_type) AS identity_types, - dc(identity.arn) AS unique_callers, - min(_time) AS first_seen, - max(_time) AS last_seen - BY modelId, region + count AS invocations, + dc(tool_called) AS unique_tools_used, + sum(in_tokens) AS total_input_tokens, + sum(out_tokens) AS total_output_tokens, + values(tool_called) AS tools_invoked, + values('identity.arn') AS caller_list, + values(identity_type) AS identity_types, + dc('identity.arn') AS unique_callers, + min(_time) AS first_seen, + max(_time) AS last_seen + BY modelId, region, user_session | eval tokens_per_call = round(total_output_tokens / invocations, 0) - | eval first_seen = strftime(first_seen - 28800, "%Y-%m-%d %H:%M:%S") - | eval last_seen = strftime(last_seen - 28800, "%Y-%m-%d %H:%M:%S") - | eval user = mvjoin(user_sessions, ", ") - | eval risk_score = case( - mvfind(tools_invoked, "bash") >= 0 - AND mvfind(tools_invoked, "curl") >= 0, "CRITICAL", - mvfind(tools_invoked, "bash") >= 0 - AND mvfind(tools_invoked, "write") >= 0, "CRITICAL", - mvfind(tools_invoked, "curl") >= 0 - AND mvfind(tools_invoked, "edit") >= 0, "CRITICAL", - mvfind(identity_types, "assumed_role") >= 0 - AND mvfind(tools_invoked, "bash") >= 0, "CRITICAL", - mvfind(tools_invoked, "bash") >= 0, "HIGH", - mvfind(tools_invoked, "curl") >= 0, "HIGH", - mvfind(tools_invoked, "edit") >= 0, "HIGH", - mvfind(tools_invoked, "write") >= 0, "HIGH", - mvfind(tools_invoked, "webfetch") >= 0, "HIGH", - unique_tools_used >= 3, "HIGH", - true(), "MEDIUM" - ) + | eval first_seen = strftime(first_seen - 28800, "%Y-%m-%d %H:%M:%S") + | eval last_seen = strftime(last_seen - 28800, "%Y-%m-%d %H:%M:%S") + | eval user = user_session + | eval severity = case( + mvfind(tools_invoked, "bash") >= 0 AND mvfind(tools_invoked, "curl") >= 0, "critical", + mvfind(tools_invoked, "bash") >= 0 AND mvfind(tools_invoked, "write") >= 0, "critical", + mvfind(tools_invoked, "curl") >= 0 AND mvfind(tools_invoked, "edit") >= 0, "critical", + mvfind(identity_types, "assumed_role") >= 0 AND mvfind(tools_invoked, "bash") >= 0, "critical", + mvfind(tools_invoked, "bash") >= 0, "high", + mvfind(tools_invoked, "curl") >= 0, "high", + mvfind(tools_invoked, "edit") >= 0, "high", + mvfind(tools_invoked, "write") >= 0, "high", + mvfind(tools_invoked, "webfetch") >= 0, "high", + unique_tools_used >= 3, "high", + true(), "medium") | eval risk_reason = case( - mvfind(tools_invoked, "bash") >= 0 - AND mvfind(tools_invoked, "curl") >= 0, - "bash and curl invoked together - possible download and execute chain", - mvfind(tools_invoked, "bash") >= 0 - AND mvfind(tools_invoked, "write") >= 0, - "bash and write invoked together - possible execution and persistence chain", - mvfind(tools_invoked, "curl") >= 0 - AND mvfind(tools_invoked, "edit") >= 0, - "curl and edit invoked together - possible remote content retrieval and file modification", - mvfind(identity_types, "assumed_role") >= 0 - AND mvfind(tools_invoked, "bash") >= 0, - "Human identity invoking bash via AI model - direct shell execution risk", - mvfind(tools_invoked, "bash") >= 0, - "bash invoked via Bedrock Claude - shell execution through AI model", - mvfind(tools_invoked, "curl") >= 0, - "curl invoked via Bedrock Claude - network call through AI model", - mvfind(tools_invoked, "edit") >= 0, - "edit invoked via Bedrock Claude - file modification through AI model", - mvfind(tools_invoked, "write") >= 0, - "write invoked via Bedrock Claude - file write through AI model", - mvfind(tools_invoked, "webfetch") >= 0, - "webfetch invoked via Bedrock Claude - remote content retrieval through AI model", - unique_tools_used >= 3, - "Broad filesystem and execution tool set invoked via AI model - reconnaissance pattern", - true(), - "Filesystem tool invoked via Bedrock Claude" - ) - | table - risk_score, - risk_reason, - modelId, - region, - unique_callers, - unique_tools_used, - user, - caller_list, - identity_types, - invocations, - tools_invoked, - total_input_tokens, - total_output_tokens, - tokens_per_call, - first_seen, - last_seen - | sort -risk_score, -unique_tools_used, -invocations + mvfind(tools_invoked, "bash") >= 0 AND mvfind(tools_invoked, "curl") >= 0, "bash and curl invoked together - possible download and execute chain", + mvfind(tools_invoked, "bash") >= 0 AND mvfind(tools_invoked, "write") >= 0, "bash and write invoked together - possible execution and persistence chain", + mvfind(tools_invoked, "curl") >= 0 AND mvfind(tools_invoked, "edit") >= 0, "curl and edit invoked together - possible remote content retrieval and file modification", + mvfind(identity_types, "assumed_role") >= 0 AND mvfind(tools_invoked, "bash") >= 0, "Human identity invoking bash via AI model - direct shell execution risk", + mvfind(tools_invoked, "bash") >= 0, "bash invoked via Bedrock Claude - shell execution through AI model", + mvfind(tools_invoked, "curl") >= 0, "curl invoked via Bedrock Claude - network call through AI model", + mvfind(tools_invoked, "edit") >= 0, "edit invoked via Bedrock Claude - file modification through AI model", + mvfind(tools_invoked, "write") >= 0, "write invoked via Bedrock Claude - file write through AI model", + mvfind(tools_invoked, "webfetch") >= 0, "webfetch invoked via Bedrock Claude - remote content retrieval through AI model", + unique_tools_used >= 3, "Broad filesystem and execution tool set invoked via AI model - reconnaissance pattern", + true(), "Filesystem tool invoked via Bedrock Claude") + | where severity IN ("critical","high") + | table severity, risk_reason, modelId, region, user,unique_tools_used, caller_list, identity_types, invocations, tools_invoked, total_input_tokens, total_output_tokens, tokens_per_call, first_seen, last_seen + | sort -unique_tools_used, -invocations | `aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation_filter` how_to_implement: You must install and configure the Splunk Add-on for AWS (https://splunkbase.splunk.com/app/1876). Enable Amazon Bedrock model invocation logging in AWS so that Claude request/response payloads are delivered to S3 and/or CloudWatch Logs (see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html for setup steps), then ingest those logs into Splunk via the AWS TA. Configure the `aws_bedrock_claude` macro to point to the index and sourcetype (`json_no_timestamp`) where these logs land. known_false_positives: This detection may produce false positives for legitimate developer activity where authorized users invoke shell execution, file write, or network tools through Claude Code as part of normal software development, deployment automation, or infrastructure management workflows. @@ -125,7 +87,7 @@ intermediate_findings: - field: user type: user score: 50 - message: Identity $user$ invoked high-risk filesystem and execution tools $tools_invoked$ via AWS Bedrock Claude with risk score $risk_score$ and reason $risk_reason$. + message: Identity $user$ invoked high-risk filesystem and execution tools $tools_invoked$ via AWS Bedrock Claude with severity $severity$ and reason $risk_reason$. analytic_story: - Suspicious AWS Bedrock Claude Activities asset_type: Web Application From 80d1b810ae9b21d07d81be40c7351b6e11c5d8d1 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali <nbencher@cisco.com> Date: Wed, 8 Jul 2026 18:31:00 +0200 Subject: [PATCH 018/162] Fix Incorrect Escape (#4159) --- ...from_password_stores_chrome_login_data_access.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index 44a44a24324..57cf84d6608 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -2,7 +2,7 @@ name: Windows Credentials from Password Stores Chrome Login Data Access id: 0d32ba37-80fc-4429-809c-0ba15801aeaf version: 23 creation_date: '2023-05-02' -modification_date: '2026-06-25' +modification_date: '2026-07-08' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -21,11 +21,11 @@ search: | NOT process_path IN ( "*:\\Windows\\explorer.exe", "*:\\Windows\\System32\\dllhost.exe", - "*\\AppData\\Local\\Google\\Chrome Beta\\Application\\\chrome.exe", - "*\\AppData\\Local\\Google\\Chrome Dev\\Application\\\chrome.exe", - "*\\AppData\\Local\\Google\\Chrome SxS\\Application\\\chrome.exe", - "*\\AppData\\Local\\Google\\Chrome Unstable\\Application\\\chrome.exe", - "*\\AppData\\Local\\Google\\Chrome\\Application\\\chrome.exe" + "*\\AppData\\Local\\Google\\Chrome Beta\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome Dev\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome SxS\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome Unstable\\Application\\chrome.exe", + "*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe" ) | stats count min(_time) as firstTime max(_time) as lastTime From b5a88d52587903db5b190fe66f72cb22725bb00d Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bpatel@splunk.com> Date: Fri, 10 Jul 2026 01:45:31 +0530 Subject: [PATCH 019/162] hotfix --- ..._rce_through_arbitrary_file_write_to_windows_system_root.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml b/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml index 74c716a6880..21114c3d1f2 100644 --- a/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml +++ b/detections/application/splunk_rce_through_arbitrary_file_write_to_windows_system_root.yml @@ -6,7 +6,7 @@ modification_date: '2026-06-23' author: Rod Soto status: production type: Hunting -description: In Splunk Enterprise for Windows versions below 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the “admin” or “power” Splunk roles could write a file to the Windows system root directory, which has a default location of C:\Windows\System32, when Splunk Enterprise for Windows is installed on a separate drive. Additionally, this user may be able to upload and execute code due to insecure session storage configuration. +description: In Splunk Enterprise for Windows versions below 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the “admin” or “power” Splunk roles could write a file to the Windows system root directory, which has a default location of C:\Windows\System32, when Splunk Enterprise for Windows is installed on a separate drive. Additionally, this user may be able to upload and execute code due to insecure session storage configuration data_source: - Splunk search: |- From 04320eac5a23ecedd190cb7b22373f74466ddd53 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Tue, 14 Jul 2026 23:50:09 +0530 Subject: [PATCH 020/162] chore: bump contentctl.yml and build.yml to 6.3.0 (#4165) Co-authored-by: research bot <research@splunk.com> --- build.yml | 2 +- contentctl.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build.yml b/build.yml index cca64df09e9..d0447873f66 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.2.0 +app_version: 6.3.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index abb5d9c6abb..c7d57446e83 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.2.0 + version: 6.3.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU From dc384ffdd9335e33d9dcd4ea51375c65b12b38f2 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Tue, 14 Jul 2026 23:51:39 +0530 Subject: [PATCH 021/162] Bug Fix - Suspicious Process Executed From Container File (#4161) --------- Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- ...s_process_executed_from_container_file.yml | 57 +++++++++++++++++-- 1 file changed, 52 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/suspicious_process_executed_from_container_file.yml b/detections/endpoint/suspicious_process_executed_from_container_file.yml index 3699a2dfcd2..714db930e46 100644 --- a/detections/endpoint/suspicious_process_executed_from_container_file.yml +++ b/detections/endpoint/suspicious_process_executed_from_container_file.yml @@ -1,8 +1,8 @@ name: Suspicious Process Executed From Container File id: d8120352-3b62-411c-8cb6-7b47584dd5e8 -version: 11 +version: 12 creation_date: '2023-07-11' -modification_date: '2026-05-13' +modification_date: '2026-07-09' author: Steven Dick status: production type: TTP @@ -11,7 +11,50 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*.ZIP\\*","*.ISO\\*","*.IMG\\*","*.CAB\\*","*.TAR\\*","*.GZ\\*","*.RAR\\*","*.7Z\\*") AND Processes.action="allowed" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | regex process="(?i).*(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z)\\\\.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH)\"?$" | rex field=process "(?i).+\\\\(?<file_name>[^\\\]+\.(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z))\\\\((.+\\\\)+)?(?<process_name>.+\.(BAT|BIN|CAB|CMD|COM|CPL|EX_|EXE|GADGET|INF1|INS|INX||HTM|HTML|ISU|JAR|JOB|JS|JSE|LNK|MSC|MSI|MSP|MST|PAF|PIF|PS1|REG|RGS|SCR|SCT|SHB|SHS|U3P|VB|VBE|VBS|VBSCRIPT|WS|WSF|WSH))\"?$"| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_executed_from_container_file_filter`' +search: |- + | tstats `security_content_summariesonly` + count + min(_time) as firstTime + max(_time) as lastTime + from datamodel=Endpoint.Processes + where Processes.process IN ( + "*.ZIP\\*", + "*.ISO\\*", + "*.IMG\\*", + "*.CAB\\*", + "*.TAR\\*", + "*.GZ\\*", + "*.RAR\\*", + "*.7Z\\*" + ) + AND Processes.action="allowed" + by + Processes.action + Processes.dest + Processes.original_file_name + Processes.parent_process + Processes.parent_process_exec + Processes.parent_process_guid + Processes.parent_process_id + Processes.parent_process_name + Processes.parent_process_path + Processes.process + Processes.process_exec + Processes.process_guid + Processes.process_hash + Processes.process_id + Processes.process_integrity_level + Processes.process_name + Processes.process_path + Processes.user + Processes.user_id + Processes.vendor_product + | `drop_dm_object_name(Processes)` + | regex process="(?i).*\.(zip|iso|img|cab|tar|gz|rar|7z)\\\\.+\.(bat|bin|cab|cmd|com|cpl|ex_|exe|gadget|inf1|ins|inx|htm|html|isu|jar|job|js|jse|lnk|msc|msi|msp|mst|paf|pif|ps1|reg|rgs|scr|sct|shb|shs|u3p|vb|vbe|vbs|vbscript|ws|wsf|wsh)\"?$" + | rex field=process "(?i).+\\\\(?<file_name>[^\\\\]+\.(?:zip|iso|img|cab|tar|gz|rar|7z))\\\\(?:.+\\\\)?(?<container_file_name>[^\\\\\"]+\.(?:bat|bin|cab|cmd|com|cpl|ex_|exe|gadget|inf1|ins|inx|htm|html|isu|jar|job|js|jse|lnk|msc|msi|msp|mst|paf|pif|ps1|reg|rgs|scr|sct|shb|shs|u3p|vb|vbe|vbs|vbscript|ws|wsf|wsh))\"?$" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `suspicious_process_executed_from_container_file_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Various business process or userland applications and behavior. references: @@ -28,7 +71,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: A suspicious process $process_name$ was launched from $file_name$ on $dest$. + title: A suspicious file [$container_file_name$] was launched from container file [$file_name$] by process [$process_name$] on [$dest$]. entity: field: user type: user @@ -38,10 +81,14 @@ intermediate_findings: - field: dest type: system score: 50 - message: A suspicious process $process_name$ was launched from $file_name$ on $dest$. + message: A suspicious file [$container_file_name$] was launched from container file [$file_name$] by process [$process_name$] on [$dest$]. threat_objects: + - field: process_name + type: process_name - field: file_name type: file_name + - field: container_file_name + type: file_name analytic_story: - APT37 Rustonotto and FadeStealer - GhostRedirector IIS Module and Rungan Backdoor From 81fa0144374e62cd9f176964397eccd9a97fb36e Mon Sep 17 00:00:00 2001 From: Lou Stella <ljstella@gmail.com> Date: Tue, 14 Jul 2026 14:31:17 -0400 Subject: [PATCH 022/162] Only run unit-testing when there's something to test (#4151) Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com> Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- .github/workflows/unit-testing.yml | 39 +++++++++++++++++------------- 1 file changed, 22 insertions(+), 17 deletions(-) diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 39f11ee0b23..c15bbc1aa35 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -2,6 +2,11 @@ name: unit-testing on: pull_request: types: [opened, reopened, synchronize] + paths: + - detections/** + - data_sources/** + - lookups/** + - macros/** jobs: unit-testing: runs-on: large-ubuntu-22.04-32core @@ -13,7 +18,7 @@ jobs: with: repository: 'splunk/security_content' #this should be the TARGET repo of the PR. we hardcode it for now ref: ${{ github.base_ref }} - + - name: Print out information abour PR target run: | echo "The PR target branch is: ${{ github.base_ref }}" @@ -21,8 +26,8 @@ jobs: echo "My current branch is" git branch --show-current git rev-parse HEAD - - + + - name: Set up Python uses: actions/setup-python@v6 with: @@ -34,38 +39,38 @@ jobs: run: | echo "- Build Tool Version - $(cat requirements.txt)" pip install -r requirements.txt - + # Check out the PR, even if it lives in a fork. - # Instructions for pulling a PR were taken from: + # Instructions for pulling a PR were taken from: # https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally - name: Checkout the PR branch and the target to calculate changed files for testing run: | - + echo "Current Branch (Head Ref): ${{ github.head_ref }}" echo "Target Branch (Base Ref): ${{ github.base_ref }}" git pull > /dev/null 2>&1 #We checkout into a new branch - new_branch_for_testing to avoid name collisions with develop incase the forked PR is from develop git fetch origin pull/${{ github.event.pull_request.number }}/head:new_branch_for_testing - #We must specifically get the PR's target branch from security_content, not the one that resides in the fork PR's forked repo + #We must specifically get the PR's target branch from security_content, not the one that resides in the fork PR's forked repo git switch new_branch_for_testing - + - name: Run a contentctl-ng build command to create a package that will be tested. run: | contentctl-ng build - + - name: Start the test environment run: | docker run -d --platform linux/amd64 -p 8088:8088 -p 8089:8089 -p 8000:8000 -e 'SPLUNK_START_ARGS=--accept-license' -e 'SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-com' -e 'SPLUNK_PASSWORD=Chang3d!' --name splunk splunk/splunk:latest # Wait some time for this environment to be ready sleep 180 - + - name: Run a contentctl-ng install to configure the testing environment env: APPINSPECTUSERNAME: "${{ secrets.APPINSPECTUSERNAME }}" - APPINSPECTPASSWORD: "${{ secrets.APPINSPECTPASSWORD }}" + APPINSPECTPASSWORD: "${{ secrets.APPINSPECTPASSWORD }}" run : | - contentctl-ng install --splunkbase-username "$APPINSPECTUSERNAME" --splunkbase-password "$APPINSPECTPASSWORD" - + contentctl-ng install --splunkbase-username "$APPINSPECTUSERNAME" --splunkbase-password "$APPINSPECTPASSWORD" + - name: Test content which has changed between this branch and the target branch run: | contentctl-ng test --verbose --post-test-behavior NEVER_PAUSE --mode CHANGED --git-ref ${{ github.base_ref }} @@ -81,7 +86,7 @@ jobs: test_results/summary.yml dist/*.tar.gz - # Print entire result summary so that the users can view it in the Github Actions logs + # Print entire result summary so that the users can view it in the Github Actions logs - name: Print entire test_results/summary.yml if: always() run: cat test_results/summary.yml @@ -89,7 +94,7 @@ jobs: # Run a simple custom script created to pretty print results in a markdown friendly format in Github Actions Summary - name: Check the test_results/summary.yml for pass/fail. if: always() - run: | - echo "This job will fail if there are failures in unit-testing" + run: | + echo "This job will fail if there are failures in unit-testing" python .github/workflows/format_test_results.py >> $GITHUB_STEP_SUMMARY - echo "The Unit testing is completed. See details in the unit-testing job summary UI " \ No newline at end of file + echo "The Unit testing is completed. See details in the unit-testing job summary UI " From 91ed6a5dff2a626b0b6665a9986608fd5d4a8bb3 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Wed, 15 Jul 2026 18:22:04 +0530 Subject: [PATCH 023/162] Update Macro Definition - `secureapp_es_field_mappings` (#4158) --------- Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- macros/secureapp_es_field_mappings.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/macros/secureapp_es_field_mappings.yml b/macros/secureapp_es_field_mappings.yml index 75433b4705c..0c6caba509c 100644 --- a/macros/secureapp_es_field_mappings.yml +++ b/macros/secureapp_es_field_mappings.yml @@ -1,8 +1,8 @@ name: secureapp_es_field_mappings id: 6feb2b98-3da5-478b-8f97-c85b29c98885 -version: 1 +version: 2 creation_date: '2025-08-04' -modification_date: '2026-05-13' +modification_date: '2026-07-08' author: Splunk Threat Research Team -description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment. -definition: '| eval rule_number=attackName | eval app=app_name | eval action=attackOutcome | eval view=blockedReason | eval product=btName | eval ids_type=eventType | eval process=jvmId | eval cve=matchedCveName | eval record_type=ptype | eval ip=socketAddr | eval package_title=tierName | eval signature_id=vulnerableMethod | eval url=webTransactionUrl | eval location=applicationId | eval package=tierId | eval rule_number=attackId | eval mode=attackStatus' +description: This macro helps normalize logs from Csico Secure App field names to CIM (Common Information Model) compliant field names. Customize the macro definition as needed for your Splunk environment. +definition: '| eval location=url | eval ip=socketOut | eval gid=coalesce(attackName,attackId) | eval action=attackOutcome | eval view=blockedReason | eval ids_type=eventType | eval process=jvmId | eval cve=matchedCveName | eval signature_id=vulnerableMethod | eval url=webTransactionUrl | eval mode=attackStatus | eval src_category=attackSource | eval dest_ip=serverAddress | eval dest_nt_host=serverName | eval dest_port=serverPort | eval signature=attackTypes | eval src_ip=clientAddress | eval src_port=clientPort | eval record_type=ptype | eval app=coalesce(application,environment) | eval product=attackBusinessTransaction | eval package_title=coalesce(tier,service) | eval package=coalesce(tierId,serviceId) | eval rule_number=name | eval object_name=keyInfo | eval file_path=workingDir | eval file_name=filename | eval session_id=sql | eval attacktypecount=mvcount(attackTypes)' From d965a40083ea5266b56b722427d8f0b82b81c2dd Mon Sep 17 00:00:00 2001 From: Tessa Georgen <67936042+tjgeorgen@users.noreply.github.com> Date: Thu, 16 Jul 2026 02:40:49 -0400 Subject: [PATCH 024/162] use contentctl-ng 1.0.2 update-data-source-tas command to create data source and install.yml app version update PRs (#4143) --- .github/workflows/datasource-dependabot.yml | 43 +++++---- .github/workflows/update_data_sources_ta.py | 98 --------------------- requirements.txt | 2 +- 3 files changed, 21 insertions(+), 122 deletions(-) delete mode 100644 .github/workflows/update_data_sources_ta.py diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index 08418087204..654ac85d846 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -6,7 +6,7 @@ on: - cron: '55 06 * * *' # Runs daily at midnight jobs: - data-source-validation-and-update: + update-data-source-tas-and-install-yml-apps: runs-on: ubuntu-latest steps: @@ -15,44 +15,41 @@ jobs: with: ref: 'develop' token: ${{ secrets.DATA_SOURCES_DEPENDABOT }} - + - name: Set up Python uses: actions/setup-python@v6 with: - python-version: '3.11' + python-version: '3.14' architecture: 'x64' # or the version your script requires - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | echo "- Contentctl version - $(cat requirements.txt)" pip install -r requirements.txt - - - name: Run ContentCTL Data source TA validation - id: validate - run: | - pwd - contentctl validate --data-source-TA-validation 2>&1 | tee data_source_validation.log - continue-on-error: true - - - name: Print Validation Log - run: | - cat data_source_validation.log - rm -f =4.0.0 - - name: Update Data Sources if Validation Fails + - name: Update data source TAs and install.yml apps run: | - python .github/workflows/update_data_sources_ta.py - git status + echo "Updating data source supported_TA and repo install.yml app versions" + contentctl-ng update-data-source-tas --content-dirs . + echo "Changed data source and install.yml files:" + git status --short -- data_sources install.yml - - name: Create Pull Request + - name: Create data source TA and install.yml app update pull request uses: peter-evans/create-pull-request@v8 with: token: ${{ secrets.DATA_SOURCES_DEPENDABOT }} - commit-message: Updated TAs + commit-message: Update data source TA and install.yml app versions branch: auto-ta-update-${{ github.run_number }} base: develop - title: Automated Splunk TA Update ${{ github.run_number }} - body: "This PR contains updates to Splunk TAs made by GitHub Actions workflow." + title: Automated Data Source TA and install.yml App Update ${{ github.run_number }} + body: | + This PR contains data source supported_TA and install.yml app version updates generated by contentctl-ng. + + The workflow runs: + + ```bash + contentctl-ng update-data-source-tas --content-dirs . + ``` add-paths: | data_sources/** - contentctl.yml + install.yml diff --git a/.github/workflows/update_data_sources_ta.py b/.github/workflows/update_data_sources_ta.py deleted file mode 100644 index 77ae138a3ee..00000000000 --- a/.github/workflows/update_data_sources_ta.py +++ /dev/null @@ -1,98 +0,0 @@ -import os -import yaml -from collections import OrderedDict - -# Custom YAML loader to preserve the order of keys -class OrderedLoader(yaml.SafeLoader): - pass - -def construct_mapping(loader, node): - loader.flatten_mapping(node) - return OrderedDict(loader.construct_pairs(node)) - -OrderedLoader.add_constructor( - yaml.resolver.BaseResolver.DEFAULT_MAPPING_TAG, - construct_mapping -) - -# Custom YAML dumper to preserve the order of keys -class OrderedDumper(yaml.SafeDumper): - pass - -def dict_representer(dumper, data): - return dumper.represent_dict(data.items()) - -OrderedDumper.add_representer(OrderedDict, dict_representer) - -# Define the paths -log_file_path = 'data_source_validation.log' -data_sources_dir = 'data_sources' -contentctl_file_path = 'contentctl.yml' - -def update_data_sources(ta_name, latest_version): - # Update the YAML files in the data sources directory - for filename in os.listdir(data_sources_dir): - if filename.endswith('.yml'): - file_path = os.path.join(data_sources_dir, filename) - with open(file_path, 'r') as yml_file: - data = yaml.load(yml_file, Loader=OrderedLoader) - - # Check if the TA name matches and update the version - updated = False - for ta in data.get('supported_TA', []): - if ta['name'] == ta_name: - if ta['version'] != latest_version: - ta['version'] = latest_version - updated = True - - # Write the updated data back to the YAML file - if updated: - with open(file_path, 'w') as yml_file: - yaml.dump(data, yml_file, Dumper=OrderedDumper) - -def update_contentctl_yml(title, new_version): - # Load the existing YAML file - with open(contentctl_file_path, 'r') as file: - content = yaml.load(file, Loader=OrderedLoader) - - # Iterate over the apps to find the title and update the version and hardcoded_path - updated = False - for app in content.get('apps', []): - if app.get('title') == title: - if app.get('version') != new_version: - app['version'] = new_version - updated = True - print(f"Updated {title} in contentctl.yml to version {new_version}") - - # Update the hardcoded_path if it exists - if 'hardcoded_path' in app: - base_url, current_version = app['hardcoded_path'].rsplit('_', 1) - new_hardcoded_path = f"{base_url}_{new_version.replace('.', '')}.tgz" - app['hardcoded_path'] = new_hardcoded_path - print(f"Updated hardcoded_path for {title} to {new_hardcoded_path}") - - # Write the updated content back to the YAML file if changes were made - if updated: - with open(contentctl_file_path, 'w') as file: - yaml.dump(content, file, Dumper=OrderedDumper, default_flow_style=False) - -def main(): - # Read the log file to find version mismatches - with open(log_file_path, 'r') as log_file: - log_lines = log_file.readlines() - - # Parse the log file to find the TA name and the latest version - for i, line in enumerate(log_lines): - if 'Version mismatch' in line: - ta_name = log_lines[i].split("'")[3].strip() - latest_version = log_lines[i + 1].split(':')[1].strip() - print(f"Found version mismatch for TA: {ta_name}, updating to version: {latest_version}") - - # Update data sources and contentctl.yml - update_data_sources(ta_name, latest_version) - update_contentctl_yml(ta_name, latest_version) - - print("Version updates completed.") - -if __name__ == "__main__": - main() \ No newline at end of file diff --git a/requirements.txt b/requirements.txt index 35b3af07a53..628e150e83f 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1 +1 @@ -contentctl-ng==1.0.1 +contentctl-ng==1.0.2 From d51afa603f239066524e71e0ce5427013d22cdd7 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 16 Jul 2026 03:29:14 -0700 Subject: [PATCH 025/162] Align STDDevs description with search (#4160) --------- Co-authored-by: Bhavin Patel <bpatel@splunk.com> --- .../aws_bedrock_claude_unusually_large_prompts.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/application/aws_bedrock_claude_unusually_large_prompts.yml b/detections/application/aws_bedrock_claude_unusually_large_prompts.yml index 26e7229ac4b..9d1123e5308 100644 --- a/detections/application/aws_bedrock_claude_unusually_large_prompts.yml +++ b/detections/application/aws_bedrock_claude_unusually_large_prompts.yml @@ -1,16 +1,16 @@ name: AWS Bedrock Claude Unusually Large Prompts id: 95fbdd4e-1202-4971-b85a-513b2005086e -version: 1 +version: 2 author: Rod Soto status: production type: Anomaly creation_date: '2026-07-06' -modification_date: '2026-07-06' +modification_date: '2026-07-08' security_domain: endpoint data_source: - AWS Bedrock Claude category: application -description: This detection identifies unusually large prompts sent to AWS Bedrock Claude models by calculating the statistical baseline of input token counts and flagging requests that exceed 15 standard deviations above the mean. Abnormally large prompts may indicate prompt injection attacks, data exfiltration attempts, or abuse of the AI service. +description: This detection identifies unusually large prompts sent to AWS Bedrock Claude models by calculating the statistical baseline of input token counts and flagging requests that exceed one standard deviations above the mean. Abnormally large prompts may indicate prompt injection attacks, data exfiltration attempts, or abuse of the AI service. search: |- `aws_bedrock_claude` | rename "input.inputTokenCount" AS input_tokens From 83fbcedcc427a6a1a014a8d7df2c91420882335e Mon Sep 17 00:00:00 2001 From: Andrei Banaru <andrei.banaru@gmail.com> Date: Fri, 17 Jul 2026 14:36:50 +0200 Subject: [PATCH 026/162] Update "Short Lived Scheduled Task" (#4152) --------- Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- .../endpoint/short_lived_scheduled_task.yml | 54 +++++++++++-------- 1 file changed, 31 insertions(+), 23 deletions(-) diff --git a/detections/endpoint/short_lived_scheduled_task.yml b/detections/endpoint/short_lived_scheduled_task.yml index 6bfbaf2cbb7..e95de1b7aeb 100644 --- a/detections/endpoint/short_lived_scheduled_task.yml +++ b/detections/endpoint/short_lived_scheduled_task.yml @@ -1,26 +1,34 @@ name: Short Lived Scheduled Task id: 6fa31414-546e-11ec-adfa-acde48001122 -version: 11 +version: 12 creation_date: '2021-12-03' -modification_date: '2026-05-13' +modification_date: '2026-07-07' author: Mauricio Velazco, Splunk status: production -type: TTP -description: The following analytic detects the creation and deletion of scheduled tasks within a short time frame (less than 30 seconds) using Windows Security EventCodes 4698 and 4699. This behavior is identified by analyzing Windows Security Event Logs and leveraging the Windows TA for parsing. Such activity is significant as it may indicate lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or execution of malicious payloads, necessitating prompt investigation and response by security analysts. +type: Anomaly +description: |- + The following analytic detects the creation and deletion of scheduled tasks within a short time frame (less than 30 seconds) using Windows Security EventCodes 4698 and 4699. + This behavior is identified by analyzing Windows Security Event Logs and leveraging the Windows TA for parsing. + Such activity may indicate lateral movement or remote code execution attempts by adversaries. + If confirmed malicious, this could lead to unauthorized access, data exfiltration, or execution of malicious payloads, necessitating prompt investigation and response by security analysts. data_source: - Windows Event Log Security 4698 - Windows Event Log Security 4699 search: |- - `wineventlog_security` EventCode=4698 OR EventCode=4699 - | xmlkv Message - | transaction Task_Name startswith=(EventCode=4698) endswith=(EventCode=4699) - | eval short_lived=case((duration<30),"TRUE") - | search short_lived = TRUE - | rename ComputerName as dest - | table _time, dest, Account_Name, Command, Task_Name, short_lived - | `short_lived_scheduled_task_filter` -how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. -known_false_positives: Although uncommon, legitimate applications may create and delete a Scheduled Task within 30 seconds. Filter as needed. + `wineventlog_security` + EventCode IN (4698, 4699) + | xmlkv object_attrs + | transaction TaskName dest startswith=(EventCode=4698) endswith=(EventCode=4699) maxspan=30s + | stats count min(_time) AS firstTime + max(_time) AS lastTime + by Command TaskName user dest RunLevel + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `short_lived_scheduled_task_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. +known_false_positives: |- + Although uncommon, legitimate applications may create and delete a Scheduled Task within 30 seconds. Filter as needed. references: - https://attack.mitre.org/techniques/T1053/005/ - https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler @@ -33,12 +41,12 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: A windows scheduled task was created and deleted in 30 seconds on $dest$ - entity: - field: dest - type: system - score: 50 +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: A windows scheduled task [$TaskName$] with the command [$Command$] was created by [$user$] and deleted in less than 30 seconds on [$dest$] analytic_story: - Active Directory Lateral Movement - CISA AA22-257A @@ -57,7 +65,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-security.log - source: WinEventLog:Security - sourcetype: WinEventLog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-security-task.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog test_type: unit From a9d1e1afe33fd3d50dcef6c9ab07fe531acc9a89 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Mon, 20 Jul 2026 18:14:58 +0530 Subject: [PATCH 027/162] Update data source TA and install.yml app versions (#4171) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/aws_bedrock_claude.yml | 87 +++-- data_sources/azure_active_directory.yml | 2 +- ...p_role_assignment_to_service_principal.yml | 2 +- ...re_active_directory_add_member_to_role.yml | 2 +- ...ive_directory_add_owner_to_application.yml | 2 +- ...active_directory_add_service_principal.yml | 2 +- ...active_directory_add_unverified_domain.yml | 2 +- ...ctive_directory_consent_to_application.yml | 2 +- ...irectory_disable_strong_authentication.yml | 2 +- .../azure_active_directory_enable_account.yml | 2 +- ..._active_directory_invite_external_user.yml | 2 +- ...e_directory_microsoftgraphactivitylogs.yml | 2 +- ...directory_noninteractiveusersigninlogs.yml | 2 +- ...ve_directory_reset_password_(by_admin).yml | 2 +- ...ve_directory_set_domain_authentication.yml | 2 +- ...zure_active_directory_sign_in_activity.yml | 2 +- ...re_active_directory_update_application.yml | 2 +- ..._directory_update_authorization_policy.yml | 2 +- .../azure_active_directory_update_user.yml | 2 +- ...irectory_user_registered_security_info.yml | 2 +- ..._or_update_an_azure_automation_account.yml | 2 +- ..._or_update_an_azure_automation_runbook.yml | 2 +- ..._or_update_an_azure_automation_webhook.yml | 2 +- data_sources/azure_monitor_activity.yml | 2 +- data_sources/cisco_ai_defense_alerts.yml | 2 +- data_sources/cisco_asa_logs.yml | 2 +- data_sources/cisco_duo_activity.yml | 2 +- data_sources/cisco_duo_administrator.yml | 2 +- data_sources/cisco_ios_logs.yml | 2 +- .../cisco_isovalent_process_connect.yml | 2 +- data_sources/cisco_isovalent_process_exec.yml | 2 +- .../cisco_isovalent_process_kprobe.yml | 2 +- data_sources/cisco_secure_access_dns.yml | 212 +++++------ data_sources/cisco_secure_access_firewall.yml | 2 +- data_sources/cisco_secure_access_proxy.yml | 352 +++++++++--------- ...rewall_threat_defense_connection_event.yml | 2 +- ...ure_firewall_threat_defense_file_event.yml | 2 +- ...irewall_threat_defense_intrusion_event.yml | 2 +- .../crowdstrike_falcon_stream_alert.yml | 2 +- data_sources/crowdstrike_processrollup2.yml | 2 +- data_sources/g_suite_drive.yml | 2 +- data_sources/g_suite_gmail.yml | 2 +- data_sources/github_enterprise_audit_logs.yml | 2 +- .../github_organizations_audit_logs.yml | 2 +- data_sources/google_workspace.yml | 2 +- .../google_workspace_login_failure.yml | 2 +- .../google_workspace_login_success.yml | 2 +- data_sources/linux_auditd_add_user.yml | 2 +- data_sources/linux_auditd_cwd.yml | 2 +- data_sources/linux_auditd_daemon_abort.yml | 2 +- data_sources/linux_auditd_daemon_end.yml | 2 +- data_sources/linux_auditd_daemon_start.yml | 2 +- data_sources/linux_auditd_execve.yml | 2 +- data_sources/linux_auditd_path.yml | 2 +- data_sources/linux_auditd_proctitle.yml | 2 +- data_sources/linux_auditd_service_stop.yml | 2 +- data_sources/linux_auditd_syscall.yml | 2 +- data_sources/linux_messages_syslog.yml | 87 +++-- data_sources/linux_secure.yml | 2 +- data_sources/ntlm_operational_8004.yml | 2 +- data_sources/ntlm_operational_8005.yml | 2 +- data_sources/ntlm_operational_8006.yml | 2 +- data_sources/okta.yml | 2 +- data_sources/palo_alto_network_threat.yml | 2 +- data_sources/palo_alto_network_traffic.yml | 2 +- .../powershell_script_block_logging_4104.yml | 2 +- data_sources/sysmon_eventid_1.yml | 2 +- data_sources/sysmon_eventid_10.yml | 2 +- data_sources/sysmon_eventid_11.yml | 2 +- data_sources/sysmon_eventid_12.yml | 2 +- data_sources/sysmon_eventid_13.yml | 2 +- data_sources/sysmon_eventid_14.yml | 2 +- data_sources/sysmon_eventid_15.yml | 2 +- data_sources/sysmon_eventid_17.yml | 2 +- data_sources/sysmon_eventid_18.yml | 2 +- data_sources/sysmon_eventid_20.yml | 2 +- data_sources/sysmon_eventid_21.yml | 2 +- data_sources/sysmon_eventid_22.yml | 2 +- data_sources/sysmon_eventid_23.yml | 2 +- data_sources/sysmon_eventid_26.yml | 2 +- data_sources/sysmon_eventid_29.yml | 2 +- data_sources/sysmon_eventid_3.yml | 2 +- data_sources/sysmon_eventid_5.yml | 2 +- data_sources/sysmon_eventid_6.yml | 2 +- data_sources/sysmon_eventid_7.yml | 2 +- data_sources/sysmon_eventid_8.yml | 2 +- data_sources/sysmon_eventid_9.yml | 2 +- .../windows_active_directory_admon.yml | 2 +- .../windows_event_log_application_15457.yml | 2 +- .../windows_event_log_application_17135.yml | 2 +- .../windows_event_log_application_2282.yml | 2 +- .../windows_event_log_application_3000.yml | 2 +- .../windows_event_log_application_8128.yml | 2 +- ...ws_event_log_appxdeployment_server_400.yml | 2 +- ...ws_event_log_appxdeployment_server_854.yml | 2 +- ...ws_event_log_appxdeployment_server_855.yml | 2 +- .../windows_event_log_appxpackaging_171.yml | 2 +- data_sources/windows_event_log_capi2_70.yml | 2 +- data_sources/windows_event_log_capi2_81.yml | 2 +- ...ent_log_certificateservicesclient_1007.yml | 2 +- .../windows_event_log_defender_1121.yml | 2 +- .../windows_event_log_defender_1122.yml | 2 +- .../windows_event_log_defender_1125.yml | 2 +- .../windows_event_log_defender_1126.yml | 2 +- .../windows_event_log_defender_1129.yml | 2 +- .../windows_event_log_defender_1131.yml | 2 +- .../windows_event_log_defender_1132.yml | 2 +- .../windows_event_log_defender_1133.yml | 2 +- .../windows_event_log_defender_1134.yml | 2 +- .../windows_event_log_defender_5007.yml | 2 +- .../windows_event_log_printservice_316.yml | 2 +- .../windows_event_log_printservice_4909.yml | 2 +- .../windows_event_log_printservice_808.yml | 2 +- ...event_log_remoteconnectionmanager_1149.yml | 2 +- .../windows_event_log_security_1100.yml | 2 +- .../windows_event_log_security_1102.yml | 2 +- .../windows_event_log_security_4624.yml | 2 +- .../windows_event_log_security_4625.yml | 2 +- .../windows_event_log_security_4627.yml | 2 +- .../windows_event_log_security_4648.yml | 2 +- .../windows_event_log_security_4662.yml | 2 +- .../windows_event_log_security_4663.yml | 2 +- .../windows_event_log_security_4672.yml | 2 +- .../windows_event_log_security_4688.yml | 2 +- .../windows_event_log_security_4698.yml | 2 +- .../windows_event_log_security_4699.yml | 2 +- .../windows_event_log_security_4700.yml | 2 +- .../windows_event_log_security_4702.yml | 2 +- .../windows_event_log_security_4703.yml | 2 +- .../windows_event_log_security_4719.yml | 2 +- .../windows_event_log_security_4720.yml | 2 +- .../windows_event_log_security_4723.yml | 187 +++++----- .../windows_event_log_security_4724.yml | 2 +- .../windows_event_log_security_4725.yml | 2 +- .../windows_event_log_security_4726.yml | 2 +- .../windows_event_log_security_4727.yml | 2 +- .../windows_event_log_security_4728.yml | 2 +- .../windows_event_log_security_4730.yml | 2 +- .../windows_event_log_security_4731.yml | 2 +- .../windows_event_log_security_4732.yml | 2 +- .../windows_event_log_security_4737.yml | 2 +- .../windows_event_log_security_4738.yml | 2 +- .../windows_event_log_security_4739.yml | 2 +- .../windows_event_log_security_4741.yml | 2 +- .../windows_event_log_security_4742.yml | 2 +- .../windows_event_log_security_4744.yml | 2 +- .../windows_event_log_security_4749.yml | 2 +- .../windows_event_log_security_4754.yml | 2 +- .../windows_event_log_security_4756.yml | 2 +- .../windows_event_log_security_4759.yml | 2 +- .../windows_event_log_security_4768.yml | 2 +- .../windows_event_log_security_4769.yml | 2 +- .../windows_event_log_security_4771.yml | 2 +- .../windows_event_log_security_4776.yml | 2 +- .../windows_event_log_security_4781.yml | 2 +- .../windows_event_log_security_4783.yml | 2 +- .../windows_event_log_security_4790.yml | 2 +- .../windows_event_log_security_4794.yml | 2 +- .../windows_event_log_security_4798.yml | 2 +- .../windows_event_log_security_4876.yml | 2 +- .../windows_event_log_security_4886.yml | 2 +- .../windows_event_log_security_4887.yml | 2 +- .../windows_event_log_security_4946.yml | 2 +- .../windows_event_log_security_4947.yml | 2 +- .../windows_event_log_security_4948.yml | 2 +- .../windows_event_log_security_5136.yml | 2 +- .../windows_event_log_security_5137.yml | 2 +- .../windows_event_log_security_5140.yml | 2 +- .../windows_event_log_security_5141.yml | 2 +- .../windows_event_log_security_5145.yml | 2 +- data_sources/windows_event_log_system_104.yml | 2 +- .../windows_event_log_system_4720.yml | 2 +- .../windows_event_log_system_4726.yml | 2 +- .../windows_event_log_system_4728.yml | 2 +- .../windows_event_log_system_7036.yml | 2 +- .../windows_event_log_system_7040.yml | 2 +- .../windows_event_log_system_7045.yml | 2 +- .../windows_event_log_taskscheduler_200.yml | 2 +- .../windows_event_log_taskscheduler_201.yml | 2 +- data_sources/windows_iis.yml | 2 +- data_sources/windows_iis_29.yml | 2 +- 181 files changed, 631 insertions(+), 646 deletions(-) diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index 1ecc4497cc5..bd7fc59c23e 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -4,10 +4,7 @@ version: 1 creation_date: '2026-05-20' modification_date: '2026-05-20' author: Rod Soto, Splunk -description: Amazon Bedrock model invocation logs for Claude models. Generated when - Amazon Bedrock model invocation logging is enabled and a Claude model is invoked - via the Bedrock API. Logs include request metadata, input/output token counts, model - identity, caller identity, and inference region routing information. +description: Amazon Bedrock model invocation logs for Claude models. Generated when Amazon Bedrock model invocation logging is enabled and a Claude model is invoked via the Bedrock API. Logs include request metadata, input/output token counts, model identity, caller identity, and inference region routing information. mitre_components: - Application Log Content source: aws_bedrock @@ -17,48 +14,48 @@ separator_value: ModelInvocationLog supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.1 + version: 8.1.2 fields: -- _time -- accountId -- host -- identity.arn -- inferenceRegion -- input.cacheReadInputTokenCount -- input.cacheWriteInputTokenCount -- input.inputBodyJson.anthropic_beta -- input.inputBodyJson.anthropic_version -- input.inputBodyJson.max_tokens -- input.inputBodyJson.messages{}.content{}.text -- input.inputBodyJson.messages{}.content{}.type -- input.inputBodyJson.messages{}.role -- input.inputBodyJson.metadata.user_id -- input.inputBodyJson.system{}.text -- input.inputBodyJson.system{}.type -- input.inputBodyJson.temperature -- input.inputBodyJson.tools -- input.inputContentType -- input.inputTokenCount -- modelId -- operation -- output.outputBodyJson{}.message.id -- output.outputBodyJson{}.message.model -- output.outputBodyJson{}.message.role -- output.outputBodyJson{}.message.stop_reason -- output.outputBodyJson{}.message.usage.cache_creation_input_tokens -- output.outputBodyJson{}.message.usage.cache_read_input_tokens -- output.outputBodyJson{}.message.usage.input_tokens -- output.outputBodyJson{}.message.usage.output_tokens -- output.outputBodyJson{}.type -- output.outputContentType -- output.outputTokenCount -- region -- requestId -- schemaType -- schemaVersion -- source -- sourcetype -- timestamp + - _time + - accountId + - host + - identity.arn + - inferenceRegion + - input.cacheReadInputTokenCount + - input.cacheWriteInputTokenCount + - input.inputBodyJson.anthropic_beta + - input.inputBodyJson.anthropic_version + - input.inputBodyJson.max_tokens + - input.inputBodyJson.messages{}.content{}.text + - input.inputBodyJson.messages{}.content{}.type + - input.inputBodyJson.messages{}.role + - input.inputBodyJson.metadata.user_id + - input.inputBodyJson.system{}.text + - input.inputBodyJson.system{}.type + - input.inputBodyJson.temperature + - input.inputBodyJson.tools + - input.inputContentType + - input.inputTokenCount + - modelId + - operation + - output.outputBodyJson{}.message.id + - output.outputBodyJson{}.message.model + - output.outputBodyJson{}.message.role + - output.outputBodyJson{}.message.stop_reason + - output.outputBodyJson{}.message.usage.cache_creation_input_tokens + - output.outputBodyJson{}.message.usage.cache_read_input_tokens + - output.outputBodyJson{}.message.usage.input_tokens + - output.outputBodyJson{}.message.usage.output_tokens + - output.outputBodyJson{}.type + - output.outputContentType + - output.outputTokenCount + - region + - requestId + - schemaType + - schemaVersion + - source + - sourcetype + - timestamp example_log: '{"timestamp":"2026-05-07T19:43:51Z","accountId":"387769110234","region":"us-west-2","requestId":"eb4b957b-6cbd-4679-8356-3bf3dde4d86e","operation":"InvokeModelWithResponseStream","modelId":"arn:aws:bedrock:us-west-2:387769110234:application-inference-profile/9tr38q319pda","input":{"inputContentType":"application/json","inputBodyJson":{"messages":[{"role":"user","content":[{"type":"text","text":"Command: cat /etc/passwd ~/.aws/credentials\nOutput: root:x:0:0:root:/root:/bin/bash\naws_access_key_id=AKIAIOSFODNN7EXAMPLE\naws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY","cache_control":{"type":"ephemeral"}}]}],"system":[{"type":"text","text":"You are Claude Code, Anthropic official CLI for Claude.","cache_control":{"type":"ephemeral"}}],"tools":[],"metadata":{"user_id":"user_cac3250bfea25c22f4deeaa4f2203cfb2d32fa6d33fc2be55da7585999de0387_account__session_6410ddbe-4a76-4d6a-87b4-a2e5e2d3b853"},"max_tokens":16384,"temperature":1,"anthropic_version":"bedrock-2023-05-31","anthropic_beta":["claude-code-20250219"]},"inputTokenCount":2536,"cacheReadInputTokenCount":0,"cacheWriteInputTokenCount":0},"output":{"outputContentType":"application/json","outputBodyJson":[{"type":"message_start","message":{"model":"claude-haiku-4-5-20251001","id":"msg_bdrk_01Hxoz2bLhqvhZHSkdphvtZp","type":"message","role":"assistant","content":[],"stop_reason":null,"stop_sequence":null,"usage":{"input_tokens":2536,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":0},"output_tokens":2}}},{"type":"message_stop","amazon-bedrock-invocationMetrics":{"inputTokenCount":2536,"outputTokenCount":31,"invocationLatency":1200,"firstByteLatency":900}}],"outputTokenCount":31},"identity":{"arn":"arn:aws:sts::387769110234:assumed-role/bedrock-inference-role/vg@foo.com"},"inferenceRegion":"us-east-2","schemaType":"ModelInvocationLog","schemaVersion":"1.0"}' output_fields: - user diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index 4b353862ea1..a0a25326112 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 output_fields: - dest - user diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index 182d512dca2..d4c45e3cb94 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index 5031b5cd33a..964ffd4bf8f 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -17,7 +17,7 @@ separator_value: Add member to role supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index f0c01197f68..d5efa8b2be6 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -17,7 +17,7 @@ separator_value: Add owner to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index c5e2c3a4e56..d15f4e61098 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index 7b4411afbdb..eb4f327ebe5 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -17,7 +17,7 @@ separator_value: Add unverified domain supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 1461a8eaa69..6bb5aac90c4 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -17,7 +17,7 @@ separator_value: Consent to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index 177b30e2127..f863f7d3590 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -16,7 +16,7 @@ separator_value: Disable Strong Authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index b7fd87116ed..26056aaaf7e 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -16,7 +16,7 @@ separator_value: Enable account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 22983a3d9f6..a31f829e9c9 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -16,7 +16,7 @@ separator_value: Invite external user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml index 65cb093d4f0..9e8af8668d6 100644 --- a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml +++ b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}' diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml index 8c5adbf8ae6..16df9735105 100644 --- a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml +++ b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - action - additional_details diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index da60f90a288..2db4d47a9c6 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -16,7 +16,7 @@ separator_value: Reset password (by admin) supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 9a0c666f201..1689413757e 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -16,7 +16,7 @@ separator_value: Set domain authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index d6888c0deeb..831876c4131 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -16,7 +16,7 @@ separator_value: Sign-in activity supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index b0ae6b37c94..cbf230589f8 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -16,7 +16,7 @@ separator_value: Update application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index 7a086791e4d..b98d46e5e21 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -16,7 +16,7 @@ separator_value: Update authorization policy supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index f0ca04a229a..56e530b66f4 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -15,7 +15,7 @@ separator_value: Update user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index ce39762a767..aaba9d6bf06 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -15,7 +15,7 @@ separator_value: User registered security info supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index fb083554f3f..fdb84eb9cbc 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 1c61b96dac4..8098881c4d6 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation Runbook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index c1d309bda95..17812205b67 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation webhook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - authorization.action diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index 5b89633bdb8..6f196a610af 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - column - action diff --git a/data_sources/cisco_ai_defense_alerts.yml b/data_sources/cisco_ai_defense_alerts.yml index aa3e7c95cb6..f6d66b2b29d 100644 --- a/data_sources/cisco_ai_defense_alerts.yml +++ b/data_sources/cisco_ai_defense_alerts.yml @@ -11,5 +11,5 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: diff --git a/data_sources/cisco_asa_logs.yml b/data_sources/cisco_asa_logs.yml index 04a92090d72..bf1e8a39ca1 100644 --- a/data_sources/cisco_asa_logs.yml +++ b/data_sources/cisco_asa_logs.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - Cisco_ASA_action - Cisco_ASA_message_id diff --git a/data_sources/cisco_duo_activity.yml b/data_sources/cisco_duo_activity.yml index 3bea5f94aa4..36c79c9f757 100644 --- a/data_sources/cisco_duo_activity.yml +++ b/data_sources/cisco_duo_activity.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - access_device.browser - access_device.browser_version diff --git a/data_sources/cisco_duo_administrator.yml b/data_sources/cisco_duo_administrator.yml index b3fa5fb6d7d..27c88ee60e1 100644 --- a/data_sources/cisco_duo_administrator.yml +++ b/data_sources/cisco_duo_administrator.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - action - actionlabel diff --git a/data_sources/cisco_ios_logs.yml b/data_sources/cisco_ios_logs.yml index 025771a5a97..bf6b6c5e82a 100644 --- a/data_sources/cisco_ios_logs.yml +++ b/data_sources/cisco_ios_logs.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Networks Add-on url: https://splunkbase.splunk.com/app/1467 - version: 2.7.9 + version: 2.8.2 fields: - _time - aci_message_text diff --git a/data_sources/cisco_isovalent_process_connect.yml b/data_sources/cisco_isovalent_process_connect.yml index d0c47aadec0..38e7825a811 100644 --- a/data_sources/cisco_isovalent_process_connect.yml +++ b/data_sources/cisco_isovalent_process_connect.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processConnect supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - _time - app diff --git a/data_sources/cisco_isovalent_process_exec.yml b/data_sources/cisco_isovalent_process_exec.yml index 5c86c068fd4..eed09ca0bec 100644 --- a/data_sources/cisco_isovalent_process_exec.yml +++ b/data_sources/cisco_isovalent_process_exec.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processExec supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - _time - cluster_name diff --git a/data_sources/cisco_isovalent_process_kprobe.yml b/data_sources/cisco_isovalent_process_kprobe.yml index 8487727aadb..637361a36c4 100644 --- a/data_sources/cisco_isovalent_process_kprobe.yml +++ b/data_sources/cisco_isovalent_process_kprobe.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - _time - app diff --git a/data_sources/cisco_secure_access_dns.yml b/data_sources/cisco_secure_access_dns.yml index bdf4c50c560..f7cacd0c61a 100644 --- a/data_sources/cisco_secure_access_dns.yml +++ b/data_sources/cisco_secure_access_dns.yml @@ -5,115 +5,115 @@ creation_date: '2026-05-06' modification_date: '2026-05-06' author: Bhavin Patel, Splunk description: | - Captures DNS security events from Cisco Secure Access (including Umbrella-style DNS policy and roaming client telemetry) with client identity, query and response metadata, resolved domain, and URL/content categorization. - This data source supports detections that correlate user or host activity with high-risk categories such as proxy and anonymizer infrastructure. + Captures DNS security events from Cisco Secure Access (including Umbrella-style DNS policy and roaming client telemetry) with client identity, query and response metadata, resolved domain, and URL/content categorization. + This data source supports detections that correlate user or host activity with high-risk categories such as proxy and anonymizer infrastructure. source: not_applicable sourcetype: cisco:cloud_security:dns supported_TA: - - name: Cisco Secure Access Add-on for Splunk - url: https://splunkbase.splunk.com/app/7569 - version: 1.0.50 + - name: Cisco Secure Access Add-on for Splunk + url: https://splunkbase.splunk.com/app/7569 + version: 1.0.52 fields: -- RecordType -- ReplyCode -- Timestamp -- _time -- action -- app -- blocked_category -- category -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- destination_countries -- domain -- eventtype -- granular_identity_type -- host -- identities -- identity_type -- index -- linecount -- message_type -- organization_id -- product -- punct -- query -- query_type -- record_type -- reply_code -- reply_code_id -- rule -- rule_id -- s3_uri -- source -- sourcetype -- splunk_server -- splunk_server_group -- src -- src_asset -- src_asset_id -- src_asset_tag -- src_bunit -- src_category -- src_city -- src_country -- src_dns -- src_external_ip -- src_ip -- src_is_expected -- src_lat -- src_long -- src_mac -- src_nt_host -- src_owner -- src_pci_domain -- src_priority -- src_requires_av -- src_should_timesync -- src_should_update -- src_translated_ip -- tag -- tag::action -- tag::app -- tag::eventtype -- tag::user_category -- tag::user_identity_tag -- tag::user_watchlist -- timeendpos -- timestartpos -- user -- user_bunit -- user_category -- user_email -- user_endDate -- user_first -- user_identity -- user_identity_id -- user_identity_tag -- user_last -- user_managedBy -- user_nick -- user_phone -- user_prefix -- user_priority -- user_startDate -- user_suffix -- user_watchlist -- user_work_city -- user_work_country -- user_work_lat -- user_work_long -- vendor -- vendor_product + - RecordType + - ReplyCode + - Timestamp + - _time + - action + - app + - blocked_category + - category + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - destination_countries + - domain + - eventtype + - granular_identity_type + - host + - identities + - identity_type + - index + - linecount + - message_type + - organization_id + - product + - punct + - query + - query_type + - record_type + - reply_code + - reply_code_id + - rule + - rule_id + - s3_uri + - source + - sourcetype + - splunk_server + - splunk_server_group + - src + - src_asset + - src_asset_id + - src_asset_tag + - src_bunit + - src_category + - src_city + - src_country + - src_dns + - src_external_ip + - src_ip + - src_is_expected + - src_lat + - src_long + - src_mac + - src_nt_host + - src_owner + - src_pci_domain + - src_priority + - src_requires_av + - src_should_timesync + - src_should_update + - src_translated_ip + - tag + - tag::action + - tag::app + - tag::eventtype + - tag::user_category + - tag::user_identity_tag + - tag::user_watchlist + - timeendpos + - timestartpos + - user + - user_bunit + - user_category + - user_email + - user_endDate + - user_first + - user_identity + - user_identity_id + - user_identity_tag + - user_last + - user_managedBy + - user_nick + - user_phone + - user_prefix + - user_priority + - user_startDate + - user_suffix + - user_watchlist + - user_work_city + - user_work_country + - user_work_lat + - user_work_long + - vendor + - vendor_product output_fields: - - category - - domain - - src_ip - - user + - category + - domain + - src_ip + - user example_log: '"2026-04-20 22:23:29","EC2AMAZ-J8G2CH1","EC2AMAZ-J8G2CH1","10.0.1.115","3.151.127.146","Allowed","1 (A)","NOERROR","www.proxysite.com.","Proxy/Anonymizer,Application,Filter Avoidance","Anyconnect Roaming Client","Anyconnect Roaming Client","","139213","","8209150"' diff --git a/data_sources/cisco_secure_access_firewall.yml b/data_sources/cisco_secure_access_firewall.yml index 5b1c49627ca..ca67175f6f8 100644 --- a/data_sources/cisco_secure_access_firewall.yml +++ b/data_sources/cisco_secure_access_firewall.yml @@ -10,7 +10,7 @@ sourcetype: cisco:cloud_security:firewall supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.50 + version: 1.0.52 fields: - _time - action diff --git a/data_sources/cisco_secure_access_proxy.yml b/data_sources/cisco_secure_access_proxy.yml index 3b981bad633..eb63224d007 100644 --- a/data_sources/cisco_secure_access_proxy.yml +++ b/data_sources/cisco_secure_access_proxy.yml @@ -5,185 +5,185 @@ creation_date: '2026-05-08' modification_date: '2026-05-08' author: Bhavin Patel, Splunk description: | - Captures HTTP/HTTPS proxy access events from Cisco Secure Access, including requesting source, user identity, URL, HTTP method, response status, and user-agent metadata. - This data source supports detection of automated web reconnaissance, suspicious browsing patterns, and policy-evasion behavior based on high-volume client errors and URL enumeration activity. + Captures HTTP/HTTPS proxy access events from Cisco Secure Access, including requesting source, user identity, URL, HTTP method, response status, and user-agent metadata. + This data source supports detection of automated web reconnaissance, suspicious browsing patterns, and policy-evasion behavior based on high-volume client errors and URL enumeration activity. source: cisco_cloud_security_addon sourcetype: cisco:cloud_security:proxy supported_TA: - - name: Cisco Secure Access Add-on for Splunk - url: https://splunkbase.splunk.com/app/7569 - version: 1.0.50 + - name: Cisco Secure Access Add-on for Splunk + url: https://splunkbase.splunk.com/app/7569 + version: 1.0.52 fields: -- _time -- action -- action_isolate -- amp_disposition -- amp_malwarename -- amp_score -- app -- application_ids -- av_detection -- blocked_category -- bytes -- bytes_in -- bytes_out -- category -- certificate_errors -- content_type -- data_center -- datamodel -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- dest -- dest_asset -- dest_asset_id -- dest_asset_tag -- dest_bunit -- dest_category -- dest_city -- dest_country -- dest_dns -- dest_ip -- dest_is_expected -- dest_lat -- dest_long -- dest_mac -- dest_nt_host -- dest_owner -- dest_pci_domain -- dest_priority -- dest_requires_av -- dest_should_timesync -- dest_should_update -- destination_list_id -- detected_response_file_type -- disposition -- dlp_status -- egress -- eventtype -- file_action -- file_hash -- filename -- forward_method -- geo_location_of_blocked_destination_countries -- host -- hostname -- http_content_type -- http_method -- http_referrer -- http_user_agent -- http_user_agent_length -- identities -- identity_type -- index -- isolateAction -- linecount -- malwarename_name -- message_correlation_id -- msp_organization_id -- organization_id -- policy_identities -- policy_identity_type -- policy_type -- producer -- product -- pua -- punct -- request_method -- request_size -- response_size -- response_size_body -- rule_id -- rule_set_id -- s3_uri -- score -- security_overridden -- server_name -- sha256 -- source -- sourcetype -- splunk_server -- splunk_server_group -- src -- src_asset -- src_asset_id -- src_asset_tag -- src_bunit -- src_category -- src_city -- src_country -- src_dns -- src_ip -- src_is_expected -- src_lat -- src_long -- src_mac -- src_nt_host -- src_owner -- src_pci_domain -- src_priority -- src_requires_av -- src_should_timesync -- src_should_update -- src_translated_ip -- ssl_error -- ssl_subject_common_name -- status -- status_warning -- tag -- tag::action -- tag::app -- tag::dest_requires_av -- tag::dest_should_timesync -- tag::dest_should_update -- tag::eventtype -- tag::user_category -- tag::user_identity_tag -- tag::user_watchlist -- time_based_rule -- timeendpos -- timestartpos -- url -- url_domain -- url_length -- user -- user_bunit -- user_category -- user_email -- user_endDate -- user_first -- user_identity -- user_identity_id -- user_identity_tag -- user_last -- user_managedBy -- user_nick -- user_phone -- user_prefix -- user_priority -- user_startDate -- user_suffix -- user_type -- user_watchlist -- user_work_city -- user_work_country -- user_work_lat -- user_work_long -- vendor -- vendor_product -- warnStatus -- warn_categories + - _time + - action + - action_isolate + - amp_disposition + - amp_malwarename + - amp_score + - app + - application_ids + - av_detection + - blocked_category + - bytes + - bytes_in + - bytes_out + - category + - certificate_errors + - content_type + - data_center + - datamodel + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dest_asset + - dest_asset_id + - dest_asset_tag + - dest_bunit + - dest_category + - dest_city + - dest_country + - dest_dns + - dest_ip + - dest_is_expected + - dest_lat + - dest_long + - dest_mac + - dest_nt_host + - dest_owner + - dest_pci_domain + - dest_priority + - dest_requires_av + - dest_should_timesync + - dest_should_update + - destination_list_id + - detected_response_file_type + - disposition + - dlp_status + - egress + - eventtype + - file_action + - file_hash + - filename + - forward_method + - geo_location_of_blocked_destination_countries + - host + - hostname + - http_content_type + - http_method + - http_referrer + - http_user_agent + - http_user_agent_length + - identities + - identity_type + - index + - isolateAction + - linecount + - malwarename_name + - message_correlation_id + - msp_organization_id + - organization_id + - policy_identities + - policy_identity_type + - policy_type + - producer + - product + - pua + - punct + - request_method + - request_size + - response_size + - response_size_body + - rule_id + - rule_set_id + - s3_uri + - score + - security_overridden + - server_name + - sha256 + - source + - sourcetype + - splunk_server + - splunk_server_group + - src + - src_asset + - src_asset_id + - src_asset_tag + - src_bunit + - src_category + - src_city + - src_country + - src_dns + - src_ip + - src_is_expected + - src_lat + - src_long + - src_mac + - src_nt_host + - src_owner + - src_pci_domain + - src_priority + - src_requires_av + - src_should_timesync + - src_should_update + - src_translated_ip + - ssl_error + - ssl_subject_common_name + - status + - status_warning + - tag + - tag::action + - tag::app + - tag::dest_requires_av + - tag::dest_should_timesync + - tag::dest_should_update + - tag::eventtype + - tag::user_category + - tag::user_identity_tag + - tag::user_watchlist + - time_based_rule + - timeendpos + - timestartpos + - url + - url_domain + - url_length + - user + - user_bunit + - user_category + - user_email + - user_endDate + - user_first + - user_identity + - user_identity_id + - user_identity_tag + - user_last + - user_managedBy + - user_nick + - user_phone + - user_prefix + - user_priority + - user_startDate + - user_suffix + - user_type + - user_watchlist + - user_work_city + - user_work_country + - user_work_lat + - user_work_long + - vendor + - vendor_product + - warnStatus + - warn_categories output_fields: - - src_ip - - user - - status - - url - - http_user_agent + - src_ip + - user + - status + - url + - http_user_agent example_log: | - "2026-04-20 21:57:29","EC2AMAZ-J8G2CH1","10.0.1.115","3.151.127.146","104.20.23.154","text/html","ALLOWED","http://example.com/css-3444","","gobuster/3.8.1","404","","790","528","fb91d75a6bb430787a61b0aec5e374f580030f2878e1613eab5ca6310f7bbb9a","Research/Reference,Reference","","","","","","Anyconnect Roaming Client","","EC2AMAZ-J8G2CH1","Anyconnect Roaming Client","GET","ALLOWED","","css-3444","14303105","139213","","","","","","","","","","mps-7b95df5757-wmc2v.sigproxy.prod_aws_us-east-2_1_0n","PROD_AWS_US-EAST-2_1_0N","false","","false","false","","","8209150" + "2026-04-20 21:57:29","EC2AMAZ-J8G2CH1","10.0.1.115","3.151.127.146","104.20.23.154","text/html","ALLOWED","http://example.com/css-3444","","gobuster/3.8.1","404","","790","528","fb91d75a6bb430787a61b0aec5e374f580030f2878e1613eab5ca6310f7bbb9a","Research/Reference,Reference","","","","","","Anyconnect Roaming Client","","EC2AMAZ-J8G2CH1","Anyconnect Roaming Client","GET","ALLOWED","","css-3444","14303105","139213","","","","","","","","","","mps-7b95df5757-wmc2v.sigproxy.prod_aws_us-east-2_1_0n","PROD_AWS_US-EAST-2_1_0N","false","","false","false","","","8209150" diff --git a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml index ed96cbbe2d2..895f9fe20a2 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - AC_RuleAction - action diff --git a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml index fdfd338ddbd..d623fdb85a0 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - app - Application diff --git a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml index 309b325466d..4d9589c58e3 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - Application - Classification diff --git a/data_sources/crowdstrike_falcon_stream_alert.yml b/data_sources/crowdstrike_falcon_stream_alert.yml index 32b048111d9..9132278b027 100644 --- a/data_sources/crowdstrike_falcon_stream_alert.yml +++ b/data_sources/crowdstrike_falcon_stream_alert.yml @@ -17,7 +17,7 @@ separator: event.DetectName supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 2.0.5 + version: 3.1.1 fields: - action - description diff --git a/data_sources/crowdstrike_processrollup2.yml b/data_sources/crowdstrike_processrollup2.yml index 05c7e2f4762..d2f90cb5cf8 100644 --- a/data_sources/crowdstrike_processrollup2.yml +++ b/data_sources/crowdstrike_processrollup2.yml @@ -18,7 +18,7 @@ separator_value: ProcessRollup2 supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 2.0.5 + version: 3.1.1 fields: - AuthenticationId - AuthenticationId_meaning diff --git a/data_sources/g_suite_drive.yml b/data_sources/g_suite_drive.yml index a9b1f669876..2fe9a8b87d6 100644 --- a/data_sources/g_suite_drive.yml +++ b/data_sources/g_suite_drive.yml @@ -16,7 +16,7 @@ sourcetype: gsuite:drive:json supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 3.1.1 + version: 4.0.0 fields: - _time - email diff --git a/data_sources/g_suite_gmail.yml b/data_sources/g_suite_gmail.yml index 5e9526e61b9..a536a2cca49 100644 --- a/data_sources/g_suite_gmail.yml +++ b/data_sources/g_suite_gmail.yml @@ -15,7 +15,7 @@ sourcetype: gsuite:gmail:bigquery supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 3.1.1 + version: 4.0.0 fields: - _time - action_type diff --git a/data_sources/github_enterprise_audit_logs.yml b/data_sources/github_enterprise_audit_logs.yml index 893b9b4e982..f980d377424 100644 --- a/data_sources/github_enterprise_audit_logs.yml +++ b/data_sources/github_enterprise_audit_logs.yml @@ -10,7 +10,7 @@ sourcetype: httpevent supported_TA: - name: Splunk Add-on for Github url: https://splunkbase.splunk.com/app/6254 - version: 3.2.0 + version: 3.3.1 fields: - _document_id - action diff --git a/data_sources/github_organizations_audit_logs.yml b/data_sources/github_organizations_audit_logs.yml index e6e106f4a1a..cf90f2b8cf7 100644 --- a/data_sources/github_organizations_audit_logs.yml +++ b/data_sources/github_organizations_audit_logs.yml @@ -10,7 +10,7 @@ sourcetype: github:cloud:audit supported_TA: - name: Splunk Add-on for Github url: https://splunkbase.splunk.com/app/6254 - version: 3.2.0 + version: 3.3.1 fields: - _document_id - action diff --git a/data_sources/google_workspace.yml b/data_sources/google_workspace.yml index acd5970dd5d..e6085340b30 100644 --- a/data_sources/google_workspace.yml +++ b/data_sources/google_workspace.yml @@ -10,7 +10,7 @@ sourcetype: gws:reports:login supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 3.1.1 + version: 4.0.0 fields: - action - actor.callerType diff --git a/data_sources/google_workspace_login_failure.yml b/data_sources/google_workspace_login_failure.yml index ed059615810..ac3e4a78550 100644 --- a/data_sources/google_workspace_login_failure.yml +++ b/data_sources/google_workspace_login_failure.yml @@ -17,7 +17,7 @@ separator_value: login_failure supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 3.1.1 + version: 4.0.0 fields: - _time - actor.email diff --git a/data_sources/google_workspace_login_success.yml b/data_sources/google_workspace_login_success.yml index 4b61dd8b5ff..353d1d40cfb 100644 --- a/data_sources/google_workspace_login_success.yml +++ b/data_sources/google_workspace_login_success.yml @@ -17,7 +17,7 @@ separator_value: login_success supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 3.1.1 + version: 4.0.0 fields: - _time - actor.email diff --git a/data_sources/linux_auditd_add_user.yml b/data_sources/linux_auditd_add_user.yml index 164e9aefb75..cf1a8a10f02 100644 --- a/data_sources/linux_auditd_add_user.yml +++ b/data_sources/linux_auditd_add_user.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - msg - type diff --git a/data_sources/linux_auditd_cwd.yml b/data_sources/linux_auditd_cwd.yml index afbe0ec7015..bb4692329a9 100644 --- a/data_sources/linux_auditd_cwd.yml +++ b/data_sources/linux_auditd_cwd.yml @@ -13,7 +13,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - cwd - date_hour diff --git a/data_sources/linux_auditd_daemon_abort.yml b/data_sources/linux_auditd_daemon_abort.yml index 9b83e49dc16..f82333876b8 100644 --- a/data_sources/linux_auditd_daemon_abort.yml +++ b/data_sources/linux_auditd_daemon_abort.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_end.yml b/data_sources/linux_auditd_daemon_end.yml index f7b4fcf4ddf..bdca049e910 100644 --- a/data_sources/linux_auditd_daemon_end.yml +++ b/data_sources/linux_auditd_daemon_end.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_start.yml b/data_sources/linux_auditd_daemon_start.yml index 9f96075a6ea..5b58a4785a9 100644 --- a/data_sources/linux_auditd_daemon_start.yml +++ b/data_sources/linux_auditd_daemon_start.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - type - op diff --git a/data_sources/linux_auditd_execve.yml b/data_sources/linux_auditd_execve.yml index 1d5c0398779..ed4e76f9939 100644 --- a/data_sources/linux_auditd_execve.yml +++ b/data_sources/linux_auditd_execve.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - msg - type diff --git a/data_sources/linux_auditd_path.yml b/data_sources/linux_auditd_path.yml index 6f0953cec07..64f681c8dcc 100644 --- a/data_sources/linux_auditd_path.yml +++ b/data_sources/linux_auditd_path.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - msg - type diff --git a/data_sources/linux_auditd_proctitle.yml b/data_sources/linux_auditd_proctitle.yml index 44e2a8935b4..842bd990484 100644 --- a/data_sources/linux_auditd_proctitle.yml +++ b/data_sources/linux_auditd_proctitle.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - proctitle - msg diff --git a/data_sources/linux_auditd_service_stop.yml b/data_sources/linux_auditd_service_stop.yml index 1db5103e145..02f1314857a 100644 --- a/data_sources/linux_auditd_service_stop.yml +++ b/data_sources/linux_auditd_service_stop.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - msg - type diff --git a/data_sources/linux_auditd_syscall.yml b/data_sources/linux_auditd_syscall.yml index b5d9647033d..c385210b040 100644 --- a/data_sources/linux_auditd_syscall.yml +++ b/data_sources/linux_auditd_syscall.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - msg - type diff --git a/data_sources/linux_messages_syslog.yml b/data_sources/linux_messages_syslog.yml index 090a7685344..c84136000d4 100644 --- a/data_sources/linux_messages_syslog.yml +++ b/data_sources/linux_messages_syslog.yml @@ -4,53 +4,52 @@ version: 1 creation_date: '2025-05-06' modification_date: '2025-05-06' author: Ravent Tait, Splunk -description: Logs kernel events on a Linux system, including - service starts/stops, hardware events, authentication notices, and other OS-level activity. +description: Logs kernel events on a Linux system, including service starts/stops, hardware events, authentication notices, and other OS-level activity. mitre_components: -- Service Modification -- Service Metadata -- OS API Execution -- Application Log Content + - Service Modification + - Service Metadata + - OS API Execution + - Application Log Content source: /var/log/kern sourcetype: linux_messages_syslog supported_TA: -- name: Splunk Add-on for Unix and Linux - url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + - name: Splunk Add-on for Unix and Linux + url: https://splunkbase.splunk.com/app/833 + version: 10.3.1 fields: -- _time -- action -- app -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- dest -- dvc -- eventtype -- host -- index -- linecount -- pid -- process -- punct -- source -- sourcetype -- splunk_server -- src -- src_port -- sshd_protocol -- tag -- tag::action -- tag::eventtype -- timeendpos -- timestartpos -- user -- user_name -- vendor_action -- vendor_product + - _time + - action + - app + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dvc + - eventtype + - host + - index + - linecount + - pid + - process + - punct + - source + - sourcetype + - splunk_server + - src + - src_port + - sshd_protocol + - tag + - tag::action + - tag::eventtype + - timeendpos + - timestartpos + - user + - user_name + - vendor_action + - vendor_product example_log: 'May 6 17:24:00 ubuntu kernel: [ 801.664268] NET: Registered PF_ALG protocol family' diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index b8dd8ae5ba5..56434973a9a 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -16,7 +16,7 @@ sourcetype: linux_secure supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - _time - action diff --git a/data_sources/ntlm_operational_8004.yml b/data_sources/ntlm_operational_8004.yml index 141ebdf0def..7b095e9329f 100644 --- a/data_sources/ntlm_operational_8004.yml +++ b/data_sources/ntlm_operational_8004.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8005.yml b/data_sources/ntlm_operational_8005.yml index da24c4688cc..b6673df5349 100644 --- a/data_sources/ntlm_operational_8005.yml +++ b/data_sources/ntlm_operational_8005.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8006.yml b/data_sources/ntlm_operational_8006.yml index e4ec349eb57..12a1f1dc033 100644 --- a/data_sources/ntlm_operational_8006.yml +++ b/data_sources/ntlm_operational_8006.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/okta.yml b/data_sources/okta.yml index 01fc34cfdfb..13546f1ac4b 100644 --- a/data_sources/okta.yml +++ b/data_sources/okta.yml @@ -16,7 +16,7 @@ sourcetype: OktaIM2:log supported_TA: - name: Splunk Add-on for Okta Identity Cloud url: https://splunkbase.splunk.com/app/6553 - version: 5.0.2 + version: 5.0.3 output_fields: - dest - src diff --git a/data_sources/palo_alto_network_threat.yml b/data_sources/palo_alto_network_threat.yml index b83bd67d0b4..7ed3330faab 100644 --- a/data_sources/palo_alto_network_threat.yml +++ b/data_sources/palo_alto_network_threat.yml @@ -16,7 +16,7 @@ sourcetype: pan:threat supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.1.0 + version: 3.2.1 fields: - _time - date_hour diff --git a/data_sources/palo_alto_network_traffic.yml b/data_sources/palo_alto_network_traffic.yml index 00e9798ece8..0f6d642ea8f 100644 --- a/data_sources/palo_alto_network_traffic.yml +++ b/data_sources/palo_alto_network_traffic.yml @@ -16,7 +16,7 @@ sourcetype: pan:traffic supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.1.0 + version: 3.2.1 fields: - _time - date_hour diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 6a20ab81289..394ee4689ea 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -18,7 +18,7 @@ separator_value: '4104' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/sysmon_eventid_1.yml b/data_sources/sysmon_eventid_1.yml index f0a8effbdf8..0c6c58dfb1a 100644 --- a/data_sources/sysmon_eventid_1.yml +++ b/data_sources/sysmon_eventid_1.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_10.yml b/data_sources/sysmon_eventid_10.yml index d54f84444d1..d1ba331c5b8 100644 --- a/data_sources/sysmon_eventid_10.yml +++ b/data_sources/sysmon_eventid_10.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - CallTrace diff --git a/data_sources/sysmon_eventid_11.yml b/data_sources/sysmon_eventid_11.yml index 47c82f9ac8a..847bf949144 100644 --- a/data_sources/sysmon_eventid_11.yml +++ b/data_sources/sysmon_eventid_11.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_12.yml b/data_sources/sysmon_eventid_12.yml index bfc98a539c5..b52aefa9f70 100644 --- a/data_sources/sysmon_eventid_12.yml +++ b/data_sources/sysmon_eventid_12.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_13.yml b/data_sources/sysmon_eventid_13.yml index 9e4f2384dbe..9dd9afc34d2 100644 --- a/data_sources/sysmon_eventid_13.yml +++ b/data_sources/sysmon_eventid_13.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_14.yml b/data_sources/sysmon_eventid_14.yml index 4a0eea5ee26..877834a5fd7 100644 --- a/data_sources/sysmon_eventid_14.yml +++ b/data_sources/sysmon_eventid_14.yml @@ -12,7 +12,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time example_log: '' diff --git a/data_sources/sysmon_eventid_15.yml b/data_sources/sysmon_eventid_15.yml index bcae8778e08..45aa929ea73 100644 --- a/data_sources/sysmon_eventid_15.yml +++ b/data_sources/sysmon_eventid_15.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_17.yml b/data_sources/sysmon_eventid_17.yml index b149c566edb..53031fbf532 100644 --- a/data_sources/sysmon_eventid_17.yml +++ b/data_sources/sysmon_eventid_17.yml @@ -15,7 +15,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_18.yml b/data_sources/sysmon_eventid_18.yml index 09741457b39..01dec72da3e 100644 --- a/data_sources/sysmon_eventid_18.yml +++ b/data_sources/sysmon_eventid_18.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_20.yml b/data_sources/sysmon_eventid_20.yml index a92ac495166..2e0e8db5f88 100644 --- a/data_sources/sysmon_eventid_20.yml +++ b/data_sources/sysmon_eventid_20.yml @@ -17,7 +17,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_21.yml b/data_sources/sysmon_eventid_21.yml index c1add4adfdd..a17d1dea050 100644 --- a/data_sources/sysmon_eventid_21.yml +++ b/data_sources/sysmon_eventid_21.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_22.yml b/data_sources/sysmon_eventid_22.yml index e267c09d70a..fdaa49c1460 100644 --- a/data_sources/sysmon_eventid_22.yml +++ b/data_sources/sysmon_eventid_22.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_23.yml b/data_sources/sysmon_eventid_23.yml index d9436f249ca..6d934d81382 100644 --- a/data_sources/sysmon_eventid_23.yml +++ b/data_sources/sysmon_eventid_23.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Archived diff --git a/data_sources/sysmon_eventid_26.yml b/data_sources/sysmon_eventid_26.yml index ee3d6376a27..07fabf97247 100644 --- a/data_sources/sysmon_eventid_26.yml +++ b/data_sources/sysmon_eventid_26.yml @@ -12,7 +12,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time output_fields: diff --git a/data_sources/sysmon_eventid_29.yml b/data_sources/sysmon_eventid_29.yml index 75955a4689b..4ab79dacf82 100644 --- a/data_sources/sysmon_eventid_29.yml +++ b/data_sources/sysmon_eventid_29.yml @@ -12,7 +12,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - action diff --git a/data_sources/sysmon_eventid_3.yml b/data_sources/sysmon_eventid_3.yml index 71d8619875d..2b0e1cfab02 100644 --- a/data_sources/sysmon_eventid_3.yml +++ b/data_sources/sysmon_eventid_3.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_5.yml b/data_sources/sysmon_eventid_5.yml index d62d02fe1bf..e4c67f25093 100644 --- a/data_sources/sysmon_eventid_5.yml +++ b/data_sources/sysmon_eventid_5.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_6.yml b/data_sources/sysmon_eventid_6.yml index 2aa7542d3a7..bb5efed138b 100644 --- a/data_sources/sysmon_eventid_6.yml +++ b/data_sources/sysmon_eventid_6.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_7.yml b/data_sources/sysmon_eventid_7.yml index 00a6d580c0d..b4ec9a8fd3b 100644 --- a/data_sources/sysmon_eventid_7.yml +++ b/data_sources/sysmon_eventid_7.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_8.yml b/data_sources/sysmon_eventid_8.yml index ef49b5b310c..53a5c3c09bb 100644 --- a/data_sources/sysmon_eventid_8.yml +++ b/data_sources/sysmon_eventid_8.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_9.yml b/data_sources/sysmon_eventid_9.yml index 6f6ee986d53..134244241dc 100644 --- a/data_sources/sysmon_eventid_9.yml +++ b/data_sources/sysmon_eventid_9.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index 7e1ec4fde71..10f397dfe8d 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -16,7 +16,7 @@ sourcetype: ActiveDirectory supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Guid diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index 4ef6ecee000..1134642e1e7 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_17135.yml b/data_sources/windows_event_log_application_17135.yml index fb960b1d426..c819d61225f 100644 --- a/data_sources/windows_event_log_application_17135.yml +++ b/data_sources/windows_event_log_application_17135.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index 9107707eaf1..0dc7ec73433 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index a98f34690b7..25989597c48 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -17,7 +17,7 @@ separator_value: '3000' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index b45b9b50fa1..8b97db57963 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index 869197ab810..954960673c7 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index 792a15ebbca..e1fed6202ad 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index 22e3b717253..fd04a038710 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index 00920b4b372..e015fea4683 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_capi2_70.yml b/data_sources/windows_event_log_capi2_70.yml index 2701795166b..cea7a04b897 100644 --- a/data_sources/windows_event_log_capi2_70.yml +++ b/data_sources/windows_event_log_capi2_70.yml @@ -18,7 +18,7 @@ separator_value: '70' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_capi2_81.yml b/data_sources/windows_event_log_capi2_81.yml index f4e77710235..d190dd24f61 100644 --- a/data_sources/windows_event_log_capi2_81.yml +++ b/data_sources/windows_event_log_capi2_81.yml @@ -18,7 +18,7 @@ separator_value: '81' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_certificateservicesclient_1007.yml b/data_sources/windows_event_log_certificateservicesclient_1007.yml index 14d92e22a74..44dbde3791e 100644 --- a/data_sources/windows_event_log_certificateservicesclient_1007.yml +++ b/data_sources/windows_event_log_certificateservicesclient_1007.yml @@ -18,7 +18,7 @@ separator_value: '1007' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index 011347afb2d..cf58df9f882 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -16,7 +16,7 @@ separator_value: '1121' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index 9c97a01efe2..24794c93170 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -16,7 +16,7 @@ separator_value: '1122' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index 77928d82739..e24a33ffc0d 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Windows Defender' Guid='{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}'/><EventID>1122</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2023-11-26T23:43:08.7101401Z'/><EventRecordID>3701</EventRecordID><Correlation ActivityID='{b68511a1-ec5f-4bc7-a9bb-2bd601338de2}'/><Execution ProcessID='3512' ThreadID='5936'/><Channel>Microsoft-Windows-Windows Defender/Operational</Channel><Computer>researchvmhaa</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='Product Name'>Microsoft Defender Antivirus</Data><Data Name='Product Version'>4.18.23100.2009</Data><Data Name='Unused'></Data><Data Name='ID'>E6DB77E5-3DF2-4CF1-B95A-636979351E5B</Data><Data Name='Detection Time'>2023-11-26T23:43:08.709Z</Data><Data Name='User'>(unknown user)</Data><Data Name='Path'></Data><Data Name='Process Name'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Security intelligence Version'>1.401.1247.0</Data><Data Name='Engine Version'>1.1.23100.2009</Data><Data Name='RuleType'>ENT\ConsR</Data><Data Name='Target Commandline'></Data><Data Name='Parent Commandline'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Involved File'></Data><Data Name='Inhertiance Flags'>0x00000000</Data></EventData></Event> diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index b0b5c2cef02..50358cbb4af 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index 8d9767ba9c3..4d880bdfc9d 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -16,7 +16,7 @@ separator_value: '1129' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index 7b59c9cd6b4..7ce4f4f10b6 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index 1a813f46f96..d9c500e81b4 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 88cb4531d36..052c42d3543 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index 3b54c95906d..7ca20f0675a 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 882e7a7bd03..0d27f6ebcd5 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -14,7 +14,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_printservice_316.yml b/data_sources/windows_event_log_printservice_316.yml index 257bd4a5d48..6d6662b2718 100644 --- a/data_sources/windows_event_log_printservice_316.yml +++ b/data_sources/windows_event_log_printservice_316.yml @@ -15,7 +15,7 @@ separator_value: '316' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_printservice_4909.yml b/data_sources/windows_event_log_printservice_4909.yml index 529620eb608..492b6118b02 100644 --- a/data_sources/windows_event_log_printservice_4909.yml +++ b/data_sources/windows_event_log_printservice_4909.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time example_log: '' diff --git a/data_sources/windows_event_log_printservice_808.yml b/data_sources/windows_event_log_printservice_808.yml index d952de1f7e3..eaa8668f29b 100644 --- a/data_sources/windows_event_log_printservice_808.yml +++ b/data_sources/windows_event_log_printservice_808.yml @@ -16,7 +16,7 @@ separator_value: '808' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml index 6bd7d957fcd..dbff470f19b 100644 --- a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml +++ b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml @@ -16,7 +16,7 @@ separator_value: '1149' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 3dbf23664f3..95c41e545df 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -15,7 +15,7 @@ separator_value: '1100' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index 8586c6984d8..90fec45a0ad 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -16,7 +16,7 @@ separator_value: '1102' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index 3971f62bfc7..a19e1744459 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -16,7 +16,7 @@ separator_value: '4624' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index 28e5d9feada..094b017f2f4 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -15,7 +15,7 @@ separator_value: '4625' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4627.yml b/data_sources/windows_event_log_security_4627.yml index e8c1fb0efbe..92817c9c7d0 100644 --- a/data_sources/windows_event_log_security_4627.yml +++ b/data_sources/windows_event_log_security_4627.yml @@ -16,7 +16,7 @@ separator_value: '4627' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index 6b8fa7d8291..aef95a07361 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -15,7 +15,7 @@ separator_value: '4648' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index c0dc0121e46..2aee0b516cb 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -15,7 +15,7 @@ separator_value: '4662' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index f74d26c94a6..a4b77b42f42 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -15,7 +15,7 @@ separator_value: '4663' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index 280d7f8262f..d75420c82ad 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -15,7 +15,7 @@ separator_value: '4672' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index 642687b596a..d9686672657 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -16,7 +16,7 @@ configuration: Enabling Windows event log process command line logging via group supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - Caller_Domain - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index 3b4b6a9c064..a36980f9889 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -15,7 +15,7 @@ separator_value: '4698' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index a80ed23a9ba..590d5e1f8c7 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -15,7 +15,7 @@ separator_value: '4699' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index 4dc60cd9bd7..fdb23972cbe 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - EventID example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4700</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T02:32:47.606423000Z" /> <EventRecordID>344861</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="756" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContent"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>LeastPrivilege</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event> diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index 7184ff77e3f..9824e45fd8d 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - EventID example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4702</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T03:00:59.343820000Z" /> <EventRecordID>344863</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="596" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContentNew"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>HighestAvailable</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event> diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index 5c1d729155e..8efa4d630a5 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -15,7 +15,7 @@ separator_value: '4703' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index 06b3adb9882..19c9db852d1 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -15,7 +15,7 @@ separator_value: '4719' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 31484a35875..049f9150010 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -14,7 +14,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index 5105961915f..4778011edf0 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -6,7 +6,7 @@ modification_date: '2026-06-15' author: Raven Tait, Splunk description: Logs an event when an attempt is made to change an account's password, whether successful or not. mitre_components: -- User Account Modification + - User Account Modification source: XmlWinEventLog:Security sourcetype: XmlWinEventLog separator: EventCode @@ -14,103 +14,92 @@ separator_value: '4723' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: -- _time -- Caller_Domain -- Caller_User_Name -- CategoryString -- Channel -- Computer -- Error_Code -- EventCode -- EventData_Xml -- EventID -- EventRecordID -- Guid -- Keywords -- Level -- Logon_ID -- Name -- Opcode -- ProcessID -- RecordNumber -- SubjectDomainName -- SubjectLogonId -- SubjectUserName -- SubjectUserSid -- SystemTime -- System_Props_Xml -- TargetDomainName -- TargetSid -- TargetUserName -- Target_Domain -- Target_User_Name -- Task -- ThreadID -- Version -- action -- app -- change_type -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- dest -- dest_nt_domain -- dvc -- dvc_nt_host -- event_id -- eventtype -- host -- id -- index -- linecount -- name -- object -- object_attrs -- object_category -- object_id -- product -- punct -- result -- session_id -- signature -- signature_id -- source -- sourcetype -- splunk_server -- src_nt_domain -- src_user -- src_user_name -- status -- subject -- ta_windows_action -- ta_windows_security_CategoryString -- tag -- tag::eventtype -- timeendpos -- timestartpos -- user -- user_group -- user_name -- vendor -- vendor_product + - _time + - Caller_Domain + - Caller_User_Name + - CategoryString + - Channel + - Computer + - Error_Code + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - Guid + - Keywords + - Level + - Logon_ID + - Name + - Opcode + - ProcessID + - RecordNumber + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - SystemTime + - System_Props_Xml + - TargetDomainName + - TargetSid + - TargetUserName + - Target_Domain + - Target_User_Name + - Task + - ThreadID + - Version + - action + - app + - change_type + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dest_nt_domain + - dvc + - dvc_nt_host + - event_id + - eventtype + - host + - id + - index + - linecount + - name + - object + - object_attrs + - object_category + - object_id + - product + - punct + - result + - session_id + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src_nt_domain + - src_user + - src_user_name + - status + - subject + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - timeendpos + - timestartpos + - user + - user_group + - user_name + - vendor + - vendor_product output_fields: -- dest -example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider - Name="Microsoft-Windows-Security-Auditing" Guid="54849625-5478-4994-A5BA-3E3B0328C30D"></Provider> - <EventID>4723</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode> - <Keywords>0x8010000000000000</Keywords><TimeCreated SystemTime="2026-04-21T17:43:18.298641Z"> - </TimeCreated><EventRecordID>781490</EventRecordID><Correlation ActivityID="9F3364FE-E417-0002-2065-339F17E4DA01"> - </Correlation><Execution ProcessID="724" ThreadID="12596"></Execution><Channel>Security</Channel> - <Computer>WIN10-21H1.strt.labs</Computer><Security></Security></System><EventData> - <Data Name="TargetUserName">Administrator</Data><Data Name="TargetDomainName">WIN10-21H1</Data> - <Data Name="TargetSid">S-1-5-21-1538153195-943065003-848949206-500</Data><Data Name="SubjectUserSid"> - S-1-5-21-1538153195-943065003-848949206-1003</Data><Data Name="SubjectUserName">bob</Data> - <Data Name="SubjectDomainName">WIN10-21H1</Data><Data Name="SubjectLogonId">0x61a292</Data> - <Data Name="PrivilegeList">-</Data></EventData></Event> + - dest +example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-Security-Auditing" Guid="54849625-5478-4994-A5BA-3E3B0328C30D"></Provider> <EventID>4723</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode> <Keywords>0x8010000000000000</Keywords><TimeCreated SystemTime="2026-04-21T17:43:18.298641Z"> </TimeCreated><EventRecordID>781490</EventRecordID><Correlation ActivityID="9F3364FE-E417-0002-2065-339F17E4DA01"> </Correlation><Execution ProcessID="724" ThreadID="12596"></Execution><Channel>Security</Channel> <Computer>WIN10-21H1.strt.labs</Computer><Security></Security></System><EventData> <Data Name="TargetUserName">Administrator</Data><Data Name="TargetDomainName">WIN10-21H1</Data> <Data Name="TargetSid">S-1-5-21-1538153195-943065003-848949206-500</Data><Data Name="SubjectUserSid"> S-1-5-21-1538153195-943065003-848949206-1003</Data><Data Name="SubjectUserName">bob</Data> <Data Name="SubjectDomainName">WIN10-21H1</Data><Data Name="SubjectLogonId">0x61a292</Data> <Data Name="PrivilegeList">-</Data></EventData></Event> diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index 0b06b7823a5..2e1ab15fd58 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -14,7 +14,7 @@ separator_value: '4724' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index ca05c7b8403..4b4a6cb80cd 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -14,7 +14,7 @@ separator_value: '4725' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index 6ddc2aba570..bffa3f61d6e 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -14,7 +14,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 0aa2c2f0b79..087aff4eead 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index bcba79a79d9..0e6346d3b2a 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index 9487a6ac521..06c4b66e669 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index 30f8bc23e81..87ad0bceae3 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index d95f852eb8e..5c7de0fd654 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -14,7 +14,7 @@ separator_value: '4732' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index f128bbfcc42..4c27227db2a 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index fb6f1f3ca8d..9db856f358c 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -14,7 +14,7 @@ separator_value: '4738' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4739.yml b/data_sources/windows_event_log_security_4739.yml index b0f63147034..d055166b557 100644 --- a/data_sources/windows_event_log_security_4739.yml +++ b/data_sources/windows_event_log_security_4739.yml @@ -15,7 +15,7 @@ separator_value: '4739' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index 7b643fb3d0e..eb0238ac908 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -17,7 +17,7 @@ separator_value: '4741' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index eb26156fe93..513872af7e4 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index 216eb54d2c5..eca1bb96094 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index 8b61381edec..37cd80c8007 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index 4dbe460a364..48f80c0979d 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index c53348491fb..8f7b0b077eb 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index 9db0814db32..d8110c1a28d 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 0d954d3b5c3..d11908d257e 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -17,7 +17,7 @@ separator_value: '4768' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index 2b1506eda99..61f7a15c8ed 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -17,7 +17,7 @@ separator_value: '4769' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index 16751ea4ef2..41d424b7e8a 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -17,7 +17,7 @@ separator_value: '4771' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index 408aaa466bb..fd970cd4223 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -17,7 +17,7 @@ separator_value: '4776' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index ed8f3691a80..7e55eadbc38 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -17,7 +17,7 @@ separator_value: '4781' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index 4b239b5056d..b0f7b5fe5c8 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index 8a945e0fe82..301fcb72152 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index 70bae43f05b..222bc3fad39 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -17,7 +17,7 @@ separator_value: supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index 8eebe0e5a94..feb4495106e 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index bdd7735a815..ca4e0c7c95e 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -17,7 +17,7 @@ separator_value: '4876' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index 9379641c7d3..e33210fe213 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -17,7 +17,7 @@ separator_value: '4886' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index 2016e280f63..7646c112a2b 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -17,7 +17,7 @@ separator_value: '4887' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index 2d9e806305f..44ee333e118 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -12,7 +12,7 @@ separator_value: '4946' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index b10ef8870b6..2b0894834e9 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -12,7 +12,7 @@ separator_value: '4947' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index 961be864ee1..67478d0f087 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -12,7 +12,7 @@ separator_value: '4948' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index b2035008e48..ab04793a83e 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -17,7 +17,7 @@ separator_value: '5136' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index 253ce10397d..5340ac3d62a 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -17,7 +17,7 @@ separator_value: '5137' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AppCorrelationID diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index f5f3cf11165..abf49c3db84 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -17,7 +17,7 @@ separator_value: '5140' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index 393098f2884..2a40fdcf81a 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -17,7 +17,7 @@ separator_value: '5141' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index 1647d2e8320..dbdf8114b39 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -17,7 +17,7 @@ separator_value: '5145' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index faea29ccadb..6ccea0b2381 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_system_4720.yml b/data_sources/windows_event_log_system_4720.yml index 49df88f658a..47015e8dd1a 100644 --- a/data_sources/windows_event_log_system_4720.yml +++ b/data_sources/windows_event_log_system_4720.yml @@ -17,7 +17,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4726.yml b/data_sources/windows_event_log_system_4726.yml index 642359a985c..31d4f0ca60e 100644 --- a/data_sources/windows_event_log_system_4726.yml +++ b/data_sources/windows_event_log_system_4726.yml @@ -17,7 +17,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4728.yml b/data_sources/windows_event_log_system_4728.yml index dd3e3849ea5..728e981ba5c 100644 --- a/data_sources/windows_event_log_system_4728.yml +++ b/data_sources/windows_event_log_system_4728.yml @@ -17,7 +17,7 @@ separator_value: '4728' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index 0cf395b1d21..b14cad1c4c6 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -17,7 +17,7 @@ separator_value: '7036' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index 518d67eacf5..552b3d1027c 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -17,7 +17,7 @@ separator_value: '7040' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index a1fda46fe87..95bbb82590d 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -17,7 +17,7 @@ separator_value: '7045' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccountName diff --git a/data_sources/windows_event_log_taskscheduler_200.yml b/data_sources/windows_event_log_taskscheduler_200.yml index e7fe0ff722b..618165e9f75 100644 --- a/data_sources/windows_event_log_taskscheduler_200.yml +++ b/data_sources/windows_event_log_taskscheduler_200.yml @@ -17,7 +17,7 @@ separator_value: '200' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActionName diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index 01ff84004bd..bd708a219d1 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_iis.yml b/data_sources/windows_iis.yml index a3412a3b423..6306f875cae 100644 --- a/data_sources/windows_iis.yml +++ b/data_sources/windows_iis.yml @@ -16,4 +16,4 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 diff --git a/data_sources/windows_iis_29.yml b/data_sources/windows_iis_29.yml index 8c6977fd3a4..85da6122429 100644 --- a/data_sources/windows_iis_29.yml +++ b/data_sources/windows_iis_29.yml @@ -17,7 +17,7 @@ separator_value: '29' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ComputerName From f72a960e7db6fa5e8a43fd50793d230c41880ae2 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Tue, 21 Jul 2026 20:39:27 +0530 Subject: [PATCH 028/162] Update data source TA and install.yml app versions (#4174) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/asl_aws_cloudtrail.yml | 2 +- data_sources/aws_bedrock_claude.yml | 2 +- data_sources/aws_cloudfront.yml | 2 +- data_sources/aws_cloudtrail.yml | 2 +- data_sources/aws_cloudtrail_assumerolewithsaml.yml | 2 +- data_sources/aws_cloudtrail_consolelogin.yml | 2 +- data_sources/aws_cloudtrail_copyobject.yml | 2 +- data_sources/aws_cloudtrail_createaccesskey.yml | 2 +- data_sources/aws_cloudtrail_createkey.yml | 2 +- data_sources/aws_cloudtrail_createloginprofile.yml | 2 +- data_sources/aws_cloudtrail_createnetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_createpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_createsnapshot.yml | 2 +- data_sources/aws_cloudtrail_createtask.yml | 2 +- data_sources/aws_cloudtrail_createvirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deactivatemfadevice.yml | 2 +- data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_deletealarms.yml | 2 +- data_sources/aws_cloudtrail_deletedetector.yml | 2 +- data_sources/aws_cloudtrail_deletegroup.yml | 2 +- data_sources/aws_cloudtrail_deleteguardrail.yml | 2 +- data_sources/aws_cloudtrail_deleteipset.yml | 2 +- data_sources/aws_cloudtrail_deleteknowledgebase.yml | 2 +- data_sources/aws_cloudtrail_deleteloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deleteloggroup.yml | 2 +- data_sources/aws_cloudtrail_deletelogstream.yml | 2 +- ...aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deletenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_deletepolicy.yml | 2 +- data_sources/aws_cloudtrail_deleterule.yml | 2 +- data_sources/aws_cloudtrail_deleterulegroup.yml | 2 +- data_sources/aws_cloudtrail_deletesnapshot.yml | 2 +- data_sources/aws_cloudtrail_deletetrail.yml | 2 +- data_sources/aws_cloudtrail_deletevirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deletewebacl.yml | 2 +- data_sources/aws_cloudtrail_describeeventaggregates.yml | 2 +- data_sources/aws_cloudtrail_describeimagescanfindings.yml | 2 +- data_sources/aws_cloudtrail_describesnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_getobject.yml | 2 +- data_sources/aws_cloudtrail_getpassworddata.yml | 2 +- data_sources/aws_cloudtrail_invokemodel.yml | 2 +- data_sources/aws_cloudtrail_jobcreated.yml | 2 +- data_sources/aws_cloudtrail_listfoundationmodels.yml | 2 +- data_sources/aws_cloudtrail_modifydbinstance.yml | 2 +- data_sources/aws_cloudtrail_modifyimageattribute.yml | 2 +- data_sources/aws_cloudtrail_modifysnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_putbucketacl.yml | 2 +- data_sources/aws_cloudtrail_putbucketlifecycle.yml | 2 +- data_sources/aws_cloudtrail_putbucketreplication.yml | 2 +- data_sources/aws_cloudtrail_putbucketversioning.yml | 2 +- data_sources/aws_cloudtrail_putimage.yml | 2 +- data_sources/aws_cloudtrail_putkeypolicy.yml | 2 +- data_sources/aws_cloudtrail_replacenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_setdefaultpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_stoplogging.yml | 2 +- data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_updateloginprofile.yml | 2 +- data_sources/aws_cloudtrail_updatesamlprovider.yml | 2 +- data_sources/aws_cloudtrail_updatetrail.yml | 2 +- data_sources/aws_cloudwatchlogs_vpcflow.yml | 2 +- data_sources/aws_security_hub.yml | 2 +- data_sources/cisco_secure_access_dns.yml | 2 +- data_sources/cisco_secure_access_firewall.yml | 2 +- data_sources/cisco_secure_access_proxy.yml | 2 +- 65 files changed, 65 insertions(+), 65 deletions(-) diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index c40126191c4..f3328a8bbc4 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -24,7 +24,7 @@ separator: api.operation supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 output_fields: - dest - user diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index bd7fc59c23e..a9511d9d9b8 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -14,7 +14,7 @@ separator_value: ModelInvocationLog supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - accountId diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index dbe9bbafd86..880aef37dd5 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -17,7 +17,7 @@ sourcetype: aws:cloudfront:accesslogs supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index d80e70b1559..fd63339bb3e 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -11,4 +11,4 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 diff --git a/data_sources/aws_cloudtrail_assumerolewithsaml.yml b/data_sources/aws_cloudtrail_assumerolewithsaml.yml index efe8b33ddb7..4c3cbe58786 100644 --- a/data_sources/aws_cloudtrail_assumerolewithsaml.yml +++ b/data_sources/aws_cloudtrail_assumerolewithsaml.yml @@ -18,7 +18,7 @@ separator_value: AssumeRoleWithSAML supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index 47f47f1900b..e73a5fdbfec 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -18,7 +18,7 @@ separator_value: ConsoleLogin supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_copyobject.yml b/data_sources/aws_cloudtrail_copyobject.yml index afce3a4582f..0369aac0266 100644 --- a/data_sources/aws_cloudtrail_copyobject.yml +++ b/data_sources/aws_cloudtrail_copyobject.yml @@ -17,7 +17,7 @@ separator_value: CopyObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index 55fa3c5e41c..b38bd36a870 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -17,7 +17,7 @@ separator_value: CreateAccessKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index a421c797639..d250e861ac7 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -17,7 +17,7 @@ separator_value: CreateKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createloginprofile.yml b/data_sources/aws_cloudtrail_createloginprofile.yml index 3f8eab8b671..63f6d6c21f9 100644 --- a/data_sources/aws_cloudtrail_createloginprofile.yml +++ b/data_sources/aws_cloudtrail_createloginprofile.yml @@ -17,7 +17,7 @@ separator_value: CreateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index 1ad54471486..a18640b7396 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -17,7 +17,7 @@ separator_value: CreateNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index dfd4ba93218..b344919b5bf 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -17,7 +17,7 @@ separator_value: CreatePolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index e2a3e40ce31..f9979ecf7d1 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -17,7 +17,7 @@ separator_value: CreateSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createtask.yml b/data_sources/aws_cloudtrail_createtask.yml index 1a462fcf5dc..b5512900a23 100644 --- a/data_sources/aws_cloudtrail_createtask.yml +++ b/data_sources/aws_cloudtrail_createtask.yml @@ -17,7 +17,7 @@ separator_value: CreateTask supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml index 1dd734b3c2e..e8d99ba572b 100644 --- a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml @@ -17,7 +17,7 @@ separator_value: CreateVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deactivatemfadevice.yml b/data_sources/aws_cloudtrail_deactivatemfadevice.yml index bf04e2a3174..ab7ff1026d3 100644 --- a/data_sources/aws_cloudtrail_deactivatemfadevice.yml +++ b/data_sources/aws_cloudtrail_deactivatemfadevice.yml @@ -17,7 +17,7 @@ separator_value: DeactivateMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml index e08314d0290..40ec3ef5137 100644 --- a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: DeleteAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletealarms.yml b/data_sources/aws_cloudtrail_deletealarms.yml index 44405c5e8b7..1ba2d214ef6 100644 --- a/data_sources/aws_cloudtrail_deletealarms.yml +++ b/data_sources/aws_cloudtrail_deletealarms.yml @@ -17,7 +17,7 @@ separator_value: DeleteAlarms supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index 3d53d8c6c74..703afa31c0c 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -17,7 +17,7 @@ separator_value: DeleteDetector supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index 67d95cdb659..362a3f413c6 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteguardrail.yml b/data_sources/aws_cloudtrail_deleteguardrail.yml index c4f6cc25985..81cf1dd57e6 100644 --- a/data_sources/aws_cloudtrail_deleteguardrail.yml +++ b/data_sources/aws_cloudtrail_deleteguardrail.yml @@ -14,7 +14,7 @@ separator_value: DeleteGuardrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 010c2162c14..ad3e9f70050 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -16,7 +16,7 @@ separator_value: DeleteIPSet supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deleteknowledgebase.yml b/data_sources/aws_cloudtrail_deleteknowledgebase.yml index 8b13e8bdc21..65395481c2c 100644 --- a/data_sources/aws_cloudtrail_deleteknowledgebase.yml +++ b/data_sources/aws_cloudtrail_deleteknowledgebase.yml @@ -14,7 +14,7 @@ separator_value: DeleteKnowledgeBase supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml index 55c95ea4adb..043a0c779f2 100644 --- a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index 3809b00a305..12c0a6eb1b1 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index 7270838ad1f..02b74f50484 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogStream supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml index 614f3fd068f..1c52a641a2c 100644 --- a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml @@ -14,7 +14,7 @@ separator_value: DeleteModelInvocationLoggingConfiguration supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index 6562a321da9..8eab3f8a750 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -16,7 +16,7 @@ separator_value: DeleteNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index 84c522f2f44..fb938e67716 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -15,7 +15,7 @@ separator_value: DeletePolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index 4929e2e883b..7165cf16f24 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -17,7 +17,7 @@ separator_value: DeleteRule supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deleterulegroup.yml b/data_sources/aws_cloudtrail_deleterulegroup.yml index b8105c4862c..52e84b8efbb 100644 --- a/data_sources/aws_cloudtrail_deleterulegroup.yml +++ b/data_sources/aws_cloudtrail_deleterulegroup.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deletesnapshot.yml b/data_sources/aws_cloudtrail_deletesnapshot.yml index c234e022e6f..6fbcecf73d7 100644 --- a/data_sources/aws_cloudtrail_deletesnapshot.yml +++ b/data_sources/aws_cloudtrail_deletesnapshot.yml @@ -17,7 +17,7 @@ separator_value: DeleteSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index e52c960d46a..bba6d810268 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -17,7 +17,7 @@ separator_value: DeleteTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml index abcf17e4385..950a8a1b2f8 100644 --- a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml @@ -15,7 +15,7 @@ separator_value: DeleteVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index c88017ac48e..874c871b8c0 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -15,7 +15,7 @@ separator_value: DeleteWebACL supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_describeeventaggregates.yml b/data_sources/aws_cloudtrail_describeeventaggregates.yml index ee363cb8cd7..627d0ff2de4 100644 --- a/data_sources/aws_cloudtrail_describeeventaggregates.yml +++ b/data_sources/aws_cloudtrail_describeeventaggregates.yml @@ -15,7 +15,7 @@ separator_value: DescribeEventAggregates supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index d19da791f6a..1d7fb02b10d 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -16,7 +16,7 @@ separator_value: DescribeImageScanFindings supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describesnapshotattribute.yml b/data_sources/aws_cloudtrail_describesnapshotattribute.yml index 2346b224943..b49e80f1f8c 100644 --- a/data_sources/aws_cloudtrail_describesnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_describesnapshotattribute.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - action - app diff --git a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml index 38d15654183..05e052adf07 100644 --- a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: GetAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_getobject.yml b/data_sources/aws_cloudtrail_getobject.yml index c39f7ca141b..0c206891b49 100644 --- a/data_sources/aws_cloudtrail_getobject.yml +++ b/data_sources/aws_cloudtrail_getobject.yml @@ -16,7 +16,7 @@ separator_value: GetObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index 060a86c2dcc..d2a7ae0fd73 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -15,7 +15,7 @@ separator_value: GetPasswordData supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_invokemodel.yml b/data_sources/aws_cloudtrail_invokemodel.yml index 924c2c13674..2e646c9b8d1 100644 --- a/data_sources/aws_cloudtrail_invokemodel.yml +++ b/data_sources/aws_cloudtrail_invokemodel.yml @@ -14,7 +14,7 @@ separator_value: InvokeModel supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_jobcreated.yml b/data_sources/aws_cloudtrail_jobcreated.yml index 83b42f84498..1eb10a3089a 100644 --- a/data_sources/aws_cloudtrail_jobcreated.yml +++ b/data_sources/aws_cloudtrail_jobcreated.yml @@ -15,7 +15,7 @@ separator_value: JobCreated supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_listfoundationmodels.yml b/data_sources/aws_cloudtrail_listfoundationmodels.yml index 06a7cd75840..62d2f6d78b8 100644 --- a/data_sources/aws_cloudtrail_listfoundationmodels.yml +++ b/data_sources/aws_cloudtrail_listfoundationmodels.yml @@ -14,7 +14,7 @@ separator_value: ListFoundationModels supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index a6b0eeca89a..8b0a18eb836 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -16,7 +16,7 @@ separator_value: ModifyDBInstance supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index 272e734d135..56005c75341 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -15,7 +15,7 @@ separator_value: ModifyImageAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index afebb51c8f3..8b217dd5831 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -14,7 +14,7 @@ separator_value: ModifySnapshotAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putbucketacl.yml b/data_sources/aws_cloudtrail_putbucketacl.yml index 172b11719d9..42c1c946e84 100644 --- a/data_sources/aws_cloudtrail_putbucketacl.yml +++ b/data_sources/aws_cloudtrail_putbucketacl.yml @@ -15,7 +15,7 @@ separator_value: PutBucketAcl supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index c24c6c24177..ea9ceda6cb2 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -15,7 +15,7 @@ separator_value: PutBucketLifecycle supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketreplication.yml b/data_sources/aws_cloudtrail_putbucketreplication.yml index ac76f2f3559..a10cdd3abb0 100644 --- a/data_sources/aws_cloudtrail_putbucketreplication.yml +++ b/data_sources/aws_cloudtrail_putbucketreplication.yml @@ -14,7 +14,7 @@ separator_value: PutBucketReplication supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketversioning.yml b/data_sources/aws_cloudtrail_putbucketversioning.yml index 9f834c10ceb..43d50753eac 100644 --- a/data_sources/aws_cloudtrail_putbucketversioning.yml +++ b/data_sources/aws_cloudtrail_putbucketversioning.yml @@ -14,7 +14,7 @@ separator_value: PutBucketVersioning supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index 22e54982752..e1ac9e542b5 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -15,7 +15,7 @@ separator_value: PutImage supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 37d43a32860..3d3dbcab74b 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -13,7 +13,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 34e190129c6..7053746645a 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -15,7 +15,7 @@ separator_value: ReplaceNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index c3264444c1c..9f5f3d620df 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -15,7 +15,7 @@ separator_value: SetDefaultPolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index 7858189b110..3edf234121c 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -14,7 +14,7 @@ separator_value: StopLogging supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml index 9790a74d672..026fcfd4698 100644 --- a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: UpdateAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index 2e58b10a336..38503edd37c 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -15,7 +15,7 @@ separator_value: UpdateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatesamlprovider.yml b/data_sources/aws_cloudtrail_updatesamlprovider.yml index 755e03f5082..c0a40b5370a 100644 --- a/data_sources/aws_cloudtrail_updatesamlprovider.yml +++ b/data_sources/aws_cloudtrail_updatesamlprovider.yml @@ -16,7 +16,7 @@ separator_value: UpdateSAMLProvider supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index cd980da8942..a2d19c3b9a6 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -15,7 +15,7 @@ separator_value: UpdateTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - app diff --git a/data_sources/aws_cloudwatchlogs_vpcflow.yml b/data_sources/aws_cloudwatchlogs_vpcflow.yml index eb0cdc7ecfe..fba9a7abdeb 100644 --- a/data_sources/aws_cloudwatchlogs_vpcflow.yml +++ b/data_sources/aws_cloudwatchlogs_vpcflow.yml @@ -12,7 +12,7 @@ source: aws_cloudwatchlogs_vpcflow sourcetype: aws:cloudwatchlogs:vpcflow supported_TA: - name: Splunk Add-on for AWS - version: 8.1.2 + version: 8.2.0 url: https://splunkbase.splunk.com/app/1876 fields: - _raw diff --git a/data_sources/aws_security_hub.yml b/data_sources/aws_security_hub.yml index b2bda6430ed..3d7464278d7 100644 --- a/data_sources/aws_security_hub.yml +++ b/data_sources/aws_security_hub.yml @@ -15,7 +15,7 @@ sourcetype: aws:securityhub:finding supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.0 fields: - _time - AwsAccountId diff --git a/data_sources/cisco_secure_access_dns.yml b/data_sources/cisco_secure_access_dns.yml index f7cacd0c61a..81ad9560349 100644 --- a/data_sources/cisco_secure_access_dns.yml +++ b/data_sources/cisco_secure_access_dns.yml @@ -12,7 +12,7 @@ sourcetype: cisco:cloud_security:dns supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.52 + version: 1.0.53 fields: - RecordType - ReplyCode diff --git a/data_sources/cisco_secure_access_firewall.yml b/data_sources/cisco_secure_access_firewall.yml index ca67175f6f8..d4cd0e777ca 100644 --- a/data_sources/cisco_secure_access_firewall.yml +++ b/data_sources/cisco_secure_access_firewall.yml @@ -10,7 +10,7 @@ sourcetype: cisco:cloud_security:firewall supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.52 + version: 1.0.53 fields: - _time - action diff --git a/data_sources/cisco_secure_access_proxy.yml b/data_sources/cisco_secure_access_proxy.yml index eb63224d007..b49c8c2dfe7 100644 --- a/data_sources/cisco_secure_access_proxy.yml +++ b/data_sources/cisco_secure_access_proxy.yml @@ -12,7 +12,7 @@ sourcetype: cisco:cloud_security:proxy supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.52 + version: 1.0.53 fields: - _time - action From 184982e33ff0306e66e5476e63e3c7cdfe082169 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Wed, 22 Jul 2026 14:15:30 +0530 Subject: [PATCH 029/162] Update data source TA and install.yml app versions (#4179) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- .../ms365_defender_incident_alerts.yml | 2 +- data_sources/ms_defender_atp_alerts.yml | 2 +- .../splunk_common_information_model_(cim).yml | 2 +- install.yml | 82 +++++++++---------- 4 files changed, 44 insertions(+), 44 deletions(-) diff --git a/data_sources/ms365_defender_incident_alerts.yml b/data_sources/ms365_defender_incident_alerts.yml index 7d332351982..5f623dfeac9 100644 --- a/data_sources/ms365_defender_incident_alerts.yml +++ b/data_sources/ms365_defender_incident_alerts.yml @@ -16,7 +16,7 @@ sourcetype: ms365:defender:incident:alerts supported_TA: - name: Splunk Add-on for Microsoft Security url: https://splunkbase.splunk.com/app/6207 - version: 3.0.0 + version: 4.0.0 fields: - actorName - alertId diff --git a/data_sources/ms_defender_atp_alerts.yml b/data_sources/ms_defender_atp_alerts.yml index a38abee6a24..2baf4d980d7 100644 --- a/data_sources/ms_defender_atp_alerts.yml +++ b/data_sources/ms_defender_atp_alerts.yml @@ -16,7 +16,7 @@ sourcetype: ms:defender:atp:alerts supported_TA: - name: Splunk Add-on for Microsoft Security url: https://splunkbase.splunk.com/app/6207 - version: 3.0.0 + version: 4.0.0 fields: - column - accountName diff --git a/data_sources/splunk_common_information_model_(cim).yml b/data_sources/splunk_common_information_model_(cim).yml index f9056852f28..b3be82871fc 100644 --- a/data_sources/splunk_common_information_model_(cim).yml +++ b/data_sources/splunk_common_information_model_(cim).yml @@ -10,4 +10,4 @@ sourcetype: not_applicable supported_TA: - name: Splunk Common Information Model (CIM) url: https://splunkbase.splunk.com/app/1621 - version: 8.5.0 + version: 8.6.0 diff --git a/install.yml b/install.yml index 666032994e1..2b299ead905 100644 --- a/install.yml +++ b/install.yml @@ -1,42 +1,42 @@ apps: - - appid: DA-ESS-ContentUpdate - hardcoded_path: dist/DA-ESS-ContentUpdate.tar.gz - - appid: SplunkEnterpriseSecuritySuite - url: https://splunkbase.splunk.com/app/263 - version: 8.5.1 - - appid: Splunk_TA_microsoft-iis - url: https://splunkbase.splunk.com/app/3185 - version: 2.0.0 - - appid: TA-suricata-4 - url: https://splunkbase.splunk.com/app/4242 - version: 2.3.4 - - appid: Splunk_TA_stream - url: https://splunkbase.splunk.com/app/5238 - version: 8.1.6 - - appid: Splunk_TA_stream_wire_data - url: https://splunkbase.splunk.com/app/5234 - version: 8.1.6 - - appid: TA-Zscaler_CIM - url: https://splunkbase.splunk.com/app/3865 - version: 4.1.5 - - appid: Splunk_TA_aws-kinesis-firehose - url: https://splunkbase.splunk.com/app/3719 - version: 1.3.2 - - appid: Splunk_TA_google-cloudplatform - url: https://splunkbase.splunk.com/app/3088 - version: 5.0.3 - - appid: utbox - url: https://splunkbase.splunk.com/app/2734 - version: 1.9.4 - - appid: SA-admon - url: https://splunkbase.splunk.com/app/6853 - version: 1.1.2 - - appid: TA-crowdstrike-falcon-event-streams - url: https://splunkbase.splunk.com/app/5082 - version: 3.7.2 - - appid: SA-VMWIndex - url: https://splunkbase.splunk.com/app/5640 - version: 4.0.4 - - appid: Splunk_SA_CIM - url: https://splunkbase.splunk.com/app/1621 - version: 8.5.0 + - appid: DA-ESS-ContentUpdate + hardcoded_path: dist/DA-ESS-ContentUpdate.tar.gz + - appid: SplunkEnterpriseSecuritySuite + url: https://splunkbase.splunk.com/app/263 + version: 8.5.1 + - appid: Splunk_TA_microsoft-iis + url: https://splunkbase.splunk.com/app/3185 + version: 2.0.0 + - appid: TA-suricata-4 + url: https://splunkbase.splunk.com/app/4242 + version: 2.3.4 + - appid: Splunk_TA_stream + url: https://splunkbase.splunk.com/app/5238 + version: 8.1.6 + - appid: Splunk_TA_stream_wire_data + url: https://splunkbase.splunk.com/app/5234 + version: 8.1.6 + - appid: TA-Zscaler_CIM + url: https://splunkbase.splunk.com/app/3865 + version: 4.1.5 + - appid: Splunk_TA_aws-kinesis-firehose + url: https://splunkbase.splunk.com/app/3719 + version: 1.3.2 + - appid: Splunk_TA_google-cloudplatform + url: https://splunkbase.splunk.com/app/3088 + version: 5.0.3 + - appid: utbox + url: https://splunkbase.splunk.com/app/2734 + version: 1.9.4 + - appid: SA-admon + url: https://splunkbase.splunk.com/app/6853 + version: 1.1.2 + - appid: TA-crowdstrike-falcon-event-streams + url: https://splunkbase.splunk.com/app/5082 + version: 3.7.2 + - appid: SA-VMWIndex + url: https://splunkbase.splunk.com/app/5640 + version: 4.0.4 + - appid: Splunk_SA_CIM + url: https://splunkbase.splunk.com/app/1621 + version: 8.6.0 From cf465dbe50c1756ab5a4dd75d330f18a9245268a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 08:47:05 +0000 Subject: [PATCH 030/162] Bump actions/labeler from 6 to 7 (#4177) Bumps [actions/labeler](https://github.com/actions/labeler) from 6 to 7. - [Release notes](https://github.com/actions/labeler/releases) - [Commits](https://github.com/actions/labeler/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/labeler dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- .github/workflows/labeler.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index 3dce58e0d55..32893e4b612 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -12,7 +12,7 @@ jobs: - uses: actions/checkout@v7 with: repository: "splunk/security_content" - - uses: actions/labeler@v6 + - uses: actions/labeler@v7 with: sync-labels: true configuration-path: '.github/labeler.yml' \ No newline at end of file From 5847467ad43afe12bc083bb95352cfaafe04d1eb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 08:49:37 +0000 Subject: [PATCH 031/162] Bump actions/setup-go from 6 to 7 (#4176) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6 to 7. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- .github/workflows/yaml-validation.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/yaml-validation.yml b/.github/workflows/yaml-validation.yml index 3ddfdf9435c..fe4aa381c5b 100644 --- a/.github/workflows/yaml-validation.yml +++ b/.github/workflows/yaml-validation.yml @@ -33,7 +33,7 @@ jobs: run: pip install yamllint - name: Set up Go - uses: actions/setup-go@v6 + uses: actions/setup-go@v7 - name: Install yamlfmt run: | From eb6f366201cb409a7aa15014303e4979d211b47e Mon Sep 17 00:00:00 2001 From: Cole Munz <145523609+munzzyy@users.noreply.github.com> Date: Wed, 22 Jul 2026 04:06:22 -0500 Subject: [PATCH 032/162] Fix `Windows Large Number of Computer Service Tickets Requested` (#4147) --------- Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- ..._of_computer_service_tickets_requested.yml | 23 ++++++++++++------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml index bbed89c02d1..a8fed6397c9 100644 --- a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml +++ b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml @@ -1,21 +1,28 @@ name: Windows Large Number of Computer Service Tickets Requested id: 386ad394-c9a7-4b4f-b66f-586252de20f0 -version: 11 +version: 12 creation_date: '2023-03-21' -modification_date: '2026-05-13' +modification_date: '2026-07-05' author: Mauricio Velazco, Splunk status: production type: Anomaly -description: The following analytic detects a high volume of Kerberos service ticket requests, specifically more than 30, from a single source within a 5-minute window. It leverages Event ID 4769, which logs when a Kerberos service ticket is requested, focusing on requests with computer names as the Service Name. This behavior is significant as it may indicate malicious activities such as lateral movement, malware staging, or reconnaissance. If confirmed malicious, an attacker could gain unauthorized access to multiple endpoints, potentially compromising the entire network. +description: |- + The following analytic detects a high volume of Kerberos service ticket requests, specifically more than 30, from a single source within a 5-minute window. + It leverages Event ID 4769, which logs when a Kerberos service ticket is requested, focusing on requests with computer names as the Service Name. This behavior is significant as it may indicate malicious activities such as lateral movement, malware staging, or reconnaissance. + If confirmed malicious, an attacker could gain unauthorized access to multiple endpoints, potentially compromising the entire network. data_source: - Windows Event Log Security 4769 search: |- `wineventlog_security` EventCode=4769 ServiceName="*$" TargetUserName!="*$" - | bucket span=5m _time - | stats dc(ServiceName) AS unique_targets values(ServiceName) as host_targets values(dest) as dest - BY _time, IpAddress, TargetUserName - | where unique_targets > 30 - | `windows_large_number_of_computer_service_tickets_requested_filter` + | eval TargetUserName = mvindex(split(TargetUserName, "@"), 0) + | search NOT TargetUserName="*$" + | bucket span=5m _time + | stats dc(ServiceName) AS unique_targets + values(ServiceName) as host_targets + values(dest) as dest + by _time, IpAddress, TargetUserName + | where unique_targets > 30 + | `windows_large_number_of_computer_service_tickets_requested_filter` how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. known_false_positives: An single endpoint requesting a large number of kerberos service tickets is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, administration systems and missconfigured systems. references: From 40cf30bcbc8981f6a98d36c50705fb1ad954404a Mon Sep 17 00:00:00 2001 From: Br3akp0int <26181693+tccontre@users.noreply.github.com> Date: Fri, 24 Jul 2026 10:59:12 +0200 Subject: [PATCH 033/162] Tag Analytics with Starland RAT Story (#4172) --------- Co-authored-by: Teoderick Contreras <tcontreras@splunk.com> Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- .../detect_mshta_url_in_command_line.yml | 5 +-- ...omain_controller_discovery_with_nltest.yml | 5 +-- ..._or_script_creation_in_suspicious_path.yml | 5 +-- ...hell_process___execution_policy_bypass.yml | 5 +-- .../endpoint/powershell_4104_hunting.yml | 5 +-- .../recon_avproduct_through_pwh_or_wmi.yml | 5 +-- .../registry_keys_used_for_persistence.yml | 5 +-- ...ution_policy_to_unrestricted_or_bypass.yml | 5 +-- ..._autostart_execution_in_startup_folder.yml | 5 +-- ...ndows_curl_download_to_suspicious_path.yml | 5 +-- .../windows_mshta_execution_in_registry.yml | 5 +-- .../windows_powershell_scheduletask.yml | 5 +-- .../windows_suspicious_process_file_path.yml | 5 +-- ...pt_or_cscript_suspicious_child_process.yml | 5 +-- ..._dns_query_request_by_telegram_bot_api.yml | 5 +-- ...ork_info_through_ip_check_web_services.yml | 5 +-- stories/starland_rat_campaign.yml | 34 +++++++++++++++++++ 17 files changed, 82 insertions(+), 32 deletions(-) create mode 100644 stories/starland_rat_campaign.yml diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index 7c6cbdb918f..f497bd613a3 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -1,8 +1,8 @@ name: Detect MSHTA Url in Command Line id: 9b3af1e6-5b68-11eb-ae93-0242ac130002 -version: 20 +version: 21 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Michael Haag, Splunk status: production type: TTP @@ -71,6 +71,7 @@ analytic_story: - XWorm - Cisco Network Visibility Module Analytics - NetSupport RMM Tool Abuse + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1218.005 diff --git a/detections/endpoint/domain_controller_discovery_with_nltest.yml b/detections/endpoint/domain_controller_discovery_with_nltest.yml index 01306e275d0..5e561e1f26e 100644 --- a/detections/endpoint/domain_controller_discovery_with_nltest.yml +++ b/detections/endpoint/domain_controller_discovery_with_nltest.yml @@ -1,8 +1,8 @@ name: Domain Controller Discovery with Nltest id: 41243735-89a7-4c83-bcdd-570aa78f00a1 -version: 13 +version: 14 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Mauricio Velazco, Splunk status: production type: TTP @@ -57,6 +57,7 @@ analytic_story: - BlackSuit Ransomware - Rhysida Ransomware - NetSupport RMM Tool Abuse + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1018 diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index c14be99c02d..e3e6d3cee17 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,8 +1,8 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 -version: 29 +version: 30 creation_date: '2021-05-07' -modification_date: '2026-06-25' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -139,6 +139,7 @@ analytic_story: - Axios Supply Chain Post Compromise - VIP Keylogger - Phantom Stealer + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index fe197452367..2e86d5d3ab1 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -1,8 +1,8 @@ name: Malicious PowerShell Process - Execution Policy Bypass id: 9be56c82-b1cc-4318-87eb-d138afaaca39 -version: 20 +version: 21 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Rico Valdez, Mauricio Velazco, Splunk status: production type: Anomaly @@ -59,6 +59,7 @@ analytic_story: - APT37 Rustonotto and FadeStealer - BlankGrabber Stealer - MuddyWater + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 8428f645ad6..d8fb84f944f 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,8 +1,8 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 -version: 27 +version: 28 creation_date: '2021-08-19' -modification_date: '2026-06-25' +modification_date: '2026-07-20' author: Michael Haag, Splunk status: production type: Hunting @@ -86,6 +86,7 @@ analytic_story: - Axios Supply Chain Post Compromise - Salat Stealer - Phantom Stealer + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index f6900a54ebe..ca0a2fe969e 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -1,8 +1,8 @@ name: Recon AVProduct Through Pwh or WMI id: 28077620-c9f6-11eb-8785-acde48001122 -version: 15 +version: 16 creation_date: '2021-06-14' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: TTP @@ -62,6 +62,7 @@ analytic_story: - MoonPeak - Qakbot - Windows Post-Exploitation + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1592 diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index af50fd3916a..a01367e4256 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,8 +1,8 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -version: 34 +version: 35 creation_date: '2020-04-29' -modification_date: '2026-06-25' +modification_date: '2026-07-20' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk status: production type: TTP @@ -83,6 +83,7 @@ analytic_story: - Axios Supply Chain Post Compromise - Salat Stealer - Phantom Stealer + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1547.001 diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 7e197e0a762..41fe0969e96 100644 --- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -1,8 +1,8 @@ name: Set Default PowerShell Execution Policy To Unrestricted or Bypass id: c2590137-0b08-4985-9ec5-6ae23d92f63d -version: 22 +version: 23 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Steven Dick, Patrick Bareiss, Splunk status: production type: TTP @@ -40,6 +40,7 @@ analytic_story: - Data Destruction - DarkGate Malware - SystemBC + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1059.001 diff --git a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml index 6b3f2e9d5f5..48b60501976 100644 --- a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml +++ b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml @@ -1,8 +1,8 @@ name: Windows Boot or Logon Autostart Execution In Startup Folder id: 99d157cb-923f-4a00-aee9-1f385412146f -version: 16 +version: 17 creation_date: '2023-01-16' -modification_date: '2026-06-25' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -50,6 +50,7 @@ analytic_story: - PromptFlux - BlankGrabber Stealer - Phantom Stealer + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1547.001 diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index 1c539a33dee..1a9ee0ad8df 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -1,8 +1,8 @@ name: Windows Curl Download to Suspicious Path id: c32f091e-30db-11ec-8738-acde48001122 -version: 21 +version: 22 creation_date: '2021-10-19' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -103,6 +103,7 @@ analytic_story: - Ingress Tool Transfer - NPM Supply Chain Compromise - Salt Typhoon + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1105 diff --git a/detections/endpoint/windows_mshta_execution_in_registry.yml b/detections/endpoint/windows_mshta_execution_in_registry.yml index 8ccfe641983..02e4c1ad722 100644 --- a/detections/endpoint/windows_mshta_execution_in_registry.yml +++ b/detections/endpoint/windows_mshta_execution_in_registry.yml @@ -1,8 +1,8 @@ name: Windows Mshta Execution In Registry id: e13ceade-b673-4d34-adc4-4d9c01729753 -version: 12 +version: 13 creation_date: '2022-10-14' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: TTP @@ -52,6 +52,7 @@ intermediate_findings: analytic_story: - Suspicious Windows Registry Activities - Windows Persistence Techniques + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1218.005 diff --git a/detections/endpoint/windows_powershell_scheduletask.yml b/detections/endpoint/windows_powershell_scheduletask.yml index edd80ba30d2..dc161addefa 100644 --- a/detections/endpoint/windows_powershell_scheduletask.yml +++ b/detections/endpoint/windows_powershell_scheduletask.yml @@ -1,8 +1,8 @@ name: Windows PowerShell ScheduleTask id: ddf82fcb-e9ee-40e3-8712-a50b5bf323fc -version: 13 +version: 14 creation_date: '2023-06-12' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Michael Haag, Splunk status: production type: Anomaly @@ -48,6 +48,7 @@ intermediate_findings: analytic_story: - Scheduled Tasks - Scattered Spider + - Starland RAT Campaign asset_type: Endpoint atomic_guid: - af9fd58f-c4ac-4bf2-a9ba-224b71ff25fd diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index 76832167a1b..48ec64c62e9 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,8 +1,8 @@ name: Windows Suspicious Process File Path id: ecddae4e-3d4b-41e2-b3df-e46a88b38521 -version: 26 +version: 27 creation_date: '2021-05-07' -modification_date: '2026-06-25' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: TTP @@ -96,6 +96,7 @@ analytic_story: - VIP Keylogger - RoguePlanet - Phantom Stealer + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1543 diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index 760f524d5fc..f9153f7e79a 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -1,8 +1,8 @@ name: Wscript Or Cscript Suspicious Child Process id: 1f35e1da-267b-11ec-90a9-acde48001122 -version: 16 +version: 17 creation_date: '2021-10-06' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -49,6 +49,7 @@ analytic_story: - MuddyWater - Axios Supply Chain Post Compromise - VIP Keylogger + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1055 diff --git a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml index e4a251deab5..dc872242386 100644 --- a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml +++ b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml @@ -1,8 +1,8 @@ name: Windows DNS Query Request by Telegram Bot API id: 86f66f44-94d9-412d-a71d-5d8ed0fef72e -version: 11 +version: 12 creation_date: '2021-08-03' -modification_date: '2026-06-25' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -46,6 +46,7 @@ analytic_story: - BlankGrabber Stealer - VIP Keylogger - Phantom Stealer + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1071.004 diff --git a/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml b/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml index c950356414c..620ecb56d8f 100644 --- a/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml +++ b/detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml @@ -1,8 +1,8 @@ name: Windows Gather Victim Network Info Through Ip Check Web Services id: 70f7c952-0758-46d6-9148-d8969c4481d1 -version: 21 +version: 22 creation_date: '2022-06-24' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -58,6 +58,7 @@ analytic_story: - Void Manticore - BlankGrabber Stealer - VIP Keylogger + - Starland RAT Campaign asset_type: Endpoint mitre_attack_id: - T1590.005 diff --git a/stories/starland_rat_campaign.yml b/stories/starland_rat_campaign.yml new file mode 100644 index 00000000000..3331d8a6fbb --- /dev/null +++ b/stories/starland_rat_campaign.yml @@ -0,0 +1,34 @@ +name: Starland RAT Campaign +id: 77049a4c-74f0-4ab3-bcb9-9995ad6c0c0f +version: 1 +creation_date: '2026-07-20' +modification_date: '2026-07-20' +author: Teoderick Contreras, Splunk +status: production +description: |- + UAT-11795 is a Russian-speaking, financially motivated threat actor active since at least June 2025 that deploys a novel Python-based remote access trojan named Starland RAT alongside a bespoke PowerShell C2 memory implant called WLDR Agent. + The campaign uses ClickFix social engineering and trojanized software installers mimicking popular tools such as MobaXterm, WebEx, Zoom, and DBeaverCommunity to deliver a multi-stage infection chain. + Starland RAT provides persistent remote access, cryptocurrency wallet enumeration, screenshot capture, and shellcode injection capabilities, while the WLDR Agent provides an encrypted, memory-resident beaconing capability with multi-threaded PowerShell execution. + The actor further supports operations with CastleStealer, a .NET infostealer targeting credentials and crypto wallets, and Remcos RAT as supplemental tooling. + C2 resilience is achieved through a blockchain-anchored fallback mechanism using a Polygon smart contract to store XOR-encrypted backup domains, and Telegram bots for victim notification. +narrative: |- + The infection chain begins when a victim is directed via ClickFix lures to execute a command that downloads and launches a weaponized HTA file through mshta.exe. + The HTA file establishes an initial foothold by writing a Registry Run key for persistence and then fetches a trojanized NSIS installer from an actor-controlled staging domain. + The installer drops a Python loader disguised as a LICENSE.txt file, which XOR-decrypts (key 0xC6) and reflectively executes Starland RAT entirely in memory to minimize on-disk artifacts. + At startup, Starland RAT performs sandbox evasion by comparing system usernames and hostnames against known analysis environments such as WDAGUtilityAccount, Cuckoo, Any.Run, and Joe Sandbox, and verifies the presence of Zone.Identifier alternate data stream markers. + It then collects extensive host reconnaissance including hardware ID derived from the C drive volume serial number, RAM capacity, installed antivirus products, Active Directory membership and domain privilege status, cryptocurrency wallet presence across more than 40 wallet types, and a Base64-encoded screenshot. + This telemetry is transmitted via HTTP POST with XOR and Base64 encoding to primary C2 domains, with polling every 50 to 60 seconds. Should primary infrastructure become unavailable, the implant queries a Polygon smart contract to retrieve XOR-encrypted fallback C2 domains at runtime. + Persistence is established through a randomized scheduled task named PythonLauncher followed by three characters with an AtLogOn trigger, a startup folder LNK shortcut, and the Registry Run key set during initial HTA execution. + At the operator discretion, Starland RAT deploys the WLDR Agent by executing an embedded PowerShell script that beacons to a separate set of staging domains over HTTPS using AES-256-CBC encryption with HMAC-SHA256 authentication and PBKDF2-SHA256 key derivation. + WLDR runs a PowerShell RunspacePool of up to ten concurrent threads, enabling parallelized command execution with real-time output streaming and a mutex guard to prevent duplicate instances. + Telegram bots are used to notify operators of new victim check-ins. + The campaign primarily targets users in the United States and Europe through opportunistic, volume-driven distribution across developer tooling, IT administration, enterprise collaboration, and consumer gaming software categories, with the financial objective of credential and cryptocurrency asset theft. +references: + - https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/ +category: + - Malware +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +usecase: Advanced Threat Detection From 855dea38ebe74f05186e4c2241b319cf29f7cdd9 Mon Sep 17 00:00:00 2001 From: Raven Tait <93157481+RavenTait@users.noreply.github.com> Date: Fri, 24 Jul 2026 11:26:41 -0400 Subject: [PATCH 034/162] CVE 2026 46331 (#4153) * Detections for CVE-2026-46331 linux priv esc * Fix pedit offset * Fix macro filter name * Add host to dest rename * Fix description that went missing * Fix sourcetype * Update detection searches * Updates to search * Add linux_syslog macro --------- Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com> Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- .../linux_apparmor_bypass_via_aaexec.yml | 71 +++++++++++++++++ ..._auditd_possible_setuid_execve_privesc.yml | 79 +++++++++++++++++++ ...binary_launched_process_with_null_argv.yml | 6 +- .../linux_pedit_offset_out_of_bounds.yml | 58 ++++++++++++++ ...lg_registration_outside_of_boot_window.yml | 6 +- macros/linux_syslog.yml | 8 ++ 6 files changed, 222 insertions(+), 6 deletions(-) create mode 100644 detections/endpoint/linux_apparmor_bypass_via_aaexec.yml create mode 100644 detections/endpoint/linux_auditd_possible_setuid_execve_privesc.yml create mode 100644 detections/endpoint/linux_pedit_offset_out_of_bounds.yml create mode 100644 macros/linux_syslog.yml diff --git a/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml b/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml new file mode 100644 index 00000000000..21c54d3be5e --- /dev/null +++ b/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml @@ -0,0 +1,71 @@ +name: Linux Apparmor Bypass Via Aaexec +id: b6d2a2b8-ad52-4a12-8956-dbf10012d1b8 +version: 1 +creation_date: '2026-06-30' +modification_date: '2026-06-30' +author: Raven Tait, Splunk +status: production +type: TTP +description: The following analytic detects aa-exec being used to launch a binary under the trinity, chrome, or flatpak AppArmor profiles where the executed target is not the legitimate application those profiles are intended to confine. This behavior is consistent with abuse of userns,-carrying AppArmor profiles to bypass Ubuntu's unprivileged user namespace restrictions as seen in the CVE-2026-46331 privilege escalation exploit. The analytic flags execution when the target command following -- is invoked via a relative path, resolves outside standard trusted install directories for these applications, or shares the same binary name as the calling parent process. Adversaries and red teams may abuse this technique to escalate privileges by tricking aa-exec into granting a namespace-creation capability to an arbitrary binary rather than the trusted application the profile was written for. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes where + Processes.process_name="*aa-exec" + AND Processes.process="* -p *" + AND Processes.process="*--*" + AND Processes.process IN ("*trinity*","*chrome*","*flatpak*") + AND NOT Processes.process_name IN ("/user*","/opt*","/snap*","/var/lib/flatpak*") + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_apparmor_bypass_via_aaexec_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Chrome, Flatpak, and the trinity profile are never legitimately re-executed with extraneious arguments from a non-browser binary path +references: + - https://github.com/sgkdev/packet_edit_meme + - https://tuxcare.com/blog/pedit-cow-cve/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: AppArmor bypass leveraging aa-exec was observed on $dest$. + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: parent_process_name + type: process +analytic_story: + - Linux Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2026-46331 +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/linux_pedit/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux + test_type: unit diff --git a/detections/endpoint/linux_auditd_possible_setuid_execve_privesc.yml b/detections/endpoint/linux_auditd_possible_setuid_execve_privesc.yml new file mode 100644 index 00000000000..0b55d776075 --- /dev/null +++ b/detections/endpoint/linux_auditd_possible_setuid_execve_privesc.yml @@ -0,0 +1,79 @@ +name: Linux Auditd Possible Setuid Execve Privesc +id: e958e6ee-7c73-4eff-a4d9-43232d719b26 +version: 1 +creation_date: '2026-07-06' +modification_date: '2026-07-06' +author: Raven Tait, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: The following detects privilege escalation via execve (syscall 59) where a process transitions from a non-root uid to euid=0 without a corresponding successful PAM authentication event (USER_AUTH, USER_ACCT, or CRED_ACQ) in the same audit session. Legitimate privilege elevation mechanisms such as sudo, su, and pkexec authenticate through PAM and generate these audit records tied to the session ID before granting elevated privileges. The absence of a matching successful PAM event alongside an effective UID change to root is anomalous and may indicate exploitation of a setuid binary, a kernel vulnerability, or another mechanism used to escalate privileges outside the normal authentication flow. +data_source: + - Linux Auditd Execve +search: >- + `linux_auditd` ( + (type=SYSCALL syscall="59" uid!="0" euid="0") + OR + (type IN ("USER_AUTH","USER_ACCT","CRED_ACQ") res="success") + ) + | eval is_suspicious_exec=if(type="SYSCALL" AND syscall="59" AND uid!="0" AND euid="0", 1, 0) + | eval is_successful_auth=if(type IN ("USER_AUTH","USER_ACCT","CRED_ACQ") AND res="success", 1, 0) + | stats + count(eval(is_suspicious_exec=1)) as exec_count + max(eval(if(is_suspicious_exec=1, _time, null()))) as lastTime + max(is_successful_auth) as has_successful_auth + min(eval(if(is_suspicious_exec=1, _time, null()))) as firstTime + values(eval(if(is_suspicious_exec=1, comm, null()))) as process_name + values(eval(if(is_suspicious_exec=1, euid, null()))) as euid + values(eval(if(is_suspicious_exec=1, exe, null()))) as process_path + values(eval(if(is_suspicious_exec=1, pid, null()))) as pid + values(eval(if(is_suspicious_exec=1, ppid, null()))) as ppid + values(eval(if(is_suspicious_exec=1, uid, null()))) as uid + by host ses + | where exec_count > 0 AND has_successful_auth != 1 + | rename host as dest, ses as session_id + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_auditd_possible_setuid_execve_privesc_filter` +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed. +known_false_positives: Processes with an unset audit session, such as cron jobs, that legitimately drop and reacquire root privileges outside of PAM, may trigger this detection and require filtering. +references: + - https://github.com/sgkdev/packet_edit_meme + - https://tuxcare.com/blog/pedit-cow-cve/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: $process_name$ was launched with euid 0 on [$dest$] without PAM auth. +threat_objects: + - field: process_name + type: process_name +analytic_story: + - Linux Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2026-46331 +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/linux_pedit/linux_auditd.log + source: auditd + sourcetype: auditd + test_type: unit diff --git a/detections/endpoint/linux_binary_launched_process_with_null_argv.yml b/detections/endpoint/linux_binary_launched_process_with_null_argv.yml index 0bde2914925..6b1da8383af 100644 --- a/detections/endpoint/linux_binary_launched_process_with_null_argv.yml +++ b/detections/endpoint/linux_binary_launched_process_with_null_argv.yml @@ -1,8 +1,8 @@ name: Linux Binary Launched Process with Null Argv id: 0085652a-e682-45a2-a40c-5bb68b8f260e -version: 1 +version: 2 creation_date: '2026-05-12' -modification_date: '2026-05-12' +modification_date: '2026-07-17' author: Raven Tait, Splunk status: production type: TTP @@ -11,7 +11,7 @@ description: |- data_source: - Linux Messages Syslog search: | - sourcetype="linux_messages_syslog" "NULL argv" "empty string added" + `linux_syslog` "NULL argv" "empty string added" | rex field=_raw "process '(?<launching_process>[^']+)' launched '(?<launched_process>[^']+)' with NULL argv" | where isnotnull(launching_process) AND isnotnull(launched_process) | stats diff --git a/detections/endpoint/linux_pedit_offset_out_of_bounds.yml b/detections/endpoint/linux_pedit_offset_out_of_bounds.yml new file mode 100644 index 00000000000..b295103b10f --- /dev/null +++ b/detections/endpoint/linux_pedit_offset_out_of_bounds.yml @@ -0,0 +1,58 @@ +name: Linux Pedit Offset Out Of Bounds +id: 749d9bbf-cfa5-42d0-90e0-eb9300f7750a +version: 1 +creation_date: '2026-07-06' +modification_date: '2026-07-06' +author: Raven Tait, Splunk +status: production +type: TTP +description: The following detects a Linux kernel warning message containing "tc action pedit offset" and "out of bounds" logged to syslog, which indicates the act_pedit attempted to write past the bounds of an allocated packet buffer. This condition is associated with CVE-2026-46331, a kernel vulnerability that can be exploited via crafted pedit netlink configurations combined with page cache poisoning to achieve privilege escalation. The presence of this message on a host is a strong indicator that exploitation of this vulnerability, or triggering of the underlying vulnerable code path, has occurred. +data_source: + - Linux Messages Syslog +search: >- + `linux_syslog` "*tc action pedit offset*" "*out of bounds*" + | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime by dest _raw + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_pedit_offset_out_of_bounds_filter` +how_to_implement: To successfully implement this search, you need to have relevant kernel logs ingested with the Splunk Add-On for Unix and Linux (https://splunkbase.splunk.com/app/833). +known_false_positives: This is generated only when the kernel's act_pedit module encounters a write outside the writable SKB region. This never occurs in normal tc pedit usage. +references: + - https://tuxcare.com/blog/pedit-cow-cve/ + - https://github.com/sgkdev/packet_edit_meme +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Out-of-bounds write by act_pedit on $dest$ indicating possible privilege escalation. + entity: + field: dest + type: system + score: 50 +analytic_story: + - Linux Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2026-46331 +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/linux_pedit/syslog.log + source: /var/log/kern + sourcetype: linux_messages_syslog + test_type: unit diff --git a/detections/endpoint/linux_pf_alg_registration_outside_of_boot_window.yml b/detections/endpoint/linux_pf_alg_registration_outside_of_boot_window.yml index 3cf3bd124ae..588b2269fe1 100644 --- a/detections/endpoint/linux_pf_alg_registration_outside_of_boot_window.yml +++ b/detections/endpoint/linux_pf_alg_registration_outside_of_boot_window.yml @@ -1,8 +1,8 @@ name: Linux PF_ALG Registration Outside of Boot Window id: 8a9684ae-52e6-4a57-aea4-8a9f72942564 -version: 1 +version: 2 creation_date: '2026-05-11' -modification_date: '2026-05-11' +modification_date: '2026-07-17' author: Raven Tait, Splunk status: production type: TTP @@ -12,7 +12,7 @@ description: |- data_source: - Linux Messages Syslog search: | - sourcetype="linux_messages_syslog" "NET: Registered PF_ALG protocol family" + `linux_syslog` "NET: Registered PF_ALG protocol family" | rex field=_raw "kernel: \[\s*(?<uptime_seconds>[\d\.]+)\]" | eval uptime_seconds=tonumber(uptime_seconds) | where uptime_seconds > 300 diff --git a/macros/linux_syslog.yml b/macros/linux_syslog.yml new file mode 100644 index 00000000000..947cb06b773 --- /dev/null +++ b/macros/linux_syslog.yml @@ -0,0 +1,8 @@ +name: linux_syslog +id: 8d38dda6-b102-454e-87c4-5ccac5aac591 +version: 1 +creation_date: '2020-07-17' +modification_date: '2026-07-17' +author: Splunk Threat Research Team +description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment. +definition: sourcetype="linux_messages_syslog" From 24d7259ca189e9a7ed547ffa330bbcabf51852fa Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Mon, 27 Jul 2026 00:52:54 -0700 Subject: [PATCH 035/162] Update data source TA and install.yml app versions (#4181) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/asl_aws_cloudtrail.yml | 2 +- data_sources/aws_bedrock_claude.yml | 2 +- data_sources/aws_cloudfront.yml | 2 +- data_sources/aws_cloudtrail.yml | 2 +- data_sources/aws_cloudtrail_assumerolewithsaml.yml | 2 +- data_sources/aws_cloudtrail_consolelogin.yml | 2 +- data_sources/aws_cloudtrail_copyobject.yml | 2 +- data_sources/aws_cloudtrail_createaccesskey.yml | 2 +- data_sources/aws_cloudtrail_createkey.yml | 2 +- data_sources/aws_cloudtrail_createloginprofile.yml | 2 +- data_sources/aws_cloudtrail_createnetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_createpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_createsnapshot.yml | 2 +- data_sources/aws_cloudtrail_createtask.yml | 2 +- data_sources/aws_cloudtrail_createvirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deactivatemfadevice.yml | 2 +- data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_deletealarms.yml | 2 +- data_sources/aws_cloudtrail_deletedetector.yml | 2 +- data_sources/aws_cloudtrail_deletegroup.yml | 2 +- data_sources/aws_cloudtrail_deleteguardrail.yml | 2 +- data_sources/aws_cloudtrail_deleteipset.yml | 2 +- data_sources/aws_cloudtrail_deleteknowledgebase.yml | 2 +- data_sources/aws_cloudtrail_deleteloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deleteloggroup.yml | 2 +- data_sources/aws_cloudtrail_deletelogstream.yml | 2 +- ...aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deletenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_deletepolicy.yml | 2 +- data_sources/aws_cloudtrail_deleterule.yml | 2 +- data_sources/aws_cloudtrail_deleterulegroup.yml | 2 +- data_sources/aws_cloudtrail_deletesnapshot.yml | 2 +- data_sources/aws_cloudtrail_deletetrail.yml | 2 +- data_sources/aws_cloudtrail_deletevirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deletewebacl.yml | 2 +- data_sources/aws_cloudtrail_describeeventaggregates.yml | 2 +- data_sources/aws_cloudtrail_describeimagescanfindings.yml | 2 +- data_sources/aws_cloudtrail_describesnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_getobject.yml | 2 +- data_sources/aws_cloudtrail_getpassworddata.yml | 2 +- data_sources/aws_cloudtrail_invokemodel.yml | 2 +- data_sources/aws_cloudtrail_jobcreated.yml | 2 +- data_sources/aws_cloudtrail_listfoundationmodels.yml | 2 +- data_sources/aws_cloudtrail_modifydbinstance.yml | 2 +- data_sources/aws_cloudtrail_modifyimageattribute.yml | 2 +- data_sources/aws_cloudtrail_modifysnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_putbucketacl.yml | 2 +- data_sources/aws_cloudtrail_putbucketlifecycle.yml | 2 +- data_sources/aws_cloudtrail_putbucketreplication.yml | 2 +- data_sources/aws_cloudtrail_putbucketversioning.yml | 2 +- data_sources/aws_cloudtrail_putimage.yml | 2 +- data_sources/aws_cloudtrail_putkeypolicy.yml | 2 +- data_sources/aws_cloudtrail_replacenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_setdefaultpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_stoplogging.yml | 2 +- data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_updateloginprofile.yml | 2 +- data_sources/aws_cloudtrail_updatesamlprovider.yml | 2 +- data_sources/aws_cloudtrail_updatetrail.yml | 2 +- data_sources/aws_cloudwatchlogs_vpcflow.yml | 2 +- data_sources/aws_security_hub.yml | 2 +- data_sources/azure_active_directory.yml | 2 +- ...e_directory_add_app_role_assignment_to_service_principal.yml | 2 +- data_sources/azure_active_directory_add_member_to_role.yml | 2 +- .../azure_active_directory_add_owner_to_application.yml | 2 +- data_sources/azure_active_directory_add_service_principal.yml | 2 +- data_sources/azure_active_directory_add_unverified_domain.yml | 2 +- data_sources/azure_active_directory_consent_to_application.yml | 2 +- .../azure_active_directory_disable_strong_authentication.yml | 2 +- data_sources/azure_active_directory_enable_account.yml | 2 +- data_sources/azure_active_directory_invite_external_user.yml | 2 +- .../azure_active_directory_microsoftgraphactivitylogs.yml | 2 +- .../azure_active_directory_noninteractiveusersigninlogs.yml | 2 +- .../azure_active_directory_reset_password_(by_admin).yml | 2 +- .../azure_active_directory_set_domain_authentication.yml | 2 +- data_sources/azure_active_directory_sign_in_activity.yml | 2 +- data_sources/azure_active_directory_update_application.yml | 2 +- .../azure_active_directory_update_authorization_policy.yml | 2 +- data_sources/azure_active_directory_update_user.yml | 2 +- .../azure_active_directory_user_registered_security_info.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_account.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_runbook.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_webhook.yml | 2 +- data_sources/azure_monitor_activity.yml | 2 +- data_sources/crowdstrike_falcon_stream_alert.yml | 2 +- data_sources/crowdstrike_processrollup2.yml | 2 +- data_sources/linux_auditd_add_user.yml | 2 +- data_sources/linux_auditd_cwd.yml | 2 +- data_sources/linux_auditd_daemon_abort.yml | 2 +- data_sources/linux_auditd_daemon_end.yml | 2 +- data_sources/linux_auditd_daemon_start.yml | 2 +- data_sources/linux_auditd_execve.yml | 2 +- data_sources/linux_auditd_path.yml | 2 +- data_sources/linux_auditd_proctitle.yml | 2 +- data_sources/linux_auditd_service_stop.yml | 2 +- data_sources/linux_auditd_syscall.yml | 2 +- data_sources/linux_messages_syslog.yml | 2 +- data_sources/linux_secure.yml | 2 +- data_sources/ntlm_operational_8004.yml | 2 +- data_sources/ntlm_operational_8005.yml | 2 +- data_sources/ntlm_operational_8006.yml | 2 +- data_sources/palo_alto_network_threat.yml | 2 +- data_sources/palo_alto_network_traffic.yml | 2 +- data_sources/powershell_script_block_logging_4104.yml | 2 +- data_sources/windows_active_directory_admon.yml | 2 +- data_sources/windows_event_log_application_15457.yml | 2 +- data_sources/windows_event_log_application_17135.yml | 2 +- data_sources/windows_event_log_application_2282.yml | 2 +- data_sources/windows_event_log_application_3000.yml | 2 +- data_sources/windows_event_log_application_8128.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_400.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_854.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_855.yml | 2 +- data_sources/windows_event_log_appxpackaging_171.yml | 2 +- data_sources/windows_event_log_capi2_70.yml | 2 +- data_sources/windows_event_log_capi2_81.yml | 2 +- .../windows_event_log_certificateservicesclient_1007.yml | 2 +- data_sources/windows_event_log_defender_1121.yml | 2 +- data_sources/windows_event_log_defender_1122.yml | 2 +- data_sources/windows_event_log_defender_1125.yml | 2 +- data_sources/windows_event_log_defender_1126.yml | 2 +- data_sources/windows_event_log_defender_1129.yml | 2 +- data_sources/windows_event_log_defender_1131.yml | 2 +- data_sources/windows_event_log_defender_1132.yml | 2 +- data_sources/windows_event_log_defender_1133.yml | 2 +- data_sources/windows_event_log_defender_1134.yml | 2 +- data_sources/windows_event_log_defender_5007.yml | 2 +- data_sources/windows_event_log_printservice_316.yml | 2 +- data_sources/windows_event_log_printservice_4909.yml | 2 +- data_sources/windows_event_log_printservice_808.yml | 2 +- data_sources/windows_event_log_remoteconnectionmanager_1149.yml | 2 +- data_sources/windows_event_log_security_1100.yml | 2 +- data_sources/windows_event_log_security_1102.yml | 2 +- data_sources/windows_event_log_security_4624.yml | 2 +- data_sources/windows_event_log_security_4625.yml | 2 +- data_sources/windows_event_log_security_4627.yml | 2 +- data_sources/windows_event_log_security_4648.yml | 2 +- data_sources/windows_event_log_security_4662.yml | 2 +- data_sources/windows_event_log_security_4663.yml | 2 +- data_sources/windows_event_log_security_4672.yml | 2 +- data_sources/windows_event_log_security_4688.yml | 2 +- data_sources/windows_event_log_security_4698.yml | 2 +- data_sources/windows_event_log_security_4699.yml | 2 +- data_sources/windows_event_log_security_4700.yml | 2 +- data_sources/windows_event_log_security_4702.yml | 2 +- data_sources/windows_event_log_security_4703.yml | 2 +- data_sources/windows_event_log_security_4719.yml | 2 +- data_sources/windows_event_log_security_4720.yml | 2 +- data_sources/windows_event_log_security_4723.yml | 2 +- data_sources/windows_event_log_security_4724.yml | 2 +- data_sources/windows_event_log_security_4725.yml | 2 +- data_sources/windows_event_log_security_4726.yml | 2 +- data_sources/windows_event_log_security_4727.yml | 2 +- data_sources/windows_event_log_security_4728.yml | 2 +- data_sources/windows_event_log_security_4730.yml | 2 +- data_sources/windows_event_log_security_4731.yml | 2 +- data_sources/windows_event_log_security_4732.yml | 2 +- data_sources/windows_event_log_security_4737.yml | 2 +- data_sources/windows_event_log_security_4738.yml | 2 +- data_sources/windows_event_log_security_4739.yml | 2 +- data_sources/windows_event_log_security_4741.yml | 2 +- data_sources/windows_event_log_security_4742.yml | 2 +- data_sources/windows_event_log_security_4744.yml | 2 +- data_sources/windows_event_log_security_4749.yml | 2 +- data_sources/windows_event_log_security_4754.yml | 2 +- data_sources/windows_event_log_security_4756.yml | 2 +- data_sources/windows_event_log_security_4759.yml | 2 +- data_sources/windows_event_log_security_4768.yml | 2 +- data_sources/windows_event_log_security_4769.yml | 2 +- data_sources/windows_event_log_security_4771.yml | 2 +- data_sources/windows_event_log_security_4776.yml | 2 +- data_sources/windows_event_log_security_4781.yml | 2 +- data_sources/windows_event_log_security_4783.yml | 2 +- data_sources/windows_event_log_security_4790.yml | 2 +- data_sources/windows_event_log_security_4794.yml | 2 +- data_sources/windows_event_log_security_4798.yml | 2 +- data_sources/windows_event_log_security_4876.yml | 2 +- data_sources/windows_event_log_security_4886.yml | 2 +- data_sources/windows_event_log_security_4887.yml | 2 +- data_sources/windows_event_log_security_4946.yml | 2 +- data_sources/windows_event_log_security_4947.yml | 2 +- data_sources/windows_event_log_security_4948.yml | 2 +- data_sources/windows_event_log_security_5136.yml | 2 +- data_sources/windows_event_log_security_5137.yml | 2 +- data_sources/windows_event_log_security_5140.yml | 2 +- data_sources/windows_event_log_security_5141.yml | 2 +- data_sources/windows_event_log_security_5145.yml | 2 +- data_sources/windows_event_log_system_104.yml | 2 +- data_sources/windows_event_log_system_4720.yml | 2 +- data_sources/windows_event_log_system_4726.yml | 2 +- data_sources/windows_event_log_system_4728.yml | 2 +- data_sources/windows_event_log_system_7036.yml | 2 +- data_sources/windows_event_log_system_7040.yml | 2 +- data_sources/windows_event_log_system_7045.yml | 2 +- data_sources/windows_event_log_taskscheduler_200.yml | 2 +- data_sources/windows_event_log_taskscheduler_201.yml | 2 +- data_sources/windows_iis.yml | 2 +- data_sources/windows_iis_29.yml | 2 +- 199 files changed, 199 insertions(+), 199 deletions(-) diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index f3328a8bbc4..c40126191c4 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -24,7 +24,7 @@ separator: api.operation supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 output_fields: - dest - user diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index a9511d9d9b8..bd7fc59c23e 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -14,7 +14,7 @@ separator_value: ModelInvocationLog supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - accountId diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index 880aef37dd5..dbe9bbafd86 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -17,7 +17,7 @@ sourcetype: aws:cloudfront:accesslogs supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index fd63339bb3e..d80e70b1559 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -11,4 +11,4 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 diff --git a/data_sources/aws_cloudtrail_assumerolewithsaml.yml b/data_sources/aws_cloudtrail_assumerolewithsaml.yml index 4c3cbe58786..efe8b33ddb7 100644 --- a/data_sources/aws_cloudtrail_assumerolewithsaml.yml +++ b/data_sources/aws_cloudtrail_assumerolewithsaml.yml @@ -18,7 +18,7 @@ separator_value: AssumeRoleWithSAML supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index e73a5fdbfec..47f47f1900b 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -18,7 +18,7 @@ separator_value: ConsoleLogin supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_copyobject.yml b/data_sources/aws_cloudtrail_copyobject.yml index 0369aac0266..afce3a4582f 100644 --- a/data_sources/aws_cloudtrail_copyobject.yml +++ b/data_sources/aws_cloudtrail_copyobject.yml @@ -17,7 +17,7 @@ separator_value: CopyObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index b38bd36a870..55fa3c5e41c 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -17,7 +17,7 @@ separator_value: CreateAccessKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index d250e861ac7..a421c797639 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -17,7 +17,7 @@ separator_value: CreateKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createloginprofile.yml b/data_sources/aws_cloudtrail_createloginprofile.yml index 63f6d6c21f9..3f8eab8b671 100644 --- a/data_sources/aws_cloudtrail_createloginprofile.yml +++ b/data_sources/aws_cloudtrail_createloginprofile.yml @@ -17,7 +17,7 @@ separator_value: CreateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index a18640b7396..1ad54471486 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -17,7 +17,7 @@ separator_value: CreateNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index b344919b5bf..dfd4ba93218 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -17,7 +17,7 @@ separator_value: CreatePolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index f9979ecf7d1..e2a3e40ce31 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -17,7 +17,7 @@ separator_value: CreateSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createtask.yml b/data_sources/aws_cloudtrail_createtask.yml index b5512900a23..1a462fcf5dc 100644 --- a/data_sources/aws_cloudtrail_createtask.yml +++ b/data_sources/aws_cloudtrail_createtask.yml @@ -17,7 +17,7 @@ separator_value: CreateTask supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml index e8d99ba572b..1dd734b3c2e 100644 --- a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml @@ -17,7 +17,7 @@ separator_value: CreateVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deactivatemfadevice.yml b/data_sources/aws_cloudtrail_deactivatemfadevice.yml index ab7ff1026d3..bf04e2a3174 100644 --- a/data_sources/aws_cloudtrail_deactivatemfadevice.yml +++ b/data_sources/aws_cloudtrail_deactivatemfadevice.yml @@ -17,7 +17,7 @@ separator_value: DeactivateMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml index 40ec3ef5137..e08314d0290 100644 --- a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: DeleteAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletealarms.yml b/data_sources/aws_cloudtrail_deletealarms.yml index 1ba2d214ef6..44405c5e8b7 100644 --- a/data_sources/aws_cloudtrail_deletealarms.yml +++ b/data_sources/aws_cloudtrail_deletealarms.yml @@ -17,7 +17,7 @@ separator_value: DeleteAlarms supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index 703afa31c0c..3d53d8c6c74 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -17,7 +17,7 @@ separator_value: DeleteDetector supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index 362a3f413c6..67d95cdb659 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteguardrail.yml b/data_sources/aws_cloudtrail_deleteguardrail.yml index 81cf1dd57e6..c4f6cc25985 100644 --- a/data_sources/aws_cloudtrail_deleteguardrail.yml +++ b/data_sources/aws_cloudtrail_deleteguardrail.yml @@ -14,7 +14,7 @@ separator_value: DeleteGuardrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index ad3e9f70050..010c2162c14 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -16,7 +16,7 @@ separator_value: DeleteIPSet supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deleteknowledgebase.yml b/data_sources/aws_cloudtrail_deleteknowledgebase.yml index 65395481c2c..8b13e8bdc21 100644 --- a/data_sources/aws_cloudtrail_deleteknowledgebase.yml +++ b/data_sources/aws_cloudtrail_deleteknowledgebase.yml @@ -14,7 +14,7 @@ separator_value: DeleteKnowledgeBase supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml index 043a0c779f2..55c95ea4adb 100644 --- a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index 12c0a6eb1b1..3809b00a305 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index 02b74f50484..7270838ad1f 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogStream supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml index 1c52a641a2c..614f3fd068f 100644 --- a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml @@ -14,7 +14,7 @@ separator_value: DeleteModelInvocationLoggingConfiguration supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index 8eab3f8a750..6562a321da9 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -16,7 +16,7 @@ separator_value: DeleteNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index fb938e67716..84c522f2f44 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -15,7 +15,7 @@ separator_value: DeletePolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index 7165cf16f24..4929e2e883b 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -17,7 +17,7 @@ separator_value: DeleteRule supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deleterulegroup.yml b/data_sources/aws_cloudtrail_deleterulegroup.yml index 52e84b8efbb..b8105c4862c 100644 --- a/data_sources/aws_cloudtrail_deleterulegroup.yml +++ b/data_sources/aws_cloudtrail_deleterulegroup.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deletesnapshot.yml b/data_sources/aws_cloudtrail_deletesnapshot.yml index 6fbcecf73d7..c234e022e6f 100644 --- a/data_sources/aws_cloudtrail_deletesnapshot.yml +++ b/data_sources/aws_cloudtrail_deletesnapshot.yml @@ -17,7 +17,7 @@ separator_value: DeleteSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index bba6d810268..e52c960d46a 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -17,7 +17,7 @@ separator_value: DeleteTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml index 950a8a1b2f8..abcf17e4385 100644 --- a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml @@ -15,7 +15,7 @@ separator_value: DeleteVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index 874c871b8c0..c88017ac48e 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -15,7 +15,7 @@ separator_value: DeleteWebACL supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_describeeventaggregates.yml b/data_sources/aws_cloudtrail_describeeventaggregates.yml index 627d0ff2de4..ee363cb8cd7 100644 --- a/data_sources/aws_cloudtrail_describeeventaggregates.yml +++ b/data_sources/aws_cloudtrail_describeeventaggregates.yml @@ -15,7 +15,7 @@ separator_value: DescribeEventAggregates supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index 1d7fb02b10d..d19da791f6a 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -16,7 +16,7 @@ separator_value: DescribeImageScanFindings supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describesnapshotattribute.yml b/data_sources/aws_cloudtrail_describesnapshotattribute.yml index b49e80f1f8c..2346b224943 100644 --- a/data_sources/aws_cloudtrail_describesnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_describesnapshotattribute.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - action - app diff --git a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml index 05e052adf07..38d15654183 100644 --- a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: GetAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_getobject.yml b/data_sources/aws_cloudtrail_getobject.yml index 0c206891b49..c39f7ca141b 100644 --- a/data_sources/aws_cloudtrail_getobject.yml +++ b/data_sources/aws_cloudtrail_getobject.yml @@ -16,7 +16,7 @@ separator_value: GetObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index d2a7ae0fd73..060a86c2dcc 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -15,7 +15,7 @@ separator_value: GetPasswordData supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_invokemodel.yml b/data_sources/aws_cloudtrail_invokemodel.yml index 2e646c9b8d1..924c2c13674 100644 --- a/data_sources/aws_cloudtrail_invokemodel.yml +++ b/data_sources/aws_cloudtrail_invokemodel.yml @@ -14,7 +14,7 @@ separator_value: InvokeModel supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_jobcreated.yml b/data_sources/aws_cloudtrail_jobcreated.yml index 1eb10a3089a..83b42f84498 100644 --- a/data_sources/aws_cloudtrail_jobcreated.yml +++ b/data_sources/aws_cloudtrail_jobcreated.yml @@ -15,7 +15,7 @@ separator_value: JobCreated supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_listfoundationmodels.yml b/data_sources/aws_cloudtrail_listfoundationmodels.yml index 62d2f6d78b8..06a7cd75840 100644 --- a/data_sources/aws_cloudtrail_listfoundationmodels.yml +++ b/data_sources/aws_cloudtrail_listfoundationmodels.yml @@ -14,7 +14,7 @@ separator_value: ListFoundationModels supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index 8b0a18eb836..a6b0eeca89a 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -16,7 +16,7 @@ separator_value: ModifyDBInstance supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index 56005c75341..272e734d135 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -15,7 +15,7 @@ separator_value: ModifyImageAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index 8b217dd5831..afebb51c8f3 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -14,7 +14,7 @@ separator_value: ModifySnapshotAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putbucketacl.yml b/data_sources/aws_cloudtrail_putbucketacl.yml index 42c1c946e84..172b11719d9 100644 --- a/data_sources/aws_cloudtrail_putbucketacl.yml +++ b/data_sources/aws_cloudtrail_putbucketacl.yml @@ -15,7 +15,7 @@ separator_value: PutBucketAcl supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index ea9ceda6cb2..c24c6c24177 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -15,7 +15,7 @@ separator_value: PutBucketLifecycle supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketreplication.yml b/data_sources/aws_cloudtrail_putbucketreplication.yml index a10cdd3abb0..ac76f2f3559 100644 --- a/data_sources/aws_cloudtrail_putbucketreplication.yml +++ b/data_sources/aws_cloudtrail_putbucketreplication.yml @@ -14,7 +14,7 @@ separator_value: PutBucketReplication supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketversioning.yml b/data_sources/aws_cloudtrail_putbucketversioning.yml index 43d50753eac..9f834c10ceb 100644 --- a/data_sources/aws_cloudtrail_putbucketversioning.yml +++ b/data_sources/aws_cloudtrail_putbucketversioning.yml @@ -14,7 +14,7 @@ separator_value: PutBucketVersioning supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index e1ac9e542b5..22e54982752 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -15,7 +15,7 @@ separator_value: PutImage supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 3d3dbcab74b..37d43a32860 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -13,7 +13,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 7053746645a..34e190129c6 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -15,7 +15,7 @@ separator_value: ReplaceNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index 9f5f3d620df..c3264444c1c 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -15,7 +15,7 @@ separator_value: SetDefaultPolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index 3edf234121c..7858189b110 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -14,7 +14,7 @@ separator_value: StopLogging supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml index 026fcfd4698..9790a74d672 100644 --- a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: UpdateAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index 38503edd37c..2e58b10a336 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -15,7 +15,7 @@ separator_value: UpdateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatesamlprovider.yml b/data_sources/aws_cloudtrail_updatesamlprovider.yml index c0a40b5370a..755e03f5082 100644 --- a/data_sources/aws_cloudtrail_updatesamlprovider.yml +++ b/data_sources/aws_cloudtrail_updatesamlprovider.yml @@ -16,7 +16,7 @@ separator_value: UpdateSAMLProvider supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index a2d19c3b9a6..cd980da8942 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -15,7 +15,7 @@ separator_value: UpdateTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - app diff --git a/data_sources/aws_cloudwatchlogs_vpcflow.yml b/data_sources/aws_cloudwatchlogs_vpcflow.yml index fba9a7abdeb..eb0cdc7ecfe 100644 --- a/data_sources/aws_cloudwatchlogs_vpcflow.yml +++ b/data_sources/aws_cloudwatchlogs_vpcflow.yml @@ -12,7 +12,7 @@ source: aws_cloudwatchlogs_vpcflow sourcetype: aws:cloudwatchlogs:vpcflow supported_TA: - name: Splunk Add-on for AWS - version: 8.2.0 + version: 8.1.2 url: https://splunkbase.splunk.com/app/1876 fields: - _raw diff --git a/data_sources/aws_security_hub.yml b/data_sources/aws_security_hub.yml index 3d7464278d7..b2bda6430ed 100644 --- a/data_sources/aws_security_hub.yml +++ b/data_sources/aws_security_hub.yml @@ -15,7 +15,7 @@ sourcetype: aws:securityhub:finding supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.0 + version: 8.1.2 fields: - _time - AwsAccountId diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index a0a25326112..4b353862ea1 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 output_fields: - dest - user diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index d4c45e3cb94..182d512dca2 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index 964ffd4bf8f..5031b5cd33a 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -17,7 +17,7 @@ separator_value: Add member to role supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index d5efa8b2be6..f0c01197f68 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -17,7 +17,7 @@ separator_value: Add owner to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index d15f4e61098..c5e2c3a4e56 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index eb4f327ebe5..7b4411afbdb 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -17,7 +17,7 @@ separator_value: Add unverified domain supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 6bb5aac90c4..1461a8eaa69 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -17,7 +17,7 @@ separator_value: Consent to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index f863f7d3590..177b30e2127 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -16,7 +16,7 @@ separator_value: Disable Strong Authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 26056aaaf7e..b7fd87116ed 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -16,7 +16,7 @@ separator_value: Enable account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index a31f829e9c9..22983a3d9f6 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -16,7 +16,7 @@ separator_value: Invite external user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml index 9e8af8668d6..65cb093d4f0 100644 --- a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml +++ b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}' diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml index 16df9735105..8c5adbf8ae6 100644 --- a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml +++ b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - action - additional_details diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index 2db4d47a9c6..da60f90a288 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -16,7 +16,7 @@ separator_value: Reset password (by admin) supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 1689413757e..9a0c666f201 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -16,7 +16,7 @@ separator_value: Set domain authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index 831876c4131..d6888c0deeb 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -16,7 +16,7 @@ separator_value: Sign-in activity supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index cbf230589f8..b0ae6b37c94 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -16,7 +16,7 @@ separator_value: Update application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index b98d46e5e21..7a086791e4d 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -16,7 +16,7 @@ separator_value: Update authorization policy supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index 56e530b66f4..f0ca04a229a 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -15,7 +15,7 @@ separator_value: Update user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index aaba9d6bf06..ce39762a767 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -15,7 +15,7 @@ separator_value: User registered security info supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - Level diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index fdb84eb9cbc..fb083554f3f 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 8098881c4d6..1c61b96dac4 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation Runbook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index 17812205b67..c1d309bda95 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation webhook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - _time - authorization.action diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index 6f196a610af..5b89633bdb8 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.0 + version: 6.1.3 fields: - column - action diff --git a/data_sources/crowdstrike_falcon_stream_alert.yml b/data_sources/crowdstrike_falcon_stream_alert.yml index 9132278b027..dceb6eef93c 100644 --- a/data_sources/crowdstrike_falcon_stream_alert.yml +++ b/data_sources/crowdstrike_falcon_stream_alert.yml @@ -17,7 +17,7 @@ separator: event.DetectName supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 3.1.1 + version: 3.0.0 fields: - action - description diff --git a/data_sources/crowdstrike_processrollup2.yml b/data_sources/crowdstrike_processrollup2.yml index d2f90cb5cf8..24d29df9598 100644 --- a/data_sources/crowdstrike_processrollup2.yml +++ b/data_sources/crowdstrike_processrollup2.yml @@ -18,7 +18,7 @@ separator_value: ProcessRollup2 supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 3.1.1 + version: 3.0.0 fields: - AuthenticationId - AuthenticationId_meaning diff --git a/data_sources/linux_auditd_add_user.yml b/data_sources/linux_auditd_add_user.yml index cf1a8a10f02..164e9aefb75 100644 --- a/data_sources/linux_auditd_add_user.yml +++ b/data_sources/linux_auditd_add_user.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - msg - type diff --git a/data_sources/linux_auditd_cwd.yml b/data_sources/linux_auditd_cwd.yml index bb4692329a9..afbe0ec7015 100644 --- a/data_sources/linux_auditd_cwd.yml +++ b/data_sources/linux_auditd_cwd.yml @@ -13,7 +13,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - cwd - date_hour diff --git a/data_sources/linux_auditd_daemon_abort.yml b/data_sources/linux_auditd_daemon_abort.yml index f82333876b8..9b83e49dc16 100644 --- a/data_sources/linux_auditd_daemon_abort.yml +++ b/data_sources/linux_auditd_daemon_abort.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_end.yml b/data_sources/linux_auditd_daemon_end.yml index bdca049e910..f7b4fcf4ddf 100644 --- a/data_sources/linux_auditd_daemon_end.yml +++ b/data_sources/linux_auditd_daemon_end.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_start.yml b/data_sources/linux_auditd_daemon_start.yml index 5b58a4785a9..9f96075a6ea 100644 --- a/data_sources/linux_auditd_daemon_start.yml +++ b/data_sources/linux_auditd_daemon_start.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - type - op diff --git a/data_sources/linux_auditd_execve.yml b/data_sources/linux_auditd_execve.yml index ed4e76f9939..1d5c0398779 100644 --- a/data_sources/linux_auditd_execve.yml +++ b/data_sources/linux_auditd_execve.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - msg - type diff --git a/data_sources/linux_auditd_path.yml b/data_sources/linux_auditd_path.yml index 64f681c8dcc..6f0953cec07 100644 --- a/data_sources/linux_auditd_path.yml +++ b/data_sources/linux_auditd_path.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - msg - type diff --git a/data_sources/linux_auditd_proctitle.yml b/data_sources/linux_auditd_proctitle.yml index 842bd990484..44e2a8935b4 100644 --- a/data_sources/linux_auditd_proctitle.yml +++ b/data_sources/linux_auditd_proctitle.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - proctitle - msg diff --git a/data_sources/linux_auditd_service_stop.yml b/data_sources/linux_auditd_service_stop.yml index 02f1314857a..1db5103e145 100644 --- a/data_sources/linux_auditd_service_stop.yml +++ b/data_sources/linux_auditd_service_stop.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - msg - type diff --git a/data_sources/linux_auditd_syscall.yml b/data_sources/linux_auditd_syscall.yml index c385210b040..b5d9647033d 100644 --- a/data_sources/linux_auditd_syscall.yml +++ b/data_sources/linux_auditd_syscall.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - msg - type diff --git a/data_sources/linux_messages_syslog.yml b/data_sources/linux_messages_syslog.yml index c84136000d4..4990b9710dc 100644 --- a/data_sources/linux_messages_syslog.yml +++ b/data_sources/linux_messages_syslog.yml @@ -15,7 +15,7 @@ sourcetype: linux_messages_syslog supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - _time - action diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index 56434973a9a..b8dd8ae5ba5 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -16,7 +16,7 @@ sourcetype: linux_secure supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.1 + version: 10.2.0 fields: - _time - action diff --git a/data_sources/ntlm_operational_8004.yml b/data_sources/ntlm_operational_8004.yml index 7b095e9329f..141ebdf0def 100644 --- a/data_sources/ntlm_operational_8004.yml +++ b/data_sources/ntlm_operational_8004.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8005.yml b/data_sources/ntlm_operational_8005.yml index b6673df5349..da24c4688cc 100644 --- a/data_sources/ntlm_operational_8005.yml +++ b/data_sources/ntlm_operational_8005.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8006.yml b/data_sources/ntlm_operational_8006.yml index 12a1f1dc033..e4ec349eb57 100644 --- a/data_sources/ntlm_operational_8006.yml +++ b/data_sources/ntlm_operational_8006.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/palo_alto_network_threat.yml b/data_sources/palo_alto_network_threat.yml index 7ed3330faab..b83bd67d0b4 100644 --- a/data_sources/palo_alto_network_threat.yml +++ b/data_sources/palo_alto_network_threat.yml @@ -16,7 +16,7 @@ sourcetype: pan:threat supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.2.1 + version: 3.1.0 fields: - _time - date_hour diff --git a/data_sources/palo_alto_network_traffic.yml b/data_sources/palo_alto_network_traffic.yml index 0f6d642ea8f..00e9798ece8 100644 --- a/data_sources/palo_alto_network_traffic.yml +++ b/data_sources/palo_alto_network_traffic.yml @@ -16,7 +16,7 @@ sourcetype: pan:traffic supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.2.1 + version: 3.1.0 fields: - _time - date_hour diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 394ee4689ea..6a20ab81289 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -18,7 +18,7 @@ separator_value: '4104' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index 10f397dfe8d..7e1ec4fde71 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -16,7 +16,7 @@ sourcetype: ActiveDirectory supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Guid diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index 1134642e1e7..4ef6ecee000 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_17135.yml b/data_sources/windows_event_log_application_17135.yml index c819d61225f..fb960b1d426 100644 --- a/data_sources/windows_event_log_application_17135.yml +++ b/data_sources/windows_event_log_application_17135.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index 0dc7ec73433..9107707eaf1 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index 25989597c48..a98f34690b7 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -17,7 +17,7 @@ separator_value: '3000' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index 8b97db57963..b45b9b50fa1 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index 954960673c7..869197ab810 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index e1fed6202ad..792a15ebbca 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index fd04a038710..22e3b717253 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index e015fea4683..00920b4b372 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_capi2_70.yml b/data_sources/windows_event_log_capi2_70.yml index cea7a04b897..2701795166b 100644 --- a/data_sources/windows_event_log_capi2_70.yml +++ b/data_sources/windows_event_log_capi2_70.yml @@ -18,7 +18,7 @@ separator_value: '70' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_capi2_81.yml b/data_sources/windows_event_log_capi2_81.yml index d190dd24f61..f4e77710235 100644 --- a/data_sources/windows_event_log_capi2_81.yml +++ b/data_sources/windows_event_log_capi2_81.yml @@ -18,7 +18,7 @@ separator_value: '81' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_certificateservicesclient_1007.yml b/data_sources/windows_event_log_certificateservicesclient_1007.yml index 44dbde3791e..14d92e22a74 100644 --- a/data_sources/windows_event_log_certificateservicesclient_1007.yml +++ b/data_sources/windows_event_log_certificateservicesclient_1007.yml @@ -18,7 +18,7 @@ separator_value: '1007' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index cf58df9f882..011347afb2d 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -16,7 +16,7 @@ separator_value: '1121' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index 24794c93170..9c97a01efe2 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -16,7 +16,7 @@ separator_value: '1122' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index e24a33ffc0d..77928d82739 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Windows Defender' Guid='{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}'/><EventID>1122</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2023-11-26T23:43:08.7101401Z'/><EventRecordID>3701</EventRecordID><Correlation ActivityID='{b68511a1-ec5f-4bc7-a9bb-2bd601338de2}'/><Execution ProcessID='3512' ThreadID='5936'/><Channel>Microsoft-Windows-Windows Defender/Operational</Channel><Computer>researchvmhaa</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='Product Name'>Microsoft Defender Antivirus</Data><Data Name='Product Version'>4.18.23100.2009</Data><Data Name='Unused'></Data><Data Name='ID'>E6DB77E5-3DF2-4CF1-B95A-636979351E5B</Data><Data Name='Detection Time'>2023-11-26T23:43:08.709Z</Data><Data Name='User'>(unknown user)</Data><Data Name='Path'></Data><Data Name='Process Name'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Security intelligence Version'>1.401.1247.0</Data><Data Name='Engine Version'>1.1.23100.2009</Data><Data Name='RuleType'>ENT\ConsR</Data><Data Name='Target Commandline'></Data><Data Name='Parent Commandline'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Involved File'></Data><Data Name='Inhertiance Flags'>0x00000000</Data></EventData></Event> diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index 50358cbb4af..b0b5c2cef02 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index 4d880bdfc9d..8d9767ba9c3 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -16,7 +16,7 @@ separator_value: '1129' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index 7ce4f4f10b6..7b59c9cd6b4 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index d9c500e81b4..1a813f46f96 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 052c42d3543..88cb4531d36 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index 7ca20f0675a..3b54c95906d 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 0d27f6ebcd5..882e7a7bd03 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -14,7 +14,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_printservice_316.yml b/data_sources/windows_event_log_printservice_316.yml index 6d6662b2718..257bd4a5d48 100644 --- a/data_sources/windows_event_log_printservice_316.yml +++ b/data_sources/windows_event_log_printservice_316.yml @@ -15,7 +15,7 @@ separator_value: '316' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_printservice_4909.yml b/data_sources/windows_event_log_printservice_4909.yml index 492b6118b02..529620eb608 100644 --- a/data_sources/windows_event_log_printservice_4909.yml +++ b/data_sources/windows_event_log_printservice_4909.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time example_log: '' diff --git a/data_sources/windows_event_log_printservice_808.yml b/data_sources/windows_event_log_printservice_808.yml index eaa8668f29b..d952de1f7e3 100644 --- a/data_sources/windows_event_log_printservice_808.yml +++ b/data_sources/windows_event_log_printservice_808.yml @@ -16,7 +16,7 @@ separator_value: '808' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml index dbff470f19b..6bd7d957fcd 100644 --- a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml +++ b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml @@ -16,7 +16,7 @@ separator_value: '1149' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 95c41e545df..3dbf23664f3 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -15,7 +15,7 @@ separator_value: '1100' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index 90fec45a0ad..8586c6984d8 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -16,7 +16,7 @@ separator_value: '1102' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index a19e1744459..3971f62bfc7 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -16,7 +16,7 @@ separator_value: '4624' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index 094b017f2f4..28e5d9feada 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -15,7 +15,7 @@ separator_value: '4625' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4627.yml b/data_sources/windows_event_log_security_4627.yml index 92817c9c7d0..e8c1fb0efbe 100644 --- a/data_sources/windows_event_log_security_4627.yml +++ b/data_sources/windows_event_log_security_4627.yml @@ -16,7 +16,7 @@ separator_value: '4627' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index aef95a07361..6b8fa7d8291 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -15,7 +15,7 @@ separator_value: '4648' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index 2aee0b516cb..c0dc0121e46 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -15,7 +15,7 @@ separator_value: '4662' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index a4b77b42f42..f74d26c94a6 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -15,7 +15,7 @@ separator_value: '4663' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index d75420c82ad..280d7f8262f 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -15,7 +15,7 @@ separator_value: '4672' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index d9686672657..642687b596a 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -16,7 +16,7 @@ configuration: Enabling Windows event log process command line logging via group supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - Caller_Domain - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index a36980f9889..3b4b6a9c064 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -15,7 +15,7 @@ separator_value: '4698' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index 590d5e1f8c7..a80ed23a9ba 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -15,7 +15,7 @@ separator_value: '4699' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index fdb23972cbe..4dc60cd9bd7 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - EventID example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4700</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T02:32:47.606423000Z" /> <EventRecordID>344861</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="756" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContent"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>LeastPrivilege</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event> diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index 9824e45fd8d..7184ff77e3f 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - EventID example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4702</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T03:00:59.343820000Z" /> <EventRecordID>344863</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="596" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContentNew"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>HighestAvailable</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event> diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index 8efa4d630a5..5c1d729155e 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -15,7 +15,7 @@ separator_value: '4703' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index 19c9db852d1..06b3adb9882 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -15,7 +15,7 @@ separator_value: '4719' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 049f9150010..31484a35875 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -14,7 +14,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index 4778011edf0..26eb1728db8 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -14,7 +14,7 @@ separator_value: '4723' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index 2e1ab15fd58..0b06b7823a5 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -14,7 +14,7 @@ separator_value: '4724' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index 4b4a6cb80cd..ca05c7b8403 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -14,7 +14,7 @@ separator_value: '4725' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index bffa3f61d6e..6ddc2aba570 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -14,7 +14,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 087aff4eead..0aa2c2f0b79 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index 0e6346d3b2a..bcba79a79d9 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index 06c4b66e669..9487a6ac521 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index 87ad0bceae3..30f8bc23e81 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index 5c7de0fd654..d95f852eb8e 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -14,7 +14,7 @@ separator_value: '4732' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index 4c27227db2a..f128bbfcc42 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index 9db856f358c..fb6f1f3ca8d 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -14,7 +14,7 @@ separator_value: '4738' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4739.yml b/data_sources/windows_event_log_security_4739.yml index d055166b557..b0f63147034 100644 --- a/data_sources/windows_event_log_security_4739.yml +++ b/data_sources/windows_event_log_security_4739.yml @@ -15,7 +15,7 @@ separator_value: '4739' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index eb0238ac908..7b643fb3d0e 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -17,7 +17,7 @@ separator_value: '4741' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index 513872af7e4..eb26156fe93 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index eca1bb96094..216eb54d2c5 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index 37cd80c8007..8b61381edec 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index 48f80c0979d..4dbe460a364 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index 8f7b0b077eb..c53348491fb 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index d8110c1a28d..9db0814db32 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index d11908d257e..0d954d3b5c3 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -17,7 +17,7 @@ separator_value: '4768' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index 61f7a15c8ed..2b1506eda99 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -17,7 +17,7 @@ separator_value: '4769' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index 41d424b7e8a..16751ea4ef2 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -17,7 +17,7 @@ separator_value: '4771' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index fd970cd4223..408aaa466bb 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -17,7 +17,7 @@ separator_value: '4776' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index 7e55eadbc38..ed8f3691a80 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -17,7 +17,7 @@ separator_value: '4781' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index b0f7b5fe5c8..4b239b5056d 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index 301fcb72152..8a945e0fe82 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index 222bc3fad39..70bae43f05b 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -17,7 +17,7 @@ separator_value: supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index feb4495106e..8eebe0e5a94 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index ca4e0c7c95e..bdd7735a815 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -17,7 +17,7 @@ separator_value: '4876' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index e33210fe213..9379641c7d3 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -17,7 +17,7 @@ separator_value: '4886' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index 7646c112a2b..2016e280f63 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -17,7 +17,7 @@ separator_value: '4887' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index 44ee333e118..2d9e806305f 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -12,7 +12,7 @@ separator_value: '4946' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index 2b0894834e9..b10ef8870b6 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -12,7 +12,7 @@ separator_value: '4947' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index 67478d0f087..961be864ee1 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -12,7 +12,7 @@ separator_value: '4948' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index ab04793a83e..b2035008e48 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -17,7 +17,7 @@ separator_value: '5136' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index 5340ac3d62a..253ce10397d 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -17,7 +17,7 @@ separator_value: '5137' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - AppCorrelationID diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index abf49c3db84..f5f3cf11165 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -17,7 +17,7 @@ separator_value: '5140' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index 2a40fdcf81a..393098f2884 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -17,7 +17,7 @@ separator_value: '5141' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index dbdf8114b39..1647d2e8320 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -17,7 +17,7 @@ separator_value: '5145' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index 6ccea0b2381..faea29ccadb 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_system_4720.yml b/data_sources/windows_event_log_system_4720.yml index 47015e8dd1a..49df88f658a 100644 --- a/data_sources/windows_event_log_system_4720.yml +++ b/data_sources/windows_event_log_system_4720.yml @@ -17,7 +17,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4726.yml b/data_sources/windows_event_log_system_4726.yml index 31d4f0ca60e..642359a985c 100644 --- a/data_sources/windows_event_log_system_4726.yml +++ b/data_sources/windows_event_log_system_4726.yml @@ -17,7 +17,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4728.yml b/data_sources/windows_event_log_system_4728.yml index 728e981ba5c..dd3e3849ea5 100644 --- a/data_sources/windows_event_log_system_4728.yml +++ b/data_sources/windows_event_log_system_4728.yml @@ -17,7 +17,7 @@ separator_value: '4728' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index b14cad1c4c6..0cf395b1d21 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -17,7 +17,7 @@ separator_value: '7036' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index 552b3d1027c..518d67eacf5 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -17,7 +17,7 @@ separator_value: '7040' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index 95bbb82590d..a1fda46fe87 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -17,7 +17,7 @@ separator_value: '7045' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - AccountName diff --git a/data_sources/windows_event_log_taskscheduler_200.yml b/data_sources/windows_event_log_taskscheduler_200.yml index 618165e9f75..e7fe0ff722b 100644 --- a/data_sources/windows_event_log_taskscheduler_200.yml +++ b/data_sources/windows_event_log_taskscheduler_200.yml @@ -17,7 +17,7 @@ separator_value: '200' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ActionName diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index bd708a219d1..01ff84004bd 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_iis.yml b/data_sources/windows_iis.yml index 6306f875cae..a3412a3b423 100644 --- a/data_sources/windows_iis.yml +++ b/data_sources/windows_iis.yml @@ -16,4 +16,4 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 diff --git a/data_sources/windows_iis_29.yml b/data_sources/windows_iis_29.yml index 85da6122429..8c6977fd3a4 100644 --- a/data_sources/windows_iis_29.yml +++ b/data_sources/windows_iis_29.yml @@ -17,7 +17,7 @@ separator_value: '29' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.1.2 + version: 10.0.1 fields: - _time - ComputerName From 5b38d2f543aa02da0a1e2173d2c97d406a223c47 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali <nbencher@cisco.com> Date: Mon, 27 Jul 2026 20:02:14 +0200 Subject: [PATCH 036/162] Update Analytics - Batch 6.3 (#4157) * update file event analytics - batch 1 * Fix #4061 * Fix #4126 * update NVM detections to new sourcetype * tune LLM analytics * fix sourcetype * add missing DS for EID 26 * Fix #4178 * Fix #4139 * Fix #4084 * Fix #4148 * Update windows_appcertdll_modification_via_registry.yml * Fix #4078 * Update domain_controllers.csv * revert version bump * Update windows_curl_upload_to_remote_destination.yml * Update windows_curl_upload_to_remote_destination.yml --- ...co_network_visibility_module_flow_data.yml | 15 ++-- ...isco_network_visibility_module_osquery.yml | 14 +-- ...itten_outside_of_the_outlook_directory.yml | 75 +++++++++++----- .../endpoint/attacker_tools_on_endpoint.yml | 4 +- .../endpoint/batch_file_write_to_system32.yml | 64 +++++++++---- ...m___curl_execution_with_insecure_flags.yml | 4 +- ...llation_of_typosquatted_python_package.yml | 4 +- ...a_network_execution_without_url_in_cli.yml | 4 +- ...twork_binary_making_network_connection.yml | 4 +- ...outbound_connection_to_suspicious_port.yml | 4 +- ...rclone_execution_with_network_activity.yml | 4 +- ...use_of_mshtml_dll_for_payload_download.yml | 4 +- ...om_archive_triggering_network_activity.yml | 4 +- ...ous_download_from_file_sharing_website.yml | 4 +- ...ous_file_download_via_headless_browser.yml | 4 +- ...k_connection_from_process_with_no_args.yml | 4 +- ...network_connection_initiated_via_msxsl.yml | 4 +- ...rk_connection_to_ip_lookup_service_api.yml | 4 +- ...ver_download_from_file_sharing_website.yml | 4 +- .../endpoint/common_ransomware_extensions.yml | 90 ++++++++++--------- .../endpoint/common_ransomware_notes.yml | 13 ++- .../detect_html_help_url_in_command_line.yml | 4 +- .../detect_mshta_url_in_command_line.yml | 2 +- .../detect_rclone_command_line_usage.yml | 4 +- .../endpoint/llm_model_file_creation.yml | 42 +++++++-- .../local_llm_framework_dns_query.yml | 64 +++++++++---- ...svchost_lolbas_execution_process_spawn.yml | 71 +++++++++++---- .../time_provider_persistence_registry.yml | 36 +++++++- ...pcertdll_modification_via_command_line.yml | 4 +- ...s_appcertdll_modification_via_registry.yml | 80 +++++++++++++++++ ...ndows_curl_download_to_suspicious_path.yml | 2 +- ...dows_curl_upload_to_remote_destination.yml | 43 +++++++-- .../windows_file_download_via_certutil.yml | 4 +- .../windows_file_download_via_powershell.yml | 4 +- ...e_without_extension_in_critical_folder.yml | 49 +++++++--- ...ttp_network_communication_from_msiexec.yml | 4 +- ..._installutil_remote_network_connection.yml | 4 +- ...indows_installutil_url_in_command_line.yml | 4 +- ...indows_kerberos_local_successful_logon.yml | 54 +++++++---- .../windows_local_llm_framework_execution.yml | 28 ++++-- .../windows_mark_of_the_web_bypass.yml | 30 ++++--- ..._script_deleted_by_non_msiexec_process.yml | 7 +- .../windows_msiexec_remote_download.yml | 4 +- ...rshell_fakecaptcha_clipboard_execution.yml | 4 +- ...ows_process_with_namedpipe_commandline.yml | 53 +++++++++-- ...ows_rdp_automaticdestinations_deletion.yml | 20 ++++- .../windows_rdp_cache_file_deletion.yml | 30 ++++++- ..._defender_update_activity_in_inetcache.yml | 6 +- ...s_winscp_configuration_security_access.yml | 8 +- .../endpoint/wmic_xsl_execution_via_url.yml | 4 +- lookups/csv/domain_controllers.csv | 2 + lookups/csv/domain_controllers.yml | 9 ++ lookups/csv/ransomware_notes_lookup.csv | 1 - lookups/csv/ransomware_notes_lookup.yml | 4 +- ...sco_network_visibility_module_flowdata.yml | 6 +- 55 files changed, 732 insertions(+), 290 deletions(-) create mode 100644 detections/endpoint/windows_appcertdll_modification_via_registry.yml create mode 100644 lookups/csv/domain_controllers.csv create mode 100644 lookups/csv/domain_controllers.yml diff --git a/data_sources/cisco_network_visibility_module_flow_data.yml b/data_sources/cisco_network_visibility_module_flow_data.yml index a44e6f1f6b8..a34facebf45 100644 --- a/data_sources/cisco_network_visibility_module_flow_data.yml +++ b/data_sources/cisco_network_visibility_module_flow_data.yml @@ -1,19 +1,18 @@ name: Cisco Network Visibility Module Flow Data id: d49bcd3c-da06-41c6-b33e-8b8d23078f68 -version: 2 +version: 3 creation_date: '2025-06-30' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk description: Data source object for Netflow events from Cisco Network Visibility Module source: not_applicable -sourcetype: cisco:nvm:flowdata +sourcetype: cisco:nvm:flowdata:v2 supported_TA: - - name: Cisco NVM Add-on for Splunk - url: https://splunkbase.splunk.com/app/4221 - version: 4.0.7 + - name: Cisco Security Cloud + url: https://splunkbase.splunk.com/app/7404 + version: 3.6.5 fields: - action - - aditional_logged_in_user_list - aliul - bytes - bytes_in @@ -147,4 +146,4 @@ fields: - user output_fields: - dest -example_log: 'Jun 26 16:09:18 127.0.0.1 Jun 26 16:09:18 ip-172-31-30-201 fv="nvzFlow_v9" pr="6" sa="172.16.3.110" sp="5203" da="140.82.112.3" dp="443" fd="1" fss="1750954134" fst="Thu Jun 26 16:08:54 2025" fes="1750954134" fet="Thu Jun 26 16:08:54 2025" hh="''" hm="''" ht="''" udid="10E8A7F940225180BFDB748D2AE336EA7285CB8C" liuid="EC2AMAZ-E56LIG5\Administrator" liuida="EC2AMAZ-E56LIG5" liuidp="Administrator" liuat="2" pa="EC2AMAZ-E56LIG5\Administrator" paa="EC2AMAZ-E56LIG5" pap="Administrator" puat="8194" pn="msiexec.exe" ph="23EC37A4DF21893A1B3B6F5F72B2D78918E86C3A90F9664F8248A2C8219F889A" ppa="EC2AMAZ-E56LIG5\Administrator" ppuat="8194" ppn="cmd.exe" pph="41871DADE953D9F40F4AA445FC19982AB59D263C8AA93D7F67A1451663A09A57" ibc="0" obc="0" ds="us-east-2.compute.internal" dh="github.com" iid="4" mnl="''" mhl="''" fsms="1750954134331" fems="1750954134340" pid="8496" ppath="C:\Windows\system32\msiexec.exe" parg=" /i \"https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.007/src/T1218.007_JScript.msi\"" ppid="9232" pppath="C:\Windows\system32\cmd.exe" aliul="''" pil="12288" ppil="12288" fsg="1" puid="071161F29663831BB4A1C0FADA9805E0"' +example_log: '{ "fv": "nvzFlow_v11", "pr": "6", "sa": "10.10.0.38", "sp": "37351", "da": "104.114.110.196", "dp": "80", "fd": "1", "fss": "1784017733", "fst": "Tue Jul 14 13:58:53 2026", "fes": "1784017793", "fet": "Tue Jul 14 13:59:53 2026", "hh": "tile-service.weather.microsoft.com", "hm": "GET", "ht": "/en-GB/livetile/preinstall", "udid": "D5E5634FDBEE82655C9C0E7523CDCE62A8249A1C", "liuid": "WIN-ANIKET\\Hostscan", "liuida": "WIN-ANIKET", "liuidp": "Hostscan", "liuat": "2", "pa": "WIN-ANIKET\\Hostscan", "puat": "2", "pn": "svchost.exe", "ph": "B0B36BFF7AE4057F687D839CD4B3D81159AB646F1EE1B22106A927E93DECBB61", "pid": "3040", "ppath": "C:\\Windows\\System32\\svchost.exe", "parg": "-k UnistackSvcGroup -s WpnUserService", "ppn": "services.exe", "ppid": "684", "pppath": "C:\\Windows\\System32\\services.exe", "ibc": "7660", "obc": "213", "ds": "cisco.com", "dh": "tile-service.weather.microsoft.com", "iid": "50", "mnl": "wpnuserservice.dll", "mhl": "8F571F1D23DE5D0C223338BDD341892CCBC62FDE443499AC373B6A621F58A332", "fsms": "1784017733536", "fems": "1784017793545", "pil": "8192", "ppil": "16384", "fsg": "0", "puid": "E89CC0DBD1F48055BB4FA09268E9B51D", "eveuuid": "00000000000000000000000000000000" }' diff --git a/data_sources/cisco_network_visibility_module_osquery.yml b/data_sources/cisco_network_visibility_module_osquery.yml index 7ee5204cd93..80e6c678e9e 100644 --- a/data_sources/cisco_network_visibility_module_osquery.yml +++ b/data_sources/cisco_network_visibility_module_osquery.yml @@ -1,16 +1,16 @@ name: Cisco Network Visibility Module OSquery id: d59bcd3c-da06-41c6-b33e-8b8d23078f68 -version: 2 +version: 3 creation_date: '2025-06-30' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk description: Data source object for OSquery events from Cisco Network Visibility Module source: not_applicable -sourcetype: cisco:nvm:osquery +sourcetype: cisco:nvm:osquery:v2 supported_TA: - - name: Cisco NVM Add-on for Splunk - url: https://splunkbase.splunk.com/app/4221 - version: 4.0.7 + - name: Cisco Security Cloud + url: https://splunkbase.splunk.com/app/7404 + version: 3.6.5 fields: - current_page - date_hour @@ -49,4 +49,4 @@ fields: - udid output_fields: - query_json_response -example_log: 'Jun 30 09:20:43 127.0.0.1 Jun 30 09:20:43 ip-172-31-30-201 fv="nvzFlow_v8" udid="10E8A7F940225180BFDB748D2AE336EA7285CB8C" qv="5.5.1-dirty" qid="38654705666" qt="1751275242" qpi="1" qpn="1" qjr="[{\"active\":\"1\",\"autoupdate\":\"1\",\"creator\":\"null\",\"description\":\"\",\"disabled\":\"0\",\"identifier\":\"addons-search-detection@mozilla.com\",\"location\":\"app-builtin\",\"name\":\"Add-ons Search Detection\",\"native\":\"\",\"path\":\"null\",\"source_url\":\"null\",\"type\":\"extension\",\"uid\":\"500\",\"version\":\"2.0.0\",\"visible\":\"1\"},{\"active\":\"0\",\"autoupdate\":\"1\",\"creator\":\"Mozilla <screenshots-feedback@mozilla.com>\",\"description\":\"Take clips and screenshots from the Web and save them temporarily or permanently.\",\"disabled\":\"1\",\"identifier\":\"screenshots@mozilla.org\",\"location\":\"app-system-defaults\",\"name\":\"Firefox Screenshots\",\"native\":\"\",\"path\":\"C:\\Program Files\\Mozilla Firefox\\browser\\features\\screenshots@mozilla.org.xpi\",\"source_url\":\"null\",\"type\":\"extension\",\"uid\":\"500\",\"version\":\"39.0.1\",\"visible\":\"1\"},{\"active\":\"1\",\"autoupdate\":\"1\",\"creator\":\"null\",\"description\":\"\",\"disabled\":\"0\",\"identifier\":\"formautofill@mozilla.org\",\"location\":\"app-system-defaults\",\"name\":\"Form Autofill\",\"native\":\"\",\"path\":\"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi\",\"source_url\":\"null\",\"type\":\"extension\",\"uid\":\"500\",\"version\":\"1.0.1\",\"visible\":\"1\"},{\"active\":\"1\",\"autoupdate\":\"1\",\"creator\":\"null\",\"description\":\"Fixes for web compatibility with Picture-in-Picture\",\"disabled\":\"0\",\"identifier\":\"pictureinpicture@mozilla.org\",\"location\":\"app-system-defaults\",\"name\":\"Picture-In-Picture\",\"native\":\"\",\"path\":\"C:\\Program Files\\Mozilla Firefox\\browser\\features\\pictureinpicture@mozilla.org.xpi\",\"source_url\":\"null\",\"type\":\"extension\",\"uid\":\"500\",\"version\":\"1.0.0\",\"visible\":\"1\"},{\"active\":\"1\",\"autoupdate\":\"1\",\"creator\":\"null\",\"description\":\"Urgent post-release fixes for web compatibility.\",\"disabled\":\"0\",\"identifier\":\"webcompat@mozilla.org\",\"location\":\"app-system-defaults\",\"name\":\"Web Compatibility Interventions\",\"native\":\"\",\"path\":\"C:\\Program Files\\Mozilla Firefox\\browser\\features\\webcompat@mozilla.org.xpi\",\"source_url\":\"null\",\"type\":\"extension\",\"uid\":\"500\",\"version\":\"137.7.0\",\"visible\":\"1\"},{\"active\":\"0\",\"autoupdate\":\"1\",\"creator\":\"Thomas Wisniewski <twisniewski@mozilla.com>\",\"description\":\"Report site compatibility issues on webcompat.com\",\"disabled\":\"1\",\"identifier\":\"webcompat-reporter@mozilla.org\",\"location\":\"app-system-defaults\",\"name\":\"WebCompat Reporter\",\"native\":\"\",\"path\":\"C:\\Program Files\\Mozilla Firefox\\browser\\features\\webcompat-reporter@mozilla.org.xpi\",\"source_url\":\"null\",\"type\":\"extension\",\"uid\":\"500\",\"version\":\"2.1.0\",\"visible\":\"1\"}]"' +example_log: '{ "fv": "nvzFlow_v8", "udid": "D5E5634FDBEE82655C9C0E7523CDCE62A8249A1C", "qv": "5.5.1-dirty", "qid": "38654705666", "qt": "1784017742", "qpi": "1", "qpn": "1", "qjr": "[{\"active\":\"1\",\"autoupdate\":\"1\",\"identifier\":\"addons-search-detection@mozilla.com\",\"location\":\"app-builtin-addons\",\"name\":\"Add-ons Search Detection\",\"type\":\"extension\",\"uid\":\"1001\",\"version\":\"3.0.0\",\"visible\":\"1\"},{\"active\":\"1\",\"identifier\":\"formautofill@mozilla.org\",\"name\":\"Form Autofill\",\"version\":\"1.0.1\"}]"}' diff --git a/detections/application/email_files_written_outside_of_the_outlook_directory.yml b/detections/application/email_files_written_outside_of_the_outlook_directory.yml index c38c5a7e736..229731bdfff 100644 --- a/detections/application/email_files_written_outside_of_the_outlook_directory.yml +++ b/detections/application/email_files_written_outside_of_the_outlook_directory.yml @@ -1,40 +1,60 @@ name: Email files written outside of the Outlook directory id: 8d52cf03-ba25-4101-aa78-07994aed4f74 -version: 12 +version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-07-02' author: Bhavin Patel, Splunk -status: experimental -type: TTP -description: The following analytic detects email files (.pst or .ost) being created outside the standard Outlook directories. It leverages the Endpoint.Filesystem data model to identify file creation events and filters for email files not located in "C:\Users\*\My Documents\Outlook Files\*" or "C:\Users\*\AppData\Local\Microsoft\Outlook*". This activity is significant as it may indicate data exfiltration or unauthorized access to email data. If confirmed malicious, an attacker could potentially access sensitive email content, leading to data breaches or further exploitation within the network. +status: production +type: Anomaly +description: |- + The following analytic detects email files (.pst or .ost) being created outside the standard Outlook directories. + It leverages the Endpoint.Filesystem data model to identify file creation events and filters for email files not located in "C:\Users\*\My Documents\Outlook Files\*" or "C:\Users\*\AppData\Local\Microsoft\Outlook*". + This activity is significant as it may indicate data exfiltration or unauthorized access to email data. + If confirmed malicious, an attacker could potentially access sensitive email content, leading to data breaches or further exploitation within the network. data_source: - Sysmon EventID 11 search: |- - | tstats `security_content_summariesonly` count values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - WHERE ( - Filesystem.file_name=*.pst - OR - Filesystem.file_name=*.ost - ) - Filesystem.file_path != "C:\Users\*\My Documents\Outlook Files\*" Filesystem.file_path!="C:\Users\*\AppData\Local\Microsoft\Outlook*" - BY Filesystem.action Filesystem.dest Filesystem.file_access_time - Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time - Filesystem.file_name Filesystem.file_path Filesystem.file_acl - Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product + | tstats `security_content_summariesonly` + count values(Filesystem.file_path) as file_path + min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Filesystem WHERE + + Filesystem.action IN ( + "created", + "modified" + ) + Filesystem.file_name IN ( + "*.pst", + "*.ost" + ) + NOT Filesystem.file_path IN ( + "C:\\Users\\*\\My Documents\\Outlook Files\\*", + "C:\\Users\\*\\AppData\\Local\\Microsoft\\Outlook*" + ) + + BY Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl + Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name("Filesystem")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `email_files_written_outside_of_the_outlook_directory_filter` how_to_implement: To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes. -known_false_positives: Administrators and users sometimes prefer backing up their email data by moving the email files into a different folder. These attempts will be detected by the search. +known_false_positives: |- + Administrators and users sometimes prefer backing up their email data by moving the email files into a different folder. These attempts will be detected by the search. + You should confirm that the activity is legitimate and modify the search to add exclusions, as necessary. references: [] -finding: - title: Email files written outside of Outlook's Directory on $dest$ - entity: - field: dest - type: system - score: 50 +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: A new email file [$file_name$] was written to [$file_path$] on endpoint $dest$ by user $user$. analytic_story: - Collection and Staging asset_type: Endpoint @@ -46,3 +66,10 @@ product: - Splunk Cloud category: application security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.001/windows_email_files_outside_email_dir/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index c2a61d01a26..2f1379ec50a 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -2,7 +2,7 @@ name: Attacker Tools On Endpoint id: a51bfe1a-94f0-48cc-b4e4-16a110145893 version: 19 creation_date: '2021-07-12' -modification_date: '2026-07-01' +modification_date: '2026-07-14' author: Bhavin Patel, Splunk, sventec, Github Community status: production type: TTP @@ -103,5 +103,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml index 5bd5039da0d..86e914066df 100644 --- a/detections/endpoint/batch_file_write_to_system32.yml +++ b/detections/endpoint/batch_file_write_to_system32.yml @@ -1,17 +1,53 @@ name: Batch File Write to System32 id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3 -version: 14 +version: 15 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-07-02' author: Steven Dick, Michael Haag, Rico Valdez, Splunk status: production -type: TTP -description: The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. It leverages data from the Endpoint datamodel, focusing on process and filesystem events to identify this behavior. This activity is significant because writing batch files to system directories can be indicative of malicious intent, such as persistence mechanisms or system manipulation. If confirmed malicious, this could allow an attacker to execute arbitrary commands with elevated privileges, potentially compromising the entire system. +type: Anomaly +description: |- + The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. It leverages data from the Endpoint datamodel, focusing on process and filesystem events to identify this behavior. + This activity is significant because writing batch files to system directories can be indicative of malicious intent, such as persistence mechanisms or system manipulation. + If confirmed malicious, this could allow an attacker to execute arbitrary commands with elevated privileges, potentially compromising the entire system. data_source: - Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\system32\\*","*\\syswow64\\*") Filesystem.file_name="*.bat" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `batch_file_write_to_system32_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: It is possible for this search to generate a finding event for a batch file write to a path that includes the string "system32", but is not the actual Windows system directory. As such, you should confirm the path of the batch file identified by the search. In addition, a false positive may be generated by an administrator copying a legitimate batch file in this directory tree. You should confirm that the activity is legitimate and modify the search to add exclusions, as necessary. +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Filesystem where + + Filesystem.action IN ( + "created", + "modified" + ) + Filesystem.file_path IN ( + "*:\\Windows\\System32\\*", + "*:\\Windows\\SysWOW64\\*" + ) + Filesystem.file_name IN ( + "*.bat", + "*.cmd" + ) + + by Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash + Filesystem.file_modify_time Filesystem.file_name + Filesystem.file_path Filesystem.file_acl + Filesystem.file_size Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `batch_file_write_to_system32_filter` +how_to_implement: |- + To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + You must also be ingesting the Endpoint.Filesystem data source. +known_false_positives: |- + Some batch files are written to the system32 directory tree for legitimate purposes, such as system maintenance or configuration. Investigate the batch file to determine if it is legitimate and modify the search to add exclusions, as necessary. references: [] drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" @@ -22,21 +58,15 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: A file - $file_name$ was written to system32 has occurred on endpoint $dest$ by user $user$. - entity: - field: user - type: user - score: 50 intermediate_findings: entities: - field: dest type: system - score: 50 - message: A file - $file_name$ was written to system32 has occurred on endpoint $dest$ by user $user$. + score: 20 + message: A new batch file [$file_name$] was written to [$file_path$] on endpoint $dest$ by user $user$. threat_objects: - - field: file_name - type: file_name + - field: file_path + type: file_path analytic_story: - SamSam Ransomware - Compromised Windows Host diff --git a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml index 6712f91f5c7..4f2287fd2b1 100644 --- a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml +++ b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Curl Execution With Insecure Flags id: cc695238-3117-4e60-aa83-4beac2a42c69 version: 8 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -94,5 +94,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml index 8a805e5448f..1230dc1fe34 100644 --- a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml +++ b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Installation of Typosquatted Python Package id: 5e3f6b44-42cb-4f8a-99f0-59e78a52ea1d version: 5 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -92,5 +92,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml index 642eb251005..39f753ba7ed 100644 --- a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml +++ b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml @@ -2,7 +2,7 @@ name: Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI id: f2a9df84-9b01-4a21-9e3a-7aa1a217f69e version: 6 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -99,5 +99,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml index 72f181766d2..30d14780297 100644 --- a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml +++ b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Non-Network Binary Making Network Connection id: c6db35af-8a0e-4b61-88ed-738e66f15715 version: 6 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -95,5 +95,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml b/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml index e754472a801..012a98db4fd 100644 --- a/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml +++ b/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Outbound Connection to Suspicious Port id: fc32a8d5-bc79-4437-b48f-4646ab7bed9d version: 6 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -91,5 +91,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml index 45218455c82..d707ed47453 100644 --- a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml +++ b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Rclone Execution With Network Activity id: 719f8c78-b20d-4bb9-8c33-6d1a762e7a9a version: 7 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -102,5 +102,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml index 89cc32f4898..3b0f0d51b9b 100644 --- a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml +++ b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download id: 18f0d27d-569e-4bc4-96e1-09b214fa73c0 version: 6 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -89,5 +89,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml index 7ad4e933926..0072fc506ec 100644 --- a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml +++ b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Susp Script From Archive Triggering Network Activity id: 8b07c2c9-0cde-4c44-9fa6-59dcf2b25777 version: 6 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -88,5 +88,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml index 8166c79a5ad..88bfa5cba70 100644 --- a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Suspicious Download From File Sharing Website id: 94ebc001-35e7-4ae8-9b0e-52766b2f99c7 version: 7 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -109,5 +109,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml index b3ba65c9900..7ea531ccb15 100644 --- a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml +++ b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Suspicious File Download via Headless Browser id: cd0e816f-f67d-4dbe-a153-480b546e867e version: 6 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -127,5 +127,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml index 1c6eb912659..30cb586fc2a 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Suspicious Network Connection From Process With No Args id: 54fa06c5-96a2-4406-a4a7-44d93ddbd173 version: 6 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -98,5 +98,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml index 97666a50e2b..8fe5860f2bc 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Suspicious Network Connection Initiated via MsXsl id: 1cbcf75f-0e45-4f29-8c1b-7fcd7e55cc55 version: 6 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -91,5 +91,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml index 7cf11c08ef6..681ce03876d 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Suspicious Network Connection to IP Lookup Service API id: 568cb83e-d79e-4a23-85ec-6e1f6c30cb2f version: 8 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk, Janantha Marasinghe status: production type: Anomaly @@ -104,5 +104,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml index 829b6421f06..bdcf425a928 100644 --- a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Webserver Download From File Sharing Website id: 1984f997-3b49-4d4b-a7e9-dc5dbf88370e version: 7 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -98,5 +98,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index be82aaebee9..495dfc05994 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -1,57 +1,59 @@ name: Common Ransomware Extensions id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec -version: 21 +version: 22 creation_date: '2019-10-16' -modification_date: '2026-05-13' -author: David Dorsey, Michael Haag, Splunk, Steven Dick +modification_date: '2026-07-02' +author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects modifications to files with extensions commonly associated with ransomware. It leverages the Endpoint.Filesystem data model to identify changes in file extensions that match known ransomware patterns. This activity is significant because it suggests an attacker is attempting to encrypt or alter files, potentially leading to severe data loss and operational disruption. If confirmed malicious, this activity could result in the encryption of critical data, rendering it inaccessible and causing significant damage to the organization's data integrity and availability. +description: |- + The following analytic detects modifications to files with extensions commonly associated with ransomware. It leverages the Endpoint.Filesystem data model to identify changes in file extensions that match known ransomware patterns. + This activity is significant because it suggests an attacker is attempting to encrypt or alter files, potentially leading to severe data loss and operational disruption. + If confirmed malicious, this activity could result in the encryption of critical data, rendering it inaccessible and causing significant damage to the organization's data integrity and availability. data_source: - Sysmon EventID 11 search: | | tstats `security_content_summariesonly` - min(_time) as firstTime - max(_time) as lastTime - count latest(Filesystem.user) as user + count min(_time) as firstTime + max(_time) as lastTime + latest(Filesystem.user) as user values(Filesystem.file_path) as file_path - from datamodel=Endpoint.Filesystem - where NOT Filesystem.file_name IN ( - "*.bat", - "*.cmd", - "*.com", - "*.cpl", - "*.dll", - "*.doc", - "*.docx", - "*.exe", - "*.gif", - "*.jar", - "*.jpeg", - "*.jpg", - "*.js", - "*.lnk", - "*.pif", - "*.png", - "*.ppt", - "*.pptx", - "*.ps1", - "*.psm1", - "*.scr", - "*.sys", - "*.txt", - "*.vbs", - "*.wsf", - "*.xls", - "*.xlsx" - ) - by Filesystem.action Filesystem.dest - Filesystem.file_access_time Filesystem.file_create_time - Filesystem.file_hash Filesystem.file_modify_time - Filesystem.file_name Filesystem.file_path - Filesystem.file_acl Filesystem.file_size - Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product + FROM datamodel=Endpoint.Filesystem WHERE + + Filesystem.action IN ( + "created", + "modified" + ) + NOT Filesystem.file_name IN ( + "*.7z", "*.aac", "*.appx", "*.appxbundle", "*.asc", "*.asm", "*.avi", + "*.bak", "*.bat", "*.bin", "*.bmp", "*.bz2", "*.cab", "*.cer", + "*.cfg", "*.cmd", "*.com", "*.conf", "*.cpp", "*.crt", "*.cs", + "*.csh", "*.css", "*.csv", "*.cxx", "*.dat", "*.deb", "*.der", + "*.diff", "*.dll", "*.doc", "*.docm", "*.docx", "*.dot", "*.dotm", + "*.dotx", "*.drv", "*.eml", "*.eps", "*.exe", "*.flac", "*.gif", + "*.go", "*.gz", "*.h", "*.hpp", "*.htm", "*.html", "*.ico", "*.ics", + "*.ini", "*.iso", "*.jar", "*.java", "*.jpeg", "*.jpg", "*.js", "*.json", + "*.key", "*.ksh", "*.ldf", "*.lib", "*.log", "*.lnk", "*.m4a", "*.m4v", + "*.md", "*.mdb", "*.mdf", "*.mht", "*.mhtml", "*.mkv", "*.mov", "*.mp3", + "*.mp4", "*.mpeg", "*.mpg", "*.msi", "*.msix", "*.msixbundle", "*.msg", + "*.odp", "*.ods", "*.odt", "*.one", "*.ost", "*.otf", "*.pdf", "*.pem", + "*.pfx", "*.php", "*.pif", "*.pl", "*.png", "*.pot", "*.potm", "*.potx", + "*.ppam", "*.pps", "*.ppsm", "*.ppsx", "*.ppt", "*.pptm", "*.pptx", "*.ps1", + "*.ps1xml", "*.psd1", "*.psm1", "*.pst", "*.pub", "*.py", "*.pyc", "*.rar", + "*.reg", "*.rpm", "*.rss", "*.rtf", "*.scr", "*.sh", "*.sql", "*.svg", + "*.swift", "*.sys", "*.tar", "*.tgz", "*.tif", "*.tiff", "*.toml", "*.ttf", + "*.txt", "*.url", "*.vb", "*.vbe", "*.vbs", "*.vcxproj", "*.vhd", "*.vhdx", + "*.wav", "*.webm", "*.webp", "*.wim", "*.wsf", "*.xlam", "*.xls", "*.xlsb", + "*.xlsm", "*.xlsx", "*.xlt", "*.xltm", "*.xltx", "*.xml", "*.xps", + "*.yaml", "*.yml", "*.zip" + ) + BY Filesystem.action Filesystem.dest + Filesystem.file_access_time Filesystem.file_create_time + Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path + Filesystem.file_acl Filesystem.file_size + Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | rex field=file_name "(?<file_extension>(\.[^\.]+){1,2})$" | lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Extensions Name diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml index 9a44d990802..73d3d89d0f9 100644 --- a/detections/endpoint/common_ransomware_notes.yml +++ b/detections/endpoint/common_ransomware_notes.yml @@ -1,8 +1,8 @@ name: Common Ransomware Notes id: ada0f478-84a8-4641-a3f1-d82362d6bd71 -version: 15 +version: 16 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-07-02' author: David Dorsey, Splunk status: production type: Hunting @@ -24,8 +24,13 @@ search: | values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path - from datamodel=Endpoint.Filesystem - where [ + + FROM datamodel=Endpoint.Filesystem WHERE + Filesystem.action IN ( + "created", + "modified" + ) + [ | inputlookup ransomware_notes_lookup | search status=true | fields ransomware_notes diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index 4a0748250d9..b12bf89d2b9 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -2,7 +2,7 @@ name: Detect HTML Help URL in Command Line id: 8c5835b9-39d9-438b-817c-95f14c69a31e version: 17 creation_date: '2021-02-11' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Michael Haag, Splunk status: production type: TTP @@ -87,5 +87,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index f497bd613a3..a38dbcb9880 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -92,5 +92,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index 9192e27b63c..70273452aef 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -2,7 +2,7 @@ name: Detect RClone Command-Line Usage id: 32e0baea-b3f1-11eb-a2ce-acde48001122 version: 19 creation_date: '2021-05-13' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Michael Haag, Splunk status: production type: TTP @@ -102,5 +102,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/llm_model_file_creation.yml b/detections/endpoint/llm_model_file_creation.yml index 8a26d5b2633..27abf9c5256 100644 --- a/detections/endpoint/llm_model_file_creation.yml +++ b/detections/endpoint/llm_model_file_creation.yml @@ -1,9 +1,9 @@ name: LLM Model File Creation id: 23e5b797-378d-45d6-ab3e-d034ca12a99b -version: 2 +version: 3 creation_date: '2025-11-24' -modification_date: '2026-05-13' -author: Rod Soto +modification_date: '2026-07-15' +author: Rod Soto, Nasreddine Bencherchali, Splunk status: production type: Hunting description: | @@ -17,12 +17,36 @@ search: | | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ( - "*.gguf*", - "*ggml*", - "*Modelfile*", - "*safetensors*" + from datamodel=Endpoint.Filesystem where + + ( + Filesystem.file_name IN ( + "*.gguf", + "*.safetensors", + "*ggml.dll", + "*modelfile*" + ) + OR + ( + Filesystem.file_name = "ggml-*" + Filesystem.file_name = "*.dll" + ) + ) + NOT Filesystem.file_name IN ( + "__PSScriptPolicyTest*", + "*.csv", + "*.doc", + "*.docx", + "*.jpeg", + "*.jpg", + "*.pdf", + "*.png", + "*.ppt", + "*.pptx", + "*.py", + "*.xls", + "*.xlsx", + "*Bentley.Civil*" ) by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path diff --git a/detections/endpoint/local_llm_framework_dns_query.yml b/detections/endpoint/local_llm_framework_dns_query.yml index 4e7d9bedfa6..e4d3bad5550 100644 --- a/detections/endpoint/local_llm_framework_dns_query.yml +++ b/detections/endpoint/local_llm_framework_dns_query.yml @@ -1,9 +1,9 @@ name: Local LLM Framework DNS Query id: d7ceffc5-a45e-412b-b9fa-2ba27c284503 -version: 2 +version: 3 creation_date: '2025-11-24' -modification_date: '2026-05-13' -author: Rod Soto +modification_date: '2026-07-15' +author: Rod Soto, Nasreddine Bencherchali, Splunk status: production type: Hunting description: | @@ -16,30 +16,58 @@ search: | `sysmon` EventCode=22 QueryName IN ( + "*anthropic*", + "*api.openrouter*", + "*civitai*", + "*dashscope.aliyuncs*", + "*gpt4all*", "*huggingface*", - "*ollama*", "*jan.ai*", - "*gpt4all*", - "*nomic*", "*koboldai*", "*lmstudio*", "*modelscope*", - "*civitai*", + "*nomic.ai*", + "*ollama*", "*oobabooga*", - "*replicate*", - "*anthropic*", "*openai*", "*openrouter*", - "*api.openrouter*", - "*aliyun*", - "*alibabacloud*", - "*dashscope.aliyuncs*" + "*replicate*", + "*tongyi*" ) - NOT Image IN ( - "*\\MsMpEng.exe", - "C:\\ProgramData\\*", - "C:\\Windows\\System32\\*", - "C:\\Windows\\SysWOW64\\*" + NOT ( + Image IN ( + "*\\360se.exe", "*\\arc.exe", "*\\atlas.exe", "*\\avastbrowser.exe", + "*\\avgbrowser.exe", "*\\blpbrowser.exe", "*\\brave.exe", "*\\braveupdate.exe", + "*\\chrome.exe", "*\\chromium.exe", "*\\Cisco\\Cisco Secure Client\\ThousandEyes Endpoint Agent\\*", + "*\\coccoc.exe", "*\\dragon.exe", "*\\duckduckgo.exe", "*\\epic.exe", + "*\\firefox.exe", "*\\ghost.exe", "*\\iexplore.exe", "*\\iridium.exe", + "*\\iron.exe", "*\\maxthon.exe", "*\\microsoftedge.exe", "*\\microsoftedgeupdate.exe", + "*\\msedge.exe", "*\\msedgewebview2.exe", "*\\MsMpEng.exe", "*\\opera_autoupdate.exe", + "*\\opera.exe", "*\\perplexity.exe", "*\\rave.exe", "*\\safari.exe", "*\\shift.exe", + "*\\sidekick.exe", "*\\thorium.exe", "*\\torch.exe", "*\\vivaldi.exe", + "*\\wavebrowser.exe", "*\\whale.exe", "*\\zen.exe", "C:\\ProgramData\\*", + "C:\\Windows\\System32\\*", "C:\\Windows\\SysWOW64\\*" + ) + OR + ( + Image IN ("*\\AnthropicClaude\\Update.exe", "*\\claude.exe") + QueryName = "anthropic.com" + ) + OR + ( + Image = "*\\lm studio.exe" + QueryName = "lmstudio.ai" + ) + OR + ( + Image IN ("*\\ollama app.exe", "*\\ollama.exe") + QueryName = "ollama.com" + ) + OR + ( + Image IN ("*\\chatgpt.exe", "*\\codex.exe") + QueryName = "openai.com" + ) ) | stats count min(_time) as firstTime diff --git a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml index 686d98b1ac4..02c80f91498 100644 --- a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml @@ -1,29 +1,61 @@ name: Svchost LOLBAS Execution Process Spawn id: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af -version: 14 +version: 15 creation_date: '2021-11-23' -modification_date: '2026-05-13' +modification_date: '2026-07-27' author: Mauricio Velazco, Splunk status: production type: TTP -description: The following analytic detects instances of 'svchost.exe' spawning Living Off The Land Binaries and Scripts (LOLBAS) processes. It leverages Endpoint Detection and Response (EDR) data to monitor child processes of 'svchost.exe' that match known LOLBAS executables. This activity is significant as adversaries often use LOLBAS techniques to execute malicious code stealthily, potentially indicating lateral movement or code execution attempts. If confirmed malicious, this behavior could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment, posing a significant security risk. +description: |- + The following analytic detects instances of 'svchost.exe' spawning Living Off The Land Binaries and Scripts (LOLBAS) processes. It leverages Endpoint Detection and Response (EDR) data to monitor child processes of 'svchost.exe' that match known LOLBAS executables. This activity is significant as adversaries often use LOLBAS techniques to execute malicious code stealthily, potentially indicating lateral movement or code execution attempts. + If confirmed malicious, this behavior could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment, posing a significant security risk. data_source: - Sysmon EventID 1 - - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE ( - Processes.parent_process_name=svchost.exe - ) - (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe", "Rasautou.exe", "Schtasks.exe", "Xwizard.exe", "Pnputil.exe", "Atbroker.exe", "Pcwrun.exe", "Ttdinject.exe","Mshta.exe", "Bitsadmin.exe", "Certoc.exe", "Ieexec.exe", "Microsoft.Workflow.Compiler.exe", "Runscripthelper.exe", "Forfiles.exe", "Msbuild.exe", "Register-cimprovider.exe", "Tttracer.exe", "Ie4uinit.exe", "Bash.exe", "Hh.exe", "SettingSyncHost.exe", "Cmstp.exe", "Stordiag.exe", "Scriptrunner.exe", "Odbcconf.exe", "Extexport.exe", "Msdt.exe", "WorkFolders.exe", "Diskshadow.exe", "Mavinject.exe", "Regasm.exe", "Gpscript.exe", "Regsvr32.exe", "Msiexec.exe", "Wuauclt.exe", "Presentationhost.exe", "Wmic.exe", "Runonce.exe", "Syncappvpublishingserver.exe", "Verclsid.exe", "Infdefaultinstall.exe", "Installutil.exe", "Netsh.exe", "Wab.exe", "Dnscmd.exe", "At.exe", "Pcalua.exe", "Msconfig.exe")) - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.parent_process = "*" + Processes.parent_process_name = "svchost.exe" + Processes.process_name IN ( + "At.exe", "Atbroker.exe", "Bash.exe", "Bitsadmin.exe", "Certoc.exe", "Cmstp.exe", + "Diskshadow.exe", "Dnscmd.exe", "Extexport.exe", "Forfiles.exe", "Ftp.exe", + "Gpscript.exe", "Hh.exe", "Ie4uinit.exe", "Ieexec.exe", "Infdefaultinstall.exe", + "Installutil.exe", "Mavinject.exe", "Microsoft.Workflow.Compiler.exe", + "Msbuild.exe", "Msconfig.exe", "Msdt.exe", "Msiexec.exe", "Netsh.exe", + "Odbcconf.exe", "OfflineScannerShell.exe", "Pcalua.exe", "Pcwrun.exe", + "Pnputil.exe", "PresentationHost.exe", "Rasautou.exe", "Regasm.exe", + "Register-cimprovider.exe", "Regsvcs.exe", "Regsvr32.exe", "Runonce.exe", + "Runscripthelper.exe", "Schtasks.exe", "Scriptrunner.exe", "SettingSyncHost.exe", + "Stordiag.exe", "Syncappvpublishingserver.exe", "Ttdinject.exe", "Mshta.exe", + "Tttracer.exe", "Verclsid.exe", "Wab.exe", "Wmic.exe", + "WorkFolders.exe", "Wuauclt.exe", "Xwizard.exe" + ) + NOT ( + Processes.parent_process IN ("*-k GPSvcGroup*", "*-k netsvcs", "*-k netsvcs -p","*-k netsvcs -p -s gpsvc") + Processes.process_name = "Gpscript.exe" + ) + NOT ( + Processes.parent_process IN ("*-k netsvcs", "*-k netsvcs -p", "*-k netsvcs -p -s wuauserv", "-k netsvcs -p -s Schedule") + Processes.process_name IN ("Wuauclt.exe", "Schedule.exe") + ) + NOT ( + Processes.parent_process = "*-k DcomLaunch*" + Processes.process_name IN ("PresentationHost.exe", "SettingSyncHost.exe") + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -44,11 +76,16 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Svchost.exe spawned a LOLBAS process on $dest$ + title: The parent process[$parent_process$] spawned a Living Off The Land process [$process_name$] on [$dest$] entity: field: dest type: system score: 50 +threat_objects: + - field: parent_process + type: process + - field: process_name + type: process_name analytic_story: - Active Directory Lateral Movement - Living Off The Land diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index cae5be714be..0d63144d23d 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -1,15 +1,43 @@ name: Time Provider Persistence Registry id: 5ba382c4-2105-11ec-8d8f-acde48001122 -version: 15 +version: 16 creation_date: '2021-09-29' -modification_date: '2026-05-13' +modification_date: '2026-07-08' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects suspicious modifications to the time provider registry for persistence and autostart. It leverages data from the Endpoint.Registry data model, focusing on changes to the "CurrentControlSet\\Services\\W32Time\\TimeProviders" registry path. This activity is significant because such modifications are uncommon and can indicate an attempt to establish persistence on a compromised host. If confirmed malicious, this technique allows an attacker to maintain access and execute code automatically upon system boot, potentially leading to further exploitation and control over the affected system. +description: |- + The following analytic detects suspicious modifications to the time provider registry for persistence and autostart. It leverages data from the Endpoint.Registry data model, focusing on changes to the "CurrentControlSet\\Services\\W32Time\\TimeProviders" registry path. + This activity is significant because such modifications are uncommon and can indicate an attempt to establish persistence on a compromised host. + If confirmed malicious, this technique allows an attacker to maintain access and execute code automatically upon system boot, potentially leading to further exploitation and control over the affected system. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `time_provider_persistence_registry_filter`' +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Registry WHERE + + Registry.registry_path="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders\\*" + Registry.registry_value_name = "DllName" + NOT Registry.registry_value_data IN + ( + "%SystemRoot%\System32\vmictimeprovider.dll", + "%SystemRoot%\System32\w32time.dll", + "C:\\Windows\\System32\\vmictimeprovider.dll", + "C:\\Windows\\System32\\w32time.dll" + ) + + by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type + Registry.status Registry.user Registry.vendor_product + + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `time_provider_persistence_registry_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_appcertdll_modification_via_command_line.yml b/detections/endpoint/windows_appcertdll_modification_via_command_line.yml index 6f0c70a235d..7a31021714d 100644 --- a/detections/endpoint/windows_appcertdll_modification_via_command_line.yml +++ b/detections/endpoint/windows_appcertdll_modification_via_command_line.yml @@ -2,7 +2,7 @@ name: Windows AppCertDLL Modification Via Command Line id: 3ba73a2b-3396-47e4-bdef-c80e6a7895c0 version: 2 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-07-27' author: Raven Tait, Splunk status: production type: Anomaly @@ -40,6 +40,8 @@ search: |- how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: |- Modifications to AppCertDLL keys may be made by legitimate software updates or trusted system management tools. Review changes to ensure they are from approved sources. +references: + - https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ diff --git a/detections/endpoint/windows_appcertdll_modification_via_registry.yml b/detections/endpoint/windows_appcertdll_modification_via_registry.yml new file mode 100644 index 00000000000..28aeaf306af --- /dev/null +++ b/detections/endpoint/windows_appcertdll_modification_via_registry.yml @@ -0,0 +1,80 @@ +name: Windows AppCertDLL Modification Via Registry +id: 547d98dd-6d6e-4aa4-be91-a1a119f48df3 +version: 1 +creation_date: '2026-07-27' +modification_date: '2026-07-27' +author: Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: |- + This analytic detects attempts to modify AppCertDLL registry entries. + Values under this registry entry are used to specify DLLs loaded by the Windows Session Manager. + Such modifications can be abused by attackers to load malicious code early in the system startup process, enabling persistent malware execution with high privileges. + If confirmed malicious, this behavior may lead to system compromise, persistence, and the evasion of security controls. +data_source: + - Sysmon EventID 13 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Registry WHERE + + Registry.action = "modified" + Registry.registry_path= "*\\Control\\Session Manager\\AppCertDLLs\\*" + Registry.registry_value_data = "*" + + by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status + Registry.user Registry.vendor_product + + | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_appcertdll_modification_via_registry_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 +known_false_positives: |- + Modifications to AppCertDLL entries may be made by legitimate software updates or trusted system management tools. Review changes to ensure they are from approved sources. +references: + - https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Potential AppCertDLL modification with value [$registry_value_data$] activity observed on [$dest$] +threat_objects: + - field: registry_value_data + type: registry_value_text +analytic_story: + - Windows Persistence Techniques + - Windows Privilege Escalation +asset_type: Endpoint +mitre_attack_id: + - T1546.009 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.009/snapattack/registry.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index 1a9ee0ad8df..d17aeac465f 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -124,5 +124,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml index fcb05ae216a..6b6034e879d 100644 --- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml +++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml @@ -1,18 +1,51 @@ name: Windows Curl Upload to Remote Destination id: 42f8f1a2-4228-11ec-aade-acde48001122 -version: 17 +version: 18 creation_date: '2021-11-10' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic detects the use of Windows Curl.exe to upload a file to a remote destination. It identifies command-line arguments such as `-T`, `--upload-file`, `-d`, `--data`, and `-F` in process execution logs. This activity is significant because adversaries may use Curl to exfiltrate data or upload malicious payloads. If confirmed malicious, this could lead to data breaches or further compromise of the system. Analysts should review parallel processes and network logs to determine if the upload was successful and isolate the endpoint if necessary. +description: |- + The following analytic detects the use of Windows Curl.exe to upload a file to a remote destination. + It identifies command-line arguments such as `-T`, `--upload-file`, `-d`, `--data`, and `-F` in process execution logs. + This activity is significant because adversaries may use Curl to exfiltrate data or upload malicious payloads. If confirmed malicious, this could lead to data breaches or further compromise of the system. + Analysts should review parallel processes and network logs to determine if the upload was successful and isolate the endpoint if necessary. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 - Cisco Network Visibility Module Flow Data -search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\nas lastTime from datamodel=Endpoint.Processes where\n(Processes.process_name=curl.exe OR Processes.original_file_name=Curl.exe)\nProcesses.process IN (\n \"*-T *\",\n \"*--upload-file *\",\n \"*-d *\",\n \"*--data *\",\n \"*-F *\"\n)\nby Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec\n Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path\n Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id\n Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id\n Processes.vendor_product\n| `drop_dm_object_name(Processes)`\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| `windows_curl_upload_to_remote_destination_filter`\n" +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + ( + Processes.process_name=curl.exe + OR + Processes.original_file_name=Curl.exe + ) + Processes.process IN ( + "*-T *", + "*--upload-file *", + "*-d *", + "*--data *", + "*-F *" + ) + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_curl_upload_to_remote_destination_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: False positives may be limited to source control applications and may be required to be filtered out. references: @@ -73,5 +106,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/windows_file_download_via_certutil.yml b/detections/endpoint/windows_file_download_via_certutil.yml index f2d30f8e3f0..b8105a3497b 100644 --- a/detections/endpoint/windows_file_download_via_certutil.yml +++ b/detections/endpoint/windows_file_download_via_certutil.yml @@ -2,7 +2,7 @@ name: Windows File Download Via CertUtil id: 7fac8d40-e370-45ea-a4a3-031bbcc18b02 version: 7 creation_date: '2021-03-24' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: TTP @@ -97,5 +97,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/windows_file_download_via_powershell.yml b/detections/endpoint/windows_file_download_via_powershell.yml index 0b1fc1c0236..72f19c64fe8 100644 --- a/detections/endpoint/windows_file_download_via_powershell.yml +++ b/detections/endpoint/windows_file_download_via_powershell.yml @@ -2,7 +2,7 @@ name: Windows File Download Via PowerShell id: 58c4e56c-b5b8-46a3-b5fb-6537dca3c6de version: 10 creation_date: '2021-03-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -108,5 +108,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml index 2c53140f8de..d6efe846e61 100644 --- a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml +++ b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml @@ -1,21 +1,43 @@ name: Windows File Without Extension In Critical Folder id: 0dbcac64-963c-11ec-bf04-acde48001122 -version: 12 +version: 13 creation_date: '2022-02-25' -modification_date: '2026-05-13' +modification_date: '2026-07-27' author: Teoderick Contreras, Bhavin Patel, Splunk status: production -type: TTP -description: This analytic detects the creation of files without extensions in critical Windows system and driver-related directories, including but not limited to System32\Drivers, Windows\WinSxS, and other known Windows driver storage and loading paths. The detection has been expanded to comprehensively cover all commonly abused and legitimate Windows driver folder locations, increasing visibility into attempts to stage or deploy kernel-mode components. The analytic leverages telemetry from the Endpoint.Filesystem data model, with a focus on file creation events and file path analysis. File creation activity in these directories—particularly involving extensionless files—is highly suspicious, as it may indicate the presence of destructive or stealthy malware. This behavior is consistent with malware families such as HermeticWiper, which deploy kernel driver components into trusted Windows driver directories to obtain low-level access and execute destructive payloads. If confirmed malicious, this activity can result in severe system compromise, including the deployment of malicious drivers, boot-sector or filesystem destruction, and ultimately system inoperability and irreversible data loss. +type: Anomaly +description: |- + This analytic detects the creation of files without extensions in critical Windows system and driver-related directories, including but not limited to System32\Drivers, Windows\WinSxS, and other known Windows driver storage and loading paths. + The analytic leverages telemetry from the Endpoint.Filesystem data model, with a focus on file creation events and file path analysis. + File creation activity in these directories—particularly involving extensionless files—is highly suspicious, as it may indicate the presence of destructive or stealthy malware. + This behavior is consistent with malware families such as HermeticWiper, which deploy kernel driver components into trusted Windows driver directories to obtain low-level access and execute destructive payloads. + If confirmed malicious, this activity can result in severe system compromise, including the deployment of malicious drivers, boot-sector or filesystem destruction, and ultimately system inoperability and irreversible data loss. data_source: - Sysmon EventID 11 search: | - | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem - where Filesystem.file_path IN("*\\System32\\drivers\\*", "*\\syswow64\\drivers\\*", "*\\WINDOWS\\inf\\*","*\\Program Files*", "*\\WINDOWS\\System32\\DriverStore\\*","*:\\Windows\\WinSxS\\*","*\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*","*\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*","*\\Windows\\servicing\\*", "*\\Windows\\ELAMBKUP\\*","*\\Windows\\Boot\\*","*\\System32\\Boot\\*","*\\System32\\Recovery\\*", "C:\\AMD\\*", "C:\\OEM\\*") + | tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Filesystem where + + Filesystem.action IN ("created", "modified") + Filesystem.file_path IN( + "*:\\AMD\\*", + "*:\\OEM\\*", + "*:\\Windows\\Boot\\*", + "*:\\Windows\\ELAMBKUP\\*", + "*:\\Windows\\INF\\*", + "*:\\Windows\\servicing\\*", + "*:\\Windows\\System32\\Boot\\*", + "*:\\Windows\\System32\\Drivers\\*", + "*:\\Windows\\System32\\DriverStore\\*", + "*:\\Windows\\System32\\Recovery\\*", + "*:\\Windows\\SysWOW64\\Drivers\\*" + ) + by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` | rex field="file_name" "\.(?<extension>[^\.]*$)" | where isnull(extension) @@ -23,7 +45,8 @@ search: | | `security_content_ctime(lastTime)` | `windows_file_without_extension_in_critical_folder_filter` how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. -known_false_positives: No false positives have been identified at this time. +known_false_positives: |- + If you are leveraging Sysmon, you may see false positives related to folder creation, since Event ID 11 does not contain enough information to determine if the file is a File or a Directory. Filter out those entries when leveraging this analytic. references: - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html - https://www.splunk.com/en_us/blog/security/detecting-hermeticwiper.html @@ -37,12 +60,12 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: Driver file with out file extension drop in $file_path$ on $dest$ - entity: - field: user - type: user - score: 50 +intermediate_findings: + entities: + - field: user + type: user + score: 20 + message: A file without extension [$file_name$] was dropped in a critical folder [$file_path$] by $user$ threat_objects: - field: file_name type: file_name diff --git a/detections/endpoint/windows_http_network_communication_from_msiexec.yml b/detections/endpoint/windows_http_network_communication_from_msiexec.yml index b9370a82696..b9c1505e46f 100644 --- a/detections/endpoint/windows_http_network_communication_from_msiexec.yml +++ b/detections/endpoint/windows_http_network_communication_from_msiexec.yml @@ -2,7 +2,7 @@ name: Windows HTTP Network Communication From MSIExec id: b0fd38c7-f71a-43a2-870e-f3ca06bcdd99 version: 11 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Michael Haag, Splunk status: production type: Anomaly @@ -109,5 +109,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index e1236510bb9..3b37e24b845 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -2,7 +2,7 @@ name: Windows InstallUtil Remote Network Connection id: 4fbf9270-43da-11ec-9486-acde48001122 version: 19 creation_date: '2021-11-12' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Michael Haag, Splunk status: production type: Anomaly @@ -96,5 +96,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/windows_installutil_url_in_command_line.yml b/detections/endpoint/windows_installutil_url_in_command_line.yml index 990d9030c9f..144f09ad86e 100644 --- a/detections/endpoint/windows_installutil_url_in_command_line.yml +++ b/detections/endpoint/windows_installutil_url_in_command_line.yml @@ -2,7 +2,7 @@ name: Windows InstallUtil URL in Command Line id: 28e06670-43df-11ec-a569-acde48001122 version: 15 creation_date: '2021-11-12' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Michael Haag, Splunk status: production type: TTP @@ -82,5 +82,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/windows_kerberos_local_successful_logon.yml b/detections/endpoint/windows_kerberos_local_successful_logon.yml index f272f56cefc..f056478f50a 100644 --- a/detections/endpoint/windows_kerberos_local_successful_logon.yml +++ b/detections/endpoint/windows_kerberos_local_successful_logon.yml @@ -1,29 +1,49 @@ name: Windows Kerberos Local Successful Logon id: 8309c3a8-4d34-48ae-ad66-631658214653 -version: 14 +version: 15 creation_date: '2022-04-28' -modification_date: '2026-05-13' +modification_date: '2026-07-27' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic identifies a local successful authentication event on a Windows endpoint using the Kerberos package. It detects EventCode 4624 with LogonType 3 and source address 127.0.0.1, indicating a login to the built-in local Administrator account. This activity is significant as it may suggest a Kerberos relay attack, a method attackers use to escalate privileges. If confirmed malicious, this could allow an attacker to gain unauthorized access to sensitive systems, execute arbitrary code, or create new accounts in Active Directory, leading to potential system compromise. +description: |- + The following analytic identifies a local successful authentication event on a Windows endpoint using the Kerberos package. + It detects EventCode 4624 with LogonType 3 and source address 127.0.0.1, indicating a login to the built-in local Administrator account. + This activity is significant as it may suggest a Kerberos relay attack, a method attackers use to escalate privileges. + If confirmed malicious, this could allow an attacker to gain unauthorized access to sensitive systems, execute arbitrary code, or create new accounts in Active Directory, leading to potential system compromise. data_source: - Windows Event Log Security 4624 search: |- - `wineventlog_security` EventCode=4624 LogonType=3 AuthenticationPackageName=Kerberos action=success src=127.0.0.1 - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY action app authentication_method - dest dvc process - process_id process_name process_path - signature signature_id src - src_port status subject - user user_group vendor_product - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_kerberos_local_successful_logon_filter` -how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4624 EventCode enabled. The Windows TA is also required. -known_false_positives: False positives are possible, filtering may be required to restrict to workstations vs domain controllers. Filter as needed. + `wineventlog_security` + EventCode=4624 + LogonType=3 + AuthenticationPackageName=Kerberos + action=success + src=127.0.0.1 + + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + BY action app authentication_method + dest dvc process + process_id process_name process_path + signature signature_id src + src_port status subject + user user_group vendor_product + + | lookup update=true domain_controllers sAMAccountName as dest OUTPUT isDC + | where isnull(isDC) + | fields - isDC + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_kerberos_local_successful_logon_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4624 EventCode enabled. The Windows TA is also required. + Populate the `domain_controllers` lookup with the hostnames that appear in the `dest` field for domain controllers in your environment. +known_false_positives: |- + False positives are possible, particularly from domain controllers that use Kerberos SSP and loopback authentication. + Add known domain controllers to the `domain_controllers` lookup to suppress those results. Filter as needed. references: - https://github.com/Dec0ne/KrbRelayUp drilldown_searches: diff --git a/detections/endpoint/windows_local_llm_framework_execution.yml b/detections/endpoint/windows_local_llm_framework_execution.yml index 4b89d908af5..3eb169770d2 100644 --- a/detections/endpoint/windows_local_llm_framework_execution.yml +++ b/detections/endpoint/windows_local_llm_framework_execution.yml @@ -1,9 +1,9 @@ name: Windows Local LLM Framework Execution id: a3f8e2c9-7d4b-4e1f-9c6a-2b5d8f3e1a7c -version: 2 +version: 3 creation_date: '2025-11-24' -modification_date: '2026-05-13' -author: Rod Soto, Splunk +modification_date: '2026-07-15' +author: Rod Soto, Nasreddine Bencherchali, Splunk status: production type: Hunting description: | @@ -37,13 +37,13 @@ search: | ) OR Processes.original_file_name IN ( - "ollama.exe", - "lmstudio.exe", "gpt4all.exe", "jan.exe", - "llama-run.exe", "koboldcpp.exe", - "nutstudio.exe" + "llama-run.exe", + "lmstudio.exe", + "nutstudio.exe", + "ollama.exe" ) OR Processes.process IN ( @@ -75,6 +75,20 @@ search: | "text-generation-webui.exe" ) ) + NOT Processes.process_name IN ( + "360se.exe", "Acrobat.exe", "arc.exe", "atlas.exe", "avastbrowser.exe", + "avgbrowser.exe", "blpbrowser.exe", "brave.exe", "braveupdate.exe", + "chrome.exe", "chromium.exe", "coccoc.exe", "comet.exe", "conhost.exe", + "dragon.exe", "duckduckgo.exe", "epic.exe", "EXCEL.EXE", "firefox.exe", + "FoxitPDFReader.exe", "ghost.exe", "iexplore.exe", "iridium.exe", "iron.exe", + "maxthon.exe", "microsoftedge.exe", "microsoftedgeupdate.exe", "msedge.exe", + "msedgewebview2.exe", "mspaint.exe", "NewformaOCR.exe", "notepad.exe", + "opera_autoupdate.exe", "opera.exe", "OUTLOOK.EXE", "perplexity.exe", + "Photos.exe", "POWERPNT.EXE", "rave.exe", "Revu.exe", "safari.exe", + "shift.exe", "sidekick.exe", "Stapler.exe", "thorium.exe", "torch.exe", + "vivaldi.exe", "wavebrowser.exe", "whale.exe", "WINWORD.EXE", "zen.exe" + ) + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process diff --git a/detections/endpoint/windows_mark_of_the_web_bypass.yml b/detections/endpoint/windows_mark_of_the_web_bypass.yml index 6a8b4928ae4..e4ab37c13df 100644 --- a/detections/endpoint/windows_mark_of_the_web_bypass.yml +++ b/detections/endpoint/windows_mark_of_the_web_bypass.yml @@ -1,26 +1,30 @@ name: Windows Mark Of The Web Bypass id: 8ca13343-7405-4916-a2d1-ae34ce0c28ae -version: 12 +version: 13 creation_date: '2023-08-14' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic identifies a suspicious process that deletes the Mark-of-the-Web (MOTW) data stream. It leverages Sysmon EventCode 23 to detect when a file's Zone.Identifier stream is removed. This activity is significant because it is a common technique used by malware, such as Ave Maria RAT, to bypass security restrictions on files downloaded from the internet. If confirmed malicious, this behavior could allow an attacker to execute potentially harmful files without triggering security warnings, leading to further compromise of the system. data_source: - Sysmon EventID 23 + - Sysmon EventID 26 search: |- - `sysmon` EventCode=23 TargetFilename = "*:Zone.Identifier" - | stats count min(_time) as firstTime, max(_time) as lastTime - BY action dest dvc - file_path file_hash file_name - file_modify_time process_exec process_guid - process_id process_name process_path - signature signature_id user - user_id vendor_product - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_mark_of_the_web_bypass_filter` + `sysmon` + EventCode IN (23, 26) + TargetFilename = "*:Zone.Identifier" + | stats count min(_time) as firstTime + max(_time) as lastTime + BY action dest dvc file_path + file_hash file_name + file_modify_time process_exec process_guid + process_id process_name process_path + signature signature_id user + user_id vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_mark_of_the_web_bypass_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the deleted target file name, process name and process id from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_msi_rollback_script_deleted_by_non_msiexec_process.yml b/detections/endpoint/windows_msi_rollback_script_deleted_by_non_msiexec_process.yml index ca74e68602f..f02724f4c2a 100644 --- a/detections/endpoint/windows_msi_rollback_script_deleted_by_non_msiexec_process.yml +++ b/detections/endpoint/windows_msi_rollback_script_deleted_by_non_msiexec_process.yml @@ -1,8 +1,8 @@ name: Windows MSI Rollback Script Deleted By Non-Msiexec Process id: 6ec7cbda-9547-4f6b-8a00-d1fb4b52c1e9 -version: 2 +version: 3 creation_date: '2026-05-05' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Raven Tait, Splunk status: production type: TTP @@ -13,9 +13,10 @@ description: |- The folder is protected with a strong DACL specifically to prevent tampering by low-privileged users — because whatever is in these files will be executed by the SYSTEM-level Installer service during rollback. data_source: - Sysmon EventID 23 + - Sysmon EventID 26 search: |- `sysmon` - EventID=23 + EventCode IN (23, 26) TargetFilename="*:\\Config.Msi\\*" TargetFilename="*.rbs" NOT ProcessName="msiexec.exe" diff --git a/detections/endpoint/windows_msiexec_remote_download.yml b/detections/endpoint/windows_msiexec_remote_download.yml index 26ae59b55ad..b6fc68b7953 100644 --- a/detections/endpoint/windows_msiexec_remote_download.yml +++ b/detections/endpoint/windows_msiexec_remote_download.yml @@ -2,7 +2,7 @@ name: Windows MSIExec Remote Download id: 6aa49ff2-3c92-4586-83e0-d83eb693dfda version: 17 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Michael Haag, Splunk status: production type: Anomaly @@ -98,5 +98,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/windows_powershell_fakecaptcha_clipboard_execution.yml b/detections/endpoint/windows_powershell_fakecaptcha_clipboard_execution.yml index 1a1edbc2233..c6b1440c9b3 100644 --- a/detections/endpoint/windows_powershell_fakecaptcha_clipboard_execution.yml +++ b/detections/endpoint/windows_powershell_fakecaptcha_clipboard_execution.yml @@ -2,7 +2,7 @@ name: Windows PowerShell FakeCAPTCHA Clipboard Execution id: d81d4d3d-76b5-4f21-ab51-b17d5164c106 version: 9 creation_date: '2025-05-19' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Michael Haag, Splunk status: production type: TTP @@ -99,5 +99,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/windows_process_with_namedpipe_commandline.yml b/detections/endpoint/windows_process_with_namedpipe_commandline.yml index 7237ee14b21..236b6b47f3e 100644 --- a/detections/endpoint/windows_process_with_namedpipe_commandline.yml +++ b/detections/endpoint/windows_process_with_namedpipe_commandline.yml @@ -1,19 +1,58 @@ name: Windows Process With NamedPipe CommandLine id: e64399d4-94a8-11ec-a9da-acde48001122 -version: 9 +version: 10 creation_date: '2022-02-23' -modification_date: '2026-05-13' +modification_date: '2026-07-08' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects processes with command lines containing named pipes. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line executions. This behavior is significant as it is often used by adversaries, such as those behind the Olympic Destroyer malware, for inter-process communication post-injection, aiding in defense evasion and privilege escalation. If confirmed malicious, this activity could allow attackers to maintain persistence, escalate privileges, or evade defenses, potentially leading to further compromise of the system. +description: |- + The following analytic detects processes with command lines containing named pipes. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line executions. + This behavior is significant as it is often used by adversaries, such as those behind the Olympic Destroyer malware, for inter-process communication post-injection, aiding in defense evasion and privilege escalation. + If confirmed malicious, this activity could allow attackers to maintain persistence, escalate privileges, or evade defenses, potentially leading to further compromise of the system. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*\\\\.\\pipe\\*" NOT Processes.process_path IN ("C:\\Program Files\\*", "C:\\Program Files (x86)\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_with_namedpipe_commandline_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Normal browser application may use this technique. Please update the filter macros to remove false positives. +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process = "*\\\\.\\pipe\\*" + ( + NOT Processes.parent_process_path IN ( + "*:\\Program Files (x86)\\*", + "*:\\Program Files\\*", + "*:\\Windows\\System32\\*", + "*:\\Windows\\SysWOW64\\*" + ) + OR + NOT Processes.process_path IN ( + "*:\\Program Files (x86)\\*", + "*:\\Program Files\\*", + "*:\\Windows\\System32\\*", + "*:\\Windows\\SysWOW64\\*" + ) + ) + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process + Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_process_with_namedpipe_commandline_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Normal browser application may use this technique. Please update the filter macros to remove false positives. references: - https://blog.talosintelligence.com/2018/02/olympic-destroyer.html drilldown_searches: @@ -30,7 +69,7 @@ intermediate_findings: - field: dest type: system score: 20 - message: Process with named pipe in $process$ on $dest$ + message: The parent process $parent_process$ spawned a process with the CommandLine $process$ that contains a named pipe on $dest$ analytic_story: - Windows Defense Evasion Tactics asset_type: Endpoint diff --git a/detections/endpoint/windows_rdp_automaticdestinations_deletion.yml b/detections/endpoint/windows_rdp_automaticdestinations_deletion.yml index 960c884be4c..4b125314999 100644 --- a/detections/endpoint/windows_rdp_automaticdestinations_deletion.yml +++ b/detections/endpoint/windows_rdp_automaticdestinations_deletion.yml @@ -1,8 +1,8 @@ name: Windows Rdp AutomaticDestinations Deletion id: e40a40a1-9fea-4554-abdf-b164422f0627 -version: 4 +version: 5 creation_date: '2025-08-06' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -10,7 +10,21 @@ description: This detection identifies the deletion of files within the Automati data_source: - Sysmon EventID 23 - Sysmon EventID 26 -search: '`sysmon` EventCode=23 TargetFilename IN ("*\\Recent\\AutomaticDestinations*") | stats count min(_time) as firstTime, max(_time) as lastTime by action dest dvc file_path file_hash file_name file_modify_time process_exec process_guid process_id process_name process_path signature signature_id user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rdp_automaticdestinations_deletion_filter`' +search: |- + `sysmon` + EventCode IN (23, 26) + TargetFilename IN ("*\\Recent\\AutomaticDestinations*") + | stats count min(_time) as firstTime + max(_time) as lastTime + + by action dest dvc file_path file_hash file_name + file_modify_time process_exec process_guid process_id + process_name process_path signature + signature_id user user_id vendor_product + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_rdp_automaticdestinations_deletion_filter` how_to_implement: To successfully implement this search, you must ingest logs that include the process name, TargetFilename, and ProcessID executions from your endpoints. If you are utilizing Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed. known_false_positives: False positives will be present, filter as needed or restrict to critical assets on the perimeter. references: diff --git a/detections/endpoint/windows_rdp_cache_file_deletion.yml b/detections/endpoint/windows_rdp_cache_file_deletion.yml index e08eb6d6996..dff11ef0e70 100644 --- a/detections/endpoint/windows_rdp_cache_file_deletion.yml +++ b/detections/endpoint/windows_rdp_cache_file_deletion.yml @@ -1,16 +1,38 @@ name: Windows RDP Cache File Deletion id: f3e86ff3-b1f9-4382-8924-6913385f1019 -version: 4 +version: 5 creation_date: '2025-08-06' -modification_date: '2026-05-13' +modification_date: '2026-07-20' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: This detection identifies the deletion of RDP bitmap cache files—specifically .bmc and .bin files—typically stored in the user profile under the Terminal Server Client\Cache directory. These files are created by the native Windows Remote Desktop Client (mstsc.exe) and store graphical elements from remote sessions to improve performance. Deleting these files may indicate an attempt to remove forensic evidence of RDP usage. While rare in legitimate user behavior, this action is commonly associated with defense evasion techniques used by attackers or red teamers who wish to hide traces of interactive remote access. When observed in conjunction with recent logon activity, RDP session indicators, or script execution, this behavior should be treated as potentially malicious. Monitoring for deletion of these files provides valuable visibility into anti-forensic actions that often follow lateral movement or hands-on-keyboard activity. +description: |- + This detection identifies the deletion of RDP bitmap cache files—specifically .bmc and .bin files—typically stored in the user profile under the Terminal Server Client\Cache directory. + These files are created by the native Windows Remote Desktop Client (mstsc.exe) and store graphical elements from remote sessions to improve performance. + Deleting these files may indicate an attempt to remove forensic evidence of RDP usage. + While rare in legitimate user behavior, this action is commonly associated with defense evasion techniques used by attackers or red teamers who wish to hide traces of interactive remote access. + When observed in conjunction with recent logon activity, RDP session indicators, or script execution, this behavior should be treated as potentially malicious. Monitoring for deletion of these files provides valuable visibility into anti-forensic actions that often follow lateral movement or hands-on-keyboard activity. data_source: - Sysmon EventID 23 - Sysmon EventID 26 -search: '`sysmon` EventCode IN ("23", "26") TargetFilename IN ("*\\Terminal Server Client\\Cache\\*.bmc", "*\\Terminal Server Client\\Cache\\cache*.bin") | stats count min(_time) as firstTime, max(_time) as lastTime by action dest dvc file_path file_hash file_name file_modify_time process_exec process_guid process_id process_name process_path signature signature_id user user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rdp_cache_file_deletion_filter`' +search: |- + `sysmon` + EventCode IN (23, 26) + TargetFilename IN ( + "*\\Terminal Server Client\\Cache\\*.bmc", + "*\\Terminal Server Client\\Cache\\cache*.bin" + ) + | stats count min(_time) as firstTime + max(_time) as lastTime + + by action dest dvc file_path file_hash file_name + file_modify_time process_exec process_guid process_id + process_name process_path signature + signature_id user user_id vendor_product + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_rdp_cache_file_deletion_filter` how_to_implement: To successfully implement this search, you must ingest logs that include the process name, TargetFilename, and ProcessID executions from your endpoints. If you are utilizing Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed. known_false_positives: False positives will be present, filter as needed or restrict to critical assets on the perimeter. references: diff --git a/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml b/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml index aaf60e32cd5..2dbde3a76f3 100644 --- a/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml +++ b/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml @@ -1,8 +1,8 @@ name: Windows Suspicious Defender Update Activity in INetCache id: 3e25f906-6319-44ad-ab9a-22d162eb3925 -version: 1 +version: 2 creation_date: '2026-04-27' -modification_date: '2026-04-27' +modification_date: '2026-07-20' author: Raven Tait, Splunk status: production type: Anomaly @@ -15,7 +15,7 @@ data_source: - Sysmon EventID 23 search: |- `sysmon` - EventID IN ("11","23") + EventID IN (11, 23, 26) TargetFilename="*\\INetCache*" TargetFilename="*\\mpam-fe[1].exe*" NOT Image IN ( diff --git a/detections/endpoint/windows_winscp_configuration_security_access.yml b/detections/endpoint/windows_winscp_configuration_security_access.yml index 14e78754bc2..5e11ead6c81 100644 --- a/detections/endpoint/windows_winscp_configuration_security_access.yml +++ b/detections/endpoint/windows_winscp_configuration_security_access.yml @@ -1,8 +1,8 @@ name: Windows WinSCP Configuration Security Access id: 90013cc4-585b-4437-a95f-099933974f3e -version: 1 +version: 2 creation_date: '2026-06-24' -modification_date: '2026-06-24' +modification_date: '2026-07-22' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -17,7 +17,7 @@ search: |- `wineventlog_security` EventCode=4663 object_file_path="*\\Martin Prikryl\\WinSCP 2\\Configuration\\Security*" - NOT process_name IN ("winscp.exe") + NOT process_path IN ("*:\\Program Files (x86)\\WinSCP\\WinSCP.exe") | stats count min(_time) as firstTime max(_time) as lastTime @@ -32,7 +32,7 @@ how_to_implement: |- To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." known_false_positives: |- - False positive may occur during backup or anti-virus scanning process. Filter as needed. + False positive may occur during backup or anti-virus scanning process, as well as from WinSCP itself if it is installed in a different path than the default path. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.phantom_stealer - https://www.proofpoint.com/us/blog/threat-insight/not-safe-work-tracking-and-investigating-stealerium-and-phantom-infostealers diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml index 5a613d7bc2d..62ae6bd88a3 100644 --- a/detections/endpoint/wmic_xsl_execution_via_url.yml +++ b/detections/endpoint/wmic_xsl_execution_via_url.yml @@ -2,7 +2,7 @@ name: WMIC XSL Execution via URL id: 787e9dd0-4328-11ec-a029-acde48001122 version: 14 creation_date: '2021-11-12' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Michael Haag, Splunk status: production type: TTP @@ -103,5 +103,5 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata.log source: not_applicable - sourcetype: cisco:nvm:flowdata + sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/lookups/csv/domain_controllers.csv b/lookups/csv/domain_controllers.csv new file mode 100644 index 00000000000..8fa743818bf --- /dev/null +++ b/lookups/csv/domain_controllers.csv @@ -0,0 +1,2 @@ +sAMAccountName,isDC +dc01.example.com,true diff --git a/lookups/csv/domain_controllers.yml b/lookups/csv/domain_controllers.yml new file mode 100644 index 00000000000..dd6b054aec2 --- /dev/null +++ b/lookups/csv/domain_controllers.yml @@ -0,0 +1,9 @@ +name: domain_controllers +id: f9983e0d-0201-40c1-babe-8b66b2cf963d +version: 1 +creation_date: '2026-07-27' +modification_date: '2026-07-27' +author: Splunk Threat Research Team +lookup_type: csv +description: A list of domain controller hostnames used to filter known domain controllers. +case_sensitive_match: false diff --git a/lookups/csv/ransomware_notes_lookup.csv b/lookups/csv/ransomware_notes_lookup.csv index be84e2dbd88..a92a6a53072 100644 --- a/lookups/csv/ransomware_notes_lookup.csv +++ b/lookups/csv/ransomware_notes_lookup.csv @@ -69,7 +69,6 @@ MILIHPEN-INSTRUCT.txt,True GANGBANG-NOTE.txt,True GET_YOUR_FILES_BACK.txt,True read_it.txt,True -*.README.txt, True *READ_ME_MEDUSA*.TXT,True How_to_back_files.HTML,True CriticalBreachDetected.pdf,True diff --git a/lookups/csv/ransomware_notes_lookup.yml b/lookups/csv/ransomware_notes_lookup.yml index 0de6c22f194..9fcc5ac27a3 100644 --- a/lookups/csv/ransomware_notes_lookup.yml +++ b/lookups/csv/ransomware_notes_lookup.yml @@ -1,8 +1,8 @@ name: ransomware_notes_lookup id: 93d9fb06-035e-496c-91d5-7a79543ce1e1 -version: 5 +version: 6 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-07-02' author: Splunk Threat Research Team lookup_type: csv description: A list of file names that are ransomware note files diff --git a/macros/cisco_network_visibility_module_flowdata.yml b/macros/cisco_network_visibility_module_flowdata.yml index 800640357ea..2bd734e8d1c 100644 --- a/macros/cisco_network_visibility_module_flowdata.yml +++ b/macros/cisco_network_visibility_module_flowdata.yml @@ -1,8 +1,8 @@ name: cisco_network_visibility_module_flowdata id: f6c50d56-4ae1-4dd3-b265-d2b00f9e3eb4 -version: 1 +version: 2 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-07-14' author: Splunk Threat Research Team description: customer specific splunk configurations(eg- index, source, sourcetype) for Cisco Network Visibility Module flow logs. Replace the macro definition with configurations for your Splunk Environment. -definition: sourcetype="cisco:nvm:flowdata" +definition: sourcetype IN ("cisco:nvm:flowdata", "cisco:nvm:flowdata:v2") From 345f42f5ac86acd8c4bcba3c38e69c705df7f20b Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali <nbencher@cisco.com> Date: Mon, 27 Jul 2026 21:51:33 +0200 Subject: [PATCH 037/162] Fix Issues (#4182) --- .github/workflows/unit-testing.yml | 3 ++- detections/endpoint/linux_apparmor_bypass_via_aaexec.yml | 2 +- .../endpoint/svchost_lolbas_execution_process_spawn.yml | 2 +- detections/endpoint/time_provider_persistence_registry.yml | 4 ++-- 4 files changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index c15bbc1aa35..ad8abf2ddaf 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -3,10 +3,11 @@ on: pull_request: types: [opened, reopened, synchronize] paths: - - detections/** - data_sources/** + - detections/** - lookups/** - macros/** + - install.yml jobs: unit-testing: runs-on: large-ubuntu-22.04-32core diff --git a/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml b/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml index 21c54d3be5e..a4c72035103 100644 --- a/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml +++ b/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml @@ -16,7 +16,7 @@ search: |- AND Processes.process="* -p *" AND Processes.process="*--*" AND Processes.process IN ("*trinity*","*chrome*","*flatpak*") - AND NOT Processes.process_name IN ("/user*","/opt*","/snap*","/var/lib/flatpak*") + AND NOT Processes.process_path IN ("/user*","/opt*","/snap*","/var/lib/flatpak*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id diff --git a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml index 02c80f91498..2d1937a88b6 100644 --- a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml @@ -41,7 +41,7 @@ search: |- ) NOT ( Processes.parent_process IN ("*-k netsvcs", "*-k netsvcs -p", "*-k netsvcs -p -s wuauserv", "-k netsvcs -p -s Schedule") - Processes.process_name IN ("Wuauclt.exe", "Schedule.exe") + Processes.process_name IN ("Wuauclt.exe", "Schtasks.exe") ) NOT ( Processes.parent_process = "*-k DcomLaunch*" diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index 0d63144d23d..2510d5a640f 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -23,8 +23,8 @@ search: |- Registry.registry_value_name = "DllName" NOT Registry.registry_value_data IN ( - "%SystemRoot%\System32\vmictimeprovider.dll", - "%SystemRoot%\System32\w32time.dll", + "%SystemRoot%\\System32\\vmictimeprovider.dll", + "%SystemRoot%\\System32\\w32time.dll", "C:\\Windows\\System32\\vmictimeprovider.dll", "C:\\Windows\\System32\\w32time.dll" ) From dfcad81abae066a47c20a1cfdef35be27cde0a66 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Mon, 27 Jul 2026 15:17:52 -0700 Subject: [PATCH 038/162] updating based on Nas' comment (#4183) --- detections/endpoint/linux_apparmor_bypass_via_aaexec.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml b/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml index a4c72035103..903cb6d04e0 100644 --- a/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml +++ b/detections/endpoint/linux_apparmor_bypass_via_aaexec.yml @@ -16,7 +16,7 @@ search: |- AND Processes.process="* -p *" AND Processes.process="*--*" AND Processes.process IN ("*trinity*","*chrome*","*flatpak*") - AND NOT Processes.process_path IN ("/user*","/opt*","/snap*","/var/lib/flatpak*") + AND NOT Processes.process IN ("/user*","/opt*","/snap*","/var/lib/flatpak*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id From a79a08f073c1330309f3c0e16ea6ce6e0f41a221 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Mon, 27 Jul 2026 15:19:32 -0700 Subject: [PATCH 039/162] removing dashbaord due to VULN (#4184) --- dashboards/threat_activity_by_snort_ids.json | 963 ------------------- dashboards/threat_activity_by_snort_ids.yml | 7 - 2 files changed, 970 deletions(-) delete mode 100644 dashboards/threat_activity_by_snort_ids.json delete mode 100644 dashboards/threat_activity_by_snort_ids.yml diff --git a/dashboards/threat_activity_by_snort_ids.json b/dashboards/threat_activity_by_snort_ids.json deleted file mode 100644 index b872568e9d2..00000000000 --- a/dashboards/threat_activity_by_snort_ids.json +++ /dev/null @@ -1,963 +0,0 @@ -{ - "title": "Threat Activity by Snort IDs", - "description": "Use this dashboard to explore how Snort signatures correlate with specific threats and surfaces broader device activity. It’s organized into four tabs:", - "inputs": { - "input_global_trp": { - "options": { - "defaultValue": "-24h@h,now", - "token": "global_time" - }, - "title": "Global Time Range", - "type": "input.timerange" - }, - "input_tlWhhLwR": { - "containerOptions": { - "visibility": { - "hideWhenNoData": true - } - }, - "context": { - "formattedConfig": { - "number": { - "prefix": "" - } - }, - "formattedStatics": ">statics | formatByType(formattedConfig)", - "label": ">primary | seriesByName(\"threat\") | renameSeries(\"label\") | formatByType(formattedConfig)", - "statics": [], - "value": ">primary | seriesByName(\"threat\") | renameSeries(\"value\") | formatByType(formattedConfig)" - }, - "dataSources": { - "primary": "ds_i58D84BP" - }, - "options": { - "defaultValue": "Select a threat", - "items": ">frame(label, value) | prepend(formattedStatics) | objects()", - "token": "threat_token" - }, - "title": "Threat", - "type": "input.dropdown" - } - }, - "defaults": { - "dataSources": { - "ds.search": { - "options": { - "queryParameters": { - "earliest": "$global_time.earliest$", - "latest": "$global_time.latest$" - } - } - } - } - }, - "visualizations": { - "viz_1ZFeC3zY": { - "containerOptions": {}, - "dataSources": { - "primary": "ds_m3IAfEaF" - }, - "description": "This table shows a detailed view of the snort events matched with the threat", - "eventHandlers": [ - { - "options": { - "tabId": "layout_hEVylosH" - }, - "type": "drilldown.switchToTab" - } - ], - "showLastUpdated": false, - "showProgressBar": false, - "title": "Snort Intrusion Events for - $threat_token$", - "type": "splunk.table" - }, - "viz_3VU4OAeI": { - "containerOptions": {}, - "dataSources": { - "primary": "ds_fwElVms9" - }, - "description": "This table shows how many distinct source IPs hit each day.", - "options": { - "backgroundColor": "transparent", - "seriesColors": [ - "#7B56DB", - "#009CEB", - "#62b3b2", - "#DD9900", - "#FF677B", - "#CB2196", - "#813193", - "#0051B5", - "#008C80", - "#99B100", - "#FFA476", - "#FF6ACE", - "#AE8CFF", - "#00689D", - "#00490A", - "#465D00", - "#9D6300", - "#F6540B", - "#FF969E", - "#E47BFE" - ] - }, - "showLastUpdated": false, - "showProgressBar": false, - "title": "Unique Attackers per Day", - "type": "splunk.column" - }, - "viz_70gtzPTV": { - "options": { - "backgroundColor": "#ffffff", - "fontColor": "#0877a6", - "fontSize": "large", - "markdown": "### Timeline\n\n- Visualizes the daily activity related to all Snort signature \n\n- Tracks total intrusion attempts per the selected time range\n- Highlights frequency and consistency of threat activity over time" - }, - "type": "splunk.markdown" - }, - "viz_8VIu1U0s": { - "containerOptions": {}, - "context": {}, - "dataSources": { - "primary": "ds_8LU6nawL" - }, - "description": "This table gives you an overview of all active threat actors in your environment", - "options": {}, - "showLastUpdated": false, - "showProgressBar": false, - "title": "All Intrusion Events by Threat Actor", - "type": "splunk.pie" - }, - "viz_AQzurdgj": { - "containerOptions": {}, - "context": { - "majorColorEditorConfig": [ - { - "to": 20, - "value": "#ffffff" - }, - { - "from": 20, - "to": 40, - "value": "#669922" - }, - { - "from": 40, - "to": 80, - "value": "#cba700" - }, - { - "from": 80, - "value": "#d41f1f" - } - ], - "trendColorEditorConfig": [ - { - "to": 0, - "value": "#9E2520" - }, - { - "from": 0, - "value": "#1C6B2D" - } - ] - }, - "dataSources": { - "primary": "ds_cU42yLz2" - }, - "description": "This table shows the file events per day", - "options": {}, - "showLastUpdated": false, - "showProgressBar": false, - "title": "File Events Trend", - "type": "splunk.area" - }, - "viz_FY6hwnml": { - "dataSources": { - "primary": "ds_wzZtYKW7" - }, - "description": "Shows the IP address currently being investigated", - "title": "Investigating IP", - "type": "splunk.singlevalue" - }, - "viz_ISoX6BgF": { - "containerOptions": {}, - "dataSources": { - "primary": "ds_z10zC280" - }, - "description": "This table shows all the various file_events on $dest_ip$", - "showLastUpdated": false, - "showProgressBar": false, - "title": "File Events on $dest_ip$", - "type": "splunk.events" - }, - "viz_KQjoxczF": { - "containerOptions": {}, - "dataSources": { - "primary": "ds_PpNvhTDF" - }, - "description": "This shows the distinct number of snort signatures matched for this threat", - "showLastUpdated": false, - "showProgressBar": false, - "title": "Distinct Snort Signature Hits", - "type": "splunk.singlevalue" - }, - "viz_NT8j5Ogy": { - "dataSources": { - "primary": "ds_ta3O0H2Z" - }, - "options": { - "center": [ - 45.503975321779336, - -48.221416265989774 - ], - "zoom": 1.6208701026526793 - }, - "title": "Connection Events", - "type": "splunk.map" - }, - "viz_SnsguT0c": { - "containerOptions": {}, - "dataSources": { - "primary": "ds_f4HzVHsa" - }, - "description": "This is the description of the selected threat actor - $threat_token$", - "options": { - "fontSize": "large", - "headerVisibility": "fixed" - }, - "showLastUpdated": false, - "showProgressBar": false, - "title": "Threat Desciption", - "type": "splunk.table" - }, - "viz_T6i68u8y": { - "containerOptions": {}, - "context": {}, - "dataSources": { - "primary": "ds_QAFOBzEx" - }, - "options": {}, - "showLastUpdated": false, - "showProgressBar": false, - "title": "Volume Inbound", - "type": "splunk.singlevalue" - }, - "viz_VpTFMowK": { - "containerOptions": {}, - "context": { - "Search_NameColumnFormatEditorConfig": { - "string": { - "unitPosition": "after" - } - } - }, - "dataSources": { - "primary": "ds_0SEcxnrn" - }, - "description": "List of related risk events in Enterprise Security for the affected host - $dest_ip$", - "eventHandlers": [ - { - "options": { - "app": "CiscoSecurityCloud", - "newTab": true, - "report": "Risk - Risk Modifiers Over Time" - }, - "type": "drilldown.linkToReport" - } - ], - "options": { - "columnFormat": { - "Search Name": { - "align": "auto", - "data": "> table | seriesByName(\"Search Name\") | formatByType(Search_NameColumnFormatEditorConfig)", - "headerAlign": "auto", - "textOverflow": "break-word", - "width": 150 - }, - "_time": { - "width": 60 - }, - "dest_ip": { - "width": 60 - } - }, - "tableFormat": { - "align": "left" - } - }, - "showLastUpdated": false, - "showProgressBar": false, - "title": "Risk Events in Enterprise Security - $dest_ip$", - "type": "splunk.table" - }, - "viz_WhFvmhK9": { - "options": { - "backgroundColor": "#ffffff", - "fontColor": "#f1813f", - "fontSize": "large", - "markdown": "\n### Risk Events\n- Surfaces all risk events tied to the Destination IP \n- Helps you understand what are the ESCU alerts in Enterprise Security\n" - }, - "type": "splunk.markdown" - }, - "viz_ZblgpoVk": { - "containerOptions": {}, - "dataSources": { - "primary": "ds_Q6zbF7Qb" - }, - "description": "This shows the snort signatures matched for this threat", - "eventHandlers": [ - { - "options": { - "tabId": "layout_hEVylosH" - }, - "type": "drilldown.switchToTab" - } - ], - "showLastUpdated": false, - "showProgressBar": false, - "title": "Top Snort Signatures", - "type": "splunk.table" - }, - "viz_darglsFq": { - "containerOptions": {}, - "context": {}, - "dataSources": { - "primary": "ds_q9NVolej" - }, - "options": {}, - "showLastUpdated": false, - "showProgressBar": false, - "title": "Volume Outbound", - "type": "splunk.singlevalue" - }, - "viz_fjbFV5up": { - "containerOptions": {}, - "dataSources": { - "primary": "ds_YybVUCKh" - }, - "description": "This shows the distinct number of affected hosts matched for this threat", - "showLastUpdated": false, - "showProgressBar": false, - "title": "Affected Hosts", - "type": "splunk.singlevalueradial" - }, - "viz_gryqfMyv": { - "options": { - "backgroundColor": "#ffffff", - "fontColor": "#dc4e41", - "fontSize": "large", - "markdown": "\n### Activity Explorer\n\n- Lists all connection and file events related to the affected host for the selected time range" - }, - "type": "splunk.markdown" - }, - "viz_kMW90k69": { - "dataSources": { - "primary": "ds_8sclv3pU" - }, - "description": "This visualizes daily snort events matched for the dest_ip", - "options": { - "xAxisTitleText": "Time", - "yAxisTitleText": "Count of signatures" - }, - "title": "Signatures matched on a Per Day Basis on $dest_ip$", - "type": "splunk.line" - }, - "viz_nr87RKRM": { - "dataSources": { - "primary": "ds_7LZlDEZh" - }, - "eventHandlers": [ - { - "options": { - "tokens": [ - { - "key": "value", - "token": "connection_id" - }, - { - "key": "value", - "token": "dest_ip" - } - ] - }, - "type": "drilldown.setToken" - } - ], - "options": { - "headerVisibility": "fixed", - "showInternalFields": false, - "tableFormat": { - "align": "left" - } - }, - "title": "Connection Events from and to all Source IPs", - "type": "splunk.table" - }, - "viz_q5G96ojA": { - "containerOptions": { - "visibility": {} - }, - "dataSources": { - "primary": "ds_70zt6tTO" - }, - "description": "This table shows you the affected hosts in your environment.", - "eventHandlers": [ - { - "options": { - "tabId": "layout_fRHBDK2O" - }, - "type": "drilldown.switchToTab" - }, - { - "options": { - "tokens": [ - { - "key": "value", - "token": "dest_ip" - } - ] - }, - "type": "drilldown.setToken" - } - ], - "options": { - "backgroundColor": "> themes.defaultBackgroundColor", - "count": 5, - "fontSize": "large", - "headerVisibility": "fixed", - "tableFormat": { - "align": "center", - "headerAlign": "center", - "rowBackgroundColors": "> table | seriesByIndex(0) | pick(tableAltRowBackgroundColorsByTheme)" - } - }, - "showLastUpdated": false, - "showProgressBar": false, - "title": "Affected Hosts", - "type": "splunk.table" - }, - "viz_uCVQgdVt": { - "containerOptions": {}, - "dataSources": { - "primary": "ds_ULaiHv6R" - }, - "options": { - "backgroundColor": "transparent" - }, - "showLastUpdated": false, - "showProgressBar": false, - "title": "Risk Event Timeline", - "type": "splunk.column" - }, - "viz_wl93h7VE": { - "options": { - "backgroundColor": "#ffffff", - "fontColor": "#dc4e41", - "fontSize": "large", - "markdown": "### Overview\n- Shows the view of threats that are currently being tracked \n- Table of Affected hosts with known snort signatures \n- Ensure that the `cisco_secure_firewall` macro is configured to use the right index\n- The Snort IDs to threat mapping is stored in the following lookups: \n\n - cisco_snort_ids_to_threat_mapping\n - threat_snort_count \n\n### Select a threat from the dropdown and click on the Host IP Address" - }, - "type": "splunk.markdown" - }, - "viz_xuwsrI0Q": { - "containerOptions": {}, - "context": {}, - "dataSources": { - "primary": "ds_XtgOToUG" - }, - "description": "Tables lists the various Mitre techniques found on affected host", - "options": {}, - "showLastUpdated": false, - "showProgressBar": false, - "title": "Mitre Techniques detected on $dest_ip$", - "type": "splunk.pie" - } - }, - "dataSources": { - "ds_0SEcxnrn": { - "name": "risk_events", - "options": { - "enableSmartSources": true, - "query": "| from datamodel Risk.All_Risk | rename normalized_risk_object AS dest_ip | search dest_ip = $dest_ip$\n| stats count by search_name" - }, - "type": "ds.search" - }, - "ds_70zt6tTO": { - "name": "affected_hosts", - "options": { - "extend": "ds_mGcuwEO0", - "query": "| search threat=\"$threat_token$\"\n| stats count by dest_ip\n| rename dest_ip as \"Host IP Address\"\n| table \"Host IP Address\"" - }, - "type": "ds.chain" - }, - "ds_7LZlDEZh": { - "name": "Top Source IP count", - "options": { - "query": "`cisco_secure_firewall` EventType=ConnectionEvent dest_ip = $dest_ip$\n| stats count BY dest_ip src_ip connection_id | sort count" - }, - "type": "ds.search" - }, - "ds_7sRMJ3vQ": { - "name": "snort_ids_threat_actor_lookup", - "options": { - "query": "|inputlookup cisco_snort_ids_to_threat_mapping | table threat signature_id category message \n| stats values(signature_id) as signature_id values(category) as category by threat" - }, - "type": "ds.search" - }, - "ds_8LU6nawL": { - "name": "all_intrusion_events_by_threat_actors", - "options": { - "extend": "ds_mGcuwEO0", - "query": "| stats count by threat" - }, - "type": "ds.chain" - }, - "ds_8sclv3pU": { - "name": "timeline_instruction", - "options": { - "query": "`cisco_secure_firewall` EventType=IntrusionEvent dest_ip = \"$dest_ip$\"\n| timechart span=1d count BY signature_id" - }, - "type": "ds.search" - }, - "ds_PpNvhTDF": { - "name": "dc_signature", - "options": { - "extend": "ds_mGcuwEO0", - "query": "| search threat=\"$threat_token$\"\n| stats dc(signature)" - }, - "type": "ds.chain" - }, - "ds_Q6zbF7Qb": { - "name": "Top Signatures", - "options": { - "extend": "ds_mGcuwEO0", - "query": "| search threat=\"$threat_token$\"\n| stats count by signature | table signature " - }, - "type": "ds.chain" - }, - "ds_QAFOBzEx": { - "name": "volume_inbound", - "options": { - "query": "`cisco_secure_firewall` EventType=ConnectionEvent dest_ip=\"$dest_ip$\"\n| stats sum(InitiatorBytes) AS inbound_bytes\n| eval Volume_Inbound_GB = round(inbound_bytes/1024/1024/1024, 2) . \" Gb\"\n| fields Volume_Inbound_GB" - }, - "type": "ds.search" - }, - "ds_TPwx4BWO": { - "name": "affected_dest_ip", - "options": { - "enableSmartSources": true, - "query": "`cisco_secure_firewall` EventType=IntrusionEvent \n| bin _time span=1d \n| stats count as Total_Alerts dc(signature_id) as sig_count \n values(signature_id) as signature_ids \n values(signature) as signature \n values(class_desc) as class_desc \n values(MitreAttackGroups) as MitreAttackGroups \n values(InlineResult) as InlineResult \n values(InlineResultReason) as InlineResultReason \n values(src_ip) as src_ip \n values(dest_port) as dest_port \n values(rule) as rule \n values(transport) as transport \n values(connection_id) as connection_id\n values(app) as app\n by dest_ip _time \n| eval sig_ids_str = mvjoin(signature_ids, \",\") \n| lookup cisco_snort_ids_to_threat_mapping signature_id as sig_ids_str OUTPUT threat_actor, distinct_count_snort_ids, description \n| where isnotnull(threat_actor) AND sig_count >= tonumber(distinct_count_snort_ids) \n| `security_content_ctime(firstTime)` \n| `security_content_ctime(lastTime)`\n| search threat_actor = \"$threat_actor_token$\"\n| table _time threat_actor description dest_ip signature_ids signature src_ip MitreAttackGroups\n| stats count by dest_ip\n| rename dest_ip as \"Private IP Address\"\n| table \"Private IP Address\"", - "queryParameters": { - "earliest": "$global_time.earliest$", - "latest": "$global_time.latest$" - } - }, - "type": "ds.search" - }, - "ds_ULaiHv6R": { - "name": "risk_event_timeline", - "options": { - "query": "index=risk normalized_risk_object=\"$dest_ip$\"\n| bin _time span=1d\n| stats count AS event_count BY _time\n| timechart span=1d sum(event_count) AS \"Events per Day\"" - }, - "type": "ds.search" - }, - "ds_XtgOToUG": { - "name": "Mitre", - "options": { - "query": "| from datamodel Risk.All_Risk | rename normalized_risk_object AS dest_ip | search dest_ip = $dest_ip$\n| stats\n count by annotations.mitre_attack.mitre_technique \n| head 5\n| rename annotations.mitre_attack.mitre_technique as \"Mitre Techniques\"" - }, - "type": "ds.search" - }, - "ds_YybVUCKh": { - "name": "affect_hosts_count", - "options": { - "extend": "ds_mGcuwEO0", - "query": "| search threat = \"$threat_token$\"\n| stats dc(dest_ip)" - }, - "type": "ds.chain" - }, - "ds_cU42yLz2": { - "name": "file_events_per_day", - "options": { - "query": "`cisco_secure_firewall` EventType=FileEvent src_ip=\"$dest_ip$\" \n| bin _time span=1d \n| stats count AS event_count BY _time \n| timechart span=1d sum(event_count) AS \"File Events per Day\"" - }, - "type": "ds.search" - }, - "ds_f4HzVHsa": { - "name": "description", - "options": { - "query": "| inputlookup threat_snort_count \n| search threat=\"$threat_token$\" \n| table description" - }, - "type": "ds.search" - }, - "ds_fwElVms9": { - "name": "unique_attackers_per_day", - "options": { - "extend": "ds_mGcuwEO0", - "query": "| search threat=\"$threat_token$\" dest_ip=\"$dest_ip$\"\n| timechart span=1d dc(src_ip) AS unique_attacker_count" - }, - "type": "ds.chain" - }, - "ds_i58D84BP": { - "name": "lookup_threat_actors", - "options": { - "enableSmartSources": true, - "query": "| inputlookup cisco_snort_ids_to_threat_mapping | stats count by threat | table threat" - }, - "type": "ds.search" - }, - "ds_m3IAfEaF": { - "name": "snort_evernts_per_actor", - "options": { - "extend": "ds_mGcuwEO0", - "query": "| search threat=\"$threat_token$\"\n| eval _time=strftime(_time, \"%Y-%m-%d\")" - }, - "type": "ds.chain" - }, - "ds_mGcuwEO0": { - "name": "parent_base_search", - "options": { - "query": "`cisco_secure_firewall` EventType=IntrusionEvent \n| stats count AS total_alerts, dc(signature_id) AS sig_count, values(SnortRuleGroups) AS snort_rule_groups, values(connection_id) AS connection_id, values(rule) AS rule, values(dest_port) AS dest_port, values(transport) AS transport, values(app) AS app, values(signature) AS signature, values(src_ip) AS src_ip BY _time dest_ip signature_id\n| lookup cisco_snort_ids_to_threat_mapping signature_id OUTPUT threat, category, message\n| where isnotnull(threat)\n| bin _time span=1d\n| stats count AS Total_Alerts, dc(signature_id) AS sig_count, values(signature_id) AS signature_id, values(category) AS category, values(message) AS message, values(snort_rule_groups) AS snort_rule_groups, values(connection_id) AS connection_id, values(rule) AS rule, values(dest_port) AS dest_port, values(transport) AS transport, values(app) AS app, values(signature) AS signature, values(src_ip) AS src_ip BY _time dest_ip threat\n| lookup threat_snort_count threat OUTPUT description, distinct_count_snort_ids\n| table _time, dest_ip, src_ip, threat, category, message, description, signature_id, signature, snort_rule_groups, sig_count, distinct_count_snort_ids, connection_id, rule, dest_port, transport, app\n| where sig_count >= distinct_count_snort_ids", - "queryParameters": { - "earliest": "$global_time.earliest$", - "latest": "$global_time.latest$" - } - }, - "type": "ds.search" - }, - "ds_q9NVolej": { - "name": "volume_outbound", - "options": { - "query": "`cisco_secure_firewall` EventType=ConnectionEvent dest_ip=\"$dest_ip$\"\n| stats sum(ResponderBytes) AS outbound_bytes\n| eval Volume_Outbound_GB = round(outbound_bytes/1024/1024/1024, 2) . \" Gb\"\n| fields Volume_Outbound_GB" - }, - "type": "ds.search" - }, - "ds_ta3O0H2Z": { - "name": "map_connection_events", - "options": { - "query": "`cisco_secure_firewall` EventType=ConnectionEvent dest_ip = $dest_ip$\n| iplocation src_ip\n| geostats count BY src_ip" - }, - "type": "ds.search" - }, - "ds_tuaeoaIh": { - "name": "all_intrusion_events", - "options": { - "query": "`cisco_secure_firewall` EventType=IntrusionEvent dest_ip = $dest_ip$\n| bin _time span=1d \n| stats count as intrusion_count\n by _time" - }, - "type": "ds.search" - }, - "ds_wzZtYKW7": { - "name": "investigating_host", - "options": { - "query": "| makeresults | eval affected_ip = \"$dest_ip$\" | table affected_ip" - }, - "type": "ds.search" - }, - "ds_z10zC280": { - "name": "file_events", - "options": { - "extend": "ds_mGcuwEO0", - "query": "| join type=inner dest_ip [\n search `cisco_secure_firewall` EventType=FileEvent\n | bin _time span=1d\n | stats count, dc(file_name) as \"File Count\", values(FileDirection) as Direction, values(FileType) as \"File Type\", values(dest_ip) , values(ClientApplication) BY src_ip _time | rename src_ip as dest_ip\n]\n| search dest_ip=\"$dest_ip$\" threat=\"$threat_token$\"\n| table _time dest_ip \"File Count\" Direction \"File Type\" signature\n\n\n" - }, - "type": "ds.chain" - } - }, - "layout": { - "globalInputs": [ - "input_global_trp", - "input_tlWhhLwR" - ], - "layoutDefinitions": { - "layout_1": { - "structure": [ - { - "item": "viz_wl93h7VE", - "position": { - "h": 321, - "w": 1200, - "x": 0, - "y": 0 - }, - "type": "block" - }, - { - "item": "viz_8VIu1U0s", - "position": { - "h": 368, - "w": 752, - "x": 0, - "y": 321 - }, - "type": "block" - }, - { - "item": "viz_q5G96ojA", - "position": { - "h": 368, - "w": 448, - "x": 752, - "y": 321 - }, - "type": "block" - } - ], - "type": "grid" - }, - "layout_U25tjhLw": { - "options": { - "gutterSize": 12 - }, - "structure": [ - { - "item": "viz_WhFvmhK9", - "position": { - "h": 106, - "w": 1200, - "x": 0, - "y": 0 - }, - "type": "block" - }, - { - "item": "viz_VpTFMowK", - "position": { - "h": 272, - "w": 621, - "x": 0, - "y": 106 - }, - "type": "block" - }, - { - "item": "viz_xuwsrI0Q", - "position": { - "h": 400, - "w": 1200, - "x": 0, - "y": 378 - }, - "type": "block" - }, - { - "item": "viz_uCVQgdVt", - "position": { - "h": 272, - "w": 579, - "x": 621, - "y": 106 - }, - "type": "block" - } - ], - "type": "grid" - }, - "layout_fRHBDK2O": { - "structure": [ - { - "item": "viz_SnsguT0c", - "position": { - "h": 211, - "w": 600, - "x": 0, - "y": 0 - }, - "type": "block" - }, - { - "item": "viz_fjbFV5up", - "position": { - "h": 217, - "w": 375, - "x": 0, - "y": 211 - }, - "type": "block" - }, - { - "item": "viz_1ZFeC3zY", - "position": { - "h": 448, - "w": 1200, - "x": 0, - "y": 428 - }, - "type": "block" - }, - { - "item": "viz_ZblgpoVk", - "position": { - "h": 217, - "w": 375, - "x": 375, - "y": 211 - }, - "type": "block" - }, - { - "item": "viz_FY6hwnml", - "position": { - "h": 211, - "w": 600, - "x": 600, - "y": 0 - }, - "type": "block" - }, - { - "item": "viz_KQjoxczF", - "position": { - "h": 217, - "w": 450, - "x": 750, - "y": 211 - }, - "type": "block" - } - ], - "type": "grid" - }, - "layout_gX58DqID": { - "structure": [ - { - "item": "viz_70gtzPTV", - "position": { - "h": 137, - "w": 1200, - "x": 0, - "y": 0 - }, - "type": "block" - }, - { - "item": "viz_kMW90k69", - "position": { - "h": 322, - "w": 600, - "x": 0, - "y": 137 - }, - "type": "block" - }, - { - "item": "viz_3VU4OAeI", - "position": { - "h": 322, - "w": 600, - "x": 600, - "y": 137 - }, - "type": "block" - } - ], - "type": "grid" - }, - "layout_hEVylosH": { - "structure": [ - { - "item": "viz_gryqfMyv", - "position": { - "h": 99, - "w": 1200, - "x": 0, - "y": 0 - }, - "type": "block" - }, - { - "item": "viz_ISoX6BgF", - "position": { - "h": 297, - "w": 594, - "x": 0, - "y": 99 - }, - "type": "block" - }, - { - "item": "viz_nr87RKRM", - "position": { - "h": 290, - "w": 594, - "x": 0, - "y": 396 - }, - "type": "block" - }, - { - "item": "viz_NT8j5Ogy", - "position": { - "h": 537, - "w": 1200, - "x": 0, - "y": 686 - }, - "type": "block" - }, - { - "item": "viz_AQzurdgj", - "position": { - "h": 297, - "w": 606, - "x": 594, - "y": 99 - }, - "type": "block" - }, - { - "item": "viz_T6i68u8y", - "position": { - "h": 290, - "w": 302, - "x": 594, - "y": 396 - }, - "type": "block" - }, - { - "item": "viz_darglsFq", - "position": { - "h": 290, - "w": 304, - "x": 896, - "y": 396 - }, - "type": "block" - } - ], - "type": "grid" - } - }, - "options": { - "submitButton": true, - "submitOnDashboardLoad": true - }, - "tabs": { - "items": [ - { - "label": "Overview", - "layoutId": "layout_1" - }, - { - "label": "Threat Details", - "layoutId": "layout_fRHBDK2O" - }, - { - "label": "Timeline", - "layoutId": "layout_gX58DqID" - }, - { - "label": "Activity Explorer", - "layoutId": "layout_hEVylosH" - }, - { - "label": "Risk Events", - "layoutId": "layout_U25tjhLw" - } - ] - } - }, - "applicationProperties": { - "collapseNavigation": false - } -} \ No newline at end of file diff --git a/dashboards/threat_activity_by_snort_ids.yml b/dashboards/threat_activity_by_snort_ids.yml deleted file mode 100644 index b760a51e62f..00000000000 --- a/dashboards/threat_activity_by_snort_ids.yml +++ /dev/null @@ -1,7 +0,0 @@ -name: Threat Activity by Snort IDs -id: 77d805c2-747e-4b78-8979-52deca44254f -version: 2 -creation_date: '2025-04-29' -modification_date: '2026-05-13' -author: Bhavin Patel, Nasreddine Bencherchali, Splunk -description: Utilize this panel to correlate Snort intrusion events with known threat activity. Configure the Snort-ID-to-Threat lookup to enrich incoming signature data and populate the “Threat Activity by Snort IDs” view. From 8426c60c004dae0df68f72c69e7f0b301822cacc Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Tue, 28 Jul 2026 02:43:59 -0700 Subject: [PATCH 040/162] Update codeowners (#4185) --- .github/CODEOWNERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index d1790ddfbe6..058ddbe15f4 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,3 +1,3 @@ -* @patel-bhavin @ljstella @nasbench +* @patel-bhavin @ljstella @nasbench @pyth0n1c @RavenTait @tccontre @rosplk @p4t12ick /response_templates/ @kbouchardherjavecgroup @ccl0utier @henryy-splunk /.github/workflows/response_templates/mcopenapi_public.yml @kbouchardherjavecgroup @ccl0utier @henryy-splunk \ No newline at end of file From ad0e9bf38dae5287fc0065942a10d11e7fdc0550 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Tue, 28 Jul 2026 03:34:04 -0700 Subject: [PATCH 041/162] Update data source TA and install.yml app versions (#4187) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- data_sources/cisco_network_visibility_module_flow_data.yml | 2 +- data_sources/cisco_network_visibility_module_osquery.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/data_sources/cisco_network_visibility_module_flow_data.yml b/data_sources/cisco_network_visibility_module_flow_data.yml index a34facebf45..2a14064bf29 100644 --- a/data_sources/cisco_network_visibility_module_flow_data.yml +++ b/data_sources/cisco_network_visibility_module_flow_data.yml @@ -10,7 +10,7 @@ sourcetype: cisco:nvm:flowdata:v2 supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - action - aliul diff --git a/data_sources/cisco_network_visibility_module_osquery.yml b/data_sources/cisco_network_visibility_module_osquery.yml index 80e6c678e9e..442e181c1fe 100644 --- a/data_sources/cisco_network_visibility_module_osquery.yml +++ b/data_sources/cisco_network_visibility_module_osquery.yml @@ -10,7 +10,7 @@ sourcetype: cisco:nvm:osquery:v2 supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - current_page - date_hour From 1a3162a22cc283a95f3e23ea0c57ac064e989c8e Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Tue, 28 Jul 2026 20:35:19 +0200 Subject: [PATCH 042/162] small fixes --- detections/endpoint/common_ransomware_extensions.yml | 2 +- .../windows_file_without_extension_in_critical_folder.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 495dfc05994..8f922873d49 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -45,7 +45,7 @@ search: | "*.txt", "*.url", "*.vb", "*.vbe", "*.vbs", "*.vcxproj", "*.vhd", "*.vhdx", "*.wav", "*.webm", "*.webp", "*.wim", "*.wsf", "*.xlam", "*.xls", "*.xlsb", "*.xlsm", "*.xlsx", "*.xlt", "*.xltm", "*.xltx", "*.xml", "*.xps", - "*.yaml", "*.yml", "*.zip" + "*.yaml", "*.yml" ) BY Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time diff --git a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml index d6efe846e61..0283a3a04e3 100644 --- a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml +++ b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml @@ -7,7 +7,7 @@ author: Teoderick Contreras, Bhavin Patel, Splunk status: production type: Anomaly description: |- - This analytic detects the creation of files without extensions in critical Windows system and driver-related directories, including but not limited to System32\Drivers, Windows\WinSxS, and other known Windows driver storage and loading paths. + This analytic detects the creation of files without extensions in critical Windows system and driver-related directories, including but not limited to System32\Drivers, and other known Windows driver storage and loading paths. The analytic leverages telemetry from the Endpoint.Filesystem data model, with a focus on file creation events and file path analysis. File creation activity in these directories—particularly involving extensionless files—is highly suspicious, as it may indicate the presence of destructive or stealthy malware. This behavior is consistent with malware families such as HermeticWiper, which deploy kernel driver components into trusted Windows driver directories to obtain low-level access and execute destructive payloads. From 0b37fe3689ee31d1e783cf4535e5bedbb6047440 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Wed, 29 Jul 2026 09:43:28 -0700 Subject: [PATCH 043/162] Bump contentctl.yml and build.yml to 6.4.0 (#4191) --------- Co-authored-by: research bot <research@splunk.com> Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> --- build.yml | 2 +- contentctl.yml | 2 +- .../powershell___connect_to_internet_with_hidden_window.yml | 4 ++-- .../detections}/regsvr32_with_known_silent_switch_cmdline.yml | 4 ++-- .../detections}/rundll32_createremotethread_in_browser.yml | 4 ++-- .../splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml | 4 ++-- ...unk_code_injection_via_custom_dashboard_leading_to_rce.yml | 4 ++-- .../splunk_enterprise_kv_store_incorrect_authorization.yml | 4 ++-- .../splunk_information_disclosure_on_account_login.yml | 4 ++-- ...lunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml | 4 ++-- .../detections}/splunk_rce_pdfgen_render.yml | 4 ++-- .../windows_process_injection_of_wermgr_to_known_browser.yml | 4 ++-- .../windows_process_injection_with_public_source_path.yml | 4 ++-- 13 files changed, 24 insertions(+), 24 deletions(-) rename {detections/deprecated => removed/detections}/powershell___connect_to_internet_with_hidden_window.yml (98%) rename {detections/deprecated => removed/detections}/regsvr32_with_known_silent_switch_cmdline.yml (99%) rename {detections/deprecated => removed/detections}/rundll32_createremotethread_in_browser.yml (98%) rename {detections/deprecated => removed/detections}/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml (97%) rename {detections/deprecated => removed/detections}/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml (98%) rename {detections/deprecated => removed/detections}/splunk_enterprise_kv_store_incorrect_authorization.yml (98%) rename {detections/deprecated => removed/detections}/splunk_information_disclosure_on_account_login.yml (97%) rename {detections/deprecated => removed/detections}/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml (97%) rename {detections/deprecated => removed/detections}/splunk_rce_pdfgen_render.yml (98%) rename {detections/deprecated => removed/detections}/windows_process_injection_of_wermgr_to_known_browser.yml (98%) rename {detections/deprecated => removed/detections}/windows_process_injection_with_public_source_path.yml (98%) diff --git a/build.yml b/build.yml index d0447873f66..ddabf18dcc0 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.3.0 +app_version: 6.4.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index c7d57446e83..d066a0ef9ea 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.3.0 + version: 6.4.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU diff --git a/detections/deprecated/powershell___connect_to_internet_with_hidden_window.yml b/removed/detections/powershell___connect_to_internet_with_hidden_window.yml similarity index 98% rename from detections/deprecated/powershell___connect_to_internet_with_hidden_window.yml rename to removed/detections/powershell___connect_to_internet_with_hidden_window.yml index 1d49d65adb4..41c33b583dd 100644 --- a/detections/deprecated/powershell___connect_to_internet_with_hidden_window.yml +++ b/removed/detections/powershell___connect_to_internet_with_hidden_window.yml @@ -2,9 +2,9 @@ name: PowerShell - Connect To Internet With Hidden Window id: ee18ed37-0802-4268-9435-b3b91aaa18db version: 17 creation_date: '2020-04-29' -modification_date: '2026-06-04' +modification_date: '2026-07-29' author: David Dorsey, Michael Haag Splunk -status: deprecated +status: removed type: Hunting description: The following analytic detects PowerShell commands using the WindowStyle parameter to hide the window while connecting to the Internet. This behavior is identified through Endpoint Detection and Response (EDR) telemetry, focusing on command-line executions that include variations of the WindowStyle parameter. This activity is significant because it attempts to bypass default PowerShell execution policies and conceal its actions, which is often indicative of malicious intent. If confirmed malicious, this could allow an attacker to execute commands stealthily, potentially leading to unauthorized data exfiltration or further compromise of the endpoint. data_source: diff --git a/detections/deprecated/regsvr32_with_known_silent_switch_cmdline.yml b/removed/detections/regsvr32_with_known_silent_switch_cmdline.yml similarity index 99% rename from detections/deprecated/regsvr32_with_known_silent_switch_cmdline.yml rename to removed/detections/regsvr32_with_known_silent_switch_cmdline.yml index b9f41a37084..50d253b9952 100644 --- a/detections/deprecated/regsvr32_with_known_silent_switch_cmdline.yml +++ b/removed/detections/regsvr32_with_known_silent_switch_cmdline.yml @@ -2,9 +2,9 @@ name: Regsvr32 with Known Silent Switch Cmdline id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122 version: 15 creation_date: '2021-07-29' -modification_date: '2026-06-09' +modification_date: '2026-07-29' author: Teoderick Contreras, Splunk -status: deprecated +status: removed deprecation_info: reason: Detection has been deprecated since its logic is already covered by another more improved detection. removed_in_version: 6.4.0 diff --git a/detections/deprecated/rundll32_createremotethread_in_browser.yml b/removed/detections/rundll32_createremotethread_in_browser.yml similarity index 98% rename from detections/deprecated/rundll32_createremotethread_in_browser.yml rename to removed/detections/rundll32_createremotethread_in_browser.yml index 538e8124ba8..d6fd3203dab 100644 --- a/detections/deprecated/rundll32_createremotethread_in_browser.yml +++ b/removed/detections/rundll32_createremotethread_in_browser.yml @@ -2,9 +2,9 @@ name: Rundll32 CreateRemoteThread In Browser id: f8a22586-ee2d-11eb-a193-acde48001122 version: 11 creation_date: '2021-07-29' -modification_date: '2026-06-29' +modification_date: '2026-07-29' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: |- The following analytic detects the suspicious creation of a remote thread by rundll32.exe targeting browser processes such as firefox.exe, chrome.exe, iexplore.exe, and microsoftedgecp.exe. diff --git a/detections/deprecated/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml b/removed/detections/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml similarity index 97% rename from detections/deprecated/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml rename to removed/detections/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml index a377c05c211..be485288dc0 100644 --- a/detections/deprecated/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml +++ b/removed/detections/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml @@ -2,9 +2,9 @@ name: Splunk App for Lookup File Editing RCE via User XSLT id: a053e6a6-2146-483a-9798-2d43652f3299 version: 8 creation_date: '2023-11-16' -modification_date: '2026-06-24' +modification_date: '2026-07-29' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic identifies the creation of lookup files in Splunk, which could indicate an attempt to exploit remote code execution via user-supplied XSLT. It leverages REST API queries to monitor the creation of these lookups, focusing on fields such as title, author, and access control lists. This activity is significant because it targets a known vulnerability in Splunk versions 9.1.x, potentially allowing attackers to execute arbitrary code. If confirmed malicious, this could lead to unauthorized code execution, compromising the integrity and security of the Splunk environment. data_source: [] diff --git a/detections/deprecated/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml b/removed/detections/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml similarity index 98% rename from detections/deprecated/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml rename to removed/detections/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml index 16c8972fdd4..1d542bc4097 100644 --- a/detections/deprecated/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml +++ b/removed/detections/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml @@ -2,9 +2,9 @@ name: Splunk Code Injection via custom dashboard leading to RCE id: b06b41d7-9570-4985-8137-0784f582a1b3 version: 8 creation_date: '2022-12-19' -modification_date: '2026-06-24' +modification_date: '2026-07-29' author: Rod Soto -status: deprecated +status: removed type: Hunting description: The following analytic identifies attempts to exploit a vulnerability in Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, where an authenticated user can execute arbitrary code via the dashboard PDF generation component. It detects this activity by analyzing events in the _internal index with the file=export parameter. This behavior is significant because it indicates a potential code injection attack, which could lead to remote code execution (RCE). If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary commands, and potentially compromise the entire Splunk environment. data_source: [] diff --git a/detections/deprecated/splunk_enterprise_kv_store_incorrect_authorization.yml b/removed/detections/splunk_enterprise_kv_store_incorrect_authorization.yml similarity index 98% rename from detections/deprecated/splunk_enterprise_kv_store_incorrect_authorization.yml rename to removed/detections/splunk_enterprise_kv_store_incorrect_authorization.yml index 048f7f1d47b..7853338daab 100644 --- a/detections/deprecated/splunk_enterprise_kv_store_incorrect_authorization.yml +++ b/removed/detections/splunk_enterprise_kv_store_incorrect_authorization.yml @@ -2,9 +2,9 @@ name: Splunk Enterprise KV Store Incorrect Authorization id: 8f0e8380-a835-4f2b-b749-9ce119364df0 version: 9 creation_date: '2024-01-22' -modification_date: '2026-06-24' +modification_date: '2026-07-29' author: Rod Soto, Eric McGinnis, Chase Franklin -status: deprecated +status: removed type: Hunting description: The following analytic detects unauthorized attempts to reload Splunk KV Store collections via the REST API. It leverages internal index logs to identify POST requests to the `/servicesNS/nobody/search/admin/collections-conf/_reload` endpoint, focusing on status codes starting with '2'. This activity is significant as it may indicate improper permission handling, potentially leading to unauthorized deletion of KV Store collections. If confirmed malicious, this could result in data loss or unauthorized data manipulation, impacting the integrity and availability of critical Splunk data. data_source: diff --git a/detections/deprecated/splunk_information_disclosure_on_account_login.yml b/removed/detections/splunk_information_disclosure_on_account_login.yml similarity index 97% rename from detections/deprecated/splunk_information_disclosure_on_account_login.yml rename to removed/detections/splunk_information_disclosure_on_account_login.yml index 2e3d38b171c..fc0d6959d85 100644 --- a/detections/deprecated/splunk_information_disclosure_on_account_login.yml +++ b/removed/detections/splunk_information_disclosure_on_account_login.yml @@ -2,9 +2,9 @@ name: Splunk Information Disclosure on Account Login id: 2bae5d19-6d1b-4db0-82ab-0af5ac5f836c version: 8 creation_date: '2024-07-01' -modification_date: '2026-06-24' +modification_date: '2026-07-29' author: Rod Soto -status: deprecated +status: removed type: Hunting description: This is a composed hunting search that looks for possible user enumeration attempts when SAML is enabled on a Splunk instance by capturing different responses from server. data_source: diff --git a/detections/deprecated/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml b/removed/detections/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml similarity index 97% rename from detections/deprecated/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml rename to removed/detections/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml index ec3f3143071..e211c928217 100644 --- a/detections/deprecated/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml +++ b/removed/detections/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml @@ -2,9 +2,9 @@ name: Splunk Path Traversal In Splunk App For Lookup File Edit id: 8ed58987-738d-4917-9e44-b8ef6ab948a6 version: 9 creation_date: '2023-06-01' -modification_date: '2026-06-24' +modification_date: '2026-07-29' author: Rod Soto, Eric McGinnis -status: deprecated +status: removed type: Hunting description: The following analytic identifies path traversal attempts in the Splunk App for Lookup File Editing. It detects specially crafted web requests targeting lookup files by analyzing the `uri_query` field in the `_internal` index. This activity is significant because it allows low-privilege users to read and write to restricted areas of the Splunk installation directory, potentially accessing sensitive files like password hashes. If confirmed malicious, this could lead to unauthorized access, data breaches, and further exploitation of the Splunk environment. data_source: diff --git a/detections/deprecated/splunk_rce_pdfgen_render.yml b/removed/detections/splunk_rce_pdfgen_render.yml similarity index 98% rename from detections/deprecated/splunk_rce_pdfgen_render.yml rename to removed/detections/splunk_rce_pdfgen_render.yml index 666040de178..3d3aa7b3b2b 100644 --- a/detections/deprecated/splunk_rce_pdfgen_render.yml +++ b/removed/detections/splunk_rce_pdfgen_render.yml @@ -2,9 +2,9 @@ name: Splunk RCE PDFgen Render id: bc2b7437-0400-438b-9537-21ab5b7d2d53 version: 8 creation_date: '2024-07-01' -modification_date: '2026-06-24' +modification_date: '2026-07-29' author: Rod Soto, Chase Franklin -status: deprecated +status: removed type: TTP description: This is a hunting search designed to find and discover exploitation attempts against Splunk pdfgen render endpoint which results in remote data_source: diff --git a/detections/deprecated/windows_process_injection_of_wermgr_to_known_browser.yml b/removed/detections/windows_process_injection_of_wermgr_to_known_browser.yml similarity index 98% rename from detections/deprecated/windows_process_injection_of_wermgr_to_known_browser.yml rename to removed/detections/windows_process_injection_of_wermgr_to_known_browser.yml index 31a51981642..268c78c9d9c 100644 --- a/detections/deprecated/windows_process_injection_of_wermgr_to_known_browser.yml +++ b/removed/detections/windows_process_injection_of_wermgr_to_known_browser.yml @@ -2,9 +2,9 @@ name: Windows Process Injection Of Wermgr to Known Browser id: aec755a5-3a2c-4be0-ab34-6540e68644e9 version: 12 creation_date: '2022-10-28' -modification_date: '2026-06-29' +modification_date: '2026-07-29' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic identifies the suspicious remote thread execution of the wermgr.exe process into known browsers such as firefox.exe, chrome.exe, and others. It leverages Sysmon EventCode 8 logs to detect this behavior by monitoring SourceImage and TargetImage fields. This activity is significant because it is indicative of Qakbot malware, which injects malicious code into legitimate processes to steal information. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, and exfiltrate sensitive data from the compromised host. data_source: diff --git a/detections/deprecated/windows_process_injection_with_public_source_path.yml b/removed/detections/windows_process_injection_with_public_source_path.yml similarity index 98% rename from detections/deprecated/windows_process_injection_with_public_source_path.yml rename to removed/detections/windows_process_injection_with_public_source_path.yml index 83a6938abc7..a282a5827a1 100644 --- a/detections/deprecated/windows_process_injection_with_public_source_path.yml +++ b/removed/detections/windows_process_injection_with_public_source_path.yml @@ -2,9 +2,9 @@ name: Windows Process Injection With Public Source Path id: 492f09cf-5d60-4d87-99dd-0bc325532dda version: 11 creation_date: '2022-09-05' -modification_date: '2026-06-29' +modification_date: '2026-07-29' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic detects a process from a non-standard file path on Windows attempting to create a remote thread in another process. This is identified using Sysmon EventCode 8, focusing on processes not originating from typical system directories. This behavior is significant as it often indicates process injection, a technique used by adversaries to evade detection or escalate privileges. If confirmed malicious, this activity could allow an attacker to execute arbitrary code within another process, potentially leading to unauthorized actions and further compromise of the system. data_source: From 8c42801be839fa3d870c841dcc3e627235f753a0 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Wed, 29 Jul 2026 09:44:49 -0700 Subject: [PATCH 044/162] Update data source TA and install.yml app versions (#4190) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> --- data_sources/cisco_ai_defense_alerts.yml | 2 +- data_sources/cisco_asa_logs.yml | 2 +- data_sources/cisco_duo_activity.yml | 2 +- data_sources/cisco_duo_administrator.yml | 2 +- data_sources/cisco_isovalent_process_connect.yml | 2 +- data_sources/cisco_isovalent_process_exec.yml | 2 +- data_sources/cisco_isovalent_process_kprobe.yml | 2 +- data_sources/cisco_network_visibility_module_flow_data.yml | 2 +- data_sources/cisco_network_visibility_module_osquery.yml | 2 +- .../cisco_secure_firewall_threat_defense_connection_event.yml | 2 +- .../cisco_secure_firewall_threat_defense_file_event.yml | 2 +- .../cisco_secure_firewall_threat_defense_intrusion_event.yml | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/data_sources/cisco_ai_defense_alerts.yml b/data_sources/cisco_ai_defense_alerts.yml index f6d66b2b29d..1404dec13c8 100644 --- a/data_sources/cisco_ai_defense_alerts.yml +++ b/data_sources/cisco_ai_defense_alerts.yml @@ -11,5 +11,5 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: diff --git a/data_sources/cisco_asa_logs.yml b/data_sources/cisco_asa_logs.yml index bf1e8a39ca1..1a8e0326076 100644 --- a/data_sources/cisco_asa_logs.yml +++ b/data_sources/cisco_asa_logs.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - Cisco_ASA_action - Cisco_ASA_message_id diff --git a/data_sources/cisco_duo_activity.yml b/data_sources/cisco_duo_activity.yml index 36c79c9f757..ef4d9c214e1 100644 --- a/data_sources/cisco_duo_activity.yml +++ b/data_sources/cisco_duo_activity.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - access_device.browser - access_device.browser_version diff --git a/data_sources/cisco_duo_administrator.yml b/data_sources/cisco_duo_administrator.yml index 27c88ee60e1..c9e84710271 100644 --- a/data_sources/cisco_duo_administrator.yml +++ b/data_sources/cisco_duo_administrator.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - action - actionlabel diff --git a/data_sources/cisco_isovalent_process_connect.yml b/data_sources/cisco_isovalent_process_connect.yml index 38e7825a811..4176c4e24ef 100644 --- a/data_sources/cisco_isovalent_process_connect.yml +++ b/data_sources/cisco_isovalent_process_connect.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processConnect supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - _time - app diff --git a/data_sources/cisco_isovalent_process_exec.yml b/data_sources/cisco_isovalent_process_exec.yml index eed09ca0bec..fbc9e8fda21 100644 --- a/data_sources/cisco_isovalent_process_exec.yml +++ b/data_sources/cisco_isovalent_process_exec.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processExec supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - _time - cluster_name diff --git a/data_sources/cisco_isovalent_process_kprobe.yml b/data_sources/cisco_isovalent_process_kprobe.yml index 637361a36c4..9b5f9b9fc86 100644 --- a/data_sources/cisco_isovalent_process_kprobe.yml +++ b/data_sources/cisco_isovalent_process_kprobe.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - _time - app diff --git a/data_sources/cisco_network_visibility_module_flow_data.yml b/data_sources/cisco_network_visibility_module_flow_data.yml index 2a14064bf29..35fb13dd7ae 100644 --- a/data_sources/cisco_network_visibility_module_flow_data.yml +++ b/data_sources/cisco_network_visibility_module_flow_data.yml @@ -10,7 +10,7 @@ sourcetype: cisco:nvm:flowdata:v2 supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - action - aliul diff --git a/data_sources/cisco_network_visibility_module_osquery.yml b/data_sources/cisco_network_visibility_module_osquery.yml index 442e181c1fe..710ef263b0b 100644 --- a/data_sources/cisco_network_visibility_module_osquery.yml +++ b/data_sources/cisco_network_visibility_module_osquery.yml @@ -10,7 +10,7 @@ sourcetype: cisco:nvm:osquery:v2 supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - current_page - date_hour diff --git a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml index 895f9fe20a2..2e6a88ad825 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - AC_RuleAction - action diff --git a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml index d623fdb85a0..022971efeb4 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - app - Application diff --git a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml index 4d9589c58e3..1552ce4c57c 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.0 + version: 4.0.1 fields: - Application - Classification From 1cd64005319bdcbb7d7b0553086d147555441e43 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Mon, 3 Aug 2026 01:15:19 -0700 Subject: [PATCH 045/162] Update data source TA and install.yml app versions (#4197) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/asl_aws_cloudtrail.yml | 2 +- data_sources/aws_bedrock_claude.yml | 2 +- data_sources/aws_cloudfront.yml | 2 +- data_sources/aws_cloudtrail.yml | 2 +- data_sources/aws_cloudtrail_assumerolewithsaml.yml | 2 +- data_sources/aws_cloudtrail_consolelogin.yml | 2 +- data_sources/aws_cloudtrail_copyobject.yml | 2 +- data_sources/aws_cloudtrail_createaccesskey.yml | 2 +- data_sources/aws_cloudtrail_createkey.yml | 2 +- data_sources/aws_cloudtrail_createloginprofile.yml | 2 +- data_sources/aws_cloudtrail_createnetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_createpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_createsnapshot.yml | 2 +- data_sources/aws_cloudtrail_createtask.yml | 2 +- data_sources/aws_cloudtrail_createvirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deactivatemfadevice.yml | 2 +- data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_deletealarms.yml | 2 +- data_sources/aws_cloudtrail_deletedetector.yml | 2 +- data_sources/aws_cloudtrail_deletegroup.yml | 2 +- data_sources/aws_cloudtrail_deleteguardrail.yml | 2 +- data_sources/aws_cloudtrail_deleteipset.yml | 2 +- data_sources/aws_cloudtrail_deleteknowledgebase.yml | 2 +- data_sources/aws_cloudtrail_deleteloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deleteloggroup.yml | 2 +- data_sources/aws_cloudtrail_deletelogstream.yml | 2 +- ...aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deletenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_deletepolicy.yml | 2 +- data_sources/aws_cloudtrail_deleterule.yml | 2 +- data_sources/aws_cloudtrail_deleterulegroup.yml | 2 +- data_sources/aws_cloudtrail_deletesnapshot.yml | 2 +- data_sources/aws_cloudtrail_deletetrail.yml | 2 +- data_sources/aws_cloudtrail_deletevirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deletewebacl.yml | 2 +- data_sources/aws_cloudtrail_describeeventaggregates.yml | 2 +- data_sources/aws_cloudtrail_describeimagescanfindings.yml | 2 +- data_sources/aws_cloudtrail_describesnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_getobject.yml | 2 +- data_sources/aws_cloudtrail_getpassworddata.yml | 2 +- data_sources/aws_cloudtrail_invokemodel.yml | 2 +- data_sources/aws_cloudtrail_jobcreated.yml | 2 +- data_sources/aws_cloudtrail_listfoundationmodels.yml | 2 +- data_sources/aws_cloudtrail_modifydbinstance.yml | 2 +- data_sources/aws_cloudtrail_modifyimageattribute.yml | 2 +- data_sources/aws_cloudtrail_modifysnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_putbucketacl.yml | 2 +- data_sources/aws_cloudtrail_putbucketlifecycle.yml | 2 +- data_sources/aws_cloudtrail_putbucketreplication.yml | 2 +- data_sources/aws_cloudtrail_putbucketversioning.yml | 2 +- data_sources/aws_cloudtrail_putimage.yml | 2 +- data_sources/aws_cloudtrail_putkeypolicy.yml | 2 +- data_sources/aws_cloudtrail_replacenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_setdefaultpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_stoplogging.yml | 2 +- data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_updateloginprofile.yml | 2 +- data_sources/aws_cloudtrail_updatesamlprovider.yml | 2 +- data_sources/aws_cloudtrail_updatetrail.yml | 2 +- data_sources/aws_cloudwatchlogs_vpcflow.yml | 2 +- data_sources/aws_security_hub.yml | 2 +- data_sources/azure_active_directory.yml | 2 +- ...e_directory_add_app_role_assignment_to_service_principal.yml | 2 +- data_sources/azure_active_directory_add_member_to_role.yml | 2 +- .../azure_active_directory_add_owner_to_application.yml | 2 +- data_sources/azure_active_directory_add_service_principal.yml | 2 +- data_sources/azure_active_directory_add_unverified_domain.yml | 2 +- data_sources/azure_active_directory_consent_to_application.yml | 2 +- .../azure_active_directory_disable_strong_authentication.yml | 2 +- data_sources/azure_active_directory_enable_account.yml | 2 +- data_sources/azure_active_directory_invite_external_user.yml | 2 +- .../azure_active_directory_microsoftgraphactivitylogs.yml | 2 +- .../azure_active_directory_noninteractiveusersigninlogs.yml | 2 +- .../azure_active_directory_reset_password_(by_admin).yml | 2 +- .../azure_active_directory_set_domain_authentication.yml | 2 +- data_sources/azure_active_directory_sign_in_activity.yml | 2 +- data_sources/azure_active_directory_update_application.yml | 2 +- .../azure_active_directory_update_authorization_policy.yml | 2 +- data_sources/azure_active_directory_update_user.yml | 2 +- .../azure_active_directory_user_registered_security_info.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_account.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_runbook.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_webhook.yml | 2 +- data_sources/azure_monitor_activity.yml | 2 +- data_sources/crowdstrike_falcon_stream_alert.yml | 2 +- data_sources/crowdstrike_processrollup2.yml | 2 +- data_sources/linux_auditd_add_user.yml | 2 +- data_sources/linux_auditd_cwd.yml | 2 +- data_sources/linux_auditd_daemon_abort.yml | 2 +- data_sources/linux_auditd_daemon_end.yml | 2 +- data_sources/linux_auditd_daemon_start.yml | 2 +- data_sources/linux_auditd_execve.yml | 2 +- data_sources/linux_auditd_path.yml | 2 +- data_sources/linux_auditd_proctitle.yml | 2 +- data_sources/linux_auditd_service_stop.yml | 2 +- data_sources/linux_auditd_syscall.yml | 2 +- data_sources/linux_messages_syslog.yml | 2 +- data_sources/linux_secure.yml | 2 +- data_sources/m365_copilot_graph_api.yml | 2 +- data_sources/ntlm_operational_8004.yml | 2 +- data_sources/ntlm_operational_8005.yml | 2 +- data_sources/ntlm_operational_8006.yml | 2 +- data_sources/o365.yml | 2 +- data_sources/o365_add_app_role_assignment_grant_to_user_.yml | 2 +- .../o365_add_app_role_assignment_to_service_principal_.yml | 2 +- data_sources/o365_add_mailboxpermission.yml | 2 +- data_sources/o365_add_member_to_role_.yml | 2 +- data_sources/o365_add_owner_to_application_.yml | 2 +- data_sources/o365_add_service_principal_.yml | 2 +- data_sources/o365_change_user_license_.yml | 2 +- data_sources/o365_consent_to_application_.yml | 2 +- data_sources/o365_disable_strong_authentication_.yml | 2 +- data_sources/o365_mailitemsaccessed.yml | 2 +- data_sources/o365_modifyfolderpermissions.yml | 2 +- data_sources/o365_set_company_information_.yml | 2 +- data_sources/o365_set_mailbox.yml | 2 +- data_sources/o365_update_application_.yml | 2 +- data_sources/o365_update_authorization_policy_.yml | 2 +- data_sources/o365_update_user_.yml | 2 +- data_sources/o365_userloggedin.yml | 2 +- data_sources/o365_userloginfailed.yml | 2 +- data_sources/office_365_reporting_message_trace.yml | 2 +- data_sources/office_365_universal_audit_log.yml | 2 +- data_sources/okta.yml | 2 +- data_sources/palo_alto_network_threat.yml | 2 +- data_sources/palo_alto_network_traffic.yml | 2 +- data_sources/powershell_script_block_logging_4104.yml | 2 +- data_sources/windows_active_directory_admon.yml | 2 +- data_sources/windows_event_log_application_15457.yml | 2 +- data_sources/windows_event_log_application_17135.yml | 2 +- data_sources/windows_event_log_application_2282.yml | 2 +- data_sources/windows_event_log_application_3000.yml | 2 +- data_sources/windows_event_log_application_8128.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_400.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_854.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_855.yml | 2 +- data_sources/windows_event_log_appxpackaging_171.yml | 2 +- data_sources/windows_event_log_capi2_70.yml | 2 +- data_sources/windows_event_log_capi2_81.yml | 2 +- .../windows_event_log_certificateservicesclient_1007.yml | 2 +- data_sources/windows_event_log_defender_1121.yml | 2 +- data_sources/windows_event_log_defender_1122.yml | 2 +- data_sources/windows_event_log_defender_1125.yml | 2 +- data_sources/windows_event_log_defender_1126.yml | 2 +- data_sources/windows_event_log_defender_1129.yml | 2 +- data_sources/windows_event_log_defender_1131.yml | 2 +- data_sources/windows_event_log_defender_1132.yml | 2 +- data_sources/windows_event_log_defender_1133.yml | 2 +- data_sources/windows_event_log_defender_1134.yml | 2 +- data_sources/windows_event_log_defender_5007.yml | 2 +- data_sources/windows_event_log_printservice_316.yml | 2 +- data_sources/windows_event_log_printservice_4909.yml | 2 +- data_sources/windows_event_log_printservice_808.yml | 2 +- data_sources/windows_event_log_remoteconnectionmanager_1149.yml | 2 +- data_sources/windows_event_log_security_1100.yml | 2 +- data_sources/windows_event_log_security_1102.yml | 2 +- data_sources/windows_event_log_security_4624.yml | 2 +- data_sources/windows_event_log_security_4625.yml | 2 +- data_sources/windows_event_log_security_4627.yml | 2 +- data_sources/windows_event_log_security_4648.yml | 2 +- data_sources/windows_event_log_security_4662.yml | 2 +- data_sources/windows_event_log_security_4663.yml | 2 +- data_sources/windows_event_log_security_4672.yml | 2 +- data_sources/windows_event_log_security_4688.yml | 2 +- data_sources/windows_event_log_security_4698.yml | 2 +- data_sources/windows_event_log_security_4699.yml | 2 +- data_sources/windows_event_log_security_4700.yml | 2 +- data_sources/windows_event_log_security_4702.yml | 2 +- data_sources/windows_event_log_security_4703.yml | 2 +- data_sources/windows_event_log_security_4719.yml | 2 +- data_sources/windows_event_log_security_4720.yml | 2 +- data_sources/windows_event_log_security_4723.yml | 2 +- data_sources/windows_event_log_security_4724.yml | 2 +- data_sources/windows_event_log_security_4725.yml | 2 +- data_sources/windows_event_log_security_4726.yml | 2 +- data_sources/windows_event_log_security_4727.yml | 2 +- data_sources/windows_event_log_security_4728.yml | 2 +- data_sources/windows_event_log_security_4730.yml | 2 +- data_sources/windows_event_log_security_4731.yml | 2 +- data_sources/windows_event_log_security_4732.yml | 2 +- data_sources/windows_event_log_security_4737.yml | 2 +- data_sources/windows_event_log_security_4738.yml | 2 +- data_sources/windows_event_log_security_4739.yml | 2 +- data_sources/windows_event_log_security_4741.yml | 2 +- data_sources/windows_event_log_security_4742.yml | 2 +- data_sources/windows_event_log_security_4744.yml | 2 +- data_sources/windows_event_log_security_4749.yml | 2 +- data_sources/windows_event_log_security_4754.yml | 2 +- data_sources/windows_event_log_security_4756.yml | 2 +- data_sources/windows_event_log_security_4759.yml | 2 +- data_sources/windows_event_log_security_4768.yml | 2 +- data_sources/windows_event_log_security_4769.yml | 2 +- data_sources/windows_event_log_security_4771.yml | 2 +- data_sources/windows_event_log_security_4776.yml | 2 +- data_sources/windows_event_log_security_4781.yml | 2 +- data_sources/windows_event_log_security_4783.yml | 2 +- data_sources/windows_event_log_security_4790.yml | 2 +- data_sources/windows_event_log_security_4794.yml | 2 +- data_sources/windows_event_log_security_4798.yml | 2 +- data_sources/windows_event_log_security_4876.yml | 2 +- data_sources/windows_event_log_security_4886.yml | 2 +- data_sources/windows_event_log_security_4887.yml | 2 +- data_sources/windows_event_log_security_4946.yml | 2 +- data_sources/windows_event_log_security_4947.yml | 2 +- data_sources/windows_event_log_security_4948.yml | 2 +- data_sources/windows_event_log_security_5136.yml | 2 +- data_sources/windows_event_log_security_5137.yml | 2 +- data_sources/windows_event_log_security_5140.yml | 2 +- data_sources/windows_event_log_security_5141.yml | 2 +- data_sources/windows_event_log_security_5145.yml | 2 +- data_sources/windows_event_log_system_104.yml | 2 +- data_sources/windows_event_log_system_4720.yml | 2 +- data_sources/windows_event_log_system_4726.yml | 2 +- data_sources/windows_event_log_system_4728.yml | 2 +- data_sources/windows_event_log_system_7036.yml | 2 +- data_sources/windows_event_log_system_7040.yml | 2 +- data_sources/windows_event_log_system_7045.yml | 2 +- data_sources/windows_event_log_taskscheduler_200.yml | 2 +- data_sources/windows_event_log_taskscheduler_201.yml | 2 +- data_sources/windows_iis.yml | 2 +- data_sources/windows_iis_29.yml | 2 +- install.yml | 2 +- 223 files changed, 223 insertions(+), 223 deletions(-) diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index c40126191c4..4607235dc48 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -24,7 +24,7 @@ separator: api.operation supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 output_fields: - dest - user diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index bd7fc59c23e..b63f18820dd 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -14,7 +14,7 @@ separator_value: ModelInvocationLog supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - accountId diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index dbe9bbafd86..e0143b82826 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -17,7 +17,7 @@ sourcetype: aws:cloudfront:accesslogs supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index d80e70b1559..825b34c64ba 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -11,4 +11,4 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 diff --git a/data_sources/aws_cloudtrail_assumerolewithsaml.yml b/data_sources/aws_cloudtrail_assumerolewithsaml.yml index efe8b33ddb7..12129d2b6c7 100644 --- a/data_sources/aws_cloudtrail_assumerolewithsaml.yml +++ b/data_sources/aws_cloudtrail_assumerolewithsaml.yml @@ -18,7 +18,7 @@ separator_value: AssumeRoleWithSAML supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index 47f47f1900b..11f6b92811f 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -18,7 +18,7 @@ separator_value: ConsoleLogin supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_copyobject.yml b/data_sources/aws_cloudtrail_copyobject.yml index afce3a4582f..31d80aad7bd 100644 --- a/data_sources/aws_cloudtrail_copyobject.yml +++ b/data_sources/aws_cloudtrail_copyobject.yml @@ -17,7 +17,7 @@ separator_value: CopyObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index 55fa3c5e41c..43dd2a556e9 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -17,7 +17,7 @@ separator_value: CreateAccessKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index a421c797639..129a3a1fb54 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -17,7 +17,7 @@ separator_value: CreateKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createloginprofile.yml b/data_sources/aws_cloudtrail_createloginprofile.yml index 3f8eab8b671..bce7344352b 100644 --- a/data_sources/aws_cloudtrail_createloginprofile.yml +++ b/data_sources/aws_cloudtrail_createloginprofile.yml @@ -17,7 +17,7 @@ separator_value: CreateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index 1ad54471486..c7f5b9a219c 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -17,7 +17,7 @@ separator_value: CreateNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index dfd4ba93218..87f204eb6fd 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -17,7 +17,7 @@ separator_value: CreatePolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index e2a3e40ce31..fbc4851ba93 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -17,7 +17,7 @@ separator_value: CreateSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createtask.yml b/data_sources/aws_cloudtrail_createtask.yml index 1a462fcf5dc..d8910cfa606 100644 --- a/data_sources/aws_cloudtrail_createtask.yml +++ b/data_sources/aws_cloudtrail_createtask.yml @@ -17,7 +17,7 @@ separator_value: CreateTask supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml index 1dd734b3c2e..2270baea06c 100644 --- a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml @@ -17,7 +17,7 @@ separator_value: CreateVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deactivatemfadevice.yml b/data_sources/aws_cloudtrail_deactivatemfadevice.yml index bf04e2a3174..f1f93bb50ae 100644 --- a/data_sources/aws_cloudtrail_deactivatemfadevice.yml +++ b/data_sources/aws_cloudtrail_deactivatemfadevice.yml @@ -17,7 +17,7 @@ separator_value: DeactivateMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml index e08314d0290..b81255026cc 100644 --- a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: DeleteAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletealarms.yml b/data_sources/aws_cloudtrail_deletealarms.yml index 44405c5e8b7..57139173711 100644 --- a/data_sources/aws_cloudtrail_deletealarms.yml +++ b/data_sources/aws_cloudtrail_deletealarms.yml @@ -17,7 +17,7 @@ separator_value: DeleteAlarms supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index 3d53d8c6c74..a093e8e01c2 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -17,7 +17,7 @@ separator_value: DeleteDetector supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index 67d95cdb659..e0ec05a9f58 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteguardrail.yml b/data_sources/aws_cloudtrail_deleteguardrail.yml index c4f6cc25985..a267a7365bd 100644 --- a/data_sources/aws_cloudtrail_deleteguardrail.yml +++ b/data_sources/aws_cloudtrail_deleteguardrail.yml @@ -14,7 +14,7 @@ separator_value: DeleteGuardrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 010c2162c14..49aaff4b2a0 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -16,7 +16,7 @@ separator_value: DeleteIPSet supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deleteknowledgebase.yml b/data_sources/aws_cloudtrail_deleteknowledgebase.yml index 8b13e8bdc21..4c8f1145d84 100644 --- a/data_sources/aws_cloudtrail_deleteknowledgebase.yml +++ b/data_sources/aws_cloudtrail_deleteknowledgebase.yml @@ -14,7 +14,7 @@ separator_value: DeleteKnowledgeBase supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml index 55c95ea4adb..805f634c520 100644 --- a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index 3809b00a305..71f8b3e5cd8 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index 7270838ad1f..e79e168f529 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogStream supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml index 614f3fd068f..1ecf190e170 100644 --- a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml @@ -14,7 +14,7 @@ separator_value: DeleteModelInvocationLoggingConfiguration supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index 6562a321da9..4b95dba5c93 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -16,7 +16,7 @@ separator_value: DeleteNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index 84c522f2f44..d49419a4963 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -15,7 +15,7 @@ separator_value: DeletePolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index 4929e2e883b..af9675c5804 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -17,7 +17,7 @@ separator_value: DeleteRule supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deleterulegroup.yml b/data_sources/aws_cloudtrail_deleterulegroup.yml index b8105c4862c..6337447b951 100644 --- a/data_sources/aws_cloudtrail_deleterulegroup.yml +++ b/data_sources/aws_cloudtrail_deleterulegroup.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deletesnapshot.yml b/data_sources/aws_cloudtrail_deletesnapshot.yml index c234e022e6f..23e8cfc587c 100644 --- a/data_sources/aws_cloudtrail_deletesnapshot.yml +++ b/data_sources/aws_cloudtrail_deletesnapshot.yml @@ -17,7 +17,7 @@ separator_value: DeleteSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index e52c960d46a..80699857863 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -17,7 +17,7 @@ separator_value: DeleteTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml index abcf17e4385..c192eec08fe 100644 --- a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml @@ -15,7 +15,7 @@ separator_value: DeleteVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index c88017ac48e..9f8e54c0b0a 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -15,7 +15,7 @@ separator_value: DeleteWebACL supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_describeeventaggregates.yml b/data_sources/aws_cloudtrail_describeeventaggregates.yml index ee363cb8cd7..84df3121585 100644 --- a/data_sources/aws_cloudtrail_describeeventaggregates.yml +++ b/data_sources/aws_cloudtrail_describeeventaggregates.yml @@ -15,7 +15,7 @@ separator_value: DescribeEventAggregates supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index d19da791f6a..ffb232cf7df 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -16,7 +16,7 @@ separator_value: DescribeImageScanFindings supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describesnapshotattribute.yml b/data_sources/aws_cloudtrail_describesnapshotattribute.yml index 2346b224943..7f8a42b3050 100644 --- a/data_sources/aws_cloudtrail_describesnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_describesnapshotattribute.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - action - app diff --git a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml index 38d15654183..36d941e095b 100644 --- a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: GetAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_getobject.yml b/data_sources/aws_cloudtrail_getobject.yml index c39f7ca141b..8fb94ecdd20 100644 --- a/data_sources/aws_cloudtrail_getobject.yml +++ b/data_sources/aws_cloudtrail_getobject.yml @@ -16,7 +16,7 @@ separator_value: GetObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index 060a86c2dcc..b40bdbc8aa9 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -15,7 +15,7 @@ separator_value: GetPasswordData supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_invokemodel.yml b/data_sources/aws_cloudtrail_invokemodel.yml index 924c2c13674..14a6f7bf67f 100644 --- a/data_sources/aws_cloudtrail_invokemodel.yml +++ b/data_sources/aws_cloudtrail_invokemodel.yml @@ -14,7 +14,7 @@ separator_value: InvokeModel supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_jobcreated.yml b/data_sources/aws_cloudtrail_jobcreated.yml index 83b42f84498..40b994aea07 100644 --- a/data_sources/aws_cloudtrail_jobcreated.yml +++ b/data_sources/aws_cloudtrail_jobcreated.yml @@ -15,7 +15,7 @@ separator_value: JobCreated supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_listfoundationmodels.yml b/data_sources/aws_cloudtrail_listfoundationmodels.yml index 06a7cd75840..405e216639d 100644 --- a/data_sources/aws_cloudtrail_listfoundationmodels.yml +++ b/data_sources/aws_cloudtrail_listfoundationmodels.yml @@ -14,7 +14,7 @@ separator_value: ListFoundationModels supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index a6b0eeca89a..d058bd83b49 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -16,7 +16,7 @@ separator_value: ModifyDBInstance supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index 272e734d135..ee76b1b6c47 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -15,7 +15,7 @@ separator_value: ModifyImageAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index afebb51c8f3..8befb435c81 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -14,7 +14,7 @@ separator_value: ModifySnapshotAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putbucketacl.yml b/data_sources/aws_cloudtrail_putbucketacl.yml index 172b11719d9..bf632058912 100644 --- a/data_sources/aws_cloudtrail_putbucketacl.yml +++ b/data_sources/aws_cloudtrail_putbucketacl.yml @@ -15,7 +15,7 @@ separator_value: PutBucketAcl supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index c24c6c24177..883fb202b5d 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -15,7 +15,7 @@ separator_value: PutBucketLifecycle supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketreplication.yml b/data_sources/aws_cloudtrail_putbucketreplication.yml index ac76f2f3559..b071d6907dc 100644 --- a/data_sources/aws_cloudtrail_putbucketreplication.yml +++ b/data_sources/aws_cloudtrail_putbucketreplication.yml @@ -14,7 +14,7 @@ separator_value: PutBucketReplication supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketversioning.yml b/data_sources/aws_cloudtrail_putbucketversioning.yml index 9f834c10ceb..d3f179ec631 100644 --- a/data_sources/aws_cloudtrail_putbucketversioning.yml +++ b/data_sources/aws_cloudtrail_putbucketversioning.yml @@ -14,7 +14,7 @@ separator_value: PutBucketVersioning supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index 22e54982752..e92163adc20 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -15,7 +15,7 @@ separator_value: PutImage supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 37d43a32860..8155bef7776 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -13,7 +13,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 34e190129c6..92c5655c6c2 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -15,7 +15,7 @@ separator_value: ReplaceNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index c3264444c1c..4e07364aa94 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -15,7 +15,7 @@ separator_value: SetDefaultPolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index 7858189b110..9c3ec05bf82 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -14,7 +14,7 @@ separator_value: StopLogging supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml index 9790a74d672..0f07c4ba642 100644 --- a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: UpdateAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index 2e58b10a336..bb02c750ca6 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -15,7 +15,7 @@ separator_value: UpdateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatesamlprovider.yml b/data_sources/aws_cloudtrail_updatesamlprovider.yml index 755e03f5082..6d8968e44d1 100644 --- a/data_sources/aws_cloudtrail_updatesamlprovider.yml +++ b/data_sources/aws_cloudtrail_updatesamlprovider.yml @@ -16,7 +16,7 @@ separator_value: UpdateSAMLProvider supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index cd980da8942..3455d837c4c 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -15,7 +15,7 @@ separator_value: UpdateTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - app diff --git a/data_sources/aws_cloudwatchlogs_vpcflow.yml b/data_sources/aws_cloudwatchlogs_vpcflow.yml index eb0cdc7ecfe..2bf501a18b5 100644 --- a/data_sources/aws_cloudwatchlogs_vpcflow.yml +++ b/data_sources/aws_cloudwatchlogs_vpcflow.yml @@ -12,7 +12,7 @@ source: aws_cloudwatchlogs_vpcflow sourcetype: aws:cloudwatchlogs:vpcflow supported_TA: - name: Splunk Add-on for AWS - version: 8.1.2 + version: 8.2.1 url: https://splunkbase.splunk.com/app/1876 fields: - _raw diff --git a/data_sources/aws_security_hub.yml b/data_sources/aws_security_hub.yml index b2bda6430ed..a74705eac42 100644 --- a/data_sources/aws_security_hub.yml +++ b/data_sources/aws_security_hub.yml @@ -15,7 +15,7 @@ sourcetype: aws:securityhub:finding supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.2 + version: 8.2.1 fields: - _time - AwsAccountId diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index 4b353862ea1..ff54229c4ac 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 output_fields: - dest - user diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index 182d512dca2..dabaaa7d982 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index 5031b5cd33a..148ad9f53d6 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -17,7 +17,7 @@ separator_value: Add member to role supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index f0c01197f68..6a3682061cd 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -17,7 +17,7 @@ separator_value: Add owner to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index c5e2c3a4e56..a89d51760a4 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index 7b4411afbdb..86ec0e593c7 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -17,7 +17,7 @@ separator_value: Add unverified domain supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 1461a8eaa69..2d3dddff8e8 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -17,7 +17,7 @@ separator_value: Consent to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index 177b30e2127..10b5050e7b3 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -16,7 +16,7 @@ separator_value: Disable Strong Authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index b7fd87116ed..2926d693c9a 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -16,7 +16,7 @@ separator_value: Enable account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 22983a3d9f6..5c989625b73 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -16,7 +16,7 @@ separator_value: Invite external user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml index 65cb093d4f0..51cf097b188 100644 --- a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml +++ b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}' diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml index 8c5adbf8ae6..161a1d8a1a3 100644 --- a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml +++ b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - action - additional_details diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index da60f90a288..bf82955119e 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -16,7 +16,7 @@ separator_value: Reset password (by admin) supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 9a0c666f201..3b2864dfe1b 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -16,7 +16,7 @@ separator_value: Set domain authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index d6888c0deeb..ec07057d4d2 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -16,7 +16,7 @@ separator_value: Sign-in activity supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index b0ae6b37c94..94311f56f83 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -16,7 +16,7 @@ separator_value: Update application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index 7a086791e4d..adb75dd369f 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -16,7 +16,7 @@ separator_value: Update authorization policy supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index f0ca04a229a..81c651980d2 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -15,7 +15,7 @@ separator_value: Update user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index ce39762a767..3b99c45001e 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -15,7 +15,7 @@ separator_value: User registered security info supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - Level diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index fb083554f3f..c08a28064fa 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 1c61b96dac4..6a5cb1015f4 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation Runbook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index c1d309bda95..0527fe91051 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation webhook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - _time - authorization.action diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index 5b89633bdb8..c9824bf8650 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.1 fields: - column - action diff --git a/data_sources/crowdstrike_falcon_stream_alert.yml b/data_sources/crowdstrike_falcon_stream_alert.yml index dceb6eef93c..2ff079b443f 100644 --- a/data_sources/crowdstrike_falcon_stream_alert.yml +++ b/data_sources/crowdstrike_falcon_stream_alert.yml @@ -17,7 +17,7 @@ separator: event.DetectName supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 3.0.0 + version: 3.1.2 fields: - action - description diff --git a/data_sources/crowdstrike_processrollup2.yml b/data_sources/crowdstrike_processrollup2.yml index 24d29df9598..a44d6511adb 100644 --- a/data_sources/crowdstrike_processrollup2.yml +++ b/data_sources/crowdstrike_processrollup2.yml @@ -18,7 +18,7 @@ separator_value: ProcessRollup2 supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 3.0.0 + version: 3.1.2 fields: - AuthenticationId - AuthenticationId_meaning diff --git a/data_sources/linux_auditd_add_user.yml b/data_sources/linux_auditd_add_user.yml index 164e9aefb75..52378a5ee6d 100644 --- a/data_sources/linux_auditd_add_user.yml +++ b/data_sources/linux_auditd_add_user.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - msg - type diff --git a/data_sources/linux_auditd_cwd.yml b/data_sources/linux_auditd_cwd.yml index afbe0ec7015..d39ee1fddc4 100644 --- a/data_sources/linux_auditd_cwd.yml +++ b/data_sources/linux_auditd_cwd.yml @@ -13,7 +13,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - cwd - date_hour diff --git a/data_sources/linux_auditd_daemon_abort.yml b/data_sources/linux_auditd_daemon_abort.yml index 9b83e49dc16..e46aa9c3264 100644 --- a/data_sources/linux_auditd_daemon_abort.yml +++ b/data_sources/linux_auditd_daemon_abort.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_end.yml b/data_sources/linux_auditd_daemon_end.yml index f7b4fcf4ddf..0522a1d4133 100644 --- a/data_sources/linux_auditd_daemon_end.yml +++ b/data_sources/linux_auditd_daemon_end.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_start.yml b/data_sources/linux_auditd_daemon_start.yml index 9f96075a6ea..4024d17bc87 100644 --- a/data_sources/linux_auditd_daemon_start.yml +++ b/data_sources/linux_auditd_daemon_start.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - type - op diff --git a/data_sources/linux_auditd_execve.yml b/data_sources/linux_auditd_execve.yml index 1d5c0398779..e72fcaef2fe 100644 --- a/data_sources/linux_auditd_execve.yml +++ b/data_sources/linux_auditd_execve.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - msg - type diff --git a/data_sources/linux_auditd_path.yml b/data_sources/linux_auditd_path.yml index 6f0953cec07..1ec1119e7d1 100644 --- a/data_sources/linux_auditd_path.yml +++ b/data_sources/linux_auditd_path.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - msg - type diff --git a/data_sources/linux_auditd_proctitle.yml b/data_sources/linux_auditd_proctitle.yml index 44e2a8935b4..4b3af11875b 100644 --- a/data_sources/linux_auditd_proctitle.yml +++ b/data_sources/linux_auditd_proctitle.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - proctitle - msg diff --git a/data_sources/linux_auditd_service_stop.yml b/data_sources/linux_auditd_service_stop.yml index 1db5103e145..71d083b8e5e 100644 --- a/data_sources/linux_auditd_service_stop.yml +++ b/data_sources/linux_auditd_service_stop.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - msg - type diff --git a/data_sources/linux_auditd_syscall.yml b/data_sources/linux_auditd_syscall.yml index b5d9647033d..7582dd5dc06 100644 --- a/data_sources/linux_auditd_syscall.yml +++ b/data_sources/linux_auditd_syscall.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - msg - type diff --git a/data_sources/linux_messages_syslog.yml b/data_sources/linux_messages_syslog.yml index 4990b9710dc..7e89cd959e8 100644 --- a/data_sources/linux_messages_syslog.yml +++ b/data_sources/linux_messages_syslog.yml @@ -15,7 +15,7 @@ sourcetype: linux_messages_syslog supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - _time - action diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index b8dd8ae5ba5..f01804afa2b 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -16,7 +16,7 @@ sourcetype: linux_secure supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.2 fields: - _time - action diff --git a/data_sources/m365_copilot_graph_api.yml b/data_sources/m365_copilot_graph_api.yml index 33aec6362d0..eef7d37443d 100644 --- a/data_sources/m365_copilot_graph_api.yml +++ b/data_sources/m365_copilot_graph_api.yml @@ -10,7 +10,7 @@ sourcetype: o365:graph:api supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - appDisplayName - appId diff --git a/data_sources/ntlm_operational_8004.yml b/data_sources/ntlm_operational_8004.yml index 141ebdf0def..d39701e6986 100644 --- a/data_sources/ntlm_operational_8004.yml +++ b/data_sources/ntlm_operational_8004.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8005.yml b/data_sources/ntlm_operational_8005.yml index da24c4688cc..2b877cc4162 100644 --- a/data_sources/ntlm_operational_8005.yml +++ b/data_sources/ntlm_operational_8005.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8006.yml b/data_sources/ntlm_operational_8006.yml index e4ec349eb57..f2371051138 100644 --- a/data_sources/ntlm_operational_8006.yml +++ b/data_sources/ntlm_operational_8006.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/o365.yml b/data_sources/o365.yml index a19cd4ad788..4184acc03ef 100644 --- a/data_sources/o365.yml +++ b/data_sources/o365.yml @@ -17,4 +17,4 @@ separator: Operation supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 diff --git a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml index 7723ded61a2..1687c98ff8f 100644 --- a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml +++ b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment grant to user. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml index 8654f39dbd7..925288235de 100644 --- a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml +++ b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_mailboxpermission.yml b/data_sources/o365_add_mailboxpermission.yml index 39b8cabf1cc..79d4333bbb7 100644 --- a/data_sources/o365_add_mailboxpermission.yml +++ b/data_sources/o365_add_mailboxpermission.yml @@ -17,7 +17,7 @@ separator_value: Add-MailboxPermission supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - AccessRights diff --git a/data_sources/o365_add_member_to_role_.yml b/data_sources/o365_add_member_to_role_.yml index 203e698796d..a69da205d94 100644 --- a/data_sources/o365_add_member_to_role_.yml +++ b/data_sources/o365_add_member_to_role_.yml @@ -17,7 +17,7 @@ separator_value: Add member to role. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_owner_to_application_.yml b/data_sources/o365_add_owner_to_application_.yml index 78a3be49c4b..aa2db390305 100644 --- a/data_sources/o365_add_owner_to_application_.yml +++ b/data_sources/o365_add_owner_to_application_.yml @@ -17,7 +17,7 @@ separator_value: Add owner to application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_service_principal_.yml b/data_sources/o365_add_service_principal_.yml index 3f55630da58..3b4615afa78 100644 --- a/data_sources/o365_add_service_principal_.yml +++ b/data_sources/o365_add_service_principal_.yml @@ -17,7 +17,7 @@ separator_value: Add service principal. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_change_user_license_.yml b/data_sources/o365_change_user_license_.yml index 63af5c5dcef..d6451bc0359 100644 --- a/data_sources/o365_change_user_license_.yml +++ b/data_sources/o365_change_user_license_.yml @@ -17,7 +17,7 @@ separator_value: Change user license. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_consent_to_application_.yml b/data_sources/o365_consent_to_application_.yml index d4a327cfbe8..f12ada70fda 100644 --- a/data_sources/o365_consent_to_application_.yml +++ b/data_sources/o365_consent_to_application_.yml @@ -17,7 +17,7 @@ separator_value: Consent to application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_disable_strong_authentication_.yml b/data_sources/o365_disable_strong_authentication_.yml index 65923c1c804..3e75abb3786 100644 --- a/data_sources/o365_disable_strong_authentication_.yml +++ b/data_sources/o365_disable_strong_authentication_.yml @@ -17,7 +17,7 @@ separator_value: Disable Strong Authentication. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_mailitemsaccessed.yml b/data_sources/o365_mailitemsaccessed.yml index 8174ccfa106..3860a0da92a 100644 --- a/data_sources/o365_mailitemsaccessed.yml +++ b/data_sources/o365_mailitemsaccessed.yml @@ -17,7 +17,7 @@ separator_value: MailItemsAccessed supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - AppId diff --git a/data_sources/o365_modifyfolderpermissions.yml b/data_sources/o365_modifyfolderpermissions.yml index 94b626b4685..bf304721058 100644 --- a/data_sources/o365_modifyfolderpermissions.yml +++ b/data_sources/o365_modifyfolderpermissions.yml @@ -17,7 +17,7 @@ separator_value: ModifyFolderPermissions supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - AppId diff --git a/data_sources/o365_set_company_information_.yml b/data_sources/o365_set_company_information_.yml index b0930986109..e40e2d49171 100644 --- a/data_sources/o365_set_company_information_.yml +++ b/data_sources/o365_set_company_information_.yml @@ -17,7 +17,7 @@ separator_value: Set Company Information. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_set_mailbox.yml b/data_sources/o365_set_mailbox.yml index 96c5ad2283e..07dff022336 100644 --- a/data_sources/o365_set_mailbox.yml +++ b/data_sources/o365_set_mailbox.yml @@ -17,7 +17,7 @@ separator_value: Set-Mailbox supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - AppId diff --git a/data_sources/o365_update_application_.yml b/data_sources/o365_update_application_.yml index 949c78147e1..48912324ff7 100644 --- a/data_sources/o365_update_application_.yml +++ b/data_sources/o365_update_application_.yml @@ -17,7 +17,7 @@ separator_value: Update application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_update_authorization_policy_.yml b/data_sources/o365_update_authorization_policy_.yml index 7bae300e3d1..0feeb95bdf6 100644 --- a/data_sources/o365_update_authorization_policy_.yml +++ b/data_sources/o365_update_authorization_policy_.yml @@ -17,7 +17,7 @@ separator_value: Update authorization policy. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_update_user_.yml b/data_sources/o365_update_user_.yml index 16dce5cfdbd..0b264ec1b2f 100644 --- a/data_sources/o365_update_user_.yml +++ b/data_sources/o365_update_user_.yml @@ -17,7 +17,7 @@ separator_value: Update user. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_userloggedin.yml b/data_sources/o365_userloggedin.yml index 8471cc627bb..0402ece5bf7 100644 --- a/data_sources/o365_userloggedin.yml +++ b/data_sources/o365_userloggedin.yml @@ -17,7 +17,7 @@ separator_value: UserLoggedIn supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/o365_userloginfailed.yml b/data_sources/o365_userloginfailed.yml index a898d3063e9..61907c7546c 100644 --- a/data_sources/o365_userloginfailed.yml +++ b/data_sources/o365_userloginfailed.yml @@ -17,7 +17,7 @@ separator_value: UserLoginFailed supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time - ActorContextId diff --git a/data_sources/office_365_reporting_message_trace.yml b/data_sources/office_365_reporting_message_trace.yml index ef82a079e76..1c2f9ffefc5 100644 --- a/data_sources/office_365_reporting_message_trace.yml +++ b/data_sources/office_365_reporting_message_trace.yml @@ -11,7 +11,7 @@ separator: Organization supported_TA: - name: Splunk Microsoft Office 365 Add-on url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - FromIP - Index diff --git a/data_sources/office_365_universal_audit_log.yml b/data_sources/office_365_universal_audit_log.yml index 0e03e59a90e..c9273ae1194 100644 --- a/data_sources/office_365_universal_audit_log.yml +++ b/data_sources/office_365_universal_audit_log.yml @@ -11,7 +11,7 @@ separator: Operation supported_TA: - name: Splunk Microsoft Office 365 Add-on url: https://splunkbase.splunk.com/app/4055 - version: 6.0.2 + version: 6.1.0 fields: - _time example_log: '' diff --git a/data_sources/okta.yml b/data_sources/okta.yml index 13546f1ac4b..aead16fbc86 100644 --- a/data_sources/okta.yml +++ b/data_sources/okta.yml @@ -16,7 +16,7 @@ sourcetype: OktaIM2:log supported_TA: - name: Splunk Add-on for Okta Identity Cloud url: https://splunkbase.splunk.com/app/6553 - version: 5.0.3 + version: 5.1.0 output_fields: - dest - src diff --git a/data_sources/palo_alto_network_threat.yml b/data_sources/palo_alto_network_threat.yml index b83bd67d0b4..9567c997b9d 100644 --- a/data_sources/palo_alto_network_threat.yml +++ b/data_sources/palo_alto_network_threat.yml @@ -16,7 +16,7 @@ sourcetype: pan:threat supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.1.0 + version: 3.2.2 fields: - _time - date_hour diff --git a/data_sources/palo_alto_network_traffic.yml b/data_sources/palo_alto_network_traffic.yml index 00e9798ece8..ac49f6e6a45 100644 --- a/data_sources/palo_alto_network_traffic.yml +++ b/data_sources/palo_alto_network_traffic.yml @@ -16,7 +16,7 @@ sourcetype: pan:traffic supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.1.0 + version: 3.2.2 fields: - _time - date_hour diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 6a20ab81289..72049e5869d 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -18,7 +18,7 @@ separator_value: '4104' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index 7e1ec4fde71..467fcb8c936 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -16,7 +16,7 @@ sourcetype: ActiveDirectory supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Guid diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index 4ef6ecee000..87a33c03d7a 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_17135.yml b/data_sources/windows_event_log_application_17135.yml index fb960b1d426..4b07db29e42 100644 --- a/data_sources/windows_event_log_application_17135.yml +++ b/data_sources/windows_event_log_application_17135.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index 9107707eaf1..a968dd1a469 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index a98f34690b7..99771041c1b 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -17,7 +17,7 @@ separator_value: '3000' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index b45b9b50fa1..4d554be9821 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index 869197ab810..ef814e94195 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index 792a15ebbca..56dd08571ef 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index 22e3b717253..d248fdad0b6 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index 00920b4b372..2630d7acd9a 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_capi2_70.yml b/data_sources/windows_event_log_capi2_70.yml index 2701795166b..40b8c314242 100644 --- a/data_sources/windows_event_log_capi2_70.yml +++ b/data_sources/windows_event_log_capi2_70.yml @@ -18,7 +18,7 @@ separator_value: '70' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_capi2_81.yml b/data_sources/windows_event_log_capi2_81.yml index f4e77710235..bf5fcbfe1c1 100644 --- a/data_sources/windows_event_log_capi2_81.yml +++ b/data_sources/windows_event_log_capi2_81.yml @@ -18,7 +18,7 @@ separator_value: '81' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_certificateservicesclient_1007.yml b/data_sources/windows_event_log_certificateservicesclient_1007.yml index 14d92e22a74..e013ce48525 100644 --- a/data_sources/windows_event_log_certificateservicesclient_1007.yml +++ b/data_sources/windows_event_log_certificateservicesclient_1007.yml @@ -18,7 +18,7 @@ separator_value: '1007' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index 011347afb2d..0782a1766a3 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -16,7 +16,7 @@ separator_value: '1121' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index 9c97a01efe2..46328a91ece 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -16,7 +16,7 @@ separator_value: '1122' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index 77928d82739..f812bf2ba77 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Windows Defender' Guid='{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}'/><EventID>1122</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2023-11-26T23:43:08.7101401Z'/><EventRecordID>3701</EventRecordID><Correlation ActivityID='{b68511a1-ec5f-4bc7-a9bb-2bd601338de2}'/><Execution ProcessID='3512' ThreadID='5936'/><Channel>Microsoft-Windows-Windows Defender/Operational</Channel><Computer>researchvmhaa</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='Product Name'>Microsoft Defender Antivirus</Data><Data Name='Product Version'>4.18.23100.2009</Data><Data Name='Unused'></Data><Data Name='ID'>E6DB77E5-3DF2-4CF1-B95A-636979351E5B</Data><Data Name='Detection Time'>2023-11-26T23:43:08.709Z</Data><Data Name='User'>(unknown user)</Data><Data Name='Path'></Data><Data Name='Process Name'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Security intelligence Version'>1.401.1247.0</Data><Data Name='Engine Version'>1.1.23100.2009</Data><Data Name='RuleType'>ENT\ConsR</Data><Data Name='Target Commandline'></Data><Data Name='Parent Commandline'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Involved File'></Data><Data Name='Inhertiance Flags'>0x00000000</Data></EventData></Event> diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index b0b5c2cef02..a55e60a8338 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index 8d9767ba9c3..2cab2267111 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -16,7 +16,7 @@ separator_value: '1129' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index 7b59c9cd6b4..4d5ec9e1e95 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index 1a813f46f96..f71c298db64 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 88cb4531d36..22cac0ee659 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index 3b54c95906d..ff75374cba2 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 882e7a7bd03..8a95469e854 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -14,7 +14,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_printservice_316.yml b/data_sources/windows_event_log_printservice_316.yml index 257bd4a5d48..2f0f18d30ae 100644 --- a/data_sources/windows_event_log_printservice_316.yml +++ b/data_sources/windows_event_log_printservice_316.yml @@ -15,7 +15,7 @@ separator_value: '316' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_printservice_4909.yml b/data_sources/windows_event_log_printservice_4909.yml index 529620eb608..d6913f17fdf 100644 --- a/data_sources/windows_event_log_printservice_4909.yml +++ b/data_sources/windows_event_log_printservice_4909.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time example_log: '' diff --git a/data_sources/windows_event_log_printservice_808.yml b/data_sources/windows_event_log_printservice_808.yml index d952de1f7e3..20f2a256479 100644 --- a/data_sources/windows_event_log_printservice_808.yml +++ b/data_sources/windows_event_log_printservice_808.yml @@ -16,7 +16,7 @@ separator_value: '808' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml index 6bd7d957fcd..69570a5152f 100644 --- a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml +++ b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml @@ -16,7 +16,7 @@ separator_value: '1149' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 3dbf23664f3..8229353cbbf 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -15,7 +15,7 @@ separator_value: '1100' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index 8586c6984d8..d565bd678ce 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -16,7 +16,7 @@ separator_value: '1102' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index 3971f62bfc7..9c368278f11 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -16,7 +16,7 @@ separator_value: '4624' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index 28e5d9feada..06fee295e2b 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -15,7 +15,7 @@ separator_value: '4625' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4627.yml b/data_sources/windows_event_log_security_4627.yml index e8c1fb0efbe..de3c2985d1e 100644 --- a/data_sources/windows_event_log_security_4627.yml +++ b/data_sources/windows_event_log_security_4627.yml @@ -16,7 +16,7 @@ separator_value: '4627' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index 6b8fa7d8291..3dab3df3498 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -15,7 +15,7 @@ separator_value: '4648' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index c0dc0121e46..63d9abb19a3 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -15,7 +15,7 @@ separator_value: '4662' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index f74d26c94a6..fef6cdc255c 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -15,7 +15,7 @@ separator_value: '4663' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index 280d7f8262f..5cb9cb72932 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -15,7 +15,7 @@ separator_value: '4672' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index 642687b596a..bd8db105257 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -16,7 +16,7 @@ configuration: Enabling Windows event log process command line logging via group supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - Caller_Domain - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index 3b4b6a9c064..b1a0fb75b77 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -15,7 +15,7 @@ separator_value: '4698' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index a80ed23a9ba..245516a91d9 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -15,7 +15,7 @@ separator_value: '4699' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index 4dc60cd9bd7..b5e97eaea36 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - EventID example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4700</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T02:32:47.606423000Z" /> <EventRecordID>344861</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="756" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContent"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>LeastPrivilege</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event> diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index 7184ff77e3f..fe586a0e05f 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - EventID example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4702</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T03:00:59.343820000Z" /> <EventRecordID>344863</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="596" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContentNew"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>HighestAvailable</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event> diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index 5c1d729155e..0b547c560ed 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -15,7 +15,7 @@ separator_value: '4703' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index 06b3adb9882..f5e9594ee22 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -15,7 +15,7 @@ separator_value: '4719' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 31484a35875..639a929eef4 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -14,7 +14,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index 26eb1728db8..d3eb5cb959f 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -14,7 +14,7 @@ separator_value: '4723' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index 0b06b7823a5..9ddcc5c979e 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -14,7 +14,7 @@ separator_value: '4724' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index ca05c7b8403..023b26bec6e 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -14,7 +14,7 @@ separator_value: '4725' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index 6ddc2aba570..d84a40ce419 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -14,7 +14,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 0aa2c2f0b79..0b186ffe539 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index bcba79a79d9..eee3ce49e92 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index 9487a6ac521..a7767a80448 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index 30f8bc23e81..7eb00e3339a 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index d95f852eb8e..3378e6e686c 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -14,7 +14,7 @@ separator_value: '4732' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index f128bbfcc42..6e188c3a964 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index fb6f1f3ca8d..f3a7e58f4af 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -14,7 +14,7 @@ separator_value: '4738' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4739.yml b/data_sources/windows_event_log_security_4739.yml index b0f63147034..ba5cda42f72 100644 --- a/data_sources/windows_event_log_security_4739.yml +++ b/data_sources/windows_event_log_security_4739.yml @@ -15,7 +15,7 @@ separator_value: '4739' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index 7b643fb3d0e..e93e8d3315f 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -17,7 +17,7 @@ separator_value: '4741' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index eb26156fe93..0efdb2a2ace 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index 216eb54d2c5..cda72a3f2d5 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index 8b61381edec..f4313a94423 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index 4dbe460a364..14bc6a85718 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index c53348491fb..516568e8f51 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index 9db0814db32..cae6d0e8b4c 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 0d954d3b5c3..5cfb55837f3 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -17,7 +17,7 @@ separator_value: '4768' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index 2b1506eda99..4c22ad71604 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -17,7 +17,7 @@ separator_value: '4769' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index 16751ea4ef2..61daf2795d5 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -17,7 +17,7 @@ separator_value: '4771' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index 408aaa466bb..b12b8773bf4 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -17,7 +17,7 @@ separator_value: '4776' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index ed8f3691a80..2eeb4b66b8e 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -17,7 +17,7 @@ separator_value: '4781' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index 4b239b5056d..e73ca759747 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index 8a945e0fe82..323438675c6 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index 70bae43f05b..9b3a4671cff 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -17,7 +17,7 @@ separator_value: supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index 8eebe0e5a94..9a395af8a1a 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index bdd7735a815..668f9a26548 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -17,7 +17,7 @@ separator_value: '4876' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index 9379641c7d3..940fdaf3572 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -17,7 +17,7 @@ separator_value: '4886' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index 2016e280f63..e5132ceded6 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -17,7 +17,7 @@ separator_value: '4887' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index 2d9e806305f..3052e227a29 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -12,7 +12,7 @@ separator_value: '4946' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index b10ef8870b6..4d0095a0d6d 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -12,7 +12,7 @@ separator_value: '4947' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index 961be864ee1..a483476732f 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -12,7 +12,7 @@ separator_value: '4948' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index b2035008e48..d122ec1a223 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -17,7 +17,7 @@ separator_value: '5136' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index 253ce10397d..67277b5148f 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -17,7 +17,7 @@ separator_value: '5137' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - AppCorrelationID diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index f5f3cf11165..8b83750b008 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -17,7 +17,7 @@ separator_value: '5140' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index 393098f2884..045fad9d03e 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -17,7 +17,7 @@ separator_value: '5141' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index 1647d2e8320..12eeaac238f 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -17,7 +17,7 @@ separator_value: '5145' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index faea29ccadb..e7af3737a91 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_system_4720.yml b/data_sources/windows_event_log_system_4720.yml index 49df88f658a..e18a77235a4 100644 --- a/data_sources/windows_event_log_system_4720.yml +++ b/data_sources/windows_event_log_system_4720.yml @@ -17,7 +17,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4726.yml b/data_sources/windows_event_log_system_4726.yml index 642359a985c..95e752daca6 100644 --- a/data_sources/windows_event_log_system_4726.yml +++ b/data_sources/windows_event_log_system_4726.yml @@ -17,7 +17,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4728.yml b/data_sources/windows_event_log_system_4728.yml index dd3e3849ea5..93b05f75d33 100644 --- a/data_sources/windows_event_log_system_4728.yml +++ b/data_sources/windows_event_log_system_4728.yml @@ -17,7 +17,7 @@ separator_value: '4728' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index 0cf395b1d21..f961b153aed 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -17,7 +17,7 @@ separator_value: '7036' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index 518d67eacf5..47707be7dcd 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -17,7 +17,7 @@ separator_value: '7040' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index a1fda46fe87..05a05f8eaad 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -17,7 +17,7 @@ separator_value: '7045' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - AccountName diff --git a/data_sources/windows_event_log_taskscheduler_200.yml b/data_sources/windows_event_log_taskscheduler_200.yml index e7fe0ff722b..a2f4dda16d5 100644 --- a/data_sources/windows_event_log_taskscheduler_200.yml +++ b/data_sources/windows_event_log_taskscheduler_200.yml @@ -17,7 +17,7 @@ separator_value: '200' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ActionName diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index 01ff84004bd..ed2d6b8bb7f 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time output_fields: diff --git a/data_sources/windows_iis.yml b/data_sources/windows_iis.yml index a3412a3b423..64204e7070f 100644 --- a/data_sources/windows_iis.yml +++ b/data_sources/windows_iis.yml @@ -16,4 +16,4 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 diff --git a/data_sources/windows_iis_29.yml b/data_sources/windows_iis_29.yml index 8c6977fd3a4..cae7b41acf5 100644 --- a/data_sources/windows_iis_29.yml +++ b/data_sources/windows_iis_29.yml @@ -17,7 +17,7 @@ separator_value: '29' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.0 fields: - _time - ComputerName diff --git a/install.yml b/install.yml index 2b299ead905..b33bb853c5f 100644 --- a/install.yml +++ b/install.yml @@ -24,7 +24,7 @@ apps: version: 1.3.2 - appid: Splunk_TA_google-cloudplatform url: https://splunkbase.splunk.com/app/3088 - version: 5.0.3 + version: 5.1.0 - appid: utbox url: https://splunkbase.splunk.com/app/2734 version: 1.9.4 From a27e7764346331a7ef8fccfe9d9778d2bb9388bd Mon Sep 17 00:00:00 2001 From: Cole Munz <Munzzyy1@proton.me> Date: Mon, 3 Aug 2026 03:44:50 -0500 Subject: [PATCH 046/162] Fix WILDCARD field name in malware_user_agents lookup (#4196) --- lookups/csv/malware_user_agents.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lookups/csv/malware_user_agents.yml b/lookups/csv/malware_user_agents.yml index 19a7fac1111..ee4b37bda5a 100644 --- a/lookups/csv/malware_user_agents.yml +++ b/lookups/csv/malware_user_agents.yml @@ -1,12 +1,12 @@ name: malware_user_agents id: 3a1a501c-d65f-4a6c-95a3-3d2b9a8c43c3 -version: 2 +version: 3 creation_date: '2026-01-06' -modification_date: '2026-05-13' +modification_date: '2026-08-02' author: Raven Tait, Splunk lookup_type: csv description: A list of user agents used with known malware. match_type: - - WILDCARD(malware_user_agents) + - WILDCARD(malware_user_agent) min_matches: 1 case_sensitive_match: true From 824e093cba94f3eba3dff9ca68c9f221bfc74948 Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Wed, 5 Aug 2026 03:11:33 -0700 Subject: [PATCH 047/162] Update data source TA and install.yml app versions (#4200) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- install.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/install.yml b/install.yml index b33bb853c5f..60db3de09f7 100644 --- a/install.yml +++ b/install.yml @@ -3,7 +3,7 @@ apps: hardcoded_path: dist/DA-ESS-ContentUpdate.tar.gz - appid: SplunkEnterpriseSecuritySuite url: https://splunkbase.splunk.com/app/263 - version: 8.5.1 + version: 8.6.1 - appid: Splunk_TA_microsoft-iis url: https://splunkbase.splunk.com/app/3185 version: 2.0.0 From 42005101ca0ef3238ce6433eb9a6279109e0d158 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 5 Aug 2026 09:05:31 -0700 Subject: [PATCH 048/162] Pin the Windows TA Version in Updater (#4203) --- .github/workflows/datasource-dependabot.yml | 5 +++++ data_sources/ntlm_operational_8004.yml | 2 +- data_sources/ntlm_operational_8005.yml | 2 +- data_sources/ntlm_operational_8006.yml | 2 +- data_sources/powershell_script_block_logging_4104.yml | 2 +- data_sources/windows_active_directory_admon.yml | 2 +- data_sources/windows_event_log_application_15457.yml | 2 +- data_sources/windows_event_log_application_17135.yml | 2 +- data_sources/windows_event_log_application_2282.yml | 2 +- data_sources/windows_event_log_application_3000.yml | 2 +- data_sources/windows_event_log_application_8128.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_400.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_854.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_855.yml | 2 +- data_sources/windows_event_log_appxpackaging_171.yml | 2 +- data_sources/windows_event_log_capi2_70.yml | 2 +- data_sources/windows_event_log_capi2_81.yml | 2 +- .../windows_event_log_certificateservicesclient_1007.yml | 2 +- data_sources/windows_event_log_defender_1121.yml | 2 +- data_sources/windows_event_log_defender_1122.yml | 2 +- data_sources/windows_event_log_defender_1125.yml | 2 +- data_sources/windows_event_log_defender_1126.yml | 2 +- data_sources/windows_event_log_defender_1129.yml | 2 +- data_sources/windows_event_log_defender_1131.yml | 2 +- data_sources/windows_event_log_defender_1132.yml | 2 +- data_sources/windows_event_log_defender_1133.yml | 2 +- data_sources/windows_event_log_defender_1134.yml | 2 +- data_sources/windows_event_log_defender_5007.yml | 2 +- data_sources/windows_event_log_printservice_316.yml | 2 +- data_sources/windows_event_log_printservice_4909.yml | 2 +- data_sources/windows_event_log_printservice_808.yml | 2 +- .../windows_event_log_remoteconnectionmanager_1149.yml | 2 +- data_sources/windows_event_log_security_1100.yml | 2 +- data_sources/windows_event_log_security_1102.yml | 2 +- data_sources/windows_event_log_security_4624.yml | 2 +- data_sources/windows_event_log_security_4625.yml | 2 +- data_sources/windows_event_log_security_4627.yml | 2 +- data_sources/windows_event_log_security_4648.yml | 2 +- data_sources/windows_event_log_security_4662.yml | 2 +- data_sources/windows_event_log_security_4663.yml | 2 +- data_sources/windows_event_log_security_4672.yml | 2 +- data_sources/windows_event_log_security_4688.yml | 2 +- data_sources/windows_event_log_security_4698.yml | 2 +- data_sources/windows_event_log_security_4699.yml | 2 +- data_sources/windows_event_log_security_4700.yml | 2 +- data_sources/windows_event_log_security_4702.yml | 2 +- data_sources/windows_event_log_security_4703.yml | 2 +- data_sources/windows_event_log_security_4719.yml | 2 +- data_sources/windows_event_log_security_4720.yml | 2 +- data_sources/windows_event_log_security_4723.yml | 2 +- data_sources/windows_event_log_security_4724.yml | 2 +- data_sources/windows_event_log_security_4725.yml | 2 +- data_sources/windows_event_log_security_4726.yml | 2 +- data_sources/windows_event_log_security_4727.yml | 2 +- data_sources/windows_event_log_security_4728.yml | 2 +- data_sources/windows_event_log_security_4730.yml | 2 +- data_sources/windows_event_log_security_4731.yml | 2 +- data_sources/windows_event_log_security_4732.yml | 2 +- data_sources/windows_event_log_security_4737.yml | 2 +- data_sources/windows_event_log_security_4738.yml | 2 +- data_sources/windows_event_log_security_4739.yml | 2 +- data_sources/windows_event_log_security_4741.yml | 2 +- data_sources/windows_event_log_security_4742.yml | 2 +- data_sources/windows_event_log_security_4744.yml | 2 +- data_sources/windows_event_log_security_4749.yml | 2 +- data_sources/windows_event_log_security_4754.yml | 2 +- data_sources/windows_event_log_security_4756.yml | 2 +- data_sources/windows_event_log_security_4759.yml | 2 +- data_sources/windows_event_log_security_4768.yml | 2 +- data_sources/windows_event_log_security_4769.yml | 2 +- data_sources/windows_event_log_security_4771.yml | 2 +- data_sources/windows_event_log_security_4776.yml | 2 +- data_sources/windows_event_log_security_4781.yml | 2 +- data_sources/windows_event_log_security_4783.yml | 2 +- data_sources/windows_event_log_security_4790.yml | 2 +- data_sources/windows_event_log_security_4794.yml | 2 +- data_sources/windows_event_log_security_4798.yml | 2 +- data_sources/windows_event_log_security_4876.yml | 2 +- data_sources/windows_event_log_security_4886.yml | 2 +- data_sources/windows_event_log_security_4887.yml | 2 +- data_sources/windows_event_log_security_4946.yml | 2 +- data_sources/windows_event_log_security_4947.yml | 2 +- data_sources/windows_event_log_security_4948.yml | 2 +- data_sources/windows_event_log_security_5136.yml | 2 +- data_sources/windows_event_log_security_5137.yml | 2 +- data_sources/windows_event_log_security_5140.yml | 2 +- data_sources/windows_event_log_security_5141.yml | 2 +- data_sources/windows_event_log_security_5145.yml | 2 +- data_sources/windows_event_log_system_104.yml | 2 +- data_sources/windows_event_log_system_4720.yml | 2 +- data_sources/windows_event_log_system_4726.yml | 2 +- data_sources/windows_event_log_system_4728.yml | 2 +- data_sources/windows_event_log_system_7036.yml | 2 +- data_sources/windows_event_log_system_7040.yml | 2 +- data_sources/windows_event_log_system_7045.yml | 2 +- data_sources/windows_event_log_taskscheduler_200.yml | 2 +- data_sources/windows_event_log_taskscheduler_201.yml | 2 +- data_sources/windows_iis.yml | 2 +- data_sources/windows_iis_29.yml | 2 +- 99 files changed, 103 insertions(+), 98 deletions(-) diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index 654ac85d846..65537866247 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -31,6 +31,11 @@ jobs: run: | echo "Updating data source supported_TA and repo install.yml app versions" contentctl-ng update-data-source-tas --content-dirs . + + # TODO: Remove this when we are fully compatible with the latest version of the Windows TA + # Temporarily roll back any automated updates to the Windows TA because we intentionally + # want to pin to the current version. + git checkout -- $(grep -rl "https://splunkbase.splunk.com/app/742" data_sources/) echo "Changed data source and install.yml files:" git status --short -- data_sources install.yml diff --git a/data_sources/ntlm_operational_8004.yml b/data_sources/ntlm_operational_8004.yml index d39701e6986..141ebdf0def 100644 --- a/data_sources/ntlm_operational_8004.yml +++ b/data_sources/ntlm_operational_8004.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8005.yml b/data_sources/ntlm_operational_8005.yml index 2b877cc4162..da24c4688cc 100644 --- a/data_sources/ntlm_operational_8005.yml +++ b/data_sources/ntlm_operational_8005.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8006.yml b/data_sources/ntlm_operational_8006.yml index f2371051138..e4ec349eb57 100644 --- a/data_sources/ntlm_operational_8006.yml +++ b/data_sources/ntlm_operational_8006.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 72049e5869d..6a20ab81289 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -18,7 +18,7 @@ separator_value: '4104' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index 467fcb8c936..7e1ec4fde71 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -16,7 +16,7 @@ sourcetype: ActiveDirectory supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Guid diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index 87a33c03d7a..4ef6ecee000 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_17135.yml b/data_sources/windows_event_log_application_17135.yml index 4b07db29e42..fb960b1d426 100644 --- a/data_sources/windows_event_log_application_17135.yml +++ b/data_sources/windows_event_log_application_17135.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index a968dd1a469..9107707eaf1 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index 99771041c1b..a98f34690b7 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -17,7 +17,7 @@ separator_value: '3000' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index 4d554be9821..b45b9b50fa1 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index ef814e94195..869197ab810 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index 56dd08571ef..792a15ebbca 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index d248fdad0b6..22e3b717253 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index 2630d7acd9a..00920b4b372 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_capi2_70.yml b/data_sources/windows_event_log_capi2_70.yml index 40b8c314242..2701795166b 100644 --- a/data_sources/windows_event_log_capi2_70.yml +++ b/data_sources/windows_event_log_capi2_70.yml @@ -18,7 +18,7 @@ separator_value: '70' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_capi2_81.yml b/data_sources/windows_event_log_capi2_81.yml index bf5fcbfe1c1..f4e77710235 100644 --- a/data_sources/windows_event_log_capi2_81.yml +++ b/data_sources/windows_event_log_capi2_81.yml @@ -18,7 +18,7 @@ separator_value: '81' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_certificateservicesclient_1007.yml b/data_sources/windows_event_log_certificateservicesclient_1007.yml index e013ce48525..14d92e22a74 100644 --- a/data_sources/windows_event_log_certificateservicesclient_1007.yml +++ b/data_sources/windows_event_log_certificateservicesclient_1007.yml @@ -18,7 +18,7 @@ separator_value: '1007' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index 0782a1766a3..011347afb2d 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -16,7 +16,7 @@ separator_value: '1121' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index 46328a91ece..9c97a01efe2 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -16,7 +16,7 @@ separator_value: '1122' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index f812bf2ba77..77928d82739 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Windows Defender' Guid='{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}'/><EventID>1122</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2023-11-26T23:43:08.7101401Z'/><EventRecordID>3701</EventRecordID><Correlation ActivityID='{b68511a1-ec5f-4bc7-a9bb-2bd601338de2}'/><Execution ProcessID='3512' ThreadID='5936'/><Channel>Microsoft-Windows-Windows Defender/Operational</Channel><Computer>researchvmhaa</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='Product Name'>Microsoft Defender Antivirus</Data><Data Name='Product Version'>4.18.23100.2009</Data><Data Name='Unused'></Data><Data Name='ID'>E6DB77E5-3DF2-4CF1-B95A-636979351E5B</Data><Data Name='Detection Time'>2023-11-26T23:43:08.709Z</Data><Data Name='User'>(unknown user)</Data><Data Name='Path'></Data><Data Name='Process Name'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Security intelligence Version'>1.401.1247.0</Data><Data Name='Engine Version'>1.1.23100.2009</Data><Data Name='RuleType'>ENT\ConsR</Data><Data Name='Target Commandline'></Data><Data Name='Parent Commandline'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Involved File'></Data><Data Name='Inhertiance Flags'>0x00000000</Data></EventData></Event> diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index a55e60a8338..b0b5c2cef02 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index 2cab2267111..8d9767ba9c3 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -16,7 +16,7 @@ separator_value: '1129' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index 4d5ec9e1e95..7b59c9cd6b4 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index f71c298db64..1a813f46f96 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 22cac0ee659..88cb4531d36 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index ff75374cba2..3b54c95906d 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 8a95469e854..882e7a7bd03 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -14,7 +14,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_printservice_316.yml b/data_sources/windows_event_log_printservice_316.yml index 2f0f18d30ae..257bd4a5d48 100644 --- a/data_sources/windows_event_log_printservice_316.yml +++ b/data_sources/windows_event_log_printservice_316.yml @@ -15,7 +15,7 @@ separator_value: '316' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_printservice_4909.yml b/data_sources/windows_event_log_printservice_4909.yml index d6913f17fdf..529620eb608 100644 --- a/data_sources/windows_event_log_printservice_4909.yml +++ b/data_sources/windows_event_log_printservice_4909.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time example_log: '' diff --git a/data_sources/windows_event_log_printservice_808.yml b/data_sources/windows_event_log_printservice_808.yml index 20f2a256479..d952de1f7e3 100644 --- a/data_sources/windows_event_log_printservice_808.yml +++ b/data_sources/windows_event_log_printservice_808.yml @@ -16,7 +16,7 @@ separator_value: '808' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml index 69570a5152f..6bd7d957fcd 100644 --- a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml +++ b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml @@ -16,7 +16,7 @@ separator_value: '1149' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 8229353cbbf..3dbf23664f3 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -15,7 +15,7 @@ separator_value: '1100' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index d565bd678ce..8586c6984d8 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -16,7 +16,7 @@ separator_value: '1102' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index 9c368278f11..3971f62bfc7 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -16,7 +16,7 @@ separator_value: '4624' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index 06fee295e2b..28e5d9feada 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -15,7 +15,7 @@ separator_value: '4625' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4627.yml b/data_sources/windows_event_log_security_4627.yml index de3c2985d1e..e8c1fb0efbe 100644 --- a/data_sources/windows_event_log_security_4627.yml +++ b/data_sources/windows_event_log_security_4627.yml @@ -16,7 +16,7 @@ separator_value: '4627' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index 3dab3df3498..6b8fa7d8291 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -15,7 +15,7 @@ separator_value: '4648' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index 63d9abb19a3..c0dc0121e46 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -15,7 +15,7 @@ separator_value: '4662' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index fef6cdc255c..f74d26c94a6 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -15,7 +15,7 @@ separator_value: '4663' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index 5cb9cb72932..280d7f8262f 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -15,7 +15,7 @@ separator_value: '4672' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index bd8db105257..642687b596a 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -16,7 +16,7 @@ configuration: Enabling Windows event log process command line logging via group supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - Caller_Domain - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index b1a0fb75b77..3b4b6a9c064 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -15,7 +15,7 @@ separator_value: '4698' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index 245516a91d9..a80ed23a9ba 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -15,7 +15,7 @@ separator_value: '4699' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index b5e97eaea36..4dc60cd9bd7 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - EventID example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4700</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T02:32:47.606423000Z" /> <EventRecordID>344861</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="756" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContent"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>LeastPrivilege</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event> diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index fe586a0e05f..7184ff77e3f 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - EventID example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4702</EventID> <Version>0</Version> <Level>0</Level> <Task>12804</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-09-23T03:00:59.343820000Z" /> <EventRecordID>344863</EventRecordID> <Correlation /> <Execution ProcessID="516" ThreadID="596" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System><EventData> <Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data> <Data Name="SubjectUserName">dadmin</Data> <Data Name="SubjectDomainName">CONTOSO</Data> <Data Name="SubjectLogonId">0x364eb</Data> <Data Name="TaskName">\\Microsoft\\StartListener</Data> <Data Name="TaskContentNew"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Date>2015-09-22T19:03:06.9258653</Date> <Author>CONTOSO\\dadmin</Author> </RegistrationInfo> <Triggers /> <Principals> <Principal id="Author"> <RunLevel>HighestAvailable</RunLevel> <UserId>CONTOSO\\dadmin</UserId> <LogonType>InteractiveToken</LogonType> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>P3D</ExecutionTimeLimit> <Priority>7</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\\Documents\\listener.exe</Command> </Exec> </Actions> </Task></Data> </EventData> </Event> diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index 0b547c560ed..5c1d729155e 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -15,7 +15,7 @@ separator_value: '4703' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index f5e9594ee22..06b3adb9882 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -15,7 +15,7 @@ separator_value: '4719' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 639a929eef4..31484a35875 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -14,7 +14,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index d3eb5cb959f..26eb1728db8 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -14,7 +14,7 @@ separator_value: '4723' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index 9ddcc5c979e..0b06b7823a5 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -14,7 +14,7 @@ separator_value: '4724' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index 023b26bec6e..ca05c7b8403 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -14,7 +14,7 @@ separator_value: '4725' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index d84a40ce419..6ddc2aba570 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -14,7 +14,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 0b186ffe539..0aa2c2f0b79 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index eee3ce49e92..bcba79a79d9 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index a7767a80448..9487a6ac521 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index 7eb00e3339a..30f8bc23e81 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index 3378e6e686c..d95f852eb8e 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -14,7 +14,7 @@ separator_value: '4732' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index 6e188c3a964..f128bbfcc42 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index f3a7e58f4af..fb6f1f3ca8d 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -14,7 +14,7 @@ separator_value: '4738' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4739.yml b/data_sources/windows_event_log_security_4739.yml index ba5cda42f72..b0f63147034 100644 --- a/data_sources/windows_event_log_security_4739.yml +++ b/data_sources/windows_event_log_security_4739.yml @@ -15,7 +15,7 @@ separator_value: '4739' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index e93e8d3315f..7b643fb3d0e 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -17,7 +17,7 @@ separator_value: '4741' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index 0efdb2a2ace..eb26156fe93 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index cda72a3f2d5..216eb54d2c5 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index f4313a94423..8b61381edec 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index 14bc6a85718..4dbe460a364 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index 516568e8f51..c53348491fb 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index cae6d0e8b4c..9db0814db32 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 5cfb55837f3..0d954d3b5c3 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -17,7 +17,7 @@ separator_value: '4768' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index 4c22ad71604..2b1506eda99 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -17,7 +17,7 @@ separator_value: '4769' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index 61daf2795d5..16751ea4ef2 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -17,7 +17,7 @@ separator_value: '4771' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index b12b8773bf4..408aaa466bb 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -17,7 +17,7 @@ separator_value: '4776' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index 2eeb4b66b8e..ed8f3691a80 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -17,7 +17,7 @@ separator_value: '4781' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index e73ca759747..4b239b5056d 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index 323438675c6..8a945e0fe82 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index 9b3a4671cff..70bae43f05b 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -17,7 +17,7 @@ separator_value: supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index 9a395af8a1a..8eebe0e5a94 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index 668f9a26548..bdd7735a815 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -17,7 +17,7 @@ separator_value: '4876' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index 940fdaf3572..9379641c7d3 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -17,7 +17,7 @@ separator_value: '4886' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index e5132ceded6..2016e280f63 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -17,7 +17,7 @@ separator_value: '4887' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index 3052e227a29..2d9e806305f 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -12,7 +12,7 @@ separator_value: '4946' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index 4d0095a0d6d..b10ef8870b6 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -12,7 +12,7 @@ separator_value: '4947' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index a483476732f..961be864ee1 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -12,7 +12,7 @@ separator_value: '4948' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index d122ec1a223..b2035008e48 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -17,7 +17,7 @@ separator_value: '5136' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index 67277b5148f..253ce10397d 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -17,7 +17,7 @@ separator_value: '5137' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - AppCorrelationID diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index 8b83750b008..f5f3cf11165 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -17,7 +17,7 @@ separator_value: '5140' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index 045fad9d03e..393098f2884 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -17,7 +17,7 @@ separator_value: '5141' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index 12eeaac238f..1647d2e8320 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -17,7 +17,7 @@ separator_value: '5145' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index e7af3737a91..faea29ccadb 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_system_4720.yml b/data_sources/windows_event_log_system_4720.yml index e18a77235a4..49df88f658a 100644 --- a/data_sources/windows_event_log_system_4720.yml +++ b/data_sources/windows_event_log_system_4720.yml @@ -17,7 +17,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4726.yml b/data_sources/windows_event_log_system_4726.yml index 95e752daca6..642359a985c 100644 --- a/data_sources/windows_event_log_system_4726.yml +++ b/data_sources/windows_event_log_system_4726.yml @@ -17,7 +17,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4728.yml b/data_sources/windows_event_log_system_4728.yml index 93b05f75d33..dd3e3849ea5 100644 --- a/data_sources/windows_event_log_system_4728.yml +++ b/data_sources/windows_event_log_system_4728.yml @@ -17,7 +17,7 @@ separator_value: '4728' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index f961b153aed..0cf395b1d21 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -17,7 +17,7 @@ separator_value: '7036' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index 47707be7dcd..518d67eacf5 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -17,7 +17,7 @@ separator_value: '7040' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index 05a05f8eaad..a1fda46fe87 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -17,7 +17,7 @@ separator_value: '7045' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - AccountName diff --git a/data_sources/windows_event_log_taskscheduler_200.yml b/data_sources/windows_event_log_taskscheduler_200.yml index a2f4dda16d5..e7fe0ff722b 100644 --- a/data_sources/windows_event_log_taskscheduler_200.yml +++ b/data_sources/windows_event_log_taskscheduler_200.yml @@ -17,7 +17,7 @@ separator_value: '200' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ActionName diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index ed2d6b8bb7f..01ff84004bd 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_iis.yml b/data_sources/windows_iis.yml index 64204e7070f..a3412a3b423 100644 --- a/data_sources/windows_iis.yml +++ b/data_sources/windows_iis.yml @@ -16,4 +16,4 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 diff --git a/data_sources/windows_iis_29.yml b/data_sources/windows_iis_29.yml index cae7b41acf5..8c6977fd3a4 100644 --- a/data_sources/windows_iis_29.yml +++ b/data_sources/windows_iis_29.yml @@ -17,7 +17,7 @@ separator_value: '29' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.0 + version: 10.0.1 fields: - _time - ComputerName From 0aa0a079bef4fb1ee6231d68067e436fdcdde4de Mon Sep 17 00:00:00 2001 From: Bhavin Patel <bhavin.j.patel91@gmail.com> Date: Wed, 5 Aug 2026 09:09:48 -0700 Subject: [PATCH 049/162] Update data source TA and install.yml app versions (#4204) Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> --- data_sources/g_suite_drive.yml | 2 +- data_sources/g_suite_gmail.yml | 2 +- data_sources/google_workspace.yml | 2 +- data_sources/google_workspace_login_failure.yml | 2 +- data_sources/google_workspace_login_success.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/data_sources/g_suite_drive.yml b/data_sources/g_suite_drive.yml index 2fe9a8b87d6..b647bf3974f 100644 --- a/data_sources/g_suite_drive.yml +++ b/data_sources/g_suite_drive.yml @@ -16,7 +16,7 @@ sourcetype: gsuite:drive:json supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 4.0.0 + version: 5.0.0 fields: - _time - email diff --git a/data_sources/g_suite_gmail.yml b/data_sources/g_suite_gmail.yml index a536a2cca49..47a7e83990f 100644 --- a/data_sources/g_suite_gmail.yml +++ b/data_sources/g_suite_gmail.yml @@ -15,7 +15,7 @@ sourcetype: gsuite:gmail:bigquery supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 4.0.0 + version: 5.0.0 fields: - _time - action_type diff --git a/data_sources/google_workspace.yml b/data_sources/google_workspace.yml index e6085340b30..bde99e8ec1d 100644 --- a/data_sources/google_workspace.yml +++ b/data_sources/google_workspace.yml @@ -10,7 +10,7 @@ sourcetype: gws:reports:login supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 4.0.0 + version: 5.0.0 fields: - action - actor.callerType diff --git a/data_sources/google_workspace_login_failure.yml b/data_sources/google_workspace_login_failure.yml index ac3e4a78550..774e7c89217 100644 --- a/data_sources/google_workspace_login_failure.yml +++ b/data_sources/google_workspace_login_failure.yml @@ -17,7 +17,7 @@ separator_value: login_failure supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 4.0.0 + version: 5.0.0 fields: - _time - actor.email diff --git a/data_sources/google_workspace_login_success.yml b/data_sources/google_workspace_login_success.yml index 353d1d40cfb..727e82de8e7 100644 --- a/data_sources/google_workspace_login_success.yml +++ b/data_sources/google_workspace_login_success.yml @@ -17,7 +17,7 @@ separator_value: login_success supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 4.0.0 + version: 5.0.0 fields: - _time - actor.email From 33064e8eda849462017836f9d80ffd8b5da23b29 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali <nbencher@cisco.com> Date: Wed, 5 Aug 2026 18:48:54 +0200 Subject: [PATCH 050/162] Fix Issues - 6.4 Batch (#4202) --- ...le_written_in_administrative_smb_share.yml | 47 +++++++++-- ...equency_copy_of_files_in_network_share.yml | 84 +++++++++++++++++-- ...etwork_share_discovery_via_dir_command.yml | 49 +++++++++-- ...sable_shutdown_button_through_registry.yml | 53 ++++++++++-- ...y_dotnet_etw_disabled_via_env_variable.yml | 40 +++++++-- .../windows_user_discovery_via_net.yml | 75 +++++++++++------ 6 files changed, 288 insertions(+), 60 deletions(-) diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml index c31e9faea71..f9f1611df17 100644 --- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml +++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml @@ -1,23 +1,56 @@ name: Executable File Written in Administrative SMB Share id: f63c34fe-a435-11eb-935a-acde48001122 -version: 13 +version: 14 creation_date: '2021-04-26' -modification_date: '2026-05-13' +modification_date: '2026-08-05' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: TTP -description: The following analytic detects executable files (.exe or .dll) being written to Windows administrative SMB shares (Admin$, IPC$, C$). It leverages Windows Security Event Logs with EventCode 5145 to identify this activity. This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed for lateral movement and remote code execution. If confirmed malicious, this activity could allow an attacker to execute arbitrary code remotely, potentially compromising additional systems within the network. +description: |- + The following analytic detects executable files (.exe, .dll, etc.) being written to Windows administrative SMB shares (Admin$, IPC$, C$). It leverages Windows Security Event Logs with EventCode 5145 to identify this activity. + This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed for lateral movement and remote code execution. + If confirmed malicious, this activity could allow an attacker to execute arbitrary code remotely, potentially compromising additional systems within the network. data_source: - Windows Event Log Security 5145 -search: '`wineventlog_security` EventCode=5145 RelativeTargetName IN ("*.exe","*.dll") ObjectType=File ShareName IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") AccessMask= "0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode ShareName RelativeTargetName ObjectType AccessMask src_user src_port IpAddress dest | `security_content_ctime(firstTime)` | `executable_file_written_in_administrative_smb_share_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. -known_false_positives: System Administrators may use looks like PsExec for troubleshooting or administrations tasks. However, this will typically come only from certain users and certain systems that can be added to an allow list. +search: |- + `wineventlog_security` + EventCode=5145 + RelativeTargetName IN ( + "*.cpl", + "*.dll", + "*.exe", + "*.sys" + ) + ObjectType=File + ShareName IN ( + "\\\\*\\Admin$", + "\\\\*\\C$", + "\\\\*\\IPC$" + ) + + | eval AccessMask_ = tonumber(AccessMask, 16) + | where (bit_and(AccessMask_, 2) != 0) OR (bit_and(AccessMask_, 4) != 0) + + | stats min(_time) as firstTime + max(_time) as lastTime count + + by EventCode ShareName RelativeTargetName ObjectType + AccessMask src_user src_port IpAddress dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `executable_file_written_in_administrative_smb_share_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. +known_false_positives: |- + System Administrators may use tools like PsExec for troubleshooting or administrations tasks. However, this will typically come only from certain users and certain systems that can be added to an allow list. references: - https://attack.mitre.org/techniques/T1021/002/ - https://www.rapid7.com/blog/post/2013/03/09/psexec-demystified/ - https://labs.vipre.com/trickbot-and-its-modules/ - https://whitehat.eu/incident-response-case-study-featuring-ryuk-and-trickbot-part-2/ - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5145#table-of-file-access-codes drilldown_searches: - name: View the detection results for - "$src_user$" search: '%original_detection_search% | search src_user = "$src_user$"' @@ -28,7 +61,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: $src_user$ dropped or created an executable file in known sensitive SMB share. Share name=$ShareName$, Target name=$RelativeTargetName$, and Access mask=$AccessMask$ + title: The [$src_user$] dropped or created an executable file in known sensitive SMB share. Share name=[$ShareName$], Target name=[$RelativeTargetName$], and Access mask=[$AccessMask$] entity: field: src_user type: user diff --git a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml index 40ef758feaf..70fbfb414aa 100644 --- a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml +++ b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml @@ -1,19 +1,89 @@ name: High Frequency Copy Of Files In Network Share id: 40925f12-4709-11ec-bb43-acde48001122 -version: 10 +version: 11 creation_date: '2021-11-17' -modification_date: '2026-05-13' +modification_date: '2026-08-05' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects a high frequency of file copying or moving within network shares, which may indicate potential data sabotage or exfiltration attempts. It leverages Windows Security Event Logs (EventCode 5145) to monitor access to specific file types and network shares. This activity is significant as it can reveal insider threats attempting to transfer classified or internal files, potentially leading to data breaches or evidence tampering. If confirmed malicious, this behavior could result in unauthorized data access, data loss, or compromised sensitive information. +description: |- + The following analytic detects a high frequency of file copying or moving within network shares, which may indicate potential data sabotage or exfiltration attempts. + It leverages Windows Security Event Logs (EventCode 5145) to monitor access to specific file types and network shares. + This activity is significant as it can reveal insider threats attempting to transfer classified or internal files, potentially leading to data breaches or evidence tampering. + If confirmed malicious, this behavior could result in unauthorized data access, data loss, or compromised sensitive information. data_source: - Windows Event Log Security 5145 -search: '`wineventlog_security` EventCode=5145 RelativeTargetName IN ("*.doc","*.docx","*.xls","*.xlsx","*.ppt","*.pptx","*.log","*.txt","*.db","*.7z","*.zip","*.rar","*.tar","*.gz","*.jpg","*.gif","*.png","*.bmp","*.pdf","*.rtf","*.key") ObjectType=File ShareName IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") AccessMask= "0x2" | bucket _time span=5m | stats values(RelativeTargetName) as valRelativeTargetName, values(ShareName) as valShareName, values(ObjectType) as valObjectType, values(AccessMask) as valAccessmask, values(src_port) as valSrcPort, values(SourceAddress) as valSrcAddress count as numShareName by dest, _time, EventCode, src_user, src_ip | eventstats avg(numShareName) as avgShareName, stdev(numShareName) as stdShareName, count as numSlots by dest, _time, EventCode, src_user | eval upperThreshold=(avgShareName + stdShareName *3) | eval isOutlier=if(avgShareName > 20 and avgShareName >= upperThreshold, 1, 0) | search isOutlier=1 | `high_frequency_copy_of_files_in_network_share_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. -known_false_positives: This behavior may seen in normal transfer of file within network if network share is common place for sharing documents. +search: |- + `wineventlog_security` + EventCode=5145 + RelativeTargetName IN ( + "*.7z", "*.bmp", "*.db", "*.doc", "*.docx", + "*.gif", "*.gz", "*.jpg", "*.key", "*.log", + "*.pdf", "*.png", "*.ppt", "*.pptx", "*.rar", + "*.rtf", "*.tar", "*.txt", "*.xls", "*.xlsx", "*.zip" + ) + ObjectType=File + ShareName IN ( + "\\\\*\\Admin$", + "\\\\*\\C$", + "\\\\*\\IPC$" + ) + | eval AccessMask_ = tonumber(AccessMask, 16) + + ``` + We Select only write-related operations: + 0x2 = WriteData (create/write file) + 0x4 = AppendData (append to file) + ``` + + | where (bit_and(AccessMask_, 2) != 0) OR (bit_and(AccessMask_, 4) != 0) + + | bucket _time span=5m + + ``` + Count write events per host, user and source IP within each time window + ``` + | stats + values(RelativeTargetName) AS valRelativeTargetName + values(ShareName) AS valShareName + values(ObjectType) AS valObjectType + values(AccessMask) AS valAccessMask + values(src_port) AS valSrcPort + values(SourceAddress) AS valSrcAddress + count AS numFileWriteEvents + BY dest _time EventCode src_user src_ip + + + ``` + Build a historical baseline for each destination host and user + using the average and standard deviation of previous buckets + ``` + + | eventstats + avg(numFileWriteEvents) AS avgFileWriteEvents + stdev(numFileWriteEvents) AS stdFileWriteEvents + count AS numSlots + BY dest EventCode src_user + + | eval upperThreshold=avgFileWriteEvents + (stdFileWriteEvents * 3) + | eval isOutlier=if( + numFileWriteEvents > 20 + AND ( + numSlots < 5 + OR numFileWriteEvents >= upperThreshold + ), + 1, + 0 + ) + | where isOutlier=1 + | `high_frequency_copy_of_files_in_network_share_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. +known_false_positives: |- + This behavior may be seen in normal transfer of files within a network if network shares are commonly used for sharing documents. references: - https://attack.mitre.org/techniques/T1537/ + - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5145#table-of-file-access-codes drilldown_searches: - name: View the detection results for - "$src_user$" search: '%original_detection_search% | search src_user = "$src_user$"' @@ -28,7 +98,7 @@ intermediate_findings: - field: src_user type: user score: 20 - message: High frequency copy of document into a network share from $src_ip$ by $src_user$ + message: High frequency copy of file [$valRelativeTargetName$] into a network share from [$src_ip$] by [$src_user$] threat_objects: - field: src_ip type: ip_address diff --git a/detections/endpoint/network_share_discovery_via_dir_command.yml b/detections/endpoint/network_share_discovery_via_dir_command.yml index 0a21281d111..bb6f37b475f 100644 --- a/detections/endpoint/network_share_discovery_via_dir_command.yml +++ b/detections/endpoint/network_share_discovery_via_dir_command.yml @@ -1,19 +1,56 @@ name: Network Share Discovery Via Dir Command id: dc1457d0-1d9b-422e-b5a7-db46c184d9aa -version: 6 +version: 7 creation_date: '2023-05-23' -modification_date: '2026-05-13' +modification_date: '2026-08-05' author: Teoderick Contreras, Splunk status: production type: Hunting -description: The following analytic detects access to Windows administrative SMB shares (Admin$, IPC$, C$) using the 'dir' command. It leverages Windows Security Event Logs with EventCode 5140 to identify this activity. This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed by adversaries for lateral movement and remote code execution. If confirmed malicious, this activity could allow attackers to propagate malware, such as IcedID, across the network, leading to widespread infection and potential data breaches. +description: |- + The following analytic detects access to Windows administrative SMB shares (Admin$, IPC$, C$) using the 'dir' command. It leverages Windows Security Event Logs with EventCode 5140 to identify this activity. + This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed by adversaries for lateral movement and remote code execution. + If confirmed malicious, this activity could allow attackers to propagate malware, such as IcedID, across the network, leading to widespread infection and potential data breaches. data_source: - Windows Event Log Security 5140 -search: '`wineventlog_security` EventCode=5140 ShareName IN("\\\\*\\ADMIN$","\\\\*\\C$","*\\\\*\\IPC$") AccessMask= 0x1 | stats min(_time) as firstTime max(_time) as lastTime count by ShareName IpAddress ObjectType SubjectUserName SubjectDomainName IpPort AccessMask Computer | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_share_discovery_via_dir_command_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5140 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. -known_false_positives: System Administrators may use looks like net.exe or "dir commandline" for troubleshooting or administrations tasks. However, this will typically come only from certain users and certain systems that can be added to an allow list. +search: |- + `wineventlog_security` + EventCode=5140 + ShareName IN ( + "\\\\*\\Admin$", + "\\\\*\\C$", + "\\\\*\\IPC$" + ) + + + ``` + We select only read-related operations: + 0x1 = ReadData (or ListDirectory) + ``` + + | eval AccessMask_ = tonumber(AccessMask, 16) + | where (bit_and(AccessMask_, 1) != 0) + + | stats min(_time) as firstTime + max(_time) as lastTime + count + + by ShareName IpAddress ObjectType SubjectUserName + SubjectDomainName IpPort AccessMask Computer + + | rename Computer as dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `network_share_discovery_via_dir_command_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5140 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. +known_false_positives: |- + System Administrators may use tools like "net.exe", "net1.exe", or "dir" for troubleshooting or administrations tasks. + However, this will typically come only from certain users and certain systems that can be added to an allow list. references: - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140#table-of-file-access-codes + - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140 analytic_story: - IcedID asset_type: Endpoint diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index eb21ea6a7e8..a9dbf0aa07a 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -1,19 +1,56 @@ name: Windows Disable Shutdown Button Through Registry id: 55fb2958-9ecd-11ec-a06a-acde48001122 -version: 14 +version: 15 creation_date: '2022-03-08' -modification_date: '2026-05-13' +modification_date: '2026-08-05' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly -description: The following analytic detects suspicious registry modifications that disable the shutdown button on a user's logon screen. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with shutdown policies. This activity is significant because it is a tactic used by malware, particularly ransomware like KillDisk, to hinder system usability and prevent the removal of malicious changes. If confirmed malicious, this could impede system recovery efforts, making it difficult to restart the machine and remove other harmful modifications. +description: |- + The following analytic detects suspicious registry modifications that disable the shutdown button on a user's logon screen. + It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with shutdown policies. + This activity is significant because it is a tactic used by malware, particularly ransomware like KillDisk, to hinder system usability and prevent the removal of malicious changes. + If confirmed malicious, this could impede system recovery efforts, making it difficult to restart the machine and remove other harmful modifications. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE ((Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon" Registry.registry_value_data = "0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" Registry.registry_value_data = "0x00000001")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_shutdown_button_through_registry_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 -known_false_positives: This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed. +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Registry WHERE + + ( + ( + Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon" + Registry.registry_value_data = "0x00000000" + ) + OR + ( + Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" + Registry.registry_value_data = "0x00000001" + ) + ) + + by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status + Registry.user Registry.vendor_product + + | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_disable_shutdown_button_through_registry_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. + If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 +known_false_positives: |- + This Windows feature may be implemented by an administrator on some servers where shutdown is restricted. + In that scenario, filtering by the machines and users allowed to modify this registry key is recommended. references: - - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/ + - https://github.com/redcanaryco/atomic-red-team/blob/1ba1dd8d9ce6f74700f7aec2e60de5632f667f03/atomics/T1112/T1112.md drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -28,7 +65,7 @@ intermediate_findings: - field: dest type: system score: 20 - message: Registry modification in "shutdownwithoutlogon" on $dest$ + message: The registry key [$registry_path$] was modified to disable the shutdown button on [$dest$]. analytic_story: - Ransomware - Windows Registry Abuse diff --git a/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml b/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml index 00fda0fd2dc..d09656e8646 100644 --- a/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml +++ b/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml @@ -1,17 +1,43 @@ name: Windows Registry Dotnet ETW Disabled Via ENV Variable id: 55502381-5cce-491b-9277-7cb1d10bc0df -version: 10 +version: 11 creation_date: '2021-10-07' -modification_date: '2026-05-13' +modification_date: '2026-08-05' author: Nasreddine Bencherchali, Splunk status: production type: TTP -description: The following analytic detects a registry modification that disables the ETW for the .NET Framework. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the COMPlus_ETWEnabled registry value under the "Environment" registry key path for both user (HKCU\Environment) and machine (HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment) scopes. This activity is significant because disabling ETW can allow attackers to evade Endpoint Detection and Response (EDR) tools and hide their execution from audit logs. If confirmed malicious, this action could enable attackers to operate undetected, potentially leading to further compromise and persistent access within the environment. +description: |- + The following analytic detects a registry modification that disables the ETW for the .NET Framework. + It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the COMPlus_ETWEnabled registry value under the "Environment" registry key path for both user (HKCU\Environment) and machine (HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment) scopes. + This activity is significant because disabling ETW can allow attackers to evade Endpoint Detection and Response (EDR) tools and hide their execution from audit logs. + If confirmed malicious, this action could enable attackers to operate undetected, potentially leading to further compromise and persistent access within the environment. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path="*\\Environment*" Registry.registry_value_name="COMPlus_ETWEnabled" (Registry.registry_value_data=0x000000000 OR Registry.registry_value_data=0) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_dotnet_etw_disabled_via_env_variable_filter`' +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Registry WHERE + + Registry.registry_path="*\\Environment*" + Registry.registry_value_name="COMPlus_ETWEnabled" + Registry.registry_value_data IN ("0x00000000", "0") + + by Registry.action Registry.dest Registry.process_guid Registry.process_id + Registry.registry_hive Registry.registry_path Registry.registry_key_name + Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status + Registry.user Registry.vendor_product + + | `drop_dm_object_name(Registry)` + | where isnotnull(registry_value_data) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_registry_dotnet_etw_disabled_via_env_variable_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 -known_false_positives: Setting the "COMPlus_ETWEnabled" value as a global environment variable either in user or machine scope should only happens during debugging use cases, hence the false positives rate should be very minimal. +known_false_positives: |- + Setting the "COMPlus_ETWEnabled" value as a global environment variable either in user or machine scope should only happen during debugging use cases, hence the false positives rate should be very minimal. references: - https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 - https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/ @@ -26,7 +52,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Modified registry entry $registry_path$ in $dest$ + title: The registry key [$registry_path$] with the value name [$registry_value_name$] was modified to the value [$registry_value_data$] to disable the ETW for the .NET Framework in [$dest$] entity: field: user type: user @@ -36,7 +62,7 @@ intermediate_findings: - field: dest type: system score: 50 - message: Modified registry entry $registry_path$ in $dest$ + message: The registry key [$registry_path$] with the value name [$registry_value_name$] was modified to the value [$registry_value_data$] to disable the ETW for the .NET Framework in [$dest$] analytic_story: - Windows Registry Abuse - Windows Defense Evasion Tactics diff --git a/detections/endpoint/windows_user_discovery_via_net.yml b/detections/endpoint/windows_user_discovery_via_net.yml index 50c542b21c6..2aedf2608b4 100644 --- a/detections/endpoint/windows_user_discovery_via_net.yml +++ b/detections/endpoint/windows_user_discovery_via_net.yml @@ -1,44 +1,62 @@ name: Windows User Discovery Via Net id: 7742987e-88c1-476b-a626-a869e088ab72 -version: 6 +version: 7 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-08-05' author: Mauricio Velazco, Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production type: Hunting -description: The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments `user` or `users` to query local user accounts. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate local users, which is a common step in situational awareness and Active Directory discovery. If confirmed malicious, this behavior could lead to further attacks, including privilege escalation and lateral movement within the network. +description: |- + The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments `user` or `users` to query local and domain accounts. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate local and domain users, which is a common step in situational awareness and Active Directory discovery. + If confirmed malicious, this behavior could lead to further attacks, including privilege escalation and lateral movement within the network. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE `process_net` (Processes.process="*user" - OR - Processes.process="*users" - OR - Processes.process="*users *" - OR - Processes.process="*user *") - AND - NOT (Processes.process="*/add" - OR - Processes.process="*/delete") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + `process_net` + + Processes.process IN ( + "*user *", + "*user", + "*users *", + "*users" + ) + NOT Processes.process IN ( + "*/add*", + "*/active*", + "*/delete*", + "*/times*" + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_discovery_via_net_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Administrators or power users may use this command for troubleshooting. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1087/001/ + - https://attack.mitre.org/techniques/T1087/002/ + - https://ss64.com/nt/net-user.html + - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/net-user?source=recommendations#parameters analytic_story: - Active Directory Discovery - Sandworm Tools @@ -46,6 +64,7 @@ analytic_story: asset_type: Endpoint mitre_attack_id: - T1087.001 + - T1087.002 product: - Splunk Enterprise - Splunk Enterprise Security @@ -53,9 +72,15 @@ product: category: endpoint security_domain: endpoint tests: - - name: True Positive Test + - name: True Positive Test - Local User Discovery attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit + - name: True Positive Test - Domain User Discovery + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit From 51e5ed817447edff13054245a8838b9cfae8f694 Mon Sep 17 00:00:00 2001 From: p4t12ick <patrickbareiss1989@gmail.com> Date: Thu, 6 Aug 2026 10:42:25 +0200 Subject: [PATCH 051/162] Remove JS from ESCU (#4198) --------- Co-authored-by: P4T12ICK <pbareiss@splunk.com> --- app_template/default/data/ui/nav/default.xml | 8 ++-- .../default/data/ui/views/escu_summary.xml | 44 ++++++++++--------- .../default/data/ui/views/feedback.xml | 2 +- 3 files changed, 27 insertions(+), 27 deletions(-) diff --git a/app_template/default/data/ui/nav/default.xml b/app_template/default/data/ui/nav/default.xml index 87cd34acd6f..6357d847015 100644 --- a/app_template/default/data/ui/nav/default.xml +++ b/app_template/default/data/ui/nav/default.xml @@ -1,10 +1,8 @@ <nav search_view="search" color="#65A637"> - <view name="landing" default="true"/> - <view name="onboarding"/> + <view name="escu_summary" default="true"/> + <view name="feedback"/> <view name="search"/> - <collection label="Dashboards"> - <view source="unclassified" match="__"/> - </collection> + <view name="dashboards"/> <a href="https://help.splunk.com/en/splunk-enterprise-security-8/security-content-update">Docs</a> <a href="/app/SplunkEnterpriseSecuritySuite/ess_use_case_library">Explore in ES</a> </nav> diff --git a/app_template/default/data/ui/views/escu_summary.xml b/app_template/default/data/ui/views/escu_summary.xml index 31fd25f3d45..21c026c5267 100644 --- a/app_template/default/data/ui/views/escu_summary.xml +++ b/app_template/default/data/ui/views/escu_summary.xml @@ -24,8 +24,8 @@ <html> <div style="background-color: #f8d7da; border: 1px solid #f5c6cb; border-radius: 5px; padding: 15px; margin-bottom: 20px;"> <h2 style="color: #721c24; margin: 0;"> - <i class="icon-info-circle" style="margin-right: 10px;"></i> - Explore Splunk Security Content using + <i class="icon-info-circle" style="margin-right: 10px;"/> + Explore Splunk Security Content using <a href="/app/SplunkEnterpriseSecuritySuite/ess_use_case_library" style="color: #721c24; text-decoration: underline;">Splunk Enterprise Security</a> </h2> </div> @@ -124,9 +124,9 @@ <chart> <search> <query> - | rest /services/saved/searches splunk_server=local count=0 | search title="ESCU - *" -| spath input=action.correlationsearch.annotations path=mitre_attack{} output="MITRE Technique ID" -| spath input=action.correlationsearch.annotations path=analytic_story{} output=story_name + | rest /services/saved/searches splunk_server=local count=0 | search title="ESCU - *" +| spath input=action.correlationsearch.annotations path=mitre_attack{} output="MITRE Technique ID" +| spath input=action.correlationsearch.annotations path=analytic_story{} output=story_name | stats dc(story_name) as "Analytic Stories" by "MITRE Technique ID" </query> </search> @@ -144,12 +144,12 @@ <label>Analytic Story</label> <choice value="*">All</choice> <search> - <latest>now</latest> - <query>| rest /services/configs/conf-savedsearches splunk_server=local count=0 -| search action.escu.search_type = detection -| spath input=action.correlationsearch.annotations path=analytic_story{} output="story" + <query>| rest /services/configs/conf-savedsearches splunk_server=local count=0 +| search title=ESCU* +| spath input=action.correlationsearch.annotations path=analytic_story{} output="story" | mvexpand story | dedup story | fields story</query> + <latest>now</latest> </search> <fieldForLabel>story</fieldForLabel> <fieldForValue>story</fieldForValue> @@ -164,19 +164,21 @@ <table> <title>Analytic Story Details - | rest /services/configs/conf-savedsearches splunk_server=local count=0 -| search action.escu.search_type = detection -| spath input=action.correlationsearch.annotations path=analytic_story{} output="analytic_story" -| spath input=action.correlationsearch.annotations path=mitre_attack{} output="mitre_attack" -| spath input=action.escu.data_models path={} output="Data Models" -| rename title as "Detections" -| join analytic_story - [| rest /services/configs/conf-analyticstories splunk_server=local count=0 - | search title="analytic_story://*" - | eval "analytic_story"=replace(title,"analytic_story://","" ) - ] + | rest /services/configs/conf-savedsearches splunk_server=local count=0 +| search title=ESCU* +| spath input=action.correlationsearch.annotations path=analytic_story{} output="analytic_story" +| spath input=action.correlationsearch.annotations path=mitre_attack{} output="mitre_attack" +| rename title as "Detections" +| join analytic_story + [| rest /services/configs/conf-analyticstories splunk_server=local count=0 + | search title="analytic_story://*" + | eval "analytic_story"=replace(title,"analytic_story://","" ) + ] | search analytic_story= $story$ -|stats values(Detections) as Detections values(mitre_attack) as "MITRE Technique ID" values(last_updated) as "Last Updated" by analytic_story description| rename analytic_story as "Analytic Story"| rename description as Description| table "Analytic Story" Description Detections "MITRE Technique ID" "Last Updated" +| stats values(Detections) as Detections values(mitre_attack) as "MITRE Technique ID" values(last_updated) as "Last Updated" by analytic_story description +| rename analytic_story as "Analytic Story" +| rename description as Description +| table "Analytic Story" Description Detections "MITRE Technique ID" "Last Updated" $earliest$ $latest$ diff --git a/app_template/default/data/ui/views/feedback.xml b/app_template/default/data/ui/views/feedback.xml index ffc5a44def3..6088037ed21 100644 --- a/app_template/default/data/ui/views/feedback.xml +++ b/app_template/default/data/ui/views/feedback.xml @@ -4,7 +4,7 @@ - You can contact the Splunk Threat Research team atresearch@splunk.com to send us support requests, bug reports, and questions. + You can contact the Splunk Threat Research team at research@splunk.com to send us support requests, bug reports, and questions.
Specify the request type and the title of any related analytic stories, detections analytics where applicable.
You can also find us on the #es-content-updates Splunk Community Slack channel. From 647618c6e00606f7d045004095671e80fe58ac6d Mon Sep 17 00:00:00 2001 From: Raven Tait <93157481+RavenTait@users.noreply.github.com> Date: Fri, 7 Aug 2026 09:46:16 -0400 Subject: [PATCH 052/162] Snapattack Linux Conversions (#4173) --------- Co-authored-by: Nasreddine Bencherchali --- ..._executed_from_shared_memory_directory.yml | 90 +++++++++++++++ .../linux_efi_bootloader_file_deletion.yml | 78 +++++++++++++ ...creation_in_system_generator_directory.yml | 74 ++++++++++++ .../linux_ghostscript_exploitation.yml | 93 +++++++++++++++ .../endpoint/linux_motd_script_added.yml | 78 +++++++++++++ .../linux_netcat_outbound_connection.yml | 79 +++++++++++++ ...linux_possible_bootloader_modification.yml | 107 ++++++++++++++++++ ...inux_possible_gsm_privilege_escalation.yml | 89 +++++++++++++++ ...ossible_nimbuspwn_privilege_escalation.yml | 84 ++++++++++++++ ...le_privilege_escalation_via_pythonpath.yml | 79 +++++++++++++ .../linux_possible_system_binary_backdoor.yml | 84 ++++++++++++++ .../endpoint/linux_root_execution_of_id.yml | 83 ++++++++++++++ ...istory_access_via_command_line_utility.yml | 102 +++++++++++++++++ ...inux_shell_pseudo_device_reverse_shell.yml | 97 ++++++++++++++++ ...suspicious_child_process_of_postgresql.yml | 102 +++++++++++++++++ ...picious_docker_build_command_execution.yml | 85 ++++++++++++++ ...invocation_building_init_shared_object.yml | 93 +++++++++++++++ ...picious_privileged_container_execution.yml | 83 ++++++++++++++ .../linux_suspicious_redis_activity.yml | 100 ++++++++++++++++ ...ious_staging_of_alternate_system_files.yml | 88 ++++++++++++++ .../linux_suspicious_xdg_autostart.yml | 81 +++++++++++++ .../endpoint/linux_udev_rule_created.yml | 78 +++++++++++++ .../endpoint/linux_usermod_root_uid_set.yml | 79 +++++++++++++ 23 files changed, 2006 insertions(+) create mode 100644 detections/endpoint/linux_binary_executed_from_shared_memory_directory.yml create mode 100644 detections/endpoint/linux_efi_bootloader_file_deletion.yml create mode 100644 detections/endpoint/linux_file_creation_in_system_generator_directory.yml create mode 100644 detections/endpoint/linux_ghostscript_exploitation.yml create mode 100644 detections/endpoint/linux_motd_script_added.yml create mode 100644 detections/endpoint/linux_netcat_outbound_connection.yml create mode 100644 detections/endpoint/linux_possible_bootloader_modification.yml create mode 100644 detections/endpoint/linux_possible_gsm_privilege_escalation.yml create mode 100644 detections/endpoint/linux_possible_nimbuspwn_privilege_escalation.yml create mode 100644 detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml create mode 100644 detections/endpoint/linux_possible_system_binary_backdoor.yml create mode 100644 detections/endpoint/linux_root_execution_of_id.yml create mode 100644 detections/endpoint/linux_shell_history_access_via_command_line_utility.yml create mode 100644 detections/endpoint/linux_shell_pseudo_device_reverse_shell.yml create mode 100644 detections/endpoint/linux_suspicious_child_process_of_postgresql.yml create mode 100644 detections/endpoint/linux_suspicious_docker_build_command_execution.yml create mode 100644 detections/endpoint/linux_suspicious_gcc_invocation_building_init_shared_object.yml create mode 100644 detections/endpoint/linux_suspicious_privileged_container_execution.yml create mode 100644 detections/endpoint/linux_suspicious_redis_activity.yml create mode 100644 detections/endpoint/linux_suspicious_staging_of_alternate_system_files.yml create mode 100644 detections/endpoint/linux_suspicious_xdg_autostart.yml create mode 100644 detections/endpoint/linux_udev_rule_created.yml create mode 100644 detections/endpoint/linux_usermod_root_uid_set.yml diff --git a/detections/endpoint/linux_binary_executed_from_shared_memory_directory.yml b/detections/endpoint/linux_binary_executed_from_shared_memory_directory.yml new file mode 100644 index 00000000000..d8207546a9d --- /dev/null +++ b/detections/endpoint/linux_binary_executed_from_shared_memory_directory.yml @@ -0,0 +1,90 @@ +name: Linux Binary Executed from Shared Memory Directory +id: 2e954190-d547-447c-94d7-d8acac97873b +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies the execution of a binary by root from Linux shared memory directories (/dev/shm/ and /run/shm/). Threat actors place executables in these directories to persist on high-uptime servers as system backdoors. Both /dev/shm and /run/shm are tmpfs-backed directories that exist only in virtual memory with no persistent storage, making them attractive for staging fileless or semi-fileless malware while avoiding disk forensics. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_path IN ( + "/dev/shm/*", + "/run/shm/*" + ) + Processes.user=root + + by Processes.process Processes.process_path Processes.process_name Processes.user + Processes.user_id Processes.process_hash Processes.parent_process_name + Processes.parent_process_path Processes.parent_process Processes.parent_process_guid + Processes.parent_process_id Processes.process_guid Processes.process_id + Processes.vendor_product Processes.action Processes.dest + Processes.process_current_directory Processes.process_integrity_level + Processes.original_file_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_binary_executed_from_shared_memory_directory_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate applications may use shared memory directories for temporary file storage or inter-process communication. Verify any flagged activity against known software behavior and filter accordingly. +references: + - https://linuxsecurity.com/features/fileless-malware-on-linux + - https://twitter.com/GossiTheDog/status/1522964028284411907 + - https://github.com/elastic/detection-rules/blob/main/rules/linux/execution_process_started_in_shared_memory_directory.toml +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Linux binary executed from shared memory directory [$process$] - activity observed on [$dest$]. + - field: user + type: user + score: 20 + message: Linux binary executed from shared memory directory [$process$] - activity observed on [$dest$]. +threat_objects: + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Linux Post-Exploitation + - Linux Persistence Techniques + - Linux Privilege Escalation + - Compromised Linux Host +asset_type: Endpoint +mitre_attack_id: + - T1059 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/linux_binary_executed_from_shared_memory_directory/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_efi_bootloader_file_deletion.yml b/detections/endpoint/linux_efi_bootloader_file_deletion.yml new file mode 100644 index 00000000000..347040e3bad --- /dev/null +++ b/detections/endpoint/linux_efi_bootloader_file_deletion.yml @@ -0,0 +1,78 @@ +name: Linux EFI Bootloader File Deletion +id: 818a63f8-f2e1-4d1b-ac95-3a4f2ec7f113 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects file deletions in the EFI boot directory. These files are responsible for initializing the Boot Manager during system startup. Modification or replacement of these files is highly unusual in normal operations and may indicate an attempt to install a bootkit, persist malicious code at the firmware level, or otherwise tamper with the system boot process. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Filesystem where + + Filesystem.action="deleted" + Filesystem.file_path="/boot/efi/EFI/BOOT/*" + Filesystem.file_name="*.efi*" + + by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest + Filesystem.action Filesystem.process_guid Filesystem.process_id + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_efi_bootloader_file_deletion_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file deletion events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate system administrators or package managers may delete or replace EFI bootloader files during system updates or OS reinstallation. Filter for known maintenance windows and authorized administrative activity. +references: + - https://www.welivesecurity.com/en/eset-research/under-cloak-uefi-secure-boot-introducing-cve-2024-7344/ + - https://www.bleepingcomputer.com/news/security/new-hybridpetya-ransomware-can-bypass-uefi-secure-boot/ +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Linux EFI bootloader [$file_name$] deletion detected on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Data Destruction + - Linux Persistence Techniques + - Ransomware +asset_type: Endpoint +cve: + - CVE-2024-7344 +mitre_attack_id: + - T1542.001 + - T1542.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1542/linux_efi_bootloader_file_deletion/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_file_creation_in_system_generator_directory.yml b/detections/endpoint/linux_file_creation_in_system_generator_directory.yml new file mode 100644 index 00000000000..0cde3fae987 --- /dev/null +++ b/detections/endpoint/linux_file_creation_in_system_generator_directory.yml @@ -0,0 +1,74 @@ +name: Linux File Creation In System Generator Directory +id: 06c23568-e05b-4fff-95cd-8b0303b6d032 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects potential persistence using a systemd generator on Linux, which involves creating a malicious script or binary that is typically executed during the system's boot process. + Systemd generators are typically placed in directories like /lib/systemd/system-generators/, where they are run early in the boot sequence to dynamically generate or modify unit files that control system services. + By placing a custom generator in this directory, an attacker can ensure their code is executed each time the system starts, allowing them to maintain access or control even after reboots. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Filesystem where + + Filesystem.action IN ("created", "modified") + Filesystem.file_path="*/lib/systemd/system-generators/*" + + by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest + Filesystem.action Filesystem.process_guid Filesystem.process_id + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_file_creation_in_system_generator_directory_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate system administrators or software packages may place custom generators in systemd generator directories during system configuration or application deployment. Filter based on known software installations and verified administrative activity. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: The file [$file_name$] was created in the system generator directory [$file_path$] on [$dest$] by [$user$]. +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Persistence Techniques +asset_type: Endpoint +mitre_attack_id: + - T1037.005 + - T1547 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1037.005/linux_persistence_via_system_generator/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_ghostscript_exploitation.yml b/detections/endpoint/linux_ghostscript_exploitation.yml new file mode 100644 index 00000000000..39c1533e182 --- /dev/null +++ b/detections/endpoint/linux_ghostscript_exploitation.yml @@ -0,0 +1,93 @@ +name: Linux Ghostscript Exploitation +id: 580f99d8-a4c8-4ef1-9c84-f355867bca41 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects exploitation of Ghostscript causing command execution. + This can be used by attackers to abuse file conversion services or embedded LibreOffice documents. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.parent_process_path IN ( + "*/gs", + "*/ghostscript" + ) + Processes.process="sh -c*" + + by Processes.process Processes.vendor_product Processes.user_id + Processes.process_hash Processes.parent_process_name + Processes.parent_process_exec Processes.action Processes.dest + Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name + Processes.parent_process Processes.parent_process_path + Processes.parent_process_guid Processes.parent_process_id + Processes.process_guid Processes.process_id Processes.user + Processes.process_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_ghostscript_exploitation_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate use of Ghostscript for document processing or file conversion tasks may trigger this rule. Filter based on known authorized applications that rely on Ghostscript for routine document handling. +references: + - https://www.bleepingcomputer.com/news/security/rce-bug-in-widely-used-ghostscript-library-now-exploited-in-attacks/ + - https://codeanlabs.com/blog/research/cve-2024-29510-ghostscript-format-string-exploitation/ +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Linux Ghostscript exploitation identified via [$process$] by [$user$] on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Linux Post-Exploitation + - Unusual Processes + - Suspicious Command-Line Executions + - Linux Living Off The Land +asset_type: Endpoint +cve: + - CVE-2024-29510 +mitre_attack_id: + - T1204.002 + - T1566 + - T1059 + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/linux_ghostscript_exploitation/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_motd_script_added.yml b/detections/endpoint/linux_motd_script_added.yml new file mode 100644 index 00000000000..262b5ce7aad --- /dev/null +++ b/detections/endpoint/linux_motd_script_added.yml @@ -0,0 +1,78 @@ +name: Linux MOTD Script Added +id: 6dd14256-559b-4364-99d8-0968407b8074 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the creation of a file within the /etc/update-motd.d directory. + This is used to add scripts that run with Message of the Day (MOTD) when a user logs in. + This can be used by attackers for persistence if it contains malicious code. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Filesystem where + + Filesystem.file_path="/etc/update-motd.d/*" + Filesystem.action IN ("created", "modified") + + by Filesystem.file_path Filesystem.file_name + Filesystem.user Filesystem.dest + Filesystem.action Filesystem.process_guid + Filesystem.process_id + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_motd_script_added_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate system administrators may add or modify MOTD scripts for valid operational purposes such as displaying system information or login banners. Filter based on known administrative activity and authorized users. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Potential MOTD Script [$file_name$] added by [$user$] on [$dest$]. +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Persistence Techniques + - Linux Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1547 + - T1037 + - T1059.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547/linux_motd_script_added/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_netcat_outbound_connection.yml b/detections/endpoint/linux_netcat_outbound_connection.yml new file mode 100644 index 00000000000..30ddef80708 --- /dev/null +++ b/detections/endpoint/linux_netcat_outbound_connection.yml @@ -0,0 +1,79 @@ +name: Linux Netcat Outbound Connection +id: 50a9de97-d58d-4844-8daf-928d2faceead +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects outbound network connections originating from Netcat or Netcat-like binaries on Linux systems. + Netcat is a versatile networking utility that, while legitimate in some contexts, is frequently abused by attackers to establish reverse shells, exfiltrate data, or create persistent backdoor connections to remote systems. + This activity is significant because outbound connections from these binaries often indicate an active compromise, where an attacker may be maintaining command-and-control communication or tunneling malicious traffic. + If confirmed malicious, this could lead to unauthorized data exfiltration, lateral movement, or persistent remote access to the compromised system. +data_source: + - Sysmon EventID 3 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Network_Traffic.All_Traffic where + + All_Traffic.app IN ( + "*nc", + "*ncat", + "*netcat" + ) + All_Traffic.direction="outbound" + + by All_Traffic.src All_Traffic.dest All_Traffic.dest_port All_Traffic.transport + All_Traffic.process_name All_Traffic.app All_Traffic.user All_Traffic.process_id + + | `drop_dm_object_name(All_Traffic)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_netcat_outbound_connection_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain network connection events including the source, destination, port, and process context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Network_Traffic` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate system administrators or developers may use netcat for troubleshooting, port scanning, or testing network connectivity. Filter based on known administrative activity or authorized users. +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Netcat outbound connection detected on [$dest$] +threat_objects: + - field: dest + type: ip_address +analytic_story: + - Linux Post-Exploitation + - Command And Control + - Data Exfiltration + - Compromised Linux Host +asset_type: Endpoint +mitre_attack_id: + - T1059.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/linux_netcat_outbound_connection/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_bootloader_modification.yml b/detections/endpoint/linux_possible_bootloader_modification.yml new file mode 100644 index 00000000000..d1ecc96baf7 --- /dev/null +++ b/detections/endpoint/linux_possible_bootloader_modification.yml @@ -0,0 +1,107 @@ +name: Linux Possible Bootloader Modification +id: 97fd4330-bd47-4742-abaf-c877d404822a +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + The following analytic detects processes modifying data in the EFI volume on Linux. + These files are responsible for initializing the Boot Manager during system startup. + Modification or replacement of these files is highly unusual in normal operations and may indicate an attempt to install a bootkit, persist malicious code at the firmware level, or otherwise tamper with the system boot process. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + ( + Processes.process_name IN ( + "cp", + "mv", + "ln", + ) + Processes.process_current_directory="*/EFI/BOOT*" + ) + OR + ( + Processes.process="*/EFI/BOOT*" + NOT Processes.process_name IN ( + "ls", + "grep", + "egrep", + ) + ) + + by Processes.process Processes.vendor_product Processes.user_id + Processes.process_hash Processes.parent_process_name Processes.parent_process_exec + Processes.action Processes.dest Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name Processes.parent_process + Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id + Processes.process_guid Processes.process_id Processes.user Processes.process_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_possible_bootloader_modification_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate system administrators or package managers such as grub or shim may modify EFI volume files during OS upgrades or bootloader updates. Filter based on known update processes or trusted administrative activity. +references: + - https://www.welivesecurity.com/en/eset-research/under-cloak-uefi-secure-boot-introducing-cve-2024-7344/ + - https://www.bleepingcomputer.com/news/security/new-hybridpetya-ransomware-can-bypass-uefi-secure-boot/ +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Possible bootloader modification identified via [$process$] by [$user$] on [$dest$] + entity: + field: dest + type: system + score: 50 +intermediate_findings: + entities: + - field: user + type: user + score: 50 + message: Possible bootloader modification via [$process$] by [$user$] on [$dest$]. +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Linux Rootkit + - Data Destruction + - Linux Persistence Techniques +asset_type: Endpoint +cve: + - CVE-2024-7344 +mitre_attack_id: + - T1542.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1542/linux_possible_bootloader_modifications/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_gsm_privilege_escalation.yml b/detections/endpoint/linux_possible_gsm_privilege_escalation.yml new file mode 100644 index 00000000000..8ff50d00933 --- /dev/null +++ b/detections/endpoint/linux_possible_gsm_privilege_escalation.yml @@ -0,0 +1,89 @@ +name: Linux Possible GSM Privilege Escalation +id: ae13064b-72ea-41fb-9d29-716c27e01208 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the commands used in a race condition found in the GSM 0710 tty multiplexor in the Linux kernel. + This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled. + This could allow a local unprivileged user to escalate their privileges on the system. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process="*rmmod *" + Processes.process="*n_gsm*" + Processes.process="*exec *" + Processes.process IN ( + "*/bin/bash*", + "*/bin/dash*", + "*/bin/sh*", + "*/bin/zsh*" + ) + + by Processes.process Processes.vendor_product + Processes.user_id Processes.process_hash Processes.parent_process_name Processes.parent_process_exec + Processes.action Processes.dest Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name Processes.parent_process + Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id + Processes.process_guid Processes.process_id Processes.user Processes.process_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_possible_gsm_privilege_escalation_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate system administrators or developers testing GSM multiplexor configurations may trigger this detection. Filter based on known authorized users or testing environments. +references: + - https://access.redhat.com/security/cve/cve-2023-6546 + - https://github.com/Nassim-Asrir/ZDI-24-020/ +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Potential GSM Privilege Escalation via [$process$] by [$user$] on [$dest$]. +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Linux Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2023-6546 +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/linux_possible_linux_gsm_privilege_escalation/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_nimbuspwn_privilege_escalation.yml b/detections/endpoint/linux_possible_nimbuspwn_privilege_escalation.yml new file mode 100644 index 00000000000..42c1670ce6c --- /dev/null +++ b/detections/endpoint/linux_possible_nimbuspwn_privilege_escalation.yml @@ -0,0 +1,84 @@ +name: Linux Possible Nimbuspwn Privilege Escalation +id: 24a540b7-6eec-4972-ad85-1f2232f9a849 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects directory traversal attempts associated with Nimbuspwn, a Linux privilege escalation vulnerability affecting the networkd-dispatcher service. + Nimbuspwn exploits weaknesses in the networkd-dispatcher service to traverse directories and execute arbitrary code with elevated privileges. + If confirmed malicious, this activity could allow an attacker to escalate privileges to root, potentially leading to full system compromise, persistent unauthorized access, and the ability to deploy additional malicious payloads. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process="*networkd-dispatcher*" + Processes.process="*../*" + + by Processes.process Processes.vendor_product Processes.user_id + Processes.process_hash Processes.parent_process_name Processes.parent_process_exec + Processes.action Processes.dest Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name Processes.parent_process + Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id + Processes.process_guid Processes.process_id Processes.user Processes.process_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_possible_nimbuspwn_privilege_escalation_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate system processes or administrative scripts that traverse directories in a similar pattern may trigger this detection. Filter based on known administrative activity and verified system processes. +references: + - https://www.microsoft.com/security/blog/2022/04/26/microsoft-finds-new-elevation-of-privilege-linux-vulnerability-nimbuspwn/ +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Possible Nimbuspwn privilege escalation via [$process$] by [$user$] on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Linux Privilege Escalation + - Linux Persistence Techniques + - Linux Post-Exploitation +asset_type: Endpoint +cve: + - CVE-2022-29799 + - CVE-2022-29800 +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/linux_possible_nimbuspwn_directory_traversal/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml b/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml new file mode 100644 index 00000000000..44dfa16e204 --- /dev/null +++ b/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml @@ -0,0 +1,79 @@ +name: Linux Possible Privilege Escalation via PYTHONPATH +id: 5edda575-409a-4820-a048-5780796a181e +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects the creation of a malicious shared object at a Python importlib path outside the standard system library directories, a technique used to abuse PYTHONPATH for local privilege escalation. + Attackers exploiting vulnerabilities such as the 2024 NeedRestart flaw (CVE-2024-48990) plant a crafted importlib/__init__.so in an attacker-controlled directory, then manipulate the PYTHONPATH environment variable so that a privileged process, such as NeedRestart running as root, loads the rogue module instead of the legitimate one, achieving code execution with elevated privileges. + The detection monitors for file writes matching the importlib/__init__.so pattern that do not originate from expected system library paths. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Filesystem where + + Filesystem.file_path="*/importlib/__init__.so*" + NOT Filesystem.file_path="*/lib/*" + + by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest + Filesystem.process_guid Filesystem.process_id + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_possible_privilege_escalation_via_pythonpath_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate Python developers or system administrators may modify PYTHONPATH for testing or application configuration purposes. Filter based on known development environments and trusted user activity. +references: + - https://www.bleepingcomputer.com/news/security/ubuntu-linux-impacted-by-decade-old-needrestart-flaw-that-gives-root/ + - https://www.qualys.com/2024/11/19/needrestart/needrestart.txt +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Possible Privilege Escalation via PYTHONPATH via [$file_name$] on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Privilege Escalation + - Linux Post-Exploitation + - Linux Persistence Techniques +asset_type: Endpoint +cve: + - CVE-2024-48990 +mitre_attack_id: + - T1068 + - T1574.007 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/linux_possible_privilege_escalation_via_pythonpath/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_system_binary_backdoor.yml b/detections/endpoint/linux_possible_system_binary_backdoor.yml new file mode 100644 index 00000000000..5ee3b287d49 --- /dev/null +++ b/detections/endpoint/linux_possible_system_binary_backdoor.yml @@ -0,0 +1,84 @@ +name: Linux Possible System Binary Backdoor +id: a806d611-ea81-4d8a-9b9b-fbf5b6ec520a +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the creation or overwrite of commonly targeted Linux system binaries such as cat, ls, cp, ps, mv, netstat, ss, and lsof. + Adversaries may replace these utilities with backdoored versions to hide malicious activity, harvest credentials, or maintain persistence while appearing to use legitimate system tools. + This technique is associated with rootkit deployment and post-exploitation frameworks such as PANIX. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime + + from datamodel=Endpoint.Filesystem where + + Filesystem.file_path IN ( + "/usr/bin/cat", + "/usr/bin/cp", + "/usr/bin/ls", + "/usr/bin/lsof", + "/usr/bin/mv", + "/usr/bin/netstat", + "/usr/bin/ps", + "/usr/bin/ss" + ) + + by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest + Filesystem.action Filesystem.process_guid Filesystem.process_id + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_possible_system_binary_backdoor_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate system updates or package managers may create or overwrite system binaries during normal operations. Filter for known update processes and package management activity to reduce noise. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Possible System Binary Backdoor activity observed on [$dest$]. System binary [$file_name$] was created or overwritten by [$user$]. +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Post-Exploitation + - Linux Persistence Techniques + - Linux Privilege Escalation + - Compromised Linux Host +asset_type: Endpoint +mitre_attack_id: + - T1036 + - T1059.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/linux_possible_system_binary_backdoor/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_root_execution_of_id.yml b/detections/endpoint/linux_root_execution_of_id.yml new file mode 100644 index 00000000000..47cb6b158b3 --- /dev/null +++ b/detections/endpoint/linux_root_execution_of_id.yml @@ -0,0 +1,83 @@ +name: Linux Root Execution of id +id: 538dc501-ce3a-4a32-9f56-6dbe0aee1474 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the execution of the `id` command by the root user on Linux systems. Attackers commonly run `id` during post-exploitation to confirm they have achieved root-level privileges after a privilege escalation attempt. + This activity is significant because it may indicate an attacker is verifying superuser access following a successful compromise. + If confirmed malicious, this could signal that an attacker has gained full control of the system, enabling them to perform destructive actions, exfiltrate sensitive data, or establish persistent unauthorized access. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_path="/usr/bin/id" + Processes.user="root" + + by Processes.process Processes.vendor_product Processes.user_id + Processes.process_hash Processes.parent_process_name Processes.parent_process_exec + Processes.action Processes.dest Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name Processes.parent_process + Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id + Processes.process_guid Processes.process_id Processes.user Processes.process_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_root_execution_of_id_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Administrators and automated scripts routinely run the id command as root for system auditing or configuration tasks. Filter based on known administrative activity or trusted scripts. +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Execution of [$process_path$] by [$user$] on [$dest$] + - field: user + type: user + score: 20 + message: Execution of [$process_path$] by [$user$] on [$dest$] +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +analytic_story: + - Linux Post-Exploitation + - Linux Privilege Escalation + - Linux Persistence Techniques +asset_type: Endpoint +mitre_attack_id: + - T1033 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/linux_root_execution_of_id/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_shell_history_access_via_command_line_utility.yml b/detections/endpoint/linux_shell_history_access_via_command_line_utility.yml new file mode 100644 index 00000000000..15010e2008c --- /dev/null +++ b/detections/endpoint/linux_shell_history_access_via_command_line_utility.yml @@ -0,0 +1,102 @@ +name: Linux Shell History Access Via Command Line Utility +id: 0e4c2544-b27a-4a2d-b9be-cac8efe515fb +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects attempts to read shell history files (bash, zsh, fish, etc.). + A history file is a log file that records all the commands executed in a shell on a Linux or Unix-based operating system. + A malicious actor who gains access to a user's shell history file can potentially obtain sensitive information and use it to compromise the user's system and data. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_name IN ( + "cat", + "fmt", + "head", + "less", + "more", + "nano", + "sort", + "tail", + "uniq", + "vi", + "vim" + ) + Processes.process IN ( + "*.bash_history*", + "*.history*", + "*.sh_history*", + "*.zhistory*", + "*.zsh_history*", + "*fish_history*" + ) + + by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash + Processes.parent_process_name Processes.parent_process_exec Processes.action Processes.dest + Processes.process_current_directory Processes.process_path Processes.process_integrity_level + Processes.original_file_name Processes.parent_process Processes.parent_process_path + Processes.parent_process_guid Processes.parent_process_id Processes.process_guid + Processes.process_id Processes.user Processes.process_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_shell_history_access_via_command_line_utility_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate system administrators and automated scripts may access shell history files for auditing or troubleshooting purposes. Filter based on known administrative accounts and approved tooling in your environment. +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Potential shell history access [$process$] by [$user$] on [$dest$] via [$process_name$]. + - field: user + type: user + score: 20 + message: Potential shell history access [$process$] by [$user$] on [$dest$] via [$process_name$]. +threat_objects: + - field: process_name + type: process_name +analytic_story: + - Linux Post-Exploitation + - Compromised Linux Host + - Linux Privilege Escalation + - Linux Persistence Techniques + - Credential Dumping +asset_type: Endpoint +mitre_attack_id: + - T1552.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.003/linux_bash_history_access/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_shell_pseudo_device_reverse_shell.yml b/detections/endpoint/linux_shell_pseudo_device_reverse_shell.yml new file mode 100644 index 00000000000..b53c890037e --- /dev/null +++ b/detections/endpoint/linux_shell_pseudo_device_reverse_shell.yml @@ -0,0 +1,97 @@ +name: Linux Shell Pseudo Device Reverse Shell +id: f324bc06-8436-4606-8882-0a8fb480b719 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the use of shell's /dev/tcp or /dev/udp pseudo-device feature to establish outbound network connections. + This special file system interface allows opening a network socket and sending or receiving data using simple shell commands. + Attackers commonly abuse this native shell capability to create reverse shells without requiring external tools such as netcat, by redirecting shell I/O over a TCP or UDP connection to an attacker-controlled host and port. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_name IN ( + "bash", + "dash", + "sh", + "zsh" + ) + Processes.process IN ( + "*/dev/tcp/*", + "*/dev/udp/*" + ) + + by Processes.process Processes.vendor_product + Processes.user_id Processes.process_hash Processes.parent_process_name Processes.parent_process_exec + Processes.action Processes.dest Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name Processes.parent_process + Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id + Processes.process_guid Processes.process_id Processes.user Processes.process_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + |`linux_shell_pseudo_device_reverse_shell_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate system administrators or developers may use /dev/tcp or /dev/udp for network diagnostics or testing purposes. + Filter based on known authorized users and trusted source systems. +references: + - https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/shell-reverse-cheatsheet/#bash-tcp +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Potential reverse shell [$process$] by [$user$] on [$dest$] via [$process_name$]. + - field: user + type: user + score: 20 + message: Potential reverse shell [$process$] by [$user$] on [$dest$] via [$process_name$]. +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +analytic_story: + - Linux Post-Exploitation + - Linux Persistence Techniques + - Linux Privilege Escalation + - Command And Control + - Compromised Linux Host +asset_type: Endpoint +mitre_attack_id: + - T1059 + - T1048.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/linux_bash_reverse_shell/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_child_process_of_postgresql.yml b/detections/endpoint/linux_suspicious_child_process_of_postgresql.yml new file mode 100644 index 00000000000..42805186793 --- /dev/null +++ b/detections/endpoint/linux_suspicious_child_process_of_postgresql.yml @@ -0,0 +1,102 @@ +name: Linux Suspicious Child Process of PostgreSQL +id: 6488b83f-8e76-43c3-91ee-c90a6d9e8d62 +version: 1 +creation_date: '2026-07-17' +modification_date: '2026-07-17' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects PostgreSQL spawning a shell, interpreter, or network utility as a child process. + When an attacker exploits a remote code execution vulnerability in PostgreSQL (such as via malicious COPY TO/FROM PROGRAM, CVE-2019-9193, or an insecurely configured extension), the database process itself becomes the parent of attacker-controlled commands. + Legitimate PostgreSQL processes do not normally fork shells or download tools, making this a high-fidelity signal for post-exploitation activity. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + ( + Processes.parent_process_name IN ( + "postgres", + "postmaster", + "pg_ctl" + ) + OR + Processes.parent_process_path = "*/bin/postgres" + OR + Processes.process_current_directory="*/var/lib/postgresql/*/main*" + ) + Processes.process_name IN ( + "awk", "bash", "curl", "dash", "env", "gawk", "id", "ifconfig", + "ksh", "lua", "nc", "ncat", "netcat", "nmap", "openssl", "perl", + "php", "python", "python2", "python3", "ruby", "sh", "socat", + "tcpdump", "wget", "whoami", "zsh" + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_current_directory Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_suspicious_child_process_of_postgresql_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Custom PostgreSQL extensions or wrapper scripts that legitimately invoke shell utilities may trigger this detection. Baseline the environment and use the filter macro to suppress known-good parent/child combinations. Recommend throttling by dest and process_name before enabling broadly. +references: + - https://www.horizon3.ai/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/ + - https://www.postgresql.org/docs/current/sql-copy.html + - https://nvd.nist.gov/vuln/detail/CVE-2019-9193 +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Suspicious Child Process of [$parent_process_path$] identified on [$dest$] via [$process_name$] with the Command Line [$process$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Linux Post-Exploitation + - Linux Privilege Escalation + - Linux Persistence Techniques + - Compromised Linux Host + - SQL Injection +asset_type: Endpoint +mitre_attack_id: + - T1190 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/linux_suspicious_child_of_postgresql/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_docker_build_command_execution.yml b/detections/endpoint/linux_suspicious_docker_build_command_execution.yml new file mode 100644 index 00000000000..643adc69314 --- /dev/null +++ b/detections/endpoint/linux_suspicious_docker_build_command_execution.yml @@ -0,0 +1,85 @@ +name: Linux Suspicious Docker Build Command Execution +id: dc4a58d2-fde3-4bdd-a36b-7368b2523589 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects docker build being executed on Dockerfiles within the /tmp directory. + This is not a typical location for this activity and can indicate an actor adding a container for malicious future actions. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process="*docker*" + Processes.process="*build*" + ( + ( + Processes.process="*-f *" + Processes.process="* /tmp*" + ) + OR + Processes.process_current_directory="/tmp*" + ) + + by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash + Processes.parent_process_name Processes.parent_process_exec Processes.action Processes.dest + Processes.process_current_directory Processes.process_path Processes.process_integrity_level + Processes.original_file_name Processes.parent_process Processes.parent_process_path + Processes.parent_process_guid Processes.parent_process_id Processes.process_guid + Processes.process_id Processes.user Processes.process_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_suspicious_docker_build_command_execution_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Developers or administrators may occasionally use the /tmp directory for testing Docker builds in non-production environments. Filter based on known users or systems where this activity has been approved. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Suspicious Docker Build Command [$process$] observed on [$dest$] executed by [$user$]. +threat_objects: + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Linux Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1610 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1610/linux_suspicious_docker_build/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_gcc_invocation_building_init_shared_object.yml b/detections/endpoint/linux_suspicious_gcc_invocation_building_init_shared_object.yml new file mode 100644 index 00000000000..321a5f1d9e6 --- /dev/null +++ b/detections/endpoint/linux_suspicious_gcc_invocation_building_init_shared_object.yml @@ -0,0 +1,93 @@ +name: Linux Suspicious GCC Invocation Building Init Shared Object +id: 9dbf4a61-0493-43bd-932c-532ba7671a7a +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects compiler usage with flags commonly used to create shared libraries that auto-run initialization functions, which are often associated with local privilege escalation exploits. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name IN ( + "*x86_64-linux-gnu-gcc*", + "cc", + "g++", + "gcc-*", + "gcc" + ) + Processes.process="*-shared*" + Processes.process="*-Wl,-init,*" + Processes.process="*.so*" + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_current_directory Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_suspicious_gcc_invocation_building_init_shared_object_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate developers may use these GCC flags when building shared libraries that require initialization functions. Filter based on known development environments and trusted users. +references: + - https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-linux-sudo-flaw-exploited-in-attacks/ + - https://github.com/pr0v3rbs/CVE-2025-32463_chwoot +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Suspicious GCC Invocation Building Init Shared Object identified on [$dest$] via [$process_name$] with the Command Line [$process$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Linux Privilege Escalation + - Linux Post-Exploitation + - Linux Persistence Techniques +asset_type: Endpoint +cve: + - CVE-2025-32463 +mitre_attack_id: + - T1129 + - T1068 + - T1608 + - T1027.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1129/linux_suspicious_gcc_invocation_building_init_shared_object/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_privileged_container_execution.yml b/detections/endpoint/linux_suspicious_privileged_container_execution.yml new file mode 100644 index 00000000000..7bacb3256d3 --- /dev/null +++ b/detections/endpoint/linux_suspicious_privileged_container_execution.yml @@ -0,0 +1,83 @@ +name: Linux Suspicious Privileged Container Execution +id: 29b888db-d6e7-4286-bbf5-39d9f260444c +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the execution of a Docker container with the privileged flag set, or with the pid namespace set to the host. + This can indicate a container running with elevated permissions and access to the underlying system. Actors can hide containers such as this to enable persistent access. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process="*docker *" + Processes.process="* run*" + Processes.process IN ("*--privileged*", "*--pid=host*") + + by Processes.process Processes.vendor_product Processes.user_id + Processes.process_hash Processes.parent_process_name + Processes.parent_process_exec Processes.action Processes.dest Processes.process_current_directory + Processes.process_path Processes.process_integrity_level Processes.original_file_name + Processes.parent_process Processes.parent_process_path Processes.parent_process_guid + Processes.parent_process_id Processes.process_guid Processes.process_id Processes.user + Processes.process_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_suspicious_privileged_container_execution_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate system administrators may intentionally run privileged containers for maintenance, debugging, or specific infrastructure tasks. Filter based on known approved workflows and trusted administrative users. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Suspicious Privileged Container identified on [$dest$] via [$process_name$] with the Command Line [$process$]. +threat_objects: + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Linux Post-Exploitation + - Linux Privilege Escalation + - Linux Persistence Techniques + - Compromised Linux Host +asset_type: Endpoint +mitre_attack_id: + - T1610 + - T1059.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1610/linux_suspicious_privileged_container/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_redis_activity.yml b/detections/endpoint/linux_suspicious_redis_activity.yml new file mode 100644 index 00000000000..9efe94050dc --- /dev/null +++ b/detections/endpoint/linux_suspicious_redis_activity.yml @@ -0,0 +1,100 @@ +name: Linux Suspicious Redis Activity +id: 098bbfa8-a591-44ab-9ec0-ae8ee82b4450 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects Redis processes spawning a system shell command. This can indicate exploitation activity of a redis server to gain code execution. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + ( + Processes.parent_process_name IN ( + "redis-sentinel", + "redis-server" + ) + OR + Processes.parent_process_path = "*/bin/redis*" + ) + + Processes.process_name IN ( + "awk", "bash", "curl", "dash", "gawk", "id", "ifconfig", + "lua", "nc", "ncat", "netcat", "openssl", "perl", "php", + "python", "python2", "python3", "ruby", "sh", "socat", + "wget", "whoami", "zsh" + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_current_directory Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_suspicious_redis_activity_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate administrative scripts or automated maintenance tasks may trigger this detection when managing Redis configurations or performing system operations. Filter based on known administrative activity and approved management tools. +references: + - https://thesecmaster.com/how-to-fix-cve-2022-0543-a-critical-lua-sandbox-escape-vulnerability-in-redis/ + - https://www.bleepingcomputer.com/news/security/new-p2pinfect-worm-malware-targets-linux-and-windows-redis-servers/ +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Suspicious Redis Activity identified on [$dest$] via [$process_name$] with the Command Line [$process$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Linux Post-Exploitation + - Compromised Linux Host + - Linux Persistence Techniques + - Linux Privilege Escalation + - Linux Living Off The Land + - Command And Control +asset_type: Endpoint +cve: + - CVE-2022-0543 +mitre_attack_id: + - T1505 + - T1210 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505/linux_suspicious_redis_activity/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_staging_of_alternate_system_files.yml b/detections/endpoint/linux_suspicious_staging_of_alternate_system_files.yml new file mode 100644 index 00000000000..028d14ace5c --- /dev/null +++ b/detections/endpoint/linux_suspicious_staging_of_alternate_system_files.yml @@ -0,0 +1,88 @@ +name: Linux Suspicious Staging of Alternate System Files +id: 250fd1b5-e62a-4515-baff-3010b52b4c12 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the creation of sensitive system files such as nsswitch.conf, passwd, shadow, sudoers, and NSS shared libraries outside of their canonical /etc or /var/lib/docker paths. + This technique is associated with CVE-2025-32463 (chwoot), where an attacker stages a fake root directory containing spoofed system configuration files and NSS libraries to manipulate how privileged processes such as sudo resolve name services, enabling local privilege escalation by hijacking library loading without modifying the real /etc directory. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime + + FROM datamodel=Endpoint.Filesystem WHERE + + Filesystem.file_path IN ( + "*/etc/group", + "*/etc/nsswitch.conf", + "*/etc/pam.conf", + "*/etc/passwd", + "*/etc/shadow", + "*/etc/sudo.conf", + "*/etc/sudoers", + "*/libnss_*" + ) + NOT Filesystem.file_path IN ( + "/etc/*", + "/var/lib/docker/*" + ) + + BY Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_suspicious_staging_of_alternate_system_files_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Developers or system administrators may stage alternate system files for legitimate testing or containerized environments. Filter based on known development or testing systems. +references: + - https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-linux-sudo-flaw-exploited-in-attacks/ + - https://github.com/pr0v3rbs/CVE-2025-32463_chwoot +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Suspicious Staging of Alternate System File - [$file_name$] observed on [$dest$]. +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Privilege Escalation + - Linux Post-Exploitation + - Linux Persistence Techniques +asset_type: Endpoint +mitre_attack_id: + - T1036 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/linux_suspicious_staging_of_alternate_system_files/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_suspicious_xdg_autostart.yml b/detections/endpoint/linux_suspicious_xdg_autostart.yml new file mode 100644 index 00000000000..02002b9513e --- /dev/null +++ b/detections/endpoint/linux_suspicious_xdg_autostart.yml @@ -0,0 +1,81 @@ +name: Linux Suspicious XDG Autostart +id: dc057fd6-34db-4c41-b8dd-00463c47bf83 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the creation of a .desktop file within XDG autostart directories, including the system-wide /etc/xdg/autostart and user-local ~/.config/autostart paths. + Adversaries abuse XDG autostart entries to achieve persistence on Linux desktop environments — any .desktop file placed in these directories is automatically executed when a user logs into a graphical session. + This technique is used by post-exploitation frameworks such as PANIX to survive reboots without requiring root on user-local paths, or to achieve system-wide persistence when writing to /etc/xdg/autostart. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime + + FROM datamodel=Endpoint.Filesystem WHERE + + Filesystem.action="created" + Filesystem.file_path IN ( + "/etc/xdg/autostart/*", + "*/.config/autostart/*" + ) + Filesystem.file_path = "*.desktop" + + BY Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_suspicious_xdg_autostart_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate software installations may create .desktop files in /etc/xdg/autostart as part of their normal setup process. Filter known software deployment tools and approved administrative activity as needed. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Possible Suspicious XDG Autostart file created under [$file_path$] by [$user$] on [$dest$] +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Persistence Techniques + - Linux Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1547 + - T1037 + - T1059.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547/linux_suspicious_xdg_autostart/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_udev_rule_created.yml b/detections/endpoint/linux_udev_rule_created.yml new file mode 100644 index 00000000000..d2bb67607db --- /dev/null +++ b/detections/endpoint/linux_udev_rule_created.yml @@ -0,0 +1,78 @@ +name: Linux UDEV Rule Created +id: 94d0e307-beae-4f85-8150-69c169b979c1 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the creation of files within udev rules directories, including /etc/udev/rules.d and /usr/lib/udev/rules.d. Adversaries abuse udev rules to achieve persistent code execution by embedding RUN+= directives that trigger arbitrary commands whenever a matching device event occurs, such as a USB device being connected or a network interface coming online. Because udev rules execute in the context of the udev daemon with elevated privileges, this technique can provide both persistence and privilege escalation. It is used by post-exploitation frameworks such as PANIX and is effective on headless servers where device events still fire despite no interactive user session. +data_source: + - Sysmon for Linux EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Filesystem WHERE + + Filesystem.file_path IN ( + "/etc/udev/rules.d/*", + "/usr/lib/udev/rules.d/*" + ) + + BY Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.process_guid + Filesystem.process_id Filesystem.user Filesystem.vendor_product + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_udev_rule_created_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain file creation events including the file path and user context. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate system administrators or software installers may create udev rules as part of normal hardware configuration or device management tasks. Filter based on known administrative activity and trusted software installations. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: New UDEV rule created under [$file_path$] by [$user$] on [$dest$] +threat_objects: + - field: file_name + type: file_name +analytic_story: + - Linux Persistence Techniques + - Linux Post-Exploitation + - Linux Privilege Escalation +asset_type: Endpoint +mitre_attack_id: + - T1547 + - T1037 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547/linux_udev_rule_created/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_usermod_root_uid_set.yml b/detections/endpoint/linux_usermod_root_uid_set.yml new file mode 100644 index 00000000000..443c1fe2e13 --- /dev/null +++ b/detections/endpoint/linux_usermod_root_uid_set.yml @@ -0,0 +1,79 @@ +name: Linux Usermod Root UID Set +id: fe143ad6-ef29-4571-be14-0cd08a32ff34 +version: 1 +creation_date: '2026-07-08' +modification_date: '2026-07-08' +author: Raven Tait, Splunk +status: production +type: TTP +description: The following analytic detects the use of usermod to set a user's UID to 0. This functionally sets the user as a root user with full permissions. This approach can be used to bypass regular privilege escalation mechanisms, giving the attacker full control over the system while appearing as a regular user in most monitoring tools. +data_source: + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes + WHERE Processes.process_name="usermod" + AND (Processes.process IN ("* -u 0 *", "* -u 0") OR Processes.process="*--uid 0*") + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_current_directory Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_usermod_root_uid_set_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Setting a user's UID to 0 is extremely rare in legitimate administration — there is almost no valid operational reason to create a second root-equivalent account this way. False positives are expected to be very low. Verify any alert against change management records before dismissing. +references: + - https://github.com/Aegrah/PANIX +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Linux Usermod Root UID Set identified on $dest$ by $user$ via $process_name$ + entity: + field: user + type: user + score: 50 +intermediate_findings: + entities: + - field: dest + type: system + score: 50 + message: Potential Usermod Root UID Set by $user$ on $dest$ via $process_name$. +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +analytic_story: + - Linux Privilege Escalation + - Linux Post-Exploitation + - Linux Persistence Techniques +asset_type: Endpoint +mitre_attack_id: + - T1098 + - T1078 + - T1548.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/linux_usermod_root_uid_set/snapattack_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux From e7d170f8c1da9b639cf8334364b93affcadd6a69 Mon Sep 17 00:00:00 2001 From: Raven Tait <93157481+RavenTait@users.noreply.github.com> Date: Fri, 7 Aug 2026 10:18:24 -0400 Subject: [PATCH 053/162] Another snapattack Windows Batch (#4192) --------- Co-authored-by: Nasreddine Bencherchali --- .../windows_dir_piped_to_findstr_activity.yml | 63 ++++++++++++ ...windows_network_sniffing_tool_executed.yml | 97 +++++++++++++++++++ ...ndows_powershell_commands_from_dns_txt.yml | 81 ++++++++++++++++ ...uspicious_child_process_of_consent_exe.yml | 88 +++++++++++++++++ lookups/csv/attacker_tools.csv | 1 + lookups/csv/attacker_tools.yml | 4 +- 6 files changed, 332 insertions(+), 2 deletions(-) create mode 100644 detections/endpoint/windows_dir_piped_to_findstr_activity.yml create mode 100644 detections/endpoint/windows_network_sniffing_tool_executed.yml create mode 100644 detections/endpoint/windows_powershell_commands_from_dns_txt.yml create mode 100644 detections/endpoint/windows_suspicious_child_process_of_consent_exe.yml diff --git a/detections/endpoint/windows_dir_piped_to_findstr_activity.yml b/detections/endpoint/windows_dir_piped_to_findstr_activity.yml new file mode 100644 index 00000000000..2fc39639ef1 --- /dev/null +++ b/detections/endpoint/windows_dir_piped_to_findstr_activity.yml @@ -0,0 +1,63 @@ +name: Windows Dir Piped to Findstr Activity +id: 43cd7a59-3d52-4969-a01a-d677630b1426 +version: 1 +creation_date: '2026-07-30' +modification_date: '2026-07-30' +author: Raven Tait, Splunk +status: production +type: Hunting +description: |- + The following analytic detects the execution of the `dir` command piped to `findstr` on Windows systems. + This technique is commonly used by attackers during the reconnaissance phase to enumerate files, directories, or sensitive data by filtering directory listings for specific strings or patterns. + While this command combination can have legitimate administrative uses, adversaries frequently leverage it to locate credentials, configuration files, or other high-value targets on a compromised system. + If confirmed malicious, this activity could indicate an attacker is actively mapping the file system in preparation for data exfiltration, lateral movement, or further exploitation. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process="*dir *|*findstr *" + + by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash + Processes.parent_process_name Processes.parent_process_exec Processes.action + Processes.dest Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name + Processes.parent_process Processes.parent_process_path Processes.parent_process_guid + Processes.parent_process_id Processes.process_guid + Processes.process_id Processes.user Processes.process_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_dir_piped_to_findstr_activity_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate administrative tasks and scripts may use `dir` piped to `findstr` for routine file searches. + Filter based on known user behavior and approved administrative activity. +analytic_story: + - Suspicious Command-Line Executions + - Windows Discovery Techniques + - Active Directory Discovery +asset_type: Endpoint +mitre_attack_id: + - T1119 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1119/windows_dir_piped_to_findstr_activity/snapattack_windows.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_network_sniffing_tool_executed.yml b/detections/endpoint/windows_network_sniffing_tool_executed.yml new file mode 100644 index 00000000000..66ede70c619 --- /dev/null +++ b/detections/endpoint/windows_network_sniffing_tool_executed.yml @@ -0,0 +1,97 @@ +name: Windows Network Sniffing Tool Executed +id: 0c594353-e12d-4867-92f6-2a1b8a1faf5f +version: 1 +creation_date: '2026-07-30' +modification_date: '2026-07-30' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the execution of common network sniffing tools on Windows systems, including Wireshark, WinPcap, tcpdump, and similar utilities. + This activity is significant because attackers use packet capture tools to intercept and analyze network traffic, enabling credential theft, sensitive data harvesting, and reconnaissance of internal network communications. + While these tools have legitimate administrative uses, their presence in unexpected environments may indicate an adversary conducting man-in-the-middle attacks or exfiltrating sensitive information traversing the network. + If confirmed malicious, this could lead to the exposure of credentials, session tokens, and confidential data, facilitating lateral movement and further compromise of the environment. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_name IN ( + "dumpcap.exe", + "netcap.exe", + "netmon.exe", + "tcpdump.exe", + "tshark.exe", + "windump.exe", + "winpcap.exe", + "wireshark.exe" + ) + + by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash + Processes.parent_process_name Processes.parent_process_exec Processes.action + Processes.dest Processes.process_current_directory Processes.process_path + Processes.process_integrity_level Processes.original_file_name Processes.parent_process + Processes.parent_process_path Processes.parent_process_guid + Processes.parent_process_id Processes.process_guid Processes.process_id + Processes.user Processes.process_name + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_network_sniffing_tool_executed_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate network administrators and security teams may use these tools for authorized network monitoring and troubleshooting. Filter based on approved software inventory and known administrative activity. +references: + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1040/T1040.md +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Network Sniffing utility execution identified on [$dest$] via [$process_name$] and the Command Line [$process$] executed by [$user$]. +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Credential Dumping + - Data Exfiltration + - Suspicious Command-Line Executions + - Windows Discovery Techniques + - Network Discovery +asset_type: Endpoint +mitre_attack_id: + - T1040 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack_windows.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_powershell_commands_from_dns_txt.yml b/detections/endpoint/windows_powershell_commands_from_dns_txt.yml new file mode 100644 index 00000000000..04d20490fe3 --- /dev/null +++ b/detections/endpoint/windows_powershell_commands_from_dns_txt.yml @@ -0,0 +1,81 @@ +name: Windows Powershell Commands from DNS TXT +id: b61353cd-5b09-4699-8b86-6517a9038043 +version: 1 +creation_date: '2026-07-30' +modification_date: '2026-07-30' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects execution of powershell commands retrieved from a remote DNS TXT query response. + The use of the DNS TXT record for C2 is an uncommon method for malware that is resilient due to the need for DNS in normal networking + activities. + This can ensure that their C2 is not blocked by any firewalls. +data_source: + - Powershell Script Block Logging 4104 +search: |- + `powershell` + EventCode=4104 + ScriptBlockText IN ("*resolve-dnsname *", "*nslookup *", "*dig *") + ScriptBlockText IN ("*-Type TXT*", "*type=txt*", "* TXT*") + ScriptBlockText IN ("*. (*", "*IEX*") + + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + + by dest signature signature_id + user_id vendor_product EventID + Guid Opcode Name + Path ProcessID ScriptBlockId + ScriptBlockText + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_powershell_commands_from_dns_txt_filter` +how_to_implement: |- + To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions are available at https://docs.splunk.com/Documentation/ES/latest/Admin/Configurepowershelllogging. +known_false_positives: |- + While false positives should be unlikely given the uncommon combination of PowerShell execution and DNS TXT query responses. + Due to the nature of Script Block Logging, it is possible that legitimate strings or unrelated commands might all match at once. + Apply appropriate exclusions for those edge cases. +drilldown_searches: + - name: View the detection results for - "$user_id$" and "$dest$" + search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user_id$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: A suspicious PowerShell script with the ScriptBlockId [$ScriptBlockId$] containing DNS TXT query commands was executed on host $dest$ + - field: user_id + type: user + score: 20 + message: A suspicious PowerShell script with the ScriptBlockId [$ScriptBlockId$] containing DNS TXT query commands was executed on host $dest$ by user $user_id$ +analytic_story: + - Malicious PowerShell + - Command And Control + - Suspicious DNS Traffic +asset_type: Endpoint +mitre_attack_id: + - T1071.004 + - T1059.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +security_domain: endpoint +category: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.004/windows_powershell_commands_from_dns_txt/snapattack_windows.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_suspicious_child_process_of_consent_exe.yml b/detections/endpoint/windows_suspicious_child_process_of_consent_exe.yml new file mode 100644 index 00000000000..dcf82d7b706 --- /dev/null +++ b/detections/endpoint/windows_suspicious_child_process_of_consent_exe.yml @@ -0,0 +1,88 @@ +name: Windows Suspicious Child Process of Consent.EXE +id: 8194b5d4-41ae-4ce7-adfb-92d375e341d2 +version: 1 +creation_date: '2026-07-30' +modification_date: '2026-07-30' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects unexpected child processes spawned by consent.exe, the Windows UAC consent dialog binary. + Consent.exe is responsible solely for rendering the UAC elevation prompt and should not spawn child processes under normal operating conditions; child process creation from this parent is a known indicator of UAC bypass and privilege escalation techniques. + The detection identifies any executable launched as a child of consent.exe, excluding the expected WerFault.exe error reporting process, which may legitimately appear in crash scenarios. + This behavior is associated with UAC bypass exploits and has been observed in multiple post-exploitation frameworks as a means of obtaining elevated privileges without triggering a visible UAC prompt. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.parent_process_name="consent.exe" + Processes.process_name="*.exe" + NOT Processes.process_name="WerFault.exe" + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process + Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_suspicious_child_process_of_consent_exe_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Legitimate software installations or system updates may occasionally trigger child processes under consent.exe but these should be rare. + Verify any flagged activity against known administrative actions or recent software changes. +references: + - https://securelist.com/cve-2024-30051/112618/ +drilldown_searches: + - earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Suspicious Child of [$parent_process_path$] activity observed on [$dest$] via [$process$] executed by [$user$] +threat_objects: + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Windows Privilege Escalation + - Unusual Processes +asset_type: Endpoint +mitre_attack_id: + - T1068 + - T1548.002 + - T1059 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + test_type: unit + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/windows_suspicious_child_of_consent_exe/snapattack_windows.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/lookups/csv/attacker_tools.csv b/lookups/csv/attacker_tools.csv index ae526f76b06..10d83a6a546 100644 --- a/lookups/csv/attacker_tools.csv +++ b/lookups/csv/attacker_tools.csv @@ -24,6 +24,7 @@ netpass.exe,This process was identified as malicious by DHS Alert TA18-201A and NLAChecker.exe,A scanner tool that checks for Windows hosts for Network Level Authentication. This tool allows attackers to detect Windows Servers with RDP without NLA enabled which facilitates the use of brute force non microsoft rdp tools or exploits NLBrute.exe,A RDP brute force tool found in botnets for further expansion and and acquisition of targets. This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords. nmap.exe,This process is an open source network mapping tool used to identify hosts and listening services on a network. +netscan.exe,NetScan is a network scanning tool used to discover hosts and services on a network. It is commonly leveraged by threat actors during the discovery phase to enumerate active hosts and open ports within a target environment. ns.exe,A commonly used tool used by attackers to scan and map file shares ntdll.exe,This process was identified as malicious by DHS Alert TA18-074A. OutlookAddressBookView.exe,This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook. diff --git a/lookups/csv/attacker_tools.yml b/lookups/csv/attacker_tools.yml index 155a36591fb..737617f2b9c 100644 --- a/lookups/csv/attacker_tools.yml +++ b/lookups/csv/attacker_tools.yml @@ -1,8 +1,8 @@ name: attacker_tools id: 72620fe1-26cb-4cee-a6ee-8c6127056d81 -version: 6 +version: 7 creation_date: '2021-07-12' -modification_date: '2026-05-13' +modification_date: '2026-08-07' author: Splunk Threat Research Team lookup_type: csv description: A list of tools used by attackers From 48b0ba4856216930072d937ceba51162314bf1a1 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 7 Aug 2026 18:48:26 +0200 Subject: [PATCH 054/162] Overlord Fixes (#4206) --- .../endpoint/linux_possible_bootloader_modification.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/linux_possible_bootloader_modification.yml b/detections/endpoint/linux_possible_bootloader_modification.yml index d1ecc96baf7..604d947263e 100644 --- a/detections/endpoint/linux_possible_bootloader_modification.yml +++ b/detections/endpoint/linux_possible_bootloader_modification.yml @@ -23,7 +23,7 @@ search: |- Processes.process_name IN ( "cp", "mv", - "ln", + "ln" ) Processes.process_current_directory="*/EFI/BOOT*" ) @@ -33,7 +33,7 @@ search: |- NOT Processes.process_name IN ( "ls", "grep", - "egrep", + "egrep" ) ) From a9ff0e20cb4fe1319ac581ff2fa64a536d8a8842 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 7 Aug 2026 20:29:29 +0200 Subject: [PATCH 055/162] More Overlord Fixes (#4207) --- data_sources/sysmon_for_linux_eventid_3.yml | 108 ++++++++++++++++++ .../linux_netcat_outbound_connection.yml | 2 +- ...le_privilege_escalation_via_pythonpath.yml | 9 +- 3 files changed, 117 insertions(+), 2 deletions(-) create mode 100644 data_sources/sysmon_for_linux_eventid_3.yml diff --git a/data_sources/sysmon_for_linux_eventid_3.yml b/data_sources/sysmon_for_linux_eventid_3.yml new file mode 100644 index 00000000000..ffaa13a39fa --- /dev/null +++ b/data_sources/sysmon_for_linux_eventid_3.yml @@ -0,0 +1,108 @@ +name: Sysmon for Linux EventID 3 +id: c56ce9d3-a37e-43a5-a0e6-b3b7d03600a4 +version: 1 +creation_date: '2026-08-07' +modification_date: '2026-08-07' +author: Nasreddine Bencherchali, Splunk +description: Logs network connection creation events on Linux systems, including details about the source and destination IPs, ports, protocols, and the associated process metadata. +mitre_components: + - Network Connection Creation + - Network Traffic Flow + - Process Metadata + - Application Log Content + - OS API Execution +source: Syslog:Linux-Sysmon/Operational +sourcetype: sysmon:linux +separator: EventID +separator_value: '3' +supported_TA: + - name: Splunk Add-on for Sysmon for Linux + url: https://splunkbase.splunk.com/app/6652 + version: 1.0.0 +fields: + - _time + - action + - app + - Computer + - creation_time + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dest_ip + - dest_port + - DestinationHostname + - DestinationIp + - DestinationIsIpv6 + - DestinationPort + - DestinationPortName + - direction + - dvc + - dvc_ip + - EventDescription + - EventID + - eventtype + - Guid + - host + - Image + - index + - Initiated + - Interesting Fields + - Keywords + - linecount + - Name + - process_exec + - process_guid + - process_id + - process_name + - ProcessGuid + - ProcessId + - ProcessID + - protocol + - Protocol + - protocol_version + - punct + - RuleName + - signature + - signature_id + - source + - SourceHostname + - SourceIp + - SourceIsIpv6 + - SourcePort + - SourcePortName + - sourcetype + - splunk_server + - src + - src_ip + - src_port + - state + - SystemTime + - tag + - tag::eventtype + - ThreadID + - timeendpos + - timestartpos + - transport + - transport_dest_port + - user + - user_id + - UserId + - UtcTime + - vendor_product + - xmlns +output_fields: + - src + - dest + - dest_port + - transport + - process_name + - app + - user + - process_id +example_log: 354300x80000000000000001068124Linux-Sysmon/Operationalip-10-0-76-137-2022-08-31 18:16:47.184{ec21f57b-a58f-630f-05a2-4983a0550000}7658/usr/bin/ncatroottcptruefalse10.0.76.137-53976-false10.0.76.44-4444- diff --git a/detections/endpoint/linux_netcat_outbound_connection.yml b/detections/endpoint/linux_netcat_outbound_connection.yml index 30ddef80708..272fd23a1e6 100644 --- a/detections/endpoint/linux_netcat_outbound_connection.yml +++ b/detections/endpoint/linux_netcat_outbound_connection.yml @@ -12,7 +12,7 @@ description: |- This activity is significant because outbound connections from these binaries often indicate an active compromise, where an attacker may be maintaining command-and-control communication or tunneling malicious traffic. If confirmed malicious, this could lead to unauthorized data exfiltration, lateral movement, or persistent remote access to the compromised system. data_source: - - Sysmon EventID 3 + - Sysmon for Linux EventID 3 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml b/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml index 44dfa16e204..2a29b417203 100644 --- a/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml +++ b/detections/endpoint/linux_possible_privilege_escalation_via_pythonpath.yml @@ -20,7 +20,14 @@ search: |- from datamodel=Endpoint.Filesystem where Filesystem.file_path="*/importlib/__init__.so*" - NOT Filesystem.file_path="*/lib/*" + NOT Filesystem.file_path IN ( + "/lib/*", + "/lib64/*", + "/usr/lib/*", + "/usr/lib64/*", + "/usr/local/lib/*", + "/usr/local/lib64/*" + ) by Filesystem.file_path Filesystem.file_name Filesystem.user Filesystem.dest Filesystem.process_guid Filesystem.process_id From f4775123ee3bf0910abd44d099f48014f7b3953c Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 13 Aug 2026 07:55:55 -0700 Subject: [PATCH 056/162] Update data source TA and install.yml app versions (#4213) --- data_sources/cisco_ai_defense_alerts.yml | 2 +- data_sources/cisco_asa_logs.yml | 2 +- data_sources/cisco_duo_activity.yml | 2 +- data_sources/cisco_duo_administrator.yml | 2 +- data_sources/cisco_isovalent_process_connect.yml | 2 +- data_sources/cisco_isovalent_process_exec.yml | 2 +- data_sources/cisco_isovalent_process_kprobe.yml | 2 +- data_sources/cisco_network_visibility_module_flow_data.yml | 2 +- data_sources/cisco_network_visibility_module_osquery.yml | 2 +- .../cisco_secure_firewall_threat_defense_connection_event.yml | 2 +- .../cisco_secure_firewall_threat_defense_file_event.yml | 2 +- .../cisco_secure_firewall_threat_defense_intrusion_event.yml | 2 +- data_sources/github_enterprise_audit_logs.yml | 2 +- data_sources/github_organizations_audit_logs.yml | 2 +- data_sources/linux_auditd_add_user.yml | 2 +- data_sources/linux_auditd_cwd.yml | 2 +- data_sources/linux_auditd_daemon_abort.yml | 2 +- data_sources/linux_auditd_daemon_end.yml | 2 +- data_sources/linux_auditd_daemon_start.yml | 2 +- data_sources/linux_auditd_execve.yml | 2 +- data_sources/linux_auditd_path.yml | 2 +- data_sources/linux_auditd_proctitle.yml | 2 +- data_sources/linux_auditd_service_stop.yml | 2 +- data_sources/linux_auditd_syscall.yml | 2 +- data_sources/linux_messages_syslog.yml | 2 +- data_sources/linux_secure.yml | 2 +- data_sources/nginx_access.yml | 2 +- 27 files changed, 27 insertions(+), 27 deletions(-) diff --git a/data_sources/cisco_ai_defense_alerts.yml b/data_sources/cisco_ai_defense_alerts.yml index 1404dec13c8..1c672354b46 100644 --- a/data_sources/cisco_ai_defense_alerts.yml +++ b/data_sources/cisco_ai_defense_alerts.yml @@ -11,5 +11,5 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: diff --git a/data_sources/cisco_asa_logs.yml b/data_sources/cisco_asa_logs.yml index 1a8e0326076..61d0ec4d563 100644 --- a/data_sources/cisco_asa_logs.yml +++ b/data_sources/cisco_asa_logs.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - Cisco_ASA_action - Cisco_ASA_message_id diff --git a/data_sources/cisco_duo_activity.yml b/data_sources/cisco_duo_activity.yml index ef4d9c214e1..57f78a420bc 100644 --- a/data_sources/cisco_duo_activity.yml +++ b/data_sources/cisco_duo_activity.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - access_device.browser - access_device.browser_version diff --git a/data_sources/cisco_duo_administrator.yml b/data_sources/cisco_duo_administrator.yml index c9e84710271..ba87861cc13 100644 --- a/data_sources/cisco_duo_administrator.yml +++ b/data_sources/cisco_duo_administrator.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - action - actionlabel diff --git a/data_sources/cisco_isovalent_process_connect.yml b/data_sources/cisco_isovalent_process_connect.yml index 4176c4e24ef..2ed3fe00592 100644 --- a/data_sources/cisco_isovalent_process_connect.yml +++ b/data_sources/cisco_isovalent_process_connect.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processConnect supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - _time - app diff --git a/data_sources/cisco_isovalent_process_exec.yml b/data_sources/cisco_isovalent_process_exec.yml index fbc9e8fda21..53b8c8dcd6c 100644 --- a/data_sources/cisco_isovalent_process_exec.yml +++ b/data_sources/cisco_isovalent_process_exec.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processExec supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - _time - cluster_name diff --git a/data_sources/cisco_isovalent_process_kprobe.yml b/data_sources/cisco_isovalent_process_kprobe.yml index 9b5f9b9fc86..82e8b8c3d40 100644 --- a/data_sources/cisco_isovalent_process_kprobe.yml +++ b/data_sources/cisco_isovalent_process_kprobe.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - _time - app diff --git a/data_sources/cisco_network_visibility_module_flow_data.yml b/data_sources/cisco_network_visibility_module_flow_data.yml index 35fb13dd7ae..402fddfdd52 100644 --- a/data_sources/cisco_network_visibility_module_flow_data.yml +++ b/data_sources/cisco_network_visibility_module_flow_data.yml @@ -10,7 +10,7 @@ sourcetype: cisco:nvm:flowdata:v2 supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - action - aliul diff --git a/data_sources/cisco_network_visibility_module_osquery.yml b/data_sources/cisco_network_visibility_module_osquery.yml index 710ef263b0b..569f2e8972c 100644 --- a/data_sources/cisco_network_visibility_module_osquery.yml +++ b/data_sources/cisco_network_visibility_module_osquery.yml @@ -10,7 +10,7 @@ sourcetype: cisco:nvm:osquery:v2 supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - current_page - date_hour diff --git a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml index 2e6a88ad825..3a199b6f486 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - AC_RuleAction - action diff --git a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml index 022971efeb4..84d09c58379 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - app - Application diff --git a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml index 1552ce4c57c..db18b5a342d 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.1 + version: 4.0.2 fields: - Application - Classification diff --git a/data_sources/github_enterprise_audit_logs.yml b/data_sources/github_enterprise_audit_logs.yml index f980d377424..266202314d9 100644 --- a/data_sources/github_enterprise_audit_logs.yml +++ b/data_sources/github_enterprise_audit_logs.yml @@ -10,7 +10,7 @@ sourcetype: httpevent supported_TA: - name: Splunk Add-on for Github url: https://splunkbase.splunk.com/app/6254 - version: 3.3.1 + version: 4.0.0 fields: - _document_id - action diff --git a/data_sources/github_organizations_audit_logs.yml b/data_sources/github_organizations_audit_logs.yml index cf90f2b8cf7..1a187a6d09d 100644 --- a/data_sources/github_organizations_audit_logs.yml +++ b/data_sources/github_organizations_audit_logs.yml @@ -10,7 +10,7 @@ sourcetype: github:cloud:audit supported_TA: - name: Splunk Add-on for Github url: https://splunkbase.splunk.com/app/6254 - version: 3.3.1 + version: 4.0.0 fields: - _document_id - action diff --git a/data_sources/linux_auditd_add_user.yml b/data_sources/linux_auditd_add_user.yml index 52378a5ee6d..835c71b6a86 100644 --- a/data_sources/linux_auditd_add_user.yml +++ b/data_sources/linux_auditd_add_user.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - msg - type diff --git a/data_sources/linux_auditd_cwd.yml b/data_sources/linux_auditd_cwd.yml index d39ee1fddc4..49224274460 100644 --- a/data_sources/linux_auditd_cwd.yml +++ b/data_sources/linux_auditd_cwd.yml @@ -13,7 +13,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - cwd - date_hour diff --git a/data_sources/linux_auditd_daemon_abort.yml b/data_sources/linux_auditd_daemon_abort.yml index e46aa9c3264..e311d746000 100644 --- a/data_sources/linux_auditd_daemon_abort.yml +++ b/data_sources/linux_auditd_daemon_abort.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_end.yml b/data_sources/linux_auditd_daemon_end.yml index 0522a1d4133..46c537bc68a 100644 --- a/data_sources/linux_auditd_daemon_end.yml +++ b/data_sources/linux_auditd_daemon_end.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_start.yml b/data_sources/linux_auditd_daemon_start.yml index 4024d17bc87..5c6aa25a0f5 100644 --- a/data_sources/linux_auditd_daemon_start.yml +++ b/data_sources/linux_auditd_daemon_start.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - type - op diff --git a/data_sources/linux_auditd_execve.yml b/data_sources/linux_auditd_execve.yml index e72fcaef2fe..231d750fc2c 100644 --- a/data_sources/linux_auditd_execve.yml +++ b/data_sources/linux_auditd_execve.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - msg - type diff --git a/data_sources/linux_auditd_path.yml b/data_sources/linux_auditd_path.yml index 1ec1119e7d1..b368989f155 100644 --- a/data_sources/linux_auditd_path.yml +++ b/data_sources/linux_auditd_path.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - msg - type diff --git a/data_sources/linux_auditd_proctitle.yml b/data_sources/linux_auditd_proctitle.yml index 4b3af11875b..1950f4a8ebe 100644 --- a/data_sources/linux_auditd_proctitle.yml +++ b/data_sources/linux_auditd_proctitle.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - proctitle - msg diff --git a/data_sources/linux_auditd_service_stop.yml b/data_sources/linux_auditd_service_stop.yml index 71d083b8e5e..cdc8d643e7c 100644 --- a/data_sources/linux_auditd_service_stop.yml +++ b/data_sources/linux_auditd_service_stop.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - msg - type diff --git a/data_sources/linux_auditd_syscall.yml b/data_sources/linux_auditd_syscall.yml index 7582dd5dc06..5e99e36493c 100644 --- a/data_sources/linux_auditd_syscall.yml +++ b/data_sources/linux_auditd_syscall.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - msg - type diff --git a/data_sources/linux_messages_syslog.yml b/data_sources/linux_messages_syslog.yml index 7e89cd959e8..574409798ec 100644 --- a/data_sources/linux_messages_syslog.yml +++ b/data_sources/linux_messages_syslog.yml @@ -15,7 +15,7 @@ sourcetype: linux_messages_syslog supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - _time - action diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index f01804afa2b..648850c8d00 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -16,7 +16,7 @@ sourcetype: linux_secure supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.2 + version: 10.3.3 fields: - _time - action diff --git a/data_sources/nginx_access.yml b/data_sources/nginx_access.yml index 8c249409e49..3b205f39323 100644 --- a/data_sources/nginx_access.yml +++ b/data_sources/nginx_access.yml @@ -16,7 +16,7 @@ sourcetype: nginx:plus:kv supported_TA: - name: Splunk Add-on for NGINX url: https://splunkbase.splunk.com/app/3258 - version: 3.3.0 + version: 3.3.1 fields: - _time - action From 9a930964bbf10c4e1536c3e4b29afd6a62708108 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 13 Aug 2026 17:38:04 +0200 Subject: [PATCH 057/162] Bump contentctl.yml and build.yml to 6.5.0 (#4214) * Update build.yml * Update contentctl.yml --- build.yml | 2 +- contentctl.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build.yml b/build.yml index ddabf18dcc0..aee844016c1 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.4.0 +app_version: 6.5.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index d066a0ef9ea..b1f828f54ed 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.4.0 + version: 6.5.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU From ef7b62198c55aad9405835cd686181cdd33d652b Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 13 Aug 2026 12:50:49 -0700 Subject: [PATCH 058/162] convert the exclsuion of TA (#4215) from the normal updater process from a hardcoded exclusion for the windows TA to a comment in case this needs to be done in the future. --- .github/workflows/datasource-dependabot.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/datasource-dependabot.yml b/.github/workflows/datasource-dependabot.yml index 65537866247..752b6063e6f 100644 --- a/.github/workflows/datasource-dependabot.yml +++ b/.github/workflows/datasource-dependabot.yml @@ -32,10 +32,13 @@ jobs: echo "Updating data source supported_TA and repo install.yml app versions" contentctl-ng update-data-source-tas --content-dirs . - # TODO: Remove this when we are fully compatible with the latest version of the Windows TA - # Temporarily roll back any automated updates to the Windows TA because we intentionally - # want to pin to the current version. - git checkout -- $(grep -rl "https://splunkbase.splunk.com/app/742" data_sources/) + # TODO: This comment is intentionally left in this workflow to demonstrate how individuals + # TAs can be intentionally excluded from updates, for example when we have intentionally pinned + # to an older version of a TA. In the future, we will try to make this a formally documented + # feature of contentctl-ng, but needing to do this is fairly rare and with out other priorities, + # does not fit at this time. + # The demonstration below shows how to exlcude the windows TA from updates, if necessary. + # git checkout -- $(grep -rl "https://splunkbase.splunk.com/app/742" data_sources/) echo "Changed data source and install.yml files:" git status --short -- data_sources install.yml From 457ce9f5ea69a8d5be9463989ee23b9366858d16 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 13 Aug 2026 12:55:22 -0700 Subject: [PATCH 059/162] Update data source TA and install.yml app versions (#4216) Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> --- data_sources/ntlm_operational_8004.yml | 2 +- data_sources/ntlm_operational_8005.yml | 2 +- data_sources/ntlm_operational_8006.yml | 2 +- data_sources/powershell_script_block_logging_4104.yml | 2 +- data_sources/windows_active_directory_admon.yml | 2 +- data_sources/windows_event_log_application_15457.yml | 2 +- data_sources/windows_event_log_application_17135.yml | 2 +- data_sources/windows_event_log_application_2282.yml | 2 +- data_sources/windows_event_log_application_3000.yml | 2 +- data_sources/windows_event_log_application_8128.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_400.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_854.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_855.yml | 2 +- data_sources/windows_event_log_appxpackaging_171.yml | 2 +- data_sources/windows_event_log_capi2_70.yml | 2 +- data_sources/windows_event_log_capi2_81.yml | 2 +- .../windows_event_log_certificateservicesclient_1007.yml | 2 +- data_sources/windows_event_log_defender_1121.yml | 2 +- data_sources/windows_event_log_defender_1122.yml | 2 +- data_sources/windows_event_log_defender_1125.yml | 2 +- data_sources/windows_event_log_defender_1126.yml | 2 +- data_sources/windows_event_log_defender_1129.yml | 2 +- data_sources/windows_event_log_defender_1131.yml | 2 +- data_sources/windows_event_log_defender_1132.yml | 2 +- data_sources/windows_event_log_defender_1133.yml | 2 +- data_sources/windows_event_log_defender_1134.yml | 2 +- data_sources/windows_event_log_defender_5007.yml | 2 +- data_sources/windows_event_log_printservice_316.yml | 2 +- data_sources/windows_event_log_printservice_4909.yml | 2 +- data_sources/windows_event_log_printservice_808.yml | 2 +- data_sources/windows_event_log_remoteconnectionmanager_1149.yml | 2 +- data_sources/windows_event_log_security_1100.yml | 2 +- data_sources/windows_event_log_security_1102.yml | 2 +- data_sources/windows_event_log_security_4624.yml | 2 +- data_sources/windows_event_log_security_4625.yml | 2 +- data_sources/windows_event_log_security_4627.yml | 2 +- data_sources/windows_event_log_security_4648.yml | 2 +- data_sources/windows_event_log_security_4662.yml | 2 +- data_sources/windows_event_log_security_4663.yml | 2 +- data_sources/windows_event_log_security_4672.yml | 2 +- data_sources/windows_event_log_security_4688.yml | 2 +- data_sources/windows_event_log_security_4698.yml | 2 +- data_sources/windows_event_log_security_4699.yml | 2 +- data_sources/windows_event_log_security_4700.yml | 2 +- data_sources/windows_event_log_security_4702.yml | 2 +- data_sources/windows_event_log_security_4703.yml | 2 +- data_sources/windows_event_log_security_4719.yml | 2 +- data_sources/windows_event_log_security_4720.yml | 2 +- data_sources/windows_event_log_security_4723.yml | 2 +- data_sources/windows_event_log_security_4724.yml | 2 +- data_sources/windows_event_log_security_4725.yml | 2 +- data_sources/windows_event_log_security_4726.yml | 2 +- data_sources/windows_event_log_security_4727.yml | 2 +- data_sources/windows_event_log_security_4728.yml | 2 +- data_sources/windows_event_log_security_4730.yml | 2 +- data_sources/windows_event_log_security_4731.yml | 2 +- data_sources/windows_event_log_security_4732.yml | 2 +- data_sources/windows_event_log_security_4737.yml | 2 +- data_sources/windows_event_log_security_4738.yml | 2 +- data_sources/windows_event_log_security_4739.yml | 2 +- data_sources/windows_event_log_security_4741.yml | 2 +- data_sources/windows_event_log_security_4742.yml | 2 +- data_sources/windows_event_log_security_4744.yml | 2 +- data_sources/windows_event_log_security_4749.yml | 2 +- data_sources/windows_event_log_security_4754.yml | 2 +- data_sources/windows_event_log_security_4756.yml | 2 +- data_sources/windows_event_log_security_4759.yml | 2 +- data_sources/windows_event_log_security_4768.yml | 2 +- data_sources/windows_event_log_security_4769.yml | 2 +- data_sources/windows_event_log_security_4771.yml | 2 +- data_sources/windows_event_log_security_4776.yml | 2 +- data_sources/windows_event_log_security_4781.yml | 2 +- data_sources/windows_event_log_security_4783.yml | 2 +- data_sources/windows_event_log_security_4790.yml | 2 +- data_sources/windows_event_log_security_4794.yml | 2 +- data_sources/windows_event_log_security_4798.yml | 2 +- data_sources/windows_event_log_security_4876.yml | 2 +- data_sources/windows_event_log_security_4886.yml | 2 +- data_sources/windows_event_log_security_4887.yml | 2 +- data_sources/windows_event_log_security_4946.yml | 2 +- data_sources/windows_event_log_security_4947.yml | 2 +- data_sources/windows_event_log_security_4948.yml | 2 +- data_sources/windows_event_log_security_5136.yml | 2 +- data_sources/windows_event_log_security_5137.yml | 2 +- data_sources/windows_event_log_security_5140.yml | 2 +- data_sources/windows_event_log_security_5141.yml | 2 +- data_sources/windows_event_log_security_5145.yml | 2 +- data_sources/windows_event_log_system_104.yml | 2 +- data_sources/windows_event_log_system_4720.yml | 2 +- data_sources/windows_event_log_system_4726.yml | 2 +- data_sources/windows_event_log_system_4728.yml | 2 +- data_sources/windows_event_log_system_7036.yml | 2 +- data_sources/windows_event_log_system_7040.yml | 2 +- data_sources/windows_event_log_system_7045.yml | 2 +- data_sources/windows_event_log_taskscheduler_200.yml | 2 +- data_sources/windows_event_log_taskscheduler_201.yml | 2 +- data_sources/windows_iis.yml | 2 +- data_sources/windows_iis_29.yml | 2 +- 98 files changed, 98 insertions(+), 98 deletions(-) diff --git a/data_sources/ntlm_operational_8004.yml b/data_sources/ntlm_operational_8004.yml index 141ebdf0def..c075b634ac5 100644 --- a/data_sources/ntlm_operational_8004.yml +++ b/data_sources/ntlm_operational_8004.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8005.yml b/data_sources/ntlm_operational_8005.yml index da24c4688cc..d8b431c098d 100644 --- a/data_sources/ntlm_operational_8005.yml +++ b/data_sources/ntlm_operational_8005.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8006.yml b/data_sources/ntlm_operational_8006.yml index e4ec349eb57..735b7e553d4 100644 --- a/data_sources/ntlm_operational_8006.yml +++ b/data_sources/ntlm_operational_8006.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 6a20ab81289..3c98545a95e 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -18,7 +18,7 @@ separator_value: '4104' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index 7e1ec4fde71..e5f967841b2 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -16,7 +16,7 @@ sourcetype: ActiveDirectory supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Guid diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index 4ef6ecee000..c27efb791d5 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_17135.yml b/data_sources/windows_event_log_application_17135.yml index fb960b1d426..4371cdb243e 100644 --- a/data_sources/windows_event_log_application_17135.yml +++ b/data_sources/windows_event_log_application_17135.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index 9107707eaf1..61ea5346439 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index a98f34690b7..7caa8736d80 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -17,7 +17,7 @@ separator_value: '3000' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index b45b9b50fa1..08734940dec 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index 869197ab810..39792c136bb 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index 792a15ebbca..9f50ea89e6c 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index 22e3b717253..6b38cc2db56 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index 00920b4b372..4ff056df308 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_capi2_70.yml b/data_sources/windows_event_log_capi2_70.yml index 2701795166b..aef7469c112 100644 --- a/data_sources/windows_event_log_capi2_70.yml +++ b/data_sources/windows_event_log_capi2_70.yml @@ -18,7 +18,7 @@ separator_value: '70' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_capi2_81.yml b/data_sources/windows_event_log_capi2_81.yml index f4e77710235..aa03a03585f 100644 --- a/data_sources/windows_event_log_capi2_81.yml +++ b/data_sources/windows_event_log_capi2_81.yml @@ -18,7 +18,7 @@ separator_value: '81' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_certificateservicesclient_1007.yml b/data_sources/windows_event_log_certificateservicesclient_1007.yml index 14d92e22a74..5f5c5af5cb6 100644 --- a/data_sources/windows_event_log_certificateservicesclient_1007.yml +++ b/data_sources/windows_event_log_certificateservicesclient_1007.yml @@ -18,7 +18,7 @@ separator_value: '1007' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index 011347afb2d..167cda8c708 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -16,7 +16,7 @@ separator_value: '1121' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index 9c97a01efe2..33600c1231b 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -16,7 +16,7 @@ separator_value: '1122' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index 77928d82739..149b6311906 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time example_log: 112204000x80000000000000003701Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009E6DB77E5-3DF2-4CF1-B95A-636979351E5B2023-11-26T23:43:08.709Z(unknown user)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1.401.1247.01.1.23100.2009ENT\ConsRC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index b0b5c2cef02..0b5a3d83a20 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index 8d9767ba9c3..70617fdd7e2 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -16,7 +16,7 @@ separator_value: '1129' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index 7b59c9cd6b4..599f4a67e00 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index 1a813f46f96..0317ab0fb40 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 88cb4531d36..48f1409144f 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index 3b54c95906d..d9c827fef63 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 882e7a7bd03..690ee87c8c9 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -14,7 +14,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_printservice_316.yml b/data_sources/windows_event_log_printservice_316.yml index 257bd4a5d48..f79b3dfdd2d 100644 --- a/data_sources/windows_event_log_printservice_316.yml +++ b/data_sources/windows_event_log_printservice_316.yml @@ -15,7 +15,7 @@ separator_value: '316' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_printservice_4909.yml b/data_sources/windows_event_log_printservice_4909.yml index 529620eb608..3da36ee8f0c 100644 --- a/data_sources/windows_event_log_printservice_4909.yml +++ b/data_sources/windows_event_log_printservice_4909.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time example_log: '' diff --git a/data_sources/windows_event_log_printservice_808.yml b/data_sources/windows_event_log_printservice_808.yml index d952de1f7e3..aba8ee364cb 100644 --- a/data_sources/windows_event_log_printservice_808.yml +++ b/data_sources/windows_event_log_printservice_808.yml @@ -16,7 +16,7 @@ separator_value: '808' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml index 6bd7d957fcd..e86b09685af 100644 --- a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml +++ b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml @@ -16,7 +16,7 @@ separator_value: '1149' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 3dbf23664f3..f113a86355f 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -15,7 +15,7 @@ separator_value: '1100' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index 8586c6984d8..7a56fa568bf 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -16,7 +16,7 @@ separator_value: '1102' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index 3971f62bfc7..cb5f1d0853c 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -16,7 +16,7 @@ separator_value: '4624' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index 28e5d9feada..9da8575acc5 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -15,7 +15,7 @@ separator_value: '4625' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4627.yml b/data_sources/windows_event_log_security_4627.yml index e8c1fb0efbe..7f378ce075e 100644 --- a/data_sources/windows_event_log_security_4627.yml +++ b/data_sources/windows_event_log_security_4627.yml @@ -16,7 +16,7 @@ separator_value: '4627' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index 6b8fa7d8291..fa943bf7878 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -15,7 +15,7 @@ separator_value: '4648' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index c0dc0121e46..5584723fb0d 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -15,7 +15,7 @@ separator_value: '4662' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index f74d26c94a6..47b3a08dfd3 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -15,7 +15,7 @@ separator_value: '4663' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index 280d7f8262f..898f064d0e9 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -15,7 +15,7 @@ separator_value: '4672' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index 642687b596a..dd02fdcfcf4 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -16,7 +16,7 @@ configuration: Enabling Windows event log process command line logging via group supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - Caller_Domain - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index 3b4b6a9c064..24bf4ad87bb 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -15,7 +15,7 @@ separator_value: '4698' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index a80ed23a9ba..971447d98b7 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -15,7 +15,7 @@ separator_value: '4699' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index 4dc60cd9bd7..27ce4cad6d2 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - EventID example_log: 4700 0 0 12804 0 0x8020000000000000 344861 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin LeastPrivilege CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index 7184ff77e3f..a5ac7fbcd52 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - EventID example_log: 4702 0 0 12804 0 0x8020000000000000 344863 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin HighestAvailable CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index 5c1d729155e..8d66db7b5a9 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -15,7 +15,7 @@ separator_value: '4703' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index 06b3adb9882..71a66f16667 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -15,7 +15,7 @@ separator_value: '4719' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 31484a35875..485dc71519b 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -14,7 +14,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index 26eb1728db8..dd4a4102e23 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -14,7 +14,7 @@ separator_value: '4723' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index 0b06b7823a5..d32bd3cb4c3 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -14,7 +14,7 @@ separator_value: '4724' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index ca05c7b8403..7d45acc942d 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -14,7 +14,7 @@ separator_value: '4725' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index 6ddc2aba570..68503802fc1 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -14,7 +14,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 0aa2c2f0b79..7ca3ba9a14e 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index bcba79a79d9..4e4f8d42473 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index 9487a6ac521..5e2a3ba701d 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index 30f8bc23e81..8d78f08e213 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index d95f852eb8e..16f6cdfa8b6 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -14,7 +14,7 @@ separator_value: '4732' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index f128bbfcc42..7525a3f1ce2 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index fb6f1f3ca8d..70ee3355a50 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -14,7 +14,7 @@ separator_value: '4738' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4739.yml b/data_sources/windows_event_log_security_4739.yml index b0f63147034..99a689249af 100644 --- a/data_sources/windows_event_log_security_4739.yml +++ b/data_sources/windows_event_log_security_4739.yml @@ -15,7 +15,7 @@ separator_value: '4739' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index 7b643fb3d0e..625bd64d26f 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -17,7 +17,7 @@ separator_value: '4741' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index eb26156fe93..7e0125e963b 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index 216eb54d2c5..7dff88ff14f 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index 8b61381edec..0a86c60d109 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index 4dbe460a364..d38bdbdaa93 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index c53348491fb..638cd75b6f9 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index 9db0814db32..45f712c76cd 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 0d954d3b5c3..4ceba33a506 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -17,7 +17,7 @@ separator_value: '4768' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index 2b1506eda99..8d9f1de5776 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -17,7 +17,7 @@ separator_value: '4769' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index 16751ea4ef2..e31dcec12a4 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -17,7 +17,7 @@ separator_value: '4771' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index 408aaa466bb..513d1d6b3df 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -17,7 +17,7 @@ separator_value: '4776' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index ed8f3691a80..7c10ebc5471 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -17,7 +17,7 @@ separator_value: '4781' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index 4b239b5056d..95936495e46 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index 8a945e0fe82..5cb3443f3de 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index 70bae43f05b..e335d8bd7fa 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -17,7 +17,7 @@ separator_value: supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index 8eebe0e5a94..cf3a023f068 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index bdd7735a815..4fd370c8f1d 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -17,7 +17,7 @@ separator_value: '4876' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index 9379641c7d3..afe8d53f69c 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -17,7 +17,7 @@ separator_value: '4886' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index 2016e280f63..5216d86c0d4 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -17,7 +17,7 @@ separator_value: '4887' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index 2d9e806305f..32ceb5f9740 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -12,7 +12,7 @@ separator_value: '4946' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index b10ef8870b6..fa8949c735d 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -12,7 +12,7 @@ separator_value: '4947' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index 961be864ee1..f5eca48d81a 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -12,7 +12,7 @@ separator_value: '4948' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index b2035008e48..c22ef0fcdb2 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -17,7 +17,7 @@ separator_value: '5136' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index 253ce10397d..91bbceceec2 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -17,7 +17,7 @@ separator_value: '5137' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - AppCorrelationID diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index f5f3cf11165..1824749f9b2 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -17,7 +17,7 @@ separator_value: '5140' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index 393098f2884..333bbbbd67e 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -17,7 +17,7 @@ separator_value: '5141' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index 1647d2e8320..0a15bd0258f 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -17,7 +17,7 @@ separator_value: '5145' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index faea29ccadb..28f5ab09be5 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_system_4720.yml b/data_sources/windows_event_log_system_4720.yml index 49df88f658a..1a6be457d10 100644 --- a/data_sources/windows_event_log_system_4720.yml +++ b/data_sources/windows_event_log_system_4720.yml @@ -17,7 +17,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4726.yml b/data_sources/windows_event_log_system_4726.yml index 642359a985c..00e26d4addb 100644 --- a/data_sources/windows_event_log_system_4726.yml +++ b/data_sources/windows_event_log_system_4726.yml @@ -17,7 +17,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4728.yml b/data_sources/windows_event_log_system_4728.yml index dd3e3849ea5..746332e5b87 100644 --- a/data_sources/windows_event_log_system_4728.yml +++ b/data_sources/windows_event_log_system_4728.yml @@ -17,7 +17,7 @@ separator_value: '4728' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index 0cf395b1d21..65f12a428ac 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -17,7 +17,7 @@ separator_value: '7036' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index 518d67eacf5..b907e1451a2 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -17,7 +17,7 @@ separator_value: '7040' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index a1fda46fe87..9648dd5f24d 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -17,7 +17,7 @@ separator_value: '7045' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - AccountName diff --git a/data_sources/windows_event_log_taskscheduler_200.yml b/data_sources/windows_event_log_taskscheduler_200.yml index e7fe0ff722b..98678fd0fe6 100644 --- a/data_sources/windows_event_log_taskscheduler_200.yml +++ b/data_sources/windows_event_log_taskscheduler_200.yml @@ -17,7 +17,7 @@ separator_value: '200' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ActionName diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index 01ff84004bd..458cf6a3a77 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time output_fields: diff --git a/data_sources/windows_iis.yml b/data_sources/windows_iis.yml index a3412a3b423..7995528f40b 100644 --- a/data_sources/windows_iis.yml +++ b/data_sources/windows_iis.yml @@ -16,4 +16,4 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 diff --git a/data_sources/windows_iis_29.yml b/data_sources/windows_iis_29.yml index 8c6977fd3a4..c0d809bc9e7 100644 --- a/data_sources/windows_iis_29.yml +++ b/data_sources/windows_iis_29.yml @@ -17,7 +17,7 @@ separator_value: '29' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 11.0.1 fields: - _time - ComputerName From 193c836185bf6d4f1cbb19ac6283f74ca5a8681a Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Sat, 15 Aug 2026 15:30:12 -0700 Subject: [PATCH 060/162] Update data source TA and install.yml app versions (#4218) Co-authored-by: tjgeorgen <67936042+tjgeorgen@users.noreply.github.com> --- data_sources/palo_alto_network_threat.yml | 2 +- data_sources/palo_alto_network_traffic.yml | 2 +- install.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/data_sources/palo_alto_network_threat.yml b/data_sources/palo_alto_network_threat.yml index 9567c997b9d..b133bf04e71 100644 --- a/data_sources/palo_alto_network_threat.yml +++ b/data_sources/palo_alto_network_threat.yml @@ -16,7 +16,7 @@ sourcetype: pan:threat supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.2.2 + version: 4.0.0 fields: - _time - date_hour diff --git a/data_sources/palo_alto_network_traffic.yml b/data_sources/palo_alto_network_traffic.yml index ac49f6e6a45..07d645dc596 100644 --- a/data_sources/palo_alto_network_traffic.yml +++ b/data_sources/palo_alto_network_traffic.yml @@ -16,7 +16,7 @@ sourcetype: pan:traffic supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.2.2 + version: 4.0.0 fields: - _time - date_hour diff --git a/install.yml b/install.yml index 60db3de09f7..1abe7d5b2bf 100644 --- a/install.yml +++ b/install.yml @@ -24,7 +24,7 @@ apps: version: 1.3.2 - appid: Splunk_TA_google-cloudplatform url: https://splunkbase.splunk.com/app/3088 - version: 5.1.0 + version: 5.1.1 - appid: utbox url: https://splunkbase.splunk.com/app/2734 version: 1.9.4 From f91a89b9ad8f2fe468b1a25e219949b47f3b0631 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 17 Aug 2026 09:44:12 -0700 Subject: [PATCH 061/162] The following attack data links were partially bad, but not totally wrong. (#4209) Several of them had a path containing double backslash, like attack_data//T1003/file.log. This is resolvable by a redirect, but still wrong. A few others did not point to the prefix https://media.githubusercontent.com/media/splunk/attack_data/master/datasets and instead started with https://media.githubusercontent.com/media/splunk/attack_data/refs/head/master/datasets which, while it still resolved, was wrong Co-authored-by: Nasreddine Bencherchali --- .../linux_auditd_unix_shell_configuration_modification.yml | 2 +- detections/endpoint/macos_list_firewall_rules.yml | 2 +- detections/endpoint/msmpeng_application_dll_side_loading.yml | 2 +- .../endpoint/windows_modify_registry_configure_bitlocker.yml | 2 +- detections/endpoint/windows_modify_registry_disable_rdp.yml | 2 +- detections/endpoint/windows_unsigned_ms_dll_side_loading.yml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml index 93c8db6aa91..0a7ed99af8b 100644 --- a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml +++ b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml @@ -97,7 +97,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config//linux_path_profile_d.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config/linux_path_profile_d.log source: auditd sourcetype: auditd test_type: unit diff --git a/detections/endpoint/macos_list_firewall_rules.yml b/detections/endpoint/macos_list_firewall_rules.yml index 385579a91ce..488af3e2302 100644 --- a/detections/endpoint/macos_list_firewall_rules.yml +++ b/detections/endpoint/macos_list_firewall_rules.yml @@ -92,7 +92,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1016/atomic_red_team/macos_net_discovery/macos_list_firewall_rules.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/atomic_red_team/macos_net_discovery/macos_list_firewall_rules.log sourcetype: osquery:results source: osquery test_type: unit diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml index 0bc2c3168f0..6957aa4da6f 100644 --- a/detections/endpoint/msmpeng_application_dll_side_loading.yml +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -44,7 +44,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets//malware/revil/msmpeng_side/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/msmpeng_side/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit diff --git a/detections/endpoint/windows_modify_registry_configure_bitlocker.yml b/detections/endpoint/windows_modify_registry_configure_bitlocker.yml index 3238b2d82c7..ccff5acbcb1 100644 --- a/detections/endpoint/windows_modify_registry_configure_bitlocker.yml +++ b/detections/endpoint/windows_modify_registry_configure_bitlocker.yml @@ -43,7 +43,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/bitlocker_registry_setting//fve-reg.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/bitlocker_registry_setting/fve-reg.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit diff --git a/detections/endpoint/windows_modify_registry_disable_rdp.yml b/detections/endpoint/windows_modify_registry_disable_rdp.yml index 312c8ab1928..b56ea1e175a 100644 --- a/detections/endpoint/windows_modify_registry_disable_rdp.yml +++ b/detections/endpoint/windows_modify_registry_disable_rdp.yml @@ -44,7 +44,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disable_rdp//fdenytsconnection-reg.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disable_rdp/fdenytsconnection-reg.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit diff --git a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml index 55dca553469..71387cbe8f2 100644 --- a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml @@ -86,7 +86,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/unsigned_dll_load//wineloader_dll_sideload.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/unsigned_dll_load/wineloader_dll_sideload.log sourcetype: XmlWinEventLog source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational test_type: unit From b9357ea1b0bd971bdfa8f6011eae1d936d352d64 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 18 Aug 2026 03:48:31 -0700 Subject: [PATCH 062/162] Update data source TA and install.yml app versions (#4225) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/ntlm_operational_8004.yml | 2 +- data_sources/ntlm_operational_8005.yml | 2 +- data_sources/ntlm_operational_8006.yml | 2 +- data_sources/powershell_script_block_logging_4104.yml | 2 +- data_sources/windows_active_directory_admon.yml | 2 +- data_sources/windows_event_log_application_15457.yml | 2 +- data_sources/windows_event_log_application_17135.yml | 2 +- data_sources/windows_event_log_application_2282.yml | 2 +- data_sources/windows_event_log_application_3000.yml | 2 +- data_sources/windows_event_log_application_8128.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_400.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_854.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_855.yml | 2 +- data_sources/windows_event_log_appxpackaging_171.yml | 2 +- data_sources/windows_event_log_capi2_70.yml | 2 +- data_sources/windows_event_log_capi2_81.yml | 2 +- .../windows_event_log_certificateservicesclient_1007.yml | 2 +- data_sources/windows_event_log_defender_1121.yml | 2 +- data_sources/windows_event_log_defender_1122.yml | 2 +- data_sources/windows_event_log_defender_1125.yml | 2 +- data_sources/windows_event_log_defender_1126.yml | 2 +- data_sources/windows_event_log_defender_1129.yml | 2 +- data_sources/windows_event_log_defender_1131.yml | 2 +- data_sources/windows_event_log_defender_1132.yml | 2 +- data_sources/windows_event_log_defender_1133.yml | 2 +- data_sources/windows_event_log_defender_1134.yml | 2 +- data_sources/windows_event_log_defender_5007.yml | 2 +- data_sources/windows_event_log_printservice_316.yml | 2 +- data_sources/windows_event_log_printservice_4909.yml | 2 +- data_sources/windows_event_log_printservice_808.yml | 2 +- data_sources/windows_event_log_remoteconnectionmanager_1149.yml | 2 +- data_sources/windows_event_log_security_1100.yml | 2 +- data_sources/windows_event_log_security_1102.yml | 2 +- data_sources/windows_event_log_security_4624.yml | 2 +- data_sources/windows_event_log_security_4625.yml | 2 +- data_sources/windows_event_log_security_4627.yml | 2 +- data_sources/windows_event_log_security_4648.yml | 2 +- data_sources/windows_event_log_security_4662.yml | 2 +- data_sources/windows_event_log_security_4663.yml | 2 +- data_sources/windows_event_log_security_4672.yml | 2 +- data_sources/windows_event_log_security_4688.yml | 2 +- data_sources/windows_event_log_security_4698.yml | 2 +- data_sources/windows_event_log_security_4699.yml | 2 +- data_sources/windows_event_log_security_4700.yml | 2 +- data_sources/windows_event_log_security_4702.yml | 2 +- data_sources/windows_event_log_security_4703.yml | 2 +- data_sources/windows_event_log_security_4719.yml | 2 +- data_sources/windows_event_log_security_4720.yml | 2 +- data_sources/windows_event_log_security_4723.yml | 2 +- data_sources/windows_event_log_security_4724.yml | 2 +- data_sources/windows_event_log_security_4725.yml | 2 +- data_sources/windows_event_log_security_4726.yml | 2 +- data_sources/windows_event_log_security_4727.yml | 2 +- data_sources/windows_event_log_security_4728.yml | 2 +- data_sources/windows_event_log_security_4730.yml | 2 +- data_sources/windows_event_log_security_4731.yml | 2 +- data_sources/windows_event_log_security_4732.yml | 2 +- data_sources/windows_event_log_security_4737.yml | 2 +- data_sources/windows_event_log_security_4738.yml | 2 +- data_sources/windows_event_log_security_4739.yml | 2 +- data_sources/windows_event_log_security_4741.yml | 2 +- data_sources/windows_event_log_security_4742.yml | 2 +- data_sources/windows_event_log_security_4744.yml | 2 +- data_sources/windows_event_log_security_4749.yml | 2 +- data_sources/windows_event_log_security_4754.yml | 2 +- data_sources/windows_event_log_security_4756.yml | 2 +- data_sources/windows_event_log_security_4759.yml | 2 +- data_sources/windows_event_log_security_4768.yml | 2 +- data_sources/windows_event_log_security_4769.yml | 2 +- data_sources/windows_event_log_security_4771.yml | 2 +- data_sources/windows_event_log_security_4776.yml | 2 +- data_sources/windows_event_log_security_4781.yml | 2 +- data_sources/windows_event_log_security_4783.yml | 2 +- data_sources/windows_event_log_security_4790.yml | 2 +- data_sources/windows_event_log_security_4794.yml | 2 +- data_sources/windows_event_log_security_4798.yml | 2 +- data_sources/windows_event_log_security_4876.yml | 2 +- data_sources/windows_event_log_security_4886.yml | 2 +- data_sources/windows_event_log_security_4887.yml | 2 +- data_sources/windows_event_log_security_4946.yml | 2 +- data_sources/windows_event_log_security_4947.yml | 2 +- data_sources/windows_event_log_security_4948.yml | 2 +- data_sources/windows_event_log_security_5136.yml | 2 +- data_sources/windows_event_log_security_5137.yml | 2 +- data_sources/windows_event_log_security_5140.yml | 2 +- data_sources/windows_event_log_security_5141.yml | 2 +- data_sources/windows_event_log_security_5145.yml | 2 +- data_sources/windows_event_log_system_104.yml | 2 +- data_sources/windows_event_log_system_4720.yml | 2 +- data_sources/windows_event_log_system_4726.yml | 2 +- data_sources/windows_event_log_system_4728.yml | 2 +- data_sources/windows_event_log_system_7036.yml | 2 +- data_sources/windows_event_log_system_7040.yml | 2 +- data_sources/windows_event_log_system_7045.yml | 2 +- data_sources/windows_event_log_taskscheduler_200.yml | 2 +- data_sources/windows_event_log_taskscheduler_201.yml | 2 +- data_sources/windows_iis.yml | 2 +- data_sources/windows_iis_29.yml | 2 +- 98 files changed, 98 insertions(+), 98 deletions(-) diff --git a/data_sources/ntlm_operational_8004.yml b/data_sources/ntlm_operational_8004.yml index c075b634ac5..749a2d3ae1c 100644 --- a/data_sources/ntlm_operational_8004.yml +++ b/data_sources/ntlm_operational_8004.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8005.yml b/data_sources/ntlm_operational_8005.yml index d8b431c098d..045f5a43f3a 100644 --- a/data_sources/ntlm_operational_8005.yml +++ b/data_sources/ntlm_operational_8005.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8006.yml b/data_sources/ntlm_operational_8006.yml index 735b7e553d4..d7df32bf79e 100644 --- a/data_sources/ntlm_operational_8006.yml +++ b/data_sources/ntlm_operational_8006.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 3c98545a95e..6089a236b58 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -18,7 +18,7 @@ separator_value: '4104' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index e5f967841b2..b43f02de4b6 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -16,7 +16,7 @@ sourcetype: ActiveDirectory supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Guid diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index c27efb791d5..953e724a1ec 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_17135.yml b/data_sources/windows_event_log_application_17135.yml index 4371cdb243e..dfbc3ae1ed9 100644 --- a/data_sources/windows_event_log_application_17135.yml +++ b/data_sources/windows_event_log_application_17135.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index 61ea5346439..df3d27c6c72 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index 7caa8736d80..7f333a78f98 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -17,7 +17,7 @@ separator_value: '3000' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index 08734940dec..e3841b7d777 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index 39792c136bb..6c924b1ebbb 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index 9f50ea89e6c..f72140ae8d7 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index 6b38cc2db56..870de7ee17b 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index 4ff056df308..cf70c22f8c0 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_capi2_70.yml b/data_sources/windows_event_log_capi2_70.yml index aef7469c112..592e0b6ef3e 100644 --- a/data_sources/windows_event_log_capi2_70.yml +++ b/data_sources/windows_event_log_capi2_70.yml @@ -18,7 +18,7 @@ separator_value: '70' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_capi2_81.yml b/data_sources/windows_event_log_capi2_81.yml index aa03a03585f..66ada131486 100644 --- a/data_sources/windows_event_log_capi2_81.yml +++ b/data_sources/windows_event_log_capi2_81.yml @@ -18,7 +18,7 @@ separator_value: '81' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_certificateservicesclient_1007.yml b/data_sources/windows_event_log_certificateservicesclient_1007.yml index 5f5c5af5cb6..4c7a4f8b938 100644 --- a/data_sources/windows_event_log_certificateservicesclient_1007.yml +++ b/data_sources/windows_event_log_certificateservicesclient_1007.yml @@ -18,7 +18,7 @@ separator_value: '1007' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index 167cda8c708..e79d9912370 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -16,7 +16,7 @@ separator_value: '1121' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index 33600c1231b..ad28a09086f 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -16,7 +16,7 @@ separator_value: '1122' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index 149b6311906..db460b697ee 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time example_log: 112204000x80000000000000003701Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009E6DB77E5-3DF2-4CF1-B95A-636979351E5B2023-11-26T23:43:08.709Z(unknown user)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1.401.1247.01.1.23100.2009ENT\ConsRC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index 0b5a3d83a20..2bbe2b2b19e 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index 70617fdd7e2..ad851b6a940 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -16,7 +16,7 @@ separator_value: '1129' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index 599f4a67e00..c014f6885a9 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index 0317ab0fb40..88a8748b5b5 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 48f1409144f..70dc254190b 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index d9c827fef63..f5889d38fd5 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 690ee87c8c9..10c8ddbedef 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -14,7 +14,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_printservice_316.yml b/data_sources/windows_event_log_printservice_316.yml index f79b3dfdd2d..2aa8588d750 100644 --- a/data_sources/windows_event_log_printservice_316.yml +++ b/data_sources/windows_event_log_printservice_316.yml @@ -15,7 +15,7 @@ separator_value: '316' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_printservice_4909.yml b/data_sources/windows_event_log_printservice_4909.yml index 3da36ee8f0c..28d99290fb0 100644 --- a/data_sources/windows_event_log_printservice_4909.yml +++ b/data_sources/windows_event_log_printservice_4909.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time example_log: '' diff --git a/data_sources/windows_event_log_printservice_808.yml b/data_sources/windows_event_log_printservice_808.yml index aba8ee364cb..38622b24f5c 100644 --- a/data_sources/windows_event_log_printservice_808.yml +++ b/data_sources/windows_event_log_printservice_808.yml @@ -16,7 +16,7 @@ separator_value: '808' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml index e86b09685af..060336e042f 100644 --- a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml +++ b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml @@ -16,7 +16,7 @@ separator_value: '1149' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index f113a86355f..75f9683746d 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -15,7 +15,7 @@ separator_value: '1100' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index 7a56fa568bf..f59cb881fd4 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -16,7 +16,7 @@ separator_value: '1102' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index cb5f1d0853c..c48507cfc3a 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -16,7 +16,7 @@ separator_value: '4624' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index 9da8575acc5..dad4989547c 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -15,7 +15,7 @@ separator_value: '4625' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4627.yml b/data_sources/windows_event_log_security_4627.yml index 7f378ce075e..89fba03f2cb 100644 --- a/data_sources/windows_event_log_security_4627.yml +++ b/data_sources/windows_event_log_security_4627.yml @@ -16,7 +16,7 @@ separator_value: '4627' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index fa943bf7878..b4667be60c9 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -15,7 +15,7 @@ separator_value: '4648' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index 5584723fb0d..fa95daaa50d 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -15,7 +15,7 @@ separator_value: '4662' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index 47b3a08dfd3..104eb80b58b 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -15,7 +15,7 @@ separator_value: '4663' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index 898f064d0e9..289d62a9024 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -15,7 +15,7 @@ separator_value: '4672' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index dd02fdcfcf4..989857e2787 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -16,7 +16,7 @@ configuration: Enabling Windows event log process command line logging via group supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - Caller_Domain - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index 24bf4ad87bb..a440f483f92 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -15,7 +15,7 @@ separator_value: '4698' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index 971447d98b7..54054afabba 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -15,7 +15,7 @@ separator_value: '4699' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index 27ce4cad6d2..3d13a756ee0 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - EventID example_log: 4700 0 0 12804 0 0x8020000000000000 344861 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin LeastPrivilege CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index a5ac7fbcd52..4c180ca38a4 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - EventID example_log: 4702 0 0 12804 0 0x8020000000000000 344863 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin HighestAvailable CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index 8d66db7b5a9..ed09ed27bd6 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -15,7 +15,7 @@ separator_value: '4703' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index 71a66f16667..4a8dfb8ca50 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -15,7 +15,7 @@ separator_value: '4719' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 485dc71519b..5e2bbda6ab1 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -14,7 +14,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index dd4a4102e23..fd486f8f612 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -14,7 +14,7 @@ separator_value: '4723' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index d32bd3cb4c3..a9cd94593d2 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -14,7 +14,7 @@ separator_value: '4724' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index 7d45acc942d..9524a3f72f0 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -14,7 +14,7 @@ separator_value: '4725' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index 68503802fc1..8136745ad82 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -14,7 +14,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 7ca3ba9a14e..24032e276be 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index 4e4f8d42473..ab74f07c8d2 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index 5e2a3ba701d..d73d16002d6 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index 8d78f08e213..fefeeec1255 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index 16f6cdfa8b6..3fdffb89a81 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -14,7 +14,7 @@ separator_value: '4732' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index 7525a3f1ce2..881d7ccf056 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index 70ee3355a50..9c4df3de2d0 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -14,7 +14,7 @@ separator_value: '4738' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4739.yml b/data_sources/windows_event_log_security_4739.yml index 99a689249af..7784f95bb37 100644 --- a/data_sources/windows_event_log_security_4739.yml +++ b/data_sources/windows_event_log_security_4739.yml @@ -15,7 +15,7 @@ separator_value: '4739' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index 625bd64d26f..1c4c800fe0c 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -17,7 +17,7 @@ separator_value: '4741' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index 7e0125e963b..027458aca61 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index 7dff88ff14f..f02e15fa1a7 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index 0a86c60d109..dac0a891f9c 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index d38bdbdaa93..27c818f2890 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index 638cd75b6f9..f73f48479e1 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index 45f712c76cd..8978d1ea3fb 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 4ceba33a506..44102ebf15e 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -17,7 +17,7 @@ separator_value: '4768' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index 8d9f1de5776..f29190cc072 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -17,7 +17,7 @@ separator_value: '4769' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index e31dcec12a4..bff553454a2 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -17,7 +17,7 @@ separator_value: '4771' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index 513d1d6b3df..b01e5a06bbb 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -17,7 +17,7 @@ separator_value: '4776' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index 7c10ebc5471..f8856f02cda 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -17,7 +17,7 @@ separator_value: '4781' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index 95936495e46..c21f93675c7 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index 5cb3443f3de..da4093a413f 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index e335d8bd7fa..75ffcb4b339 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -17,7 +17,7 @@ separator_value: supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index cf3a023f068..50d72b8dc7f 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index 4fd370c8f1d..8c021ffff6d 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -17,7 +17,7 @@ separator_value: '4876' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index afe8d53f69c..fc950fe6494 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -17,7 +17,7 @@ separator_value: '4886' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index 5216d86c0d4..88e0dff8539 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -17,7 +17,7 @@ separator_value: '4887' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index 32ceb5f9740..361668dc89e 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -12,7 +12,7 @@ separator_value: '4946' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index fa8949c735d..892346a5984 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -12,7 +12,7 @@ separator_value: '4947' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index f5eca48d81a..3ed3918118c 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -12,7 +12,7 @@ separator_value: '4948' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index c22ef0fcdb2..fe9b0aa1ac9 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -17,7 +17,7 @@ separator_value: '5136' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index 91bbceceec2..4ff1c91b19e 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -17,7 +17,7 @@ separator_value: '5137' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - AppCorrelationID diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index 1824749f9b2..31c604a5035 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -17,7 +17,7 @@ separator_value: '5140' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index 333bbbbd67e..03d0bbe1f66 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -17,7 +17,7 @@ separator_value: '5141' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index 0a15bd0258f..bd20531413e 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -17,7 +17,7 @@ separator_value: '5145' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index 28f5ab09be5..b7298c67134 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_system_4720.yml b/data_sources/windows_event_log_system_4720.yml index 1a6be457d10..5b95d4b808e 100644 --- a/data_sources/windows_event_log_system_4720.yml +++ b/data_sources/windows_event_log_system_4720.yml @@ -17,7 +17,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4726.yml b/data_sources/windows_event_log_system_4726.yml index 00e26d4addb..b5590d7546c 100644 --- a/data_sources/windows_event_log_system_4726.yml +++ b/data_sources/windows_event_log_system_4726.yml @@ -17,7 +17,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4728.yml b/data_sources/windows_event_log_system_4728.yml index 746332e5b87..2ca373f47e1 100644 --- a/data_sources/windows_event_log_system_4728.yml +++ b/data_sources/windows_event_log_system_4728.yml @@ -17,7 +17,7 @@ separator_value: '4728' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index 65f12a428ac..6cd9b92a19f 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -17,7 +17,7 @@ separator_value: '7036' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index b907e1451a2..d43588fae6a 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -17,7 +17,7 @@ separator_value: '7040' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index 9648dd5f24d..1aa7fef4267 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -17,7 +17,7 @@ separator_value: '7045' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - AccountName diff --git a/data_sources/windows_event_log_taskscheduler_200.yml b/data_sources/windows_event_log_taskscheduler_200.yml index 98678fd0fe6..31739b254e3 100644 --- a/data_sources/windows_event_log_taskscheduler_200.yml +++ b/data_sources/windows_event_log_taskscheduler_200.yml @@ -17,7 +17,7 @@ separator_value: '200' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ActionName diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index 458cf6a3a77..6809dbf363c 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time output_fields: diff --git a/data_sources/windows_iis.yml b/data_sources/windows_iis.yml index 7995528f40b..521b00579bc 100644 --- a/data_sources/windows_iis.yml +++ b/data_sources/windows_iis.yml @@ -16,4 +16,4 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 diff --git a/data_sources/windows_iis_29.yml b/data_sources/windows_iis_29.yml index c0d809bc9e7..27abf33af68 100644 --- a/data_sources/windows_iis_29.yml +++ b/data_sources/windows_iis_29.yml @@ -17,7 +17,7 @@ separator_value: '29' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.1 + version: 11.0.2 fields: - _time - ComputerName From b4886ff0ca06af3f2c4f00ef73780f3b8fc82b85 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Tue, 18 Aug 2026 19:31:00 +0200 Subject: [PATCH 063/162] add field ordering workflows and scripts (#4208) --- .github/workflows/yaml-validation.yml | 14 + .pre-commit-config.yaml | 8 + .yamlfieldorder | 46 +++ ..._cross_region_possible_inference_abuse.yml | 4 +- ...edrock_claude_hostile_prompt_sentiment.yml | 8 +- ...drock_claude_possible_prompt_injection.yml | 10 +- ...drock_claude_sensitive_data_in_prompts.yml | 8 +- ...bedrock_claude_unusually_large_prompts.yml | 10 +- ...binary_launched_process_with_null_argv.yml | 6 +- .../endpoint/linux_malformed_auth_entry.yml | 4 +- ...lg_registration_outside_of_boot_window.yml | 4 +- .../linux_suspicious_namespace_creation.yml | 6 +- ...ws_admin_password_changed_by_non_admin.yml | 4 +- ...lter_log_created_by_non_system_process.yml | 4 +- .../windows_msmpeng_writing_to_system32.yml | 4 +- ...tem_process_querying_definition_update.yml | 4 +- ...ndows_powershell_commands_from_dns_txt.yml | 2 +- ...s_suspicious_burst_of_password_changes.yml | 4 +- ...ld_process_of_tieringengineservice_exe.yml | 4 +- ...nder_engine_or_signature_files_created.yml | 4 +- ..._defender_update_activity_in_inetcache.yml | 4 +- ...ssvc_process_accessing_defender_engine.yml | 4 +- docs/ci/yaml_formatting.md | 12 +- scripts/enforce_yaml_field_order.py | 382 ++++++++++++++++++ scripts/validate_yaml.py | 50 ++- 25 files changed, 556 insertions(+), 54 deletions(-) create mode 100644 .yamlfieldorder create mode 100644 scripts/enforce_yaml_field_order.py diff --git a/.github/workflows/yaml-validation.yml b/.github/workflows/yaml-validation.yml index fe4aa381c5b..fa5640e36c6 100644 --- a/.github/workflows/yaml-validation.yml +++ b/.github/workflows/yaml-validation.yml @@ -5,12 +5,26 @@ on: paths: - 'detections/**/*.yml' - 'detections/**/*.yaml' + - '.yamlfieldorder' + - '.yamlfmt' + - '.yamllint' + - '.pre-commit-config.yaml' + - 'scripts/enforce_yaml_field_order.py' + - 'scripts/validate_yaml.py' + - '.github/workflows/yaml-validation.yml' push: branches: - develop paths: - 'detections/**/*.yml' - 'detections/**/*.yaml' + - '.yamlfieldorder' + - '.yamlfmt' + - '.yamllint' + - '.pre-commit-config.yaml' + - 'scripts/enforce_yaml_field_order.py' + - 'scripts/validate_yaml.py' + - '.github/workflows/yaml-validation.yml' jobs: validate: diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 3b5877a65c5..c71a44920b9 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -22,3 +22,11 @@ repos: pass_filenames: true # Optional: Specify custom yamlfmt binary path if not in PATH # args: [--yamlfmt-path, /path/to/yamlfmt] + + - id: yaml-field-order + name: YAML field order (detections only) + description: Enforce configured root field order in detection YAML files + entry: python scripts/enforce_yaml_field_order.py --fix + language: python + files: ^detections/.*\.(yml|yaml)$ + pass_filenames: true diff --git a/.yamlfieldorder b/.yamlfieldorder new file mode 100644 index 00000000000..36f5054b522 --- /dev/null +++ b/.yamlfieldorder @@ -0,0 +1,46 @@ +# Root field order for detection YAML files. +# +# The formatter moves whole top-level YAML blocks and does not re-emit YAML. +# This preserves indentation, spaces, comments, scalar style, and nested content +# inside each field block. +target_paths: + - detections/ + +extensions: + - .yml + - .yaml + +# Unknown top-level fields are kept intact and appended after configured fields. +unknown_fields: append + +root_field_order: + - name + - id + - version + - creation_date + - modification_date + - author + - status + - type + - description + - data_source + - search + - how_to_implement + - known_false_positives + - references + - drilldown_searches + - finding + - intermediate_findings + - threat_objects + - analytic_story + - threat_group + - asset_type + - cve + - atomic_guid + - mitre_attack_id + - product + - category + - security_domain + - baselines + - tests + - deprecation_info diff --git a/detections/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml b/detections/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml index 3d7d8b682ac..ceb99790901 100644 --- a/detections/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml +++ b/detections/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml @@ -6,10 +6,9 @@ modification_date: '2026-07-06' author: Rod Soto status: production type: Anomaly +description: This detection identifies potential cross-region inference abuse in AWS Bedrock Claude models. Cross-region inference abuse may indicate attempts to bypass regional restrictions, exfiltrate data, or perform unauthorized actions across different AWS regions. data_source: - AWS Bedrock Claude -category: application -description: This detection identifies potential cross-region inference abuse in AWS Bedrock Claude models. Cross-region inference abuse may indicate attempts to bypass regional restrictions, exfiltrate data, or perform unauthorized actions across different AWS regions. search: |- `aws_bedrock_claude` | rename "identity.arn" AS user_arn @@ -60,6 +59,7 @@ product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud +category: application security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/application/aws_bedrock_claude_hostile_prompt_sentiment.yml b/detections/application/aws_bedrock_claude_hostile_prompt_sentiment.yml index fe1d52d9194..1070ebd0da5 100644 --- a/detections/application/aws_bedrock_claude_hostile_prompt_sentiment.yml +++ b/detections/application/aws_bedrock_claude_hostile_prompt_sentiment.yml @@ -3,14 +3,12 @@ id: 54734442-955a-4427-9a86-2d9712151067 version: 1 creation_date: '2026-07-06' modification_date: '2026-07-06' -security_domain: endpoint -data_source: - - AWS Bedrock Claude -category: application author: Rod Soto status: production type: Anomaly description: This detection identifies prompts with hostile or aggressive sentiment being sent to AWS Bedrock Claude models. Hostile prompts may indicate potential abuse, harassment, or other malicious intent. +data_source: + - AWS Bedrock Claude search: |- `aws_bedrock_claude` | rename "identity.arn" AS user_arn @@ -61,6 +59,8 @@ product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud +category: application +security_domain: endpoint tests: - name: True Positive Test test_type: unit diff --git a/detections/application/aws_bedrock_claude_possible_prompt_injection.yml b/detections/application/aws_bedrock_claude_possible_prompt_injection.yml index 48025043879..74e80256de1 100644 --- a/detections/application/aws_bedrock_claude_possible_prompt_injection.yml +++ b/detections/application/aws_bedrock_claude_possible_prompt_injection.yml @@ -1,16 +1,14 @@ name: AWS Bedrock Claude Possible Prompt Injection id: 9e162548-3e9a-4a74-9eb5-34ee28350f07 version: 1 +creation_date: '2026-07-06' +modification_date: '2026-07-06' author: Rod Soto status: production type: Hunting -category: application -creation_date: '2026-07-06' -modification_date: '2026-07-06' -security_domain: endpoint +description: This search surfaces AWS Bedrock Claude prompts containing phrases commonly associated with prompt injection or jailbreak attempts, such as instruction overrides, persona switching, or requests to ignore prior guidance. These strings are not inherently malicious on their own - many of them (for example "act as", "you must", or "new persona") appear routinely in legitimate system prompts, few-shot examples, and role-play or creative-writing use cases. This is a hunting search rather than an anomaly detection because the base rate of benign matches is high; use it to pivot into the surrounding conversation and look for corroborating signals such as the phrase appearing mid-conversation rather than in an expected system/few-shot prompt, the user attempting to override guardrails or safety instructions rather than set a benign persona, instructions that follow the injected phrase requesting privilege escalation, data exfiltration, or access to restricted tools/resources, repeated or iterative attempts from the same user/role after being refused, and injected phrases originating from untrusted input (e.g., retrieved documents or tool output) rather than the human user turn. data_source: - AWS Bedrock Claude -description: This search surfaces AWS Bedrock Claude prompts containing phrases commonly associated with prompt injection or jailbreak attempts, such as instruction overrides, persona switching, or requests to ignore prior guidance. These strings are not inherently malicious on their own - many of them (for example "act as", "you must", or "new persona") appear routinely in legitimate system prompts, few-shot examples, and role-play or creative-writing use cases. This is a hunting search rather than an anomaly detection because the base rate of benign matches is high; use it to pivot into the surrounding conversation and look for corroborating signals such as the phrase appearing mid-conversation rather than in an expected system/few-shot prompt, the user attempting to override guardrails or safety instructions rather than set a benign persona, instructions that follow the injected phrase requesting privilege escalation, data exfiltration, or access to restricted tools/resources, repeated or iterative attempts from the same user/role after being refused, and injected phrases originating from untrusted input (e.g., retrieved documents or tool output) rather than the human user turn. search: |- `aws_bedrock_claude` | rename "identity.arn" AS user_arn, "input.inputBodyJson.messages{}.content{}.text" AS prompt_mv @@ -52,6 +50,8 @@ product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud +category: application +security_domain: endpoint tests: - name: True Positive Test test_type: unit diff --git a/detections/application/aws_bedrock_claude_sensitive_data_in_prompts.yml b/detections/application/aws_bedrock_claude_sensitive_data_in_prompts.yml index 49dcde6df80..2e14dadae53 100644 --- a/detections/application/aws_bedrock_claude_sensitive_data_in_prompts.yml +++ b/detections/application/aws_bedrock_claude_sensitive_data_in_prompts.yml @@ -1,14 +1,14 @@ name: AWS Bedrock Claude Sensitive Data in Prompts id: 39346724-a73a-4e01-8e93-4f4791e1a0bb version: 1 -author: Rod Soto -status: production creation_date: '2026-07-06' modification_date: '2026-07-06' -data_source: - - AWS Bedrock Claude +author: Rod Soto +status: production type: Anomaly description: This detection identifies sensitive data such as social security numbers, passwords, API keys, and credit card numbers being sent in prompts to AWS Bedrock Claude models. Exposure of sensitive data through AI prompts may indicate data loss, credential leakage, or insider threat activity. +data_source: + - AWS Bedrock Claude search: |- `aws_bedrock_claude` | rename "identity.arn" AS user_arn, "input.inputBodyJson.messages{}.content{}.text" AS prompt_mv, "accountId" AS account_id diff --git a/detections/application/aws_bedrock_claude_unusually_large_prompts.yml b/detections/application/aws_bedrock_claude_unusually_large_prompts.yml index 9d1123e5308..f3e883a80ee 100644 --- a/detections/application/aws_bedrock_claude_unusually_large_prompts.yml +++ b/detections/application/aws_bedrock_claude_unusually_large_prompts.yml @@ -1,16 +1,14 @@ name: AWS Bedrock Claude Unusually Large Prompts id: 95fbdd4e-1202-4971-b85a-513b2005086e version: 2 +creation_date: '2026-07-06' +modification_date: '2026-07-08' author: Rod Soto status: production type: Anomaly -creation_date: '2026-07-06' -modification_date: '2026-07-08' -security_domain: endpoint +description: This detection identifies unusually large prompts sent to AWS Bedrock Claude models by calculating the statistical baseline of input token counts and flagging requests that exceed one standard deviations above the mean. Abnormally large prompts may indicate prompt injection attacks, data exfiltration attempts, or abuse of the AI service. data_source: - AWS Bedrock Claude -category: application -description: This detection identifies unusually large prompts sent to AWS Bedrock Claude models by calculating the statistical baseline of input token counts and flagging requests that exceed one standard deviations above the mean. Abnormally large prompts may indicate prompt injection attacks, data exfiltration attempts, or abuse of the AI service. search: |- `aws_bedrock_claude` | rename "input.inputTokenCount" AS input_tokens @@ -56,6 +54,8 @@ product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud +category: application +security_domain: endpoint tests: - name: True Positive Test test_type: unit diff --git a/detections/endpoint/linux_binary_launched_process_with_null_argv.yml b/detections/endpoint/linux_binary_launched_process_with_null_argv.yml index 6b1da8383af..9dec0940f7d 100644 --- a/detections/endpoint/linux_binary_launched_process_with_null_argv.yml +++ b/detections/endpoint/linux_binary_launched_process_with_null_argv.yml @@ -48,6 +48,9 @@ finding: analytic_story: - Linux Privilege Escalation asset_type: Endpoint +cve: + - CVE-2026-43284 + - CVE-2026-43500 mitre_attack_id: - T1068 product: @@ -56,9 +59,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-43284 - - CVE-2026-43500 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/linux_malformed_auth_entry.yml b/detections/endpoint/linux_malformed_auth_entry.yml index d03f3154732..79a8ec4f7f8 100644 --- a/detections/endpoint/linux_malformed_auth_entry.yml +++ b/detections/endpoint/linux_malformed_auth_entry.yml @@ -55,6 +55,8 @@ intermediate_findings: analytic_story: - Linux Privilege Escalation asset_type: Endpoint +cve: + - CVE-2026-31431 mitre_attack_id: - T1068 product: @@ -63,8 +65,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-31431 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/linux_pf_alg_registration_outside_of_boot_window.yml b/detections/endpoint/linux_pf_alg_registration_outside_of_boot_window.yml index 588b2269fe1..9350c9df39f 100644 --- a/detections/endpoint/linux_pf_alg_registration_outside_of_boot_window.yml +++ b/detections/endpoint/linux_pf_alg_registration_outside_of_boot_window.yml @@ -45,6 +45,8 @@ finding: analytic_story: - Linux Privilege Escalation asset_type: Endpoint +cve: + - CVE-2026-31431 mitre_attack_id: - T1068 product: @@ -53,8 +55,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-31431 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/linux_suspicious_namespace_creation.yml b/detections/endpoint/linux_suspicious_namespace_creation.yml index 4f1edb94d04..86c010c4fe8 100644 --- a/detections/endpoint/linux_suspicious_namespace_creation.yml +++ b/detections/endpoint/linux_suspicious_namespace_creation.yml @@ -91,6 +91,9 @@ finding: analytic_story: - Linux Privilege Escalation asset_type: Endpoint +cve: + - CVE-2026-43284 + - CVE-2026-43500 mitre_attack_id: - T1068 product: @@ -99,9 +102,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-43284 - - CVE-2026-43500 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml index 9efa95ae5a5..7bb99a45b9b 100644 --- a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml +++ b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml @@ -50,6 +50,8 @@ analytic_story: - Windows Privilege Escalation - BlueHammer asset_type: Endpoint +cve: + - CVE-2026-33825 mitre_attack_id: - T1068 - T1543.003 @@ -59,8 +61,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-33825 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_cloud_files_filter_log_created_by_non_system_process.yml b/detections/endpoint/windows_cloud_files_filter_log_created_by_non_system_process.yml index 22f756fe004..fef62dc23f3 100644 --- a/detections/endpoint/windows_cloud_files_filter_log_created_by_non_system_process.yml +++ b/detections/endpoint/windows_cloud_files_filter_log_created_by_non_system_process.yml @@ -53,6 +53,8 @@ analytic_story: - RedSun - Windows Privilege Escalation asset_type: Endpoint +cve: + - CVE-2026-33825 mitre_attack_id: - T1068 product: @@ -61,8 +63,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-33825 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_msmpeng_writing_to_system32.yml b/detections/endpoint/windows_msmpeng_writing_to_system32.yml index 77a92767942..5612c1f7386 100644 --- a/detections/endpoint/windows_msmpeng_writing_to_system32.yml +++ b/detections/endpoint/windows_msmpeng_writing_to_system32.yml @@ -60,6 +60,8 @@ analytic_story: - BlueHammer - RedSun asset_type: Endpoint +cve: + - CVE-2026-33825 mitre_attack_id: - T1068 - T1543.003 @@ -69,8 +71,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-33825 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_non_system_process_querying_definition_update.yml b/detections/endpoint/windows_non_system_process_querying_definition_update.yml index 3a889d8d33b..f2a81e01160 100644 --- a/detections/endpoint/windows_non_system_process_querying_definition_update.yml +++ b/detections/endpoint/windows_non_system_process_querying_definition_update.yml @@ -55,6 +55,8 @@ analytic_story: - BlueHammer - RedSun asset_type: Endpoint +cve: + - CVE-2026-33825 mitre_attack_id: - T1068 - T1071.001 @@ -64,8 +66,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-33825 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_powershell_commands_from_dns_txt.yml b/detections/endpoint/windows_powershell_commands_from_dns_txt.yml index 04d20490fe3..7db563b9a0f 100644 --- a/detections/endpoint/windows_powershell_commands_from_dns_txt.yml +++ b/detections/endpoint/windows_powershell_commands_from_dns_txt.yml @@ -70,8 +70,8 @@ product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud -security_domain: endpoint category: endpoint +security_domain: endpoint tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_suspicious_burst_of_password_changes.yml b/detections/endpoint/windows_suspicious_burst_of_password_changes.yml index b0d3a2986e5..d8d495550ef 100644 --- a/detections/endpoint/windows_suspicious_burst_of_password_changes.yml +++ b/detections/endpoint/windows_suspicious_burst_of_password_changes.yml @@ -71,6 +71,8 @@ analytic_story: - Windows Privilege Escalation - BlueHammer asset_type: Endpoint +cve: + - CVE-2026-33825 mitre_attack_id: - T1068 product: @@ -79,8 +81,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-33825 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_suspicious_child_process_of_tieringengineservice_exe.yml b/detections/endpoint/windows_suspicious_child_process_of_tieringengineservice_exe.yml index 887533c621f..7cf0819d97d 100644 --- a/detections/endpoint/windows_suspicious_child_process_of_tieringengineservice_exe.yml +++ b/detections/endpoint/windows_suspicious_child_process_of_tieringengineservice_exe.yml @@ -97,6 +97,8 @@ analytic_story: - RedSun - Windows Privilege Escalation asset_type: Endpoint +cve: + - CVE-2026-33825 mitre_attack_id: - T1068 product: @@ -105,8 +107,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-33825 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_suspicious_defender_engine_or_signature_files_created.yml b/detections/endpoint/windows_suspicious_defender_engine_or_signature_files_created.yml index a7c5c40ed2c..6f5b06b99cf 100644 --- a/detections/endpoint/windows_suspicious_defender_engine_or_signature_files_created.yml +++ b/detections/endpoint/windows_suspicious_defender_engine_or_signature_files_created.yml @@ -62,6 +62,8 @@ analytic_story: - Windows Privilege Escalation - BlueHammer asset_type: Endpoint +cve: + - CVE-2026-33825 mitre_attack_id: - T1068 product: @@ -70,8 +72,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-33825 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml b/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml index 2dbde3a76f3..27fd49a2158 100644 --- a/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml +++ b/detections/endpoint/windows_suspicious_defender_update_activity_in_inetcache.yml @@ -59,6 +59,8 @@ analytic_story: - Windows Persistence Techniques - BlueHammer asset_type: Endpoint +cve: + - CVE-2026-33825 mitre_attack_id: - T1068 - T1105 @@ -68,8 +70,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-33825 tests: - name: True Positive Test attack_data: diff --git a/detections/endpoint/windows_vssvc_process_accessing_defender_engine.yml b/detections/endpoint/windows_vssvc_process_accessing_defender_engine.yml index 6885fd4a79e..93c761b557f 100644 --- a/detections/endpoint/windows_vssvc_process_accessing_defender_engine.yml +++ b/detections/endpoint/windows_vssvc_process_accessing_defender_engine.yml @@ -57,6 +57,8 @@ analytic_story: - RedSun - Windows Privilege Escalation asset_type: Endpoint +cve: + - CVE-2026-33825 mitre_attack_id: - T1068 product: @@ -65,8 +67,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -cve: - - CVE-2026-33825 tests: - name: True Positive Test attack_data: diff --git a/docs/ci/yaml_formatting.md b/docs/ci/yaml_formatting.md index f09fca5c847..cbc79a2dd3b 100644 --- a/docs/ci/yaml_formatting.md +++ b/docs/ci/yaml_formatting.md @@ -43,7 +43,7 @@ Pre-commit hook runs automatically when you commit files in `detections/`: ```bash git add detections/endpoint/my_detection.yml git commit -m "Add detection" -# yamlfmt runs automatically +# yamlfmt and YAML field ordering run automatically ``` **Skip hook if needed:** @@ -65,6 +65,12 @@ yamlfmt detections/endpoint/my_detection.yml # Check what would change (dry run) yamlfmt -dry detections/ + +# Enforce configured root field order without changing other formatting +python scripts/enforce_yaml_field_order.py --fix detections/ + +# Check root field order only +python scripts/enforce_yaml_field_order.py --check detections/ ``` ### Validation (CI) @@ -118,7 +124,8 @@ pre-commit autoupdate - Check the script output for specific errors - Run locally: `python scripts/validate_yaml.py detections/` -- Ensure files pass both yamllint and yamlfmt --lint +- Ensure files pass yamllint, yamlfmt --lint, and configured root field ordering +- Fix field order locally: `python scripts/enforce_yaml_field_order.py --fix detections/` --- @@ -126,4 +133,5 @@ pre-commit autoupdate - `.yamlfmt` - yamlfmt formatting rules (4-space indent, LF line endings) - `.yamllint` - yamllint validation rules (syntax checks, no duplicate keys) +- `.yamlfieldorder` - Root field order for detection YAML files - `.pre-commit-config.yaml` - Pre-commit hook configuration diff --git a/scripts/enforce_yaml_field_order.py b/scripts/enforce_yaml_field_order.py new file mode 100644 index 00000000000..c23926d949e --- /dev/null +++ b/scripts/enforce_yaml_field_order.py @@ -0,0 +1,382 @@ +#!/usr/bin/env python3 +""" +Preserve-format YAML root field ordering. + +The script only moves complete top-level YAML blocks. It does not parse and +dump YAML, so indentation, spaces, scalar style, comments, and nested content +inside each field block stay exactly as they were. +""" + +import argparse +import re +import subprocess +import sys +from dataclasses import dataclass +from pathlib import Path +from typing import Dict, Iterable, List, Optional, Sequence, Tuple + + +BOM = b"\xef\xbb\xbf" +ROOT_KEY_RE = re.compile(r"^([A-Za-z_][A-Za-z0-9_]*)\s*:(?:\s.*)?(?:\r?\n)?$") + + +class ConfigError(ValueError): + """Raised when the field-order config cannot be read.""" + + +class FieldOrderError(ValueError): + """Raised when a YAML file cannot be safely reordered.""" + + +@dataclass(frozen=True) +class FieldOrderConfig: + target_paths: Tuple[str, ...] + extensions: Tuple[str, ...] + root_field_order: Tuple[str, ...] + unknown_fields: str = "append" + + +@dataclass(frozen=True) +class RootBlock: + key: str + lines: Tuple[str, ...] + line_number: int + + +@dataclass(frozen=True) +class OrderedText: + text: str + current_keys: Tuple[str, ...] + desired_keys: Tuple[str, ...] + + +@dataclass(frozen=True) +class FileOrderResult: + path: Path + changed: bool + detail: Optional[str] = None + error: Optional[str] = None + + +def find_repo_root() -> Path: + try: + result = subprocess.run( + ["git", "rev-parse", "--show-toplevel"], + capture_output=True, + text=True, + check=True, + ) + return Path(result.stdout.strip()) + except (subprocess.CalledProcessError, FileNotFoundError): + return Path.cwd() + + +def parse_scalar(value: str) -> str: + value = value.strip() + if len(value) >= 2 and value[0] == value[-1] and value[0] in {"'", '"'}: + return value[1:-1] + return value + + +def parse_simple_yaml_config(config_path: Path) -> Dict[str, object]: + data: Dict[str, object] = {} + current_key: Optional[str] = None + + for lineno, raw_line in enumerate(config_path.read_text(encoding="utf-8").splitlines(), start=1): + line = raw_line.strip() + if not line or line.startswith("#"): + continue + + if line.startswith("- "): + if current_key is None or not isinstance(data.get(current_key), list): + raise ConfigError(f"{config_path}:{lineno}: list item without a list key") + item = parse_scalar(line[2:]) + if not item: + raise ConfigError(f"{config_path}:{lineno}: empty list item") + data[current_key].append(item) # type: ignore[index] + continue + + if ":" not in line: + raise ConfigError(f"{config_path}:{lineno}: expected 'key:' or 'key: value'") + + key, value = line.split(":", 1) + key = key.strip() + value = value.strip() + if not key: + raise ConfigError(f"{config_path}:{lineno}: empty key") + + if value: + data[key] = parse_scalar(value) + current_key = None + else: + data[key] = [] + current_key = key + + return data + + +def as_string_list(data: Dict[str, object], key: str, default: Sequence[str]) -> Tuple[str, ...]: + value = data.get(key, list(default)) + if isinstance(value, str): + return (value,) + if not isinstance(value, list) or not all(isinstance(item, str) for item in value): + raise ConfigError(f"Config key '{key}' must be a string or list of strings") + return tuple(value) + + +def load_config(config_path: Path) -> FieldOrderConfig: + if not config_path.exists(): + raise ConfigError(f"Field-order config not found: {config_path}") + + data = parse_simple_yaml_config(config_path) + root_field_order = data.get("root_field_order", data.get("field_order")) + if not isinstance(root_field_order, list) or not all(isinstance(item, str) for item in root_field_order): + raise ConfigError("Config key 'root_field_order' must be a list of field names") + + duplicate_fields = sorted({field for field in root_field_order if root_field_order.count(field) > 1}) + if duplicate_fields: + raise ConfigError(f"Duplicate field(s) in root_field_order: {', '.join(duplicate_fields)}") + + target_paths = as_string_list(data, "target_paths", ["detections/"]) + extensions = as_string_list(data, "extensions", [".yml", ".yaml"]) + normalized_extensions = tuple(ext if ext.startswith(".") else f".{ext}" for ext in extensions) + + unknown_fields = data.get("unknown_fields", "append") + if not isinstance(unknown_fields, str): + raise ConfigError("Config key 'unknown_fields' must be a string") + if unknown_fields not in {"append", "fail"}: + raise ConfigError("Config key 'unknown_fields' must be either 'append' or 'fail'") + + return FieldOrderConfig( + target_paths=tuple(normalize_target_path(path) for path in target_paths), + extensions=normalized_extensions, + root_field_order=tuple(root_field_order), + unknown_fields=unknown_fields, + ) + + +def normalize_target_path(path: str) -> str: + normalized = path.replace("\\", "/").strip("/") + return normalized + + +def relative_to_repo(path: Path, repo_root: Path) -> Path: + absolute_path = path if path.is_absolute() else repo_root / path + try: + return absolute_path.resolve().relative_to(repo_root.resolve()) + except ValueError: + return path + + +def path_matches_config(path: Path, repo_root: Path, config: FieldOrderConfig) -> bool: + if path.suffix not in config.extensions: + return False + + rel_path = relative_to_repo(path, repo_root) + rel_posix = rel_path.as_posix().strip("/") + return any(rel_posix == target or rel_posix.startswith(f"{target}/") for target in config.target_paths) + + +def find_yaml_files(paths: Sequence[str], repo_root: Path, config: FieldOrderConfig) -> List[Path]: + found: List[Path] = [] + + for path_str in paths: + path = Path(path_str) + path = path if path.is_absolute() else repo_root / path + + if path.is_file(): + if path_matches_config(path, repo_root, config): + found.append(path) + continue + + if path.is_dir(): + for extension in config.extensions: + for yaml_file in path.rglob(f"*{extension}"): + if path_matches_config(yaml_file, repo_root, config): + found.append(yaml_file) + + return sorted(set(found), key=lambda item: relative_to_repo(item, repo_root).as_posix()) + + +def split_root_blocks(text: str) -> Tuple[Tuple[str, ...], Tuple[RootBlock, ...]]: + lines = tuple(text.splitlines(keepends=True)) + starts: List[Tuple[int, str]] = [] + + for index, line in enumerate(lines): + match = ROOT_KEY_RE.match(line) + if match: + starts.append((index, match.group(1))) + + if not starts: + return lines, tuple() + + preamble = lines[: starts[0][0]] + blocks: List[RootBlock] = [] + seen: Dict[str, int] = {} + duplicates: List[str] = [] + + for index, (start, key) in enumerate(starts): + end = starts[index + 1][0] if index + 1 < len(starts) else len(lines) + if key in seen: + duplicates.append(f"{key} at lines {seen[key]} and {start + 1}") + else: + seen[key] = start + 1 + blocks.append(RootBlock(key=key, lines=lines[start:end], line_number=start + 1)) + + if duplicates: + raise FieldOrderError(f"Duplicate root field(s): {', '.join(duplicates)}") + + return preamble, tuple(blocks) + + +def render_ordered_text(text: str, config: FieldOrderConfig) -> OrderedText: + preamble, blocks = split_root_blocks(text) + if not blocks: + return OrderedText(text=text, current_keys=tuple(), desired_keys=tuple()) + + block_by_key = {block.key: block for block in blocks} + ordered_blocks: List[RootBlock] = [] + used_keys = set() + + for key in config.root_field_order: + block = block_by_key.get(key) + if block is not None: + ordered_blocks.append(block) + used_keys.add(key) + + unknown_blocks = [block for block in blocks if block.key not in used_keys] + if unknown_blocks and config.unknown_fields == "fail": + unknown_keys = ", ".join(block.key for block in unknown_blocks) + raise FieldOrderError(f"Unknown root field(s) not configured: {unknown_keys}") + + ordered_blocks.extend(unknown_blocks) + + rendered_lines: List[str] = list(preamble) + for block in ordered_blocks: + rendered_lines.extend(block.lines) + + return OrderedText( + text="".join(rendered_lines), + current_keys=tuple(block.key for block in blocks), + desired_keys=tuple(block.key for block in ordered_blocks), + ) + + +def describe_difference(current_keys: Sequence[str], desired_keys: Sequence[str]) -> str: + for index, (current, desired) in enumerate(zip(current_keys, desired_keys), start=1): + if current != desired: + return f"position {index}: found '{current}', expected '{desired}'" + if len(current_keys) != len(desired_keys): + return "root field set changed during ordering" + return "root fields are not in configured order" + + +def read_utf8_bytes(path: Path) -> Tuple[str, bool]: + raw = path.read_bytes() + has_bom = raw.startswith(BOM) + if has_bom: + raw = raw[len(BOM) :] + try: + return raw.decode("utf-8"), has_bom + except UnicodeDecodeError as exc: + raise FieldOrderError(f"File is not valid UTF-8: {exc}") from exc + + +def write_utf8_bytes(path: Path, text: str, has_bom: bool) -> None: + raw = text.encode("utf-8") + if has_bom: + raw = BOM + raw + path.write_bytes(raw) + + +def process_file(path: Path, config: FieldOrderConfig, fix: bool = False) -> FileOrderResult: + try: + original_text, has_bom = read_utf8_bytes(path) + ordered = render_ordered_text(original_text, config) + except (OSError, FieldOrderError) as exc: + return FileOrderResult(path=path, changed=False, error=str(exc)) + + changed = ordered.text != original_text + if changed and fix: + try: + write_utf8_bytes(path, ordered.text, has_bom) + except OSError as exc: + return FileOrderResult(path=path, changed=False, error=str(exc)) + + detail = describe_difference(ordered.current_keys, ordered.desired_keys) if changed else None + return FileOrderResult(path=path, changed=changed, detail=detail) + + +def display_path(path: Path, repo_root: Path) -> str: + try: + return relative_to_repo(path, repo_root).as_posix() + except OSError: + return str(path) + + +def print_results(results: Sequence[FileOrderResult], repo_root: Path, fix: bool) -> int: + errors = [result for result in results if result.error] + changed = [result for result in results if result.changed] + + if errors: + print("[FAIL] Field-order check could not process some file(s):") + for result in errors: + print(f" - {display_path(result.path, repo_root)}: {result.error}") + + if changed and fix: + print(f"[OK] Reordered root fields in {len(changed)} file(s):") + for result in changed: + print(f" - {display_path(result.path, repo_root)}") + elif changed: + print(f"[FAIL] Root fields are not in configured order in {len(changed)} file(s):") + for result in changed: + detail = f": {result.detail}" if result.detail else "" + print(f" - {display_path(result.path, repo_root)}{detail}") + print("\n[TIP] Run: python scripts/enforce_yaml_field_order.py --fix detections/") + + if not errors and not changed: + print(f"[PASS] Root field order is valid for {len(results)} file(s)") + + return 1 if errors or (changed and not fix) else 0 + + +def main(argv: Optional[Sequence[str]] = None) -> int: + parser = argparse.ArgumentParser( + description="Check or fix top-level YAML field order without changing field formatting.", + formatter_class=argparse.RawDescriptionHelpFormatter, + epilog="""Examples: + python scripts/enforce_yaml_field_order.py --check detections/ + python scripts/enforce_yaml_field_order.py --fix detections/endpoint/file.yml + python scripts/enforce_yaml_field_order.py --config .yamlfieldorder --check detections/ +""", + ) + mode = parser.add_mutually_exclusive_group() + mode.add_argument("--check", action="store_true", help="Verify field order without changing files (default)") + mode.add_argument("--fix", action="store_true", help="Rewrite files with configured root field order") + parser.add_argument("--config", default=".yamlfieldorder", help="Path to field-order config") + parser.add_argument("paths", nargs="*", help="YAML files or directories to process") + + args = parser.parse_args(argv) + repo_root = find_repo_root() + config_path = Path(args.config) + if not config_path.is_absolute(): + config_path = repo_root / config_path + + try: + config = load_config(config_path) + except ConfigError as exc: + print(f"[ERROR] {exc}") + return 1 + + input_paths = args.paths if args.paths else list(config.target_paths) + yaml_files = find_yaml_files(input_paths, repo_root, config) + if not yaml_files: + print("[PASS] No configured YAML files found") + return 0 + + results = [process_file(path, config, fix=args.fix) for path in yaml_files] + return print_results(results, repo_root, fix=args.fix) + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/scripts/validate_yaml.py b/scripts/validate_yaml.py index f946d1fdc5d..4913a97480e 100644 --- a/scripts/validate_yaml.py +++ b/scripts/validate_yaml.py @@ -1,7 +1,7 @@ #!/usr/bin/env python3 """ CI Validation Script for YAML Files -Runs yamllint and yamlfmt --lint with beautified error output +Runs yamllint, yamlfmt --lint, and root field-order checks with beautified error output Usage: python scripts/validate_yaml.py [path_to_yaml_files...] """ import argparse @@ -10,6 +10,9 @@ from pathlib import Path from typing import List, Tuple, Optional +from enforce_yaml_field_order import load_config as load_field_order_config +from enforce_yaml_field_order import process_file as process_field_order_file + def find_yamlfmt(custom_path: Optional[str] = None) -> Optional[str]: """Find yamlfmt executable in common locations or use custom path @@ -228,10 +231,37 @@ def run_yamlfmt_lint(files: List[Path], config: Path, yamlfmt_path: Optional[str return all_passed, all_unformatted_files +def run_field_order_lint(files: List[Path], config: Path) -> Tuple[bool, dict]: + """Run root field-order check on files and return success status and errors by file + + Returns: + Tuple of (success, file_errors_dict) + """ + if not files: + return True, {} + + try: + field_order_config = load_field_order_config(config) + except Exception as exc: + return False, {str(config): [str(exc)]} + + file_errors = {} + + for yaml_file in files: + result = process_field_order_file(yaml_file, field_order_config, fix=False) + if result.error: + file_errors[str(yaml_file)] = [f"Field-order check failed: {result.error}"] + elif result.changed: + detail = f" ({result.detail})" if result.detail else "" + file_errors[str(yaml_file)] = [f"Root field order differs from .yamlfieldorder{detail}"] + + return not file_errors, file_errors + + def main(): """Main entry point""" parser = argparse.ArgumentParser( - description='Validate YAML files with yamllint and yamlfmt', + description='Validate YAML files with yamllint, yamlfmt, and root field ordering', formatter_class=argparse.RawDescriptionHelpFormatter, epilog=r""" Examples: @@ -281,6 +311,7 @@ def main(): # Find config files yamllint_config = repo_root / '.yamllint' yamlfmt_config = repo_root / '.yamlfmt' + field_order_config = repo_root / '.yamlfieldorder' if not yamllint_config.exists(): print_error(f".yamllint config not found at {yamllint_config}") @@ -289,6 +320,10 @@ def main(): if not yamlfmt_config.exists(): print_error(f".yamlfmt config not found at {yamlfmt_config}") return 1 + + if not field_order_config.exists(): + print_error(f".yamlfieldorder config not found at {field_order_config}") + return 1 # Find YAML files yaml_files = find_yaml_files(args.paths) @@ -301,9 +336,10 @@ def main(): print_header("Validating YAML Files") - # Run both validations + # Run validations yamllint_passed, yamllint_errors = run_yamllint(yaml_files, yamllint_config) yamlfmt_passed, yamlfmt_files = run_yamlfmt_lint(yaml_files, yamlfmt_config, args.yamlfmt_path) + field_order_passed, field_order_errors = run_field_order_lint(yaml_files, field_order_config) # Combine results by file all_issues = {} # file_path -> list of errors @@ -319,6 +355,12 @@ def main(): if file_path not in all_issues: all_issues[file_path] = [] all_issues[file_path].append("Formatting differences detected") + + # Add field-order issues + for file_path, errors in field_order_errors.items(): + if file_path not in all_issues: + all_issues[file_path] = [] + all_issues[file_path].extend(errors) # Display combined results if not all_issues: @@ -338,8 +380,10 @@ def main(): # Show fix instructions print(f"{Colors.CYAN}[TIP] To fix these issues, run:{Colors.RESET}") print(f" {Colors.BOLD}yamlfmt -conf .yamlfmt detections/{Colors.RESET}") + print(f" {Colors.BOLD}python scripts/enforce_yaml_field_order.py --fix detections/{Colors.RESET}") print(f"\n{Colors.CYAN} Or for specific files:{Colors.RESET}") print(f" {Colors.BOLD}yamlfmt -conf .yamlfmt {Colors.RESET}\n") + print(f" {Colors.BOLD}python scripts/enforce_yaml_field_order.py --fix {Colors.RESET}\n") return 1 From 0d6f6bfb28bbd8f1a8ac059864178f15d66b72e2 Mon Sep 17 00:00:00 2001 From: Samuel Owusu Date: Wed, 19 Aug 2026 07:05:24 -0500 Subject: [PATCH 064/162] docs: fix README grammar and wording (#4227) Corrected typos and improved clarity in the README. --- README.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index e01cf2677f0..340b89cf323 100644 --- a/README.md +++ b/README.md @@ -31,7 +31,7 @@ This project gives you access to our repository of Analytic Stories, security gu - [Splunk Attack Range](https://github.com/splunk/attack_range): The Splunk Attack Range is an open-source project maintained by the Splunk Threat Research Team. It builds instrumented cloud (AWS, Azure) and local environments (Virtualbox), simulates attacks, and forwards the data into a Splunk instance. This environment can then be used to develop and test the effectiveness of detections. - [contentctl-ng](https://pypi.org/project/contentctl-ng/): The tool that enables us to build, test, and package our content for distribution. -- [Attack data](https://github.com/splunk/attack_data): The is a collection of attack data that is used to test our content. +- [Attack data](https://github.com/splunk/attack_data): This is a collection of attack data that is used to test our content. - [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team): Atomic Red Team™ is a library of tests mapped to the MITRE ATT&CK® framework. Security teams can use Atomic Red Team to quickly, portably, and reproducibly test their environments. # Get Content🛡 @@ -55,12 +55,12 @@ Follow these steps to get started with Splunk Security Content. 1. Clone this repository using `git clone https://github.com/splunk/security_content.git` 2. Navigate to the repository directory using `cd security_content` -3. Install contentctl-ng using `pip install contentctl-ng` to install the latest version of contentctl-ng, this is a pre-requisite to validate, build and test the content like the Splunk Threat Research team -4. Install pre-commit using `pip install pre-commit` then proceed to installing the hooks via `pre-commit install`. this is a pre-requisite to validate and apply the proper formatting. +3. Install contentctl-ng using `pip install contentctl-ng` to install the latest version of contentctl-ng, this is a prerequisite to validate, build, and test the content like the Splunk Threat Research team +4. Install pre-commit using `pip install pre-commit` then proceed to installing the hooks via `pre-commit install`. This is a prerequisite to validate and apply the proper formatting. # Quick Start 🚀 -1. Setup the environment +1. Set up the environment ``` git clone https://github.com/splunk/security_content.git cd security_content @@ -95,9 +95,9 @@ https://github.com/user-attachments/assets/1be02afa-36b5-4d49-91cb-8ebbcf4123d0 - 🚨 NOTE: If you are just getting started with managing your Splunk detection as code, we recommend that you keep the YML structure of the detections as close as possible to the original structure of the detections. This will make it easier to manage your detections and will also make it easier to contribute back to the community by creating a pull request to the Splunk Security Content project. -- In order to build an content app that specific for your organization, we strongly recommend that you start with keeping only the detections that are related to your organization and remove other YML files that are not related to your organization. This includes selecting detections, stories, macros, lookups that are used by the detection YML files. +- In order to build a content app that specific for your organization, we strongly recommend that you start with keeping only the detections that are related to your organization and remove other YML files that are not related to your organization. This includes selecting detections, stories, macros, lookups that are used by the detection YML files. -- If your detections are using macros and lookups, please make sure that you have the same macros and lookups in those directories.. This will ensure that the content app is self-contained and does not rely on external files. +- If your detections are using macros and lookups, please make sure that you have the same macros and lookups in those directories. This will ensure that the content app is self-contained and does not rely on external files. - We recommend that you follow the errors produced by the `contentctl-ng` tool while developing this content. The errors are descriptive enough to guide you in getting the right values. If you need help, please refer to the [JSON Schemas](#json-schemas) to check out the list of allowed values From 4fede6c7c02091185e4187865117b4ef41734d73 Mon Sep 17 00:00:00 2001 From: Br3akp0int <26181693+tccontre@users.noreply.github.com> Date: Wed, 19 Aug 2026 21:29:40 +0200 Subject: [PATCH 065/162] Add Content and Tagging for Vidar Stealer (#4217) --------- Co-authored-by: Teoderick Contreras Co-authored-by: Bhavin Patel Co-authored-by: Nasreddine Bencherchali --- ..._or_script_creation_in_suspicious_path.yml | 5 +- ...tables_or_script_creation_in_temp_path.yml | 5 +- ...e_process_accessing_chrome_default_dir.yml | 5 +- ...fox_process_access_firefox_profile_dir.yml | 5 +- ...ss_token_manipulation_sedebugprivilege.yml | 5 +- ...e_file_read_access_by_uncommon_process.yml | 109 ++++++++++++++++++ ...assword_stores_chrome_extension_access.yml | 5 +- ...ssword_stores_chrome_localstate_access.yml | 5 +- ...ssword_stores_chrome_login_data_access.yml | 5 +- ...indows_disable_or_stop_browser_process.yml | 5 +- .../windows_indicator_removal_via_rmdir.yml | 5 +- ...indows_process_injection_remote_thread.yml | 5 +- ..._query_registry_uninstall_program_list.yml | 5 +- .../windows_screen_capture_in_temp_folder.yml | 5 +- .../windows_suspicious_process_file_path.yml | 5 +- stories/vidar_stealer.yml | 34 ++++++ 16 files changed, 185 insertions(+), 28 deletions(-) create mode 100644 detections/endpoint/windows_cloud_sensitive_file_read_access_by_uncommon_process.yml create mode 100644 stories/vidar_stealer.yml diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index e3e6d3cee17..88b6fb4b745 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,8 +1,8 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 -version: 30 +version: 31 creation_date: '2021-05-07' -modification_date: '2026-07-20' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -140,6 +140,7 @@ analytic_story: - VIP Keylogger - Phantom Stealer - Starland RAT Campaign + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml index 6f4f9aa1ce0..69962abd69f 100644 --- a/detections/endpoint/executables_or_script_creation_in_temp_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml @@ -1,8 +1,8 @@ name: Executables Or Script Creation In Temp Path id: e0422b71-2c05-4f32-8754-01fb415f49c9 -version: 26 +version: 27 creation_date: '2021-05-07' -modification_date: '2026-06-25' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -133,6 +133,7 @@ analytic_story: - RoguePlanet - Salat Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 9eed7ce0f7c..7c4d31481cc 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -1,8 +1,8 @@ name: Non Chrome Process Accessing Chrome Default Dir id: 81263de4-160a-11ec-944f-acde48001122 -version: 20 +version: 21 creation_date: '2021-09-15' -modification_date: '2026-06-25' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -51,6 +51,7 @@ analytic_story: - VIP Keylogger - Salat Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1555.003 diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index bdd370d7efa..87b1884b1ca 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -1,8 +1,8 @@ name: Non Firefox Process Access Firefox Profile Dir id: e6fc13b0-1609-11ec-b533-acde48001122 -version: 20 +version: 21 creation_date: '2021-09-15' -modification_date: '2026-06-25' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -53,6 +53,7 @@ analytic_story: - VIP Keylogger - Salat Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1555.003 diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index d3b92a9ed66..cee3e655c7a 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -1,8 +1,8 @@ name: Windows Access Token Manipulation SeDebugPrivilege id: 6ece9ed0-5f92-4315-889d-48560472b188 -version: 23 +version: 24 creation_date: '2022-09-05' -modification_date: '2026-06-08' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -53,6 +53,7 @@ analytic_story: - Tuoni - Gh0st RAT - Salat Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1134.002 diff --git a/detections/endpoint/windows_cloud_sensitive_file_read_access_by_uncommon_process.yml b/detections/endpoint/windows_cloud_sensitive_file_read_access_by_uncommon_process.yml new file mode 100644 index 00000000000..bf909972d7a --- /dev/null +++ b/detections/endpoint/windows_cloud_sensitive_file_read_access_by_uncommon_process.yml @@ -0,0 +1,109 @@ +name: Windows Cloud Sensitive File Read Access By Uncommon Process +id: 313e4f5c-add3-4b4d-8348-6a009ce5fe40 +version: 1 +creation_date: '2026-08-19' +modification_date: '2026-08-19' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: |- + This analytic detects uncommon processes reading or requesting read access to sensitive files from cloud providers on Windows endpoints. + It monitors Windows Security Event 4663 for ReadData (AccessMask 0x1) operations against sensitive files from cloud providers such as Azure. + Access by any process outside the known toolchain may indicate credential theft or cloud identity reconnaissance activity, including infostealer behavior such as one observed in Vidar Stealer variants. + This detection currently only supports Azure sensitive files, but will be extended to support other cloud providers in the future. +data_source: + - Windows Event Log Security 4663 +search: |- + `wineventlog_security` + EventCode=4663 + ObjectType="File" + NOT process_path IN ( + "*:\\AppData\\Local\\Programs\\Python\\*\\python.exe", + "*:\\AppData\\Local\\Python\\bin\\python.exe", + "*:\\AppData\\Local\\Python\\pythoncore-*\\python.exe", + "*:\\Program Files\\Azure Dev CLI\\azd.exe", + "*:\\Program Files\\Microsoft SDKs\\Azure\\CLI2\\python.exe", + "*:\\Program Files\\Microsoft VS Code\\Code.exe", + "*:\\Program Files\\nodejs\\node.exe", + "*:\\Program Files\\PowerShell\\7-preview\\pwsh.exe", + "*:\\Program Files\\PowerShell\\7\\pwsh.exe", + "*:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", + "*:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", + "*\\.azd\\bin\\azd.exe", + "*\\AppData\\Local\\Microsoft\\powershell\\pwsh.exe", + "*\\AppData\\Local\\Programs\\Azure Dev CLI\\azd.exe", + "*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe" + ) + ObjectName IN ( + "*\\.azure\\accessTokens.json", + "*\\.azure\\azureProfile.json", + "*\\.azure\\msal_token_cache.json", + "*\\.azure\\TokenCache.dat", + "*\\Windows Azure Powershell\\TokenCache.dat" + ) + + ``` + We select only read-related operations: + 0x1 = ReadData (or ListDirectory) + ``` + + | eval AccessMask_ = tonumber(AccessMask, 16) + | where (bit_and(AccessMask_, 1) != 0) + + | stats count min(_time) as firstTime + max(_time) as lastTime + by signature_id signature + ObjectType file_path file_name + process_path process_name process_id + AccessMask src_user dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_cloud_sensitive_file_read_access_by_uncommon_process_filter` +how_to_implement: |- + To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. + To enable Event ID 4663, enable object access auditing through Group Policy: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object Access > Audit File System, then enable Success auditing. Enable Failure auditing if your environment also requires denied access attempts. + Event ID 4663 is only generated for files with a matching System Access Control List (SACL), so configure auditing on the relevant sensitive files from cloud providers. +known_false_positives: |- + False positives are expected from legitimate tooling. + The detection excludes the Azure CLI bundled Python interpreter, Windows PowerShell, PowerShell 7+, VS Code, and the Azure Developer CLI by process path. + Residual false positives may arise from CI/CD agents (e.g., Azure DevOps self-hosted runners, GitHub Actions runners) that invoke az or Azure PowerShell from non-standard install paths not covered by the exclusion list, backup or DLP agents that scan user profile directories, and custom automation scripts that shell out to Azure CLI from an unexpected working directory. + Tune by adding confirmed-legitimate process paths and file paths to the companion filter macro windows_cloud_sensitive_file_read_access_by_uncommon_process_filter. +references: + - https://www.trendmicro.com/en_us/research/25/j/how-vidar-stealer-2-upgrades-infostealer-capabilities.html +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: An uncommon process [$process_name$] accessing sensitive file [$file_path$] with AccessMask [$AccessMask$] on $dest$ +threat_objects: + - field: process_name + type: process_name +analytic_story: + - Vidar Stealer +asset_type: Endpoint +mitre_attack_id: + - T1528 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1528/vidar_azure_file_access/azure_vidar_access.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml index e4f8a81b82a..231b1b6cbb3 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml @@ -1,8 +1,8 @@ name: Windows Credentials from Password Stores Chrome Extension Access id: 2e65afe0-9a75-4487-bd87-ada9a9f1b9af -version: 13 +version: 14 creation_date: '2023-05-02' -modification_date: '2026-06-25' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -71,6 +71,7 @@ analytic_story: - 0bj3ctivity Stealer - BlankGrabber Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml index 20b4759d219..1d58baaa711 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -1,8 +1,8 @@ name: Windows Credentials from Password Stores Chrome LocalState Access id: 3b1d09a8-a26f-473e-a510-6c6613573657 -version: 23 +version: 24 creation_date: '2023-05-02' -modification_date: '2026-06-25' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -85,6 +85,7 @@ analytic_story: - VIP Keylogger - Salat Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index 57cf84d6608..5656489fbe4 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -1,8 +1,8 @@ name: Windows Credentials from Password Stores Chrome Login Data Access id: 0d32ba37-80fc-4429-809c-0ba15801aeaf -version: 23 +version: 24 creation_date: '2023-05-02' -modification_date: '2026-07-08' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -85,6 +85,7 @@ analytic_story: - VIP Keylogger - Salat Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_disable_or_stop_browser_process.yml b/detections/endpoint/windows_disable_or_stop_browser_process.yml index 51490b89246..354d3e7a7d7 100644 --- a/detections/endpoint/windows_disable_or_stop_browser_process.yml +++ b/detections/endpoint/windows_disable_or_stop_browser_process.yml @@ -1,8 +1,8 @@ name: Windows Disable or Stop Browser Process id: 220d34b7-b6c7-45fe-8dbb-c35cdd9fe6d5 -version: 14 +version: 15 creation_date: '2024-10-18' -modification_date: '2026-06-25' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: TTP @@ -57,6 +57,7 @@ analytic_story: - BlankGrabber Stealer - Salat Stealer - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1685 diff --git a/detections/endpoint/windows_indicator_removal_via_rmdir.yml b/detections/endpoint/windows_indicator_removal_via_rmdir.yml index fdeaac6b089..e86c4aa3507 100644 --- a/detections/endpoint/windows_indicator_removal_via_rmdir.yml +++ b/detections/endpoint/windows_indicator_removal_via_rmdir.yml @@ -1,8 +1,8 @@ name: Windows Indicator Removal Via Rmdir id: c4566d2c-b094-48a1-9c59-d66e22065560 -version: 12 +version: 13 creation_date: '2022-12-06' -modification_date: '2026-05-13' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -35,6 +35,7 @@ analytic_story: - DarkGate Malware - APT37 Rustonotto and FadeStealer - ZOVWiper + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1070 diff --git a/detections/endpoint/windows_process_injection_remote_thread.yml b/detections/endpoint/windows_process_injection_remote_thread.yml index e50e55a3257..3a06b8b7ed5 100644 --- a/detections/endpoint/windows_process_injection_remote_thread.yml +++ b/detections/endpoint/windows_process_injection_remote_thread.yml @@ -1,8 +1,8 @@ name: Windows Process Injection Remote Thread id: 8a618ade-ca8f-4d04-b972-2d526ba59924 -version: 14 +version: 15 creation_date: '2022-10-28' -modification_date: '2026-06-29' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: TTP @@ -72,6 +72,7 @@ analytic_story: - Earth Alux - Water Gamayun - Phantom Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1055.002 diff --git a/detections/endpoint/windows_query_registry_uninstall_program_list.yml b/detections/endpoint/windows_query_registry_uninstall_program_list.yml index d2f45279fe6..d1ac45a9079 100644 --- a/detections/endpoint/windows_query_registry_uninstall_program_list.yml +++ b/detections/endpoint/windows_query_registry_uninstall_program_list.yml @@ -1,8 +1,8 @@ name: Windows Query Registry UnInstall Program List id: 535fd4fc-7151-4062-9d7e-e896bea77bf6 -version: 10 +version: 11 creation_date: '2023-05-02' -modification_date: '2026-05-13' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -33,6 +33,7 @@ analytic_story: - StealC Stealer - RedLine Stealer - Meduza Stealer + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1012 diff --git a/detections/endpoint/windows_screen_capture_in_temp_folder.yml b/detections/endpoint/windows_screen_capture_in_temp_folder.yml index 02e18be49a3..c9aa8093d14 100644 --- a/detections/endpoint/windows_screen_capture_in_temp_folder.yml +++ b/detections/endpoint/windows_screen_capture_in_temp_folder.yml @@ -1,8 +1,8 @@ name: Windows Screen Capture in TEMP folder id: 00524d1f-a032-46f5-9108-e7d9f01bfb3c -version: 12 +version: 13 creation_date: '2024-10-18' -modification_date: '2026-05-13' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: TTP @@ -37,6 +37,7 @@ analytic_story: - APT37 Rustonotto and FadeStealer - Hellcat Ransomware - VIP Keylogger + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1113 diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index 48ec64c62e9..bae7c631445 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,8 +1,8 @@ name: Windows Suspicious Process File Path id: ecddae4e-3d4b-41e2-b3df-e46a88b38521 -version: 27 +version: 28 creation_date: '2021-05-07' -modification_date: '2026-07-20' +modification_date: '2026-08-14' author: Teoderick Contreras, Splunk status: production type: TTP @@ -97,6 +97,7 @@ analytic_story: - RoguePlanet - Phantom Stealer - Starland RAT Campaign + - Vidar Stealer asset_type: Endpoint mitre_attack_id: - T1543 diff --git a/stories/vidar_stealer.yml b/stories/vidar_stealer.yml new file mode 100644 index 00000000000..7ff25c70859 --- /dev/null +++ b/stories/vidar_stealer.yml @@ -0,0 +1,34 @@ +name: Vidar Stealer +id: 220047e4-6075-40bc-846f-ab737e6a4dc8 +version: 1 +creation_date: '2026-07-31' +modification_date: '2026-07-31' +author: Teoderick Contreras, Splunk +status: production +description: |- + The Vidar Stealer analytic story provides detection and investigation content for identifying and responding to threats associated with the Vidar information stealer on Windows endpoints. + Vidar is a commodity infostealer sold as malware-as-a-service (MaaS) on underground forums, capable of harvesting credentials, browser cookies, saved passwords, cryptocurrency wallet data, and cloud profile metadata from infected systems. + Recent variants have been observed targeting Azure CLI profile data stored in azureProfile.json, enabling cloud identity reconnaissance and potential account takeover. + Vidar also loads legitimate Mozilla NSS and mozglue DLLs to decrypt browser-stored credentials without raising typical AV signatures. + This story leverages endpoint telemetry from Windows Security Event logs and Sysmon to detect suspicious file access, unusual DLL loading patterns, and process behaviors consistent with Vidar activity. + Security teams can use these analytics to identify early-stage Vidar compromise, isolate affected hosts, and prevent credential exfiltration to attacker-controlled command-and-control infrastructure. +narrative: |- + Vidar Stealer is an active commodity threat targeting Windows users across multiple sectors, distributed primarily through phishing campaigns, malvertising, trojanized software downloads, and cracked application bundles. + Once executed, Vidar performs rapid system and credential reconnaissance before exfiltrating harvested data to its command-and-control (C2) server, often within minutes of initial execution. + A notable capability of Vidar is its abuse of legitimate Mozilla NSS libraries (nss3.dll, mozglue.dll) to decrypt browser-stored credentials from Chromium and Firefox-based browsers without triggering conventional security controls. + By side-loading these trusted DLLs from an unexpected process context, Vidar bypasses many endpoint detection signatures that rely on browser process lineage. + More recent Vidar variants have extended their reconnaissance scope to include Azure CLI artifacts, specifically targeting the azureProfile.json file stored in the user profile directory. + This file contains Azure subscription identifiers, tenant IDs, and environment metadata that attackers can use to enumerate accessible cloud resources and facilitate lateral movement into Azure-hosted infrastructure. + Telemetry from affected endpoints typically shows non-Azure processes opening azureProfile.json with read access (Event 4663, AccessMask 0x1), followed by data staging and outbound HTTPS exfiltration. + Detection of these behaviors early in the infection chain gives defenders the opportunity to contain the compromise before credentials reach attacker infrastructure, preventing downstream account takeovers, financial fraud, and secondary malware deployment. +references: + - https://www.trendmicro.com/en_us/research/25/j/how-vidar-stealer-2-upgrades-infostealer-capabilities.html + - https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar + - https://www.esentire.com/blog/vidar-stealer-abusing-social-media-for-c2 +category: + - Malware +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +usecase: Advanced Threat Detection From 8370dddf1187cfa042cb4b51a7fea2751671d334 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 20 Aug 2026 01:17:01 -0700 Subject: [PATCH 066/162] Update data source TA and install.yml app versions (#4228) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/asl_aws_cloudtrail.yml | 2 +- data_sources/aws_bedrock_claude.yml | 2 +- data_sources/aws_cloudfront.yml | 2 +- data_sources/aws_cloudtrail.yml | 2 +- data_sources/aws_cloudtrail_assumerolewithsaml.yml | 2 +- data_sources/aws_cloudtrail_consolelogin.yml | 2 +- data_sources/aws_cloudtrail_copyobject.yml | 2 +- data_sources/aws_cloudtrail_createaccesskey.yml | 2 +- data_sources/aws_cloudtrail_createkey.yml | 2 +- data_sources/aws_cloudtrail_createloginprofile.yml | 2 +- data_sources/aws_cloudtrail_createnetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_createpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_createsnapshot.yml | 2 +- data_sources/aws_cloudtrail_createtask.yml | 2 +- data_sources/aws_cloudtrail_createvirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deactivatemfadevice.yml | 2 +- data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_deletealarms.yml | 2 +- data_sources/aws_cloudtrail_deletedetector.yml | 2 +- data_sources/aws_cloudtrail_deletegroup.yml | 2 +- data_sources/aws_cloudtrail_deleteguardrail.yml | 2 +- data_sources/aws_cloudtrail_deleteipset.yml | 2 +- data_sources/aws_cloudtrail_deleteknowledgebase.yml | 2 +- data_sources/aws_cloudtrail_deleteloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deleteloggroup.yml | 2 +- data_sources/aws_cloudtrail_deletelogstream.yml | 2 +- ...aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deletenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_deletepolicy.yml | 2 +- data_sources/aws_cloudtrail_deleterule.yml | 2 +- data_sources/aws_cloudtrail_deleterulegroup.yml | 2 +- data_sources/aws_cloudtrail_deletesnapshot.yml | 2 +- data_sources/aws_cloudtrail_deletetrail.yml | 2 +- data_sources/aws_cloudtrail_deletevirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deletewebacl.yml | 2 +- data_sources/aws_cloudtrail_describeeventaggregates.yml | 2 +- data_sources/aws_cloudtrail_describeimagescanfindings.yml | 2 +- data_sources/aws_cloudtrail_describesnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_getobject.yml | 2 +- data_sources/aws_cloudtrail_getpassworddata.yml | 2 +- data_sources/aws_cloudtrail_invokemodel.yml | 2 +- data_sources/aws_cloudtrail_jobcreated.yml | 2 +- data_sources/aws_cloudtrail_listfoundationmodels.yml | 2 +- data_sources/aws_cloudtrail_modifydbinstance.yml | 2 +- data_sources/aws_cloudtrail_modifyimageattribute.yml | 2 +- data_sources/aws_cloudtrail_modifysnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_putbucketacl.yml | 2 +- data_sources/aws_cloudtrail_putbucketlifecycle.yml | 2 +- data_sources/aws_cloudtrail_putbucketreplication.yml | 2 +- data_sources/aws_cloudtrail_putbucketversioning.yml | 2 +- data_sources/aws_cloudtrail_putimage.yml | 2 +- data_sources/aws_cloudtrail_putkeypolicy.yml | 2 +- data_sources/aws_cloudtrail_replacenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_setdefaultpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_stoplogging.yml | 2 +- data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_updateloginprofile.yml | 2 +- data_sources/aws_cloudtrail_updatesamlprovider.yml | 2 +- data_sources/aws_cloudtrail_updatetrail.yml | 2 +- data_sources/aws_cloudwatchlogs_vpcflow.yml | 2 +- data_sources/aws_security_hub.yml | 2 +- 62 files changed, 62 insertions(+), 62 deletions(-) diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index 4607235dc48..177d51fa859 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -24,7 +24,7 @@ separator: api.operation supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 output_fields: - dest - user diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index b63f18820dd..801a3882ead 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -14,7 +14,7 @@ separator_value: ModelInvocationLog supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - accountId diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index e0143b82826..e725a27c95d 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -17,7 +17,7 @@ sourcetype: aws:cloudfront:accesslogs supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index 825b34c64ba..9ce661d9697 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -11,4 +11,4 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 diff --git a/data_sources/aws_cloudtrail_assumerolewithsaml.yml b/data_sources/aws_cloudtrail_assumerolewithsaml.yml index 12129d2b6c7..87c2702b279 100644 --- a/data_sources/aws_cloudtrail_assumerolewithsaml.yml +++ b/data_sources/aws_cloudtrail_assumerolewithsaml.yml @@ -18,7 +18,7 @@ separator_value: AssumeRoleWithSAML supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index 11f6b92811f..1c5f94ecab4 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -18,7 +18,7 @@ separator_value: ConsoleLogin supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_copyobject.yml b/data_sources/aws_cloudtrail_copyobject.yml index 31d80aad7bd..042284fe756 100644 --- a/data_sources/aws_cloudtrail_copyobject.yml +++ b/data_sources/aws_cloudtrail_copyobject.yml @@ -17,7 +17,7 @@ separator_value: CopyObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index 43dd2a556e9..90d25a6c4b4 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -17,7 +17,7 @@ separator_value: CreateAccessKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index 129a3a1fb54..66946e91610 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -17,7 +17,7 @@ separator_value: CreateKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createloginprofile.yml b/data_sources/aws_cloudtrail_createloginprofile.yml index bce7344352b..e9c79a8b1ae 100644 --- a/data_sources/aws_cloudtrail_createloginprofile.yml +++ b/data_sources/aws_cloudtrail_createloginprofile.yml @@ -17,7 +17,7 @@ separator_value: CreateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index c7f5b9a219c..c1153a30680 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -17,7 +17,7 @@ separator_value: CreateNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index 87f204eb6fd..00c450ca5dc 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -17,7 +17,7 @@ separator_value: CreatePolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index fbc4851ba93..621812b8ec1 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -17,7 +17,7 @@ separator_value: CreateSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createtask.yml b/data_sources/aws_cloudtrail_createtask.yml index d8910cfa606..f84b2cf0026 100644 --- a/data_sources/aws_cloudtrail_createtask.yml +++ b/data_sources/aws_cloudtrail_createtask.yml @@ -17,7 +17,7 @@ separator_value: CreateTask supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml index 2270baea06c..bcc8f0593cb 100644 --- a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml @@ -17,7 +17,7 @@ separator_value: CreateVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deactivatemfadevice.yml b/data_sources/aws_cloudtrail_deactivatemfadevice.yml index f1f93bb50ae..9c87fc438ac 100644 --- a/data_sources/aws_cloudtrail_deactivatemfadevice.yml +++ b/data_sources/aws_cloudtrail_deactivatemfadevice.yml @@ -17,7 +17,7 @@ separator_value: DeactivateMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml index b81255026cc..4364c100004 100644 --- a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: DeleteAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletealarms.yml b/data_sources/aws_cloudtrail_deletealarms.yml index 57139173711..9aa28412573 100644 --- a/data_sources/aws_cloudtrail_deletealarms.yml +++ b/data_sources/aws_cloudtrail_deletealarms.yml @@ -17,7 +17,7 @@ separator_value: DeleteAlarms supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index a093e8e01c2..39d29d1a6fc 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -17,7 +17,7 @@ separator_value: DeleteDetector supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index e0ec05a9f58..d190093d91f 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteguardrail.yml b/data_sources/aws_cloudtrail_deleteguardrail.yml index a267a7365bd..bcf4fd5f848 100644 --- a/data_sources/aws_cloudtrail_deleteguardrail.yml +++ b/data_sources/aws_cloudtrail_deleteguardrail.yml @@ -14,7 +14,7 @@ separator_value: DeleteGuardrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 49aaff4b2a0..6cb149284f9 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -16,7 +16,7 @@ separator_value: DeleteIPSet supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deleteknowledgebase.yml b/data_sources/aws_cloudtrail_deleteknowledgebase.yml index 4c8f1145d84..0bacc4bbb41 100644 --- a/data_sources/aws_cloudtrail_deleteknowledgebase.yml +++ b/data_sources/aws_cloudtrail_deleteknowledgebase.yml @@ -14,7 +14,7 @@ separator_value: DeleteKnowledgeBase supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml index 805f634c520..d8aa0af29a5 100644 --- a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index 71f8b3e5cd8..32a576295d7 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index e79e168f529..fb8e5147f61 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogStream supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml index 1ecf190e170..6518df5b567 100644 --- a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml @@ -14,7 +14,7 @@ separator_value: DeleteModelInvocationLoggingConfiguration supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index 4b95dba5c93..26b3ce7198e 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -16,7 +16,7 @@ separator_value: DeleteNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index d49419a4963..f5c3a384fe7 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -15,7 +15,7 @@ separator_value: DeletePolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index af9675c5804..95f67eb714a 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -17,7 +17,7 @@ separator_value: DeleteRule supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deleterulegroup.yml b/data_sources/aws_cloudtrail_deleterulegroup.yml index 6337447b951..888baf1d853 100644 --- a/data_sources/aws_cloudtrail_deleterulegroup.yml +++ b/data_sources/aws_cloudtrail_deleterulegroup.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deletesnapshot.yml b/data_sources/aws_cloudtrail_deletesnapshot.yml index 23e8cfc587c..e8eb028bb97 100644 --- a/data_sources/aws_cloudtrail_deletesnapshot.yml +++ b/data_sources/aws_cloudtrail_deletesnapshot.yml @@ -17,7 +17,7 @@ separator_value: DeleteSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index 80699857863..2a0af889973 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -17,7 +17,7 @@ separator_value: DeleteTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml index c192eec08fe..bd587aed866 100644 --- a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml @@ -15,7 +15,7 @@ separator_value: DeleteVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index 9f8e54c0b0a..3d389b31f62 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -15,7 +15,7 @@ separator_value: DeleteWebACL supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_describeeventaggregates.yml b/data_sources/aws_cloudtrail_describeeventaggregates.yml index 84df3121585..5aa835619d9 100644 --- a/data_sources/aws_cloudtrail_describeeventaggregates.yml +++ b/data_sources/aws_cloudtrail_describeeventaggregates.yml @@ -15,7 +15,7 @@ separator_value: DescribeEventAggregates supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index ffb232cf7df..191afb2bcec 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -16,7 +16,7 @@ separator_value: DescribeImageScanFindings supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describesnapshotattribute.yml b/data_sources/aws_cloudtrail_describesnapshotattribute.yml index 7f8a42b3050..e31315d18cd 100644 --- a/data_sources/aws_cloudtrail_describesnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_describesnapshotattribute.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - action - app diff --git a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml index 36d941e095b..27e9e0b3f16 100644 --- a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: GetAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_getobject.yml b/data_sources/aws_cloudtrail_getobject.yml index 8fb94ecdd20..160dfe1db5b 100644 --- a/data_sources/aws_cloudtrail_getobject.yml +++ b/data_sources/aws_cloudtrail_getobject.yml @@ -16,7 +16,7 @@ separator_value: GetObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index b40bdbc8aa9..4c419b3a636 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -15,7 +15,7 @@ separator_value: GetPasswordData supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_invokemodel.yml b/data_sources/aws_cloudtrail_invokemodel.yml index 14a6f7bf67f..d2d1b63ce6f 100644 --- a/data_sources/aws_cloudtrail_invokemodel.yml +++ b/data_sources/aws_cloudtrail_invokemodel.yml @@ -14,7 +14,7 @@ separator_value: InvokeModel supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_jobcreated.yml b/data_sources/aws_cloudtrail_jobcreated.yml index 40b994aea07..c421ba7cb94 100644 --- a/data_sources/aws_cloudtrail_jobcreated.yml +++ b/data_sources/aws_cloudtrail_jobcreated.yml @@ -15,7 +15,7 @@ separator_value: JobCreated supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_listfoundationmodels.yml b/data_sources/aws_cloudtrail_listfoundationmodels.yml index 405e216639d..f3898a66797 100644 --- a/data_sources/aws_cloudtrail_listfoundationmodels.yml +++ b/data_sources/aws_cloudtrail_listfoundationmodels.yml @@ -14,7 +14,7 @@ separator_value: ListFoundationModels supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index d058bd83b49..3613f843e82 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -16,7 +16,7 @@ separator_value: ModifyDBInstance supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index ee76b1b6c47..4d47df2492d 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -15,7 +15,7 @@ separator_value: ModifyImageAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index 8befb435c81..1027f7c5f23 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -14,7 +14,7 @@ separator_value: ModifySnapshotAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putbucketacl.yml b/data_sources/aws_cloudtrail_putbucketacl.yml index bf632058912..4877ea119c8 100644 --- a/data_sources/aws_cloudtrail_putbucketacl.yml +++ b/data_sources/aws_cloudtrail_putbucketacl.yml @@ -15,7 +15,7 @@ separator_value: PutBucketAcl supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index 883fb202b5d..daa93d4c05c 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -15,7 +15,7 @@ separator_value: PutBucketLifecycle supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketreplication.yml b/data_sources/aws_cloudtrail_putbucketreplication.yml index b071d6907dc..452914db259 100644 --- a/data_sources/aws_cloudtrail_putbucketreplication.yml +++ b/data_sources/aws_cloudtrail_putbucketreplication.yml @@ -14,7 +14,7 @@ separator_value: PutBucketReplication supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketversioning.yml b/data_sources/aws_cloudtrail_putbucketversioning.yml index d3f179ec631..ebcd3e95b4f 100644 --- a/data_sources/aws_cloudtrail_putbucketversioning.yml +++ b/data_sources/aws_cloudtrail_putbucketversioning.yml @@ -14,7 +14,7 @@ separator_value: PutBucketVersioning supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index e92163adc20..d95a8e337fc 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -15,7 +15,7 @@ separator_value: PutImage supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 8155bef7776..57b95d703a1 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -13,7 +13,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 92c5655c6c2..40e4c9ae5d8 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -15,7 +15,7 @@ separator_value: ReplaceNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index 4e07364aa94..83e554a5ca4 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -15,7 +15,7 @@ separator_value: SetDefaultPolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index 9c3ec05bf82..de9423c9c53 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -14,7 +14,7 @@ separator_value: StopLogging supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml index 0f07c4ba642..106b623c2c5 100644 --- a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: UpdateAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index bb02c750ca6..f62c9e64176 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -15,7 +15,7 @@ separator_value: UpdateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatesamlprovider.yml b/data_sources/aws_cloudtrail_updatesamlprovider.yml index 6d8968e44d1..e8c6c5ae94b 100644 --- a/data_sources/aws_cloudtrail_updatesamlprovider.yml +++ b/data_sources/aws_cloudtrail_updatesamlprovider.yml @@ -16,7 +16,7 @@ separator_value: UpdateSAMLProvider supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index 3455d837c4c..c609919c95d 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -15,7 +15,7 @@ separator_value: UpdateTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudwatchlogs_vpcflow.yml b/data_sources/aws_cloudwatchlogs_vpcflow.yml index 2bf501a18b5..b165f0ace89 100644 --- a/data_sources/aws_cloudwatchlogs_vpcflow.yml +++ b/data_sources/aws_cloudwatchlogs_vpcflow.yml @@ -12,7 +12,7 @@ source: aws_cloudwatchlogs_vpcflow sourcetype: aws:cloudwatchlogs:vpcflow supported_TA: - name: Splunk Add-on for AWS - version: 8.2.1 + version: 8.2.2 url: https://splunkbase.splunk.com/app/1876 fields: - _raw diff --git a/data_sources/aws_security_hub.yml b/data_sources/aws_security_hub.yml index a74705eac42..64fc6abb3b9 100644 --- a/data_sources/aws_security_hub.yml +++ b/data_sources/aws_security_hub.yml @@ -15,7 +15,7 @@ sourcetype: aws:securityhub:finding supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.1 + version: 8.2.2 fields: - _time - AwsAccountId From a2f99be2f5c340d84aae86a8e182d1e68bb7dfd3 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Thu, 20 Aug 2026 16:28:10 +0200 Subject: [PATCH 067/162] Add New Detections Covering ShieldBreak Exploitation (#4222) --------- Co-authored-by: Nasreddine Bencherchali --- .../windows_event_log_defender_1116.yml | 89 ++++++++++++++ .../windows_event_log_defender_1117.yml | 93 +++++++++++++++ ...e_data_stream_created_over_local_share.yml | 83 +++++++++++++ ...r_protocol_wermgr_connect_to_namedpipe.yml | 6 +- ...ent_dll_loaded_by_non_defender_process.yml | 86 ++++++++++++++ ..._threat_detected_on_kernel_object_path.yml | 76 ++++++++++++ ...report_created_in_reportqueue_manually.yml | 84 +++++++++++++ .../windows_phantom_dll_created_on_disk.yml | 111 ++++++++++++++++++ ...process_injection_wermgr_child_process.yml | 5 +- ...rmgr_spawning_system_integrity_process.yml | 90 ++++++++++++++ stories/rogueplanet.yml | 17 ++- 11 files changed, 732 insertions(+), 8 deletions(-) create mode 100644 data_sources/windows_event_log_defender_1116.yml create mode 100644 data_sources/windows_event_log_defender_1117.yml create mode 100644 detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml create mode 100644 detections/endpoint/windows_defender_mpclient_dll_loaded_by_non_defender_process.yml create mode 100644 detections/endpoint/windows_defender_threat_detected_on_kernel_object_path.yml create mode 100644 detections/endpoint/windows_error_report_created_in_reportqueue_manually.yml create mode 100644 detections/endpoint/windows_phantom_dll_created_on_disk.yml create mode 100644 detections/endpoint/windows_wermgr_spawning_system_integrity_process.yml diff --git a/data_sources/windows_event_log_defender_1116.yml b/data_sources/windows_event_log_defender_1116.yml new file mode 100644 index 00000000000..9b02654eb11 --- /dev/null +++ b/data_sources/windows_event_log_defender_1116.yml @@ -0,0 +1,89 @@ +name: Windows Event Log Defender 1116 +id: 588d6a99-14eb-4061-aec3-55cc54d11d6b +version: 1 +creation_date: '2026-08-17' +modification_date: '2026-08-17' +author: Onur Mustafa Erdogan, Splunk +description: Logs an event when a Windows Defender detects a malware or potentially unwanted software. +mitre_components: + - Application Log Content + - Host Status + - Process Creation +source: WinEventLog:Microsoft-Windows-Windows Defender/Operational +sourcetype: XmlWinEventLog +separator: EventCode +separator_value: '1116' +supported_TA: + - name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 11.0.2 +fields: + - _time + - Action_ID + - Action_Name + - ActivityID + - Additional_Actions_ID + - Additional_Actions_String + - Category_ID + - Category_Name + - Channel + - Computer + - Detection_ID + - Detection_Time + - Detection_User + - dvc + - dvc_nt_host + - Engine_Version + - Error_Code + - Error_Description + - event_id + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - eventtype + - Execution_ID + - Execution_Name + - FWLink + - Guid + - id + - Keywords + - Level + - Name + - Opcode + - Origin_ID + - Origin_Name + - Path + - Post_Clean_Status + - Pre_Execution_Status + - Process_Name + - ProcessID + - Product_Name + - Product_Version + - RecordNumber + - Security_intelligence_Version + - severity + - Severity_ID + - severity_id + - Severity_Name + - signature_id + - Source_ID + - Source_Name + - splunk_server + - State + - Status_Code + - System_Props_Xml + - SystemTime + - tag + - Task + - TaskCategory + - ThreadID + - Threat_ID + - Threat_Name + - Type_ID + - Type_Name + - user_id + - UserID + - vendor_product + - Version +example_log: "111603000x80000000000000001799Microsoft-Windows-Windows Defender/OperationalEC2AMAZ-FKEOM7GMicrosoft Defender Antivirus4.18.26070.9{8D3B4441-6828-4720-8030-B059CF1D35D5}2026-08-14T16:03:24.393Z2147519003Virus:DOS/EICAR_Test_File5Severe42Virushttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0111UserUnknownEC2AMAZ-FKEOM7G\\Administratorcontainerfile:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN; file:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN->eicar.com2Network share0Unknown0Concrete09Not Applicable0x00000000The operation completed successfully. 00No additional actions requiredAV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0AM: 1.1.26070.7, NIS: 1.1.26070.7" diff --git a/data_sources/windows_event_log_defender_1117.yml b/data_sources/windows_event_log_defender_1117.yml new file mode 100644 index 00000000000..4eee9d4d80b --- /dev/null +++ b/data_sources/windows_event_log_defender_1117.yml @@ -0,0 +1,93 @@ +name: Windows Event Log Defender 1117 +id: c620d5f3-53d6-4697-abf5-b2c8434e7ff9 +version: 1 +creation_date: '2026-08-17' +modification_date: '2026-08-17' +author: Onur Mustafa Erdogan, Splunk +description: Logs an event when a Windows Defender takes an action against detected threat. +mitre_components: + - Application Log Content + - Host Status + - Process Creation +source: WinEventLog:Microsoft-Windows-Windows Defender/Operational +sourcetype: XmlWinEventLog +separator: EventCode +separator_value: '1117' +supported_TA: + - name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 11.0.2 +fields: + - _time + - Action_Name + - ActivityID + - Additional_Actions_ID + - Additional_Actions_String + - Category_ID + - Category_Name + - Channel + - Computer + - Detection_ID + - Detection_Time + - Detection_User + - dvc + - dvc_nt_host + - Engine_Version + - Error_Code + - Error_Description + - event_id + - EventAction_ID + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - eventtype + - Execution_ID + - Execution_Name + - FWLink + - Guid + - host + - id + - Keywords + - Level + - Name + - Opcode + - Origin_ID + - Origin_Name + - Path + - Post_Clean_Status + - Pre_Execution_Status + - Process_Name + - ProcessID + - Product_Name + - Product_Version + - RecordNumber + - Remediation_User + - Security_intelligence_Version + - severity + - Severity_ID + - severity_id + - Severity_Name + - signature_id + - source + - Source_ID + - Source_Name + - sourcetype + - splunk_server + - State + - Status_Code + - System_Props_Xml + - SystemTime + - tag + - Task + - TaskCategory + - ThreadID + - Threat_ID + - Threat_Name + - Type_ID + - Type_Name + - user_id + - UserID + - vendor_product + - Version +example_log: "111704000x80000000000000001800Microsoft-Windows-Windows Defender/OperationalEC2AMAZ-FKEOM7GMicrosoft Defender Antivirus4.18.26070.9{8D3B4441-6828-4720-8030-B059CF1D35D5}2026-08-14T16:03:24.393Z2147519003Virus:DOS/EICAR_Test_File5Severe42Virushttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0321UserUnknownEC2AMAZ-FKEOM7G\\Administratorcontainerfile:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN; file:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN->eicar.com2Network share0Unknown0Concrete02Quarantine0x00000000The operation completed successfully. 00No additional actions requiredEC2AMAZ-FKEOM7G\\AdministratorAV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0AM: 1.1.26070.7, NIS: 1.1.26070.7" diff --git a/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml b/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml new file mode 100644 index 00000000000..bd2877700bf --- /dev/null +++ b/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml @@ -0,0 +1,83 @@ +name: Windows Alternate Data Stream Created Over Local Share +id: e974a5c9-cbe9-4b4a-8fba-b55e7dbc8259 +version: 1 +creation_date: '2026-08-19' +modification_date: '2026-08-19' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the creation of an NTFS alternate data stream (ADS) accessed over a local administrative share targeting the loopback address (127.0.0.1). + It leverages Windows Security Event Logs with EventCode 5145 to identify this activity. + Legitimate local processes access files directly rather than through a local SMB share. + This behavior is a hallmark of the ShieldBreak exploit, which abuses a symbolic link swap through a loopback share to redirect a privileged, Defender-driven write into an alternate data stream on a system-owned file, ultimately landing attacker content in C:\Windows\System32. + If confirmed malicious, this activity indicates an in-progress local privilege escalation attempt and should be investigated immediately. +data_source: + - Windows Event Log Security 5145 +search: |- + `wineventlog_security` + EventCode=5145 + IpAddress="127.0.0.1" + ObjectType="File" + | regex RelativeTargetName="(?i)\:\w+$" + | fillnull + | rename IpAddress as dest_ip + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest dest_ip + ShareName ShareLocalPath RelativeTargetName + AccessMask src_user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_alternate_data_stream_created_over_local_share_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Windows Security Event Logs with EventCode 5145 enabled. + The Windows TA is also required. + Enable Object Access auditing (success/failure) for File Share in group policy so that RelativeTargetName and IpAddress are populated. +known_false_positives: |- + Backup, replication, or file-sync software may occasionally write alternate data streams over administrative shares. + Loopback (127.0.0.1) access to a local share is rare for legitimate software, tune by ShareName or src_user as needed for your environment. +references: + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: An alternate data stream $RelativeTargetName$ was created over a loopback local share on $dest$ +threat_objects: + - field: dest + type: system + - field: RelativeTargetName + type: file_path + - field: src_user + type: user +analytic_story: + - RoguePlanet +asset_type: Endpoint +mitre_attack_id: + - T1564.004 + - T1021.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/ShieldBreak/ads_over_local_share.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml b/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml index f34db567782..59e7b20e376 100644 --- a/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml +++ b/detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml @@ -1,8 +1,8 @@ name: Windows App Layer Protocol Wermgr Connect To NamedPipe id: 2f3a4092-548b-421c-9caa-84918e1787ef -version: 10 +version: 11 creation_date: '2022-10-28' -modification_date: '2026-05-13' +modification_date: '2026-08-18' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -33,6 +33,8 @@ intermediate_findings: message: wermgr.exe process is creating or connecting to a named pipe $PipeName$ on $dest$ analytic_story: - Qakbot + - RoguePlanet + - Windows Error Reporting Service Elevation of Privilege Vulnerability asset_type: Endpoint mitre_attack_id: - T1071 diff --git a/detections/endpoint/windows_defender_mpclient_dll_loaded_by_non_defender_process.yml b/detections/endpoint/windows_defender_mpclient_dll_loaded_by_non_defender_process.yml new file mode 100644 index 00000000000..d4ff791a7e5 --- /dev/null +++ b/detections/endpoint/windows_defender_mpclient_dll_loaded_by_non_defender_process.yml @@ -0,0 +1,86 @@ +name: Windows Defender MpClient.dll Loaded by Non-Defender Process +id: 20f72601-2a92-47bc-8776-177671bbe189 +version: 1 +creation_date: '2026-08-19' +modification_date: '2026-08-19' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects mpclient.dll, the Windows Defender client API library, being loaded by a process that is not part of the Windows Defender platform. + mpclient.dll exposes the API surface used to drive on-demand Defender scans (IOAV, MpScan). In the ShieldBreak exploit, the attacker binary loads mpclient.dll directly and calls its scan APIs against an object-manager path in order to trigger a Defender scan against attacker-controlled content as part of a race condition targeting Defender's placeholder-hydration behavior. + If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender's own scanning pipeline for local privilege escalation. +data_source: + - Sysmon EventID 7 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + from datamodel=Endpoint.Processes where + + Processes.loaded_file="mpclient.dll" + NOT Processes.user IN ("* SERVICE", "SYSTEM") + NOT Processes.process_path="*\MpCmdRun.exe" + Processes.process_path IN ( + "*:\\AppData\\Local\\Temp\\*", + "*:\\Perflogs\\*", + "*:\\ProgramData\\*", + "*:\\Temp\\*", + "*:\\Users\\*", + "*:\\Windows\\Tasks\\*" + ) + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.loaded_file Processes.process + Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_defender_mpclient_dll_loaded_by_non_defender_process_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting logs with the driver/module loaded from your endpoints. + If you are using Sysmon, configuration must explicitly include image loading events targeting mpclient.dll. +known_false_positives: |- + Third-party security products or custom AV-integration tooling that legitimately calls into the Defender client API may load mpclient.dll outside the Defender platform directories. Filter as necessary for your environment. +references: + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: The [$loaded_file$] DLL was loaded by a suspicious process [$process_path$] on [$dest$] +threat_objects: + - field: process_path + type: file_path +analytic_story: + - RoguePlanet +asset_type: Endpoint +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/ShieldBreak/mpclient_dll_loaded.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_defender_threat_detected_on_kernel_object_path.yml b/detections/endpoint/windows_defender_threat_detected_on_kernel_object_path.yml new file mode 100644 index 00000000000..023f83d6a92 --- /dev/null +++ b/detections/endpoint/windows_defender_threat_detected_on_kernel_object_path.yml @@ -0,0 +1,76 @@ +name: Windows Defender Threat Detected on Kernel Object Path +id: 702631e8-90ce-43db-90fd-cf0228edc8ad +version: 1 +creation_date: '2026-08-17' +modification_date: '2026-08-18' +author: Onur Mustafa Erdogan, Splunk +status: production +type: TTP +description: |- + The following analytic detects a Windows Defender malware detection or remediation event where the scanned path resolves through the NT object manager namespace (\globalroot\). + It leverages Windows Defender Operational log EventCodes 1116 and 1117 to identify this activity. + In the ShieldBreak exploit, this is how Defender is coerced into hydrating a cloud file placeholder and copying attacker content through a symbolic link chain that ultimately writes into C:\Windows\System32. + If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender's own scanning pipeline for local privilege escalation. +data_source: + - Windows Event Log Defender 1116 + - Windows Event Log Defender 1117 +search: |- + `ms_defender` + EventCode IN (1116, 1117) + Path="*\\globalroot\\*" + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + values(EventCode) as EventCode + values(Action_Name) as Action_Name + values(Additional_Actions_String) as Additional_Actions_String + values(FWLink) as FWLink + by dvc Detection_User Path Threat_Name Severity_Name Category_Name + | rename dvc as dest, Detection_User as user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_defender_threat_detected_on_kernel_object_path_filter` +how_to_implement: |- + The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line, via the Splunk Add-on for Microsoft Windows. Ensure the Microsoft-Windows-Windows Defender/Operational channel is being collected so that EventCode 1116 (detection) and 1117 (remediation) events are ingested. +known_false_positives: |- + No false positives have been identified at this time. Legitimate Defender scans do not report detections against paths resolved through the NT object manager namespace. +references: + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Windows Defender reported a detection on a kernel object path $Path$ on $dest$ + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: Path + type: file_path +analytic_story: + - RoguePlanet +asset_type: Endpoint +mitre_attack_id: + - T1068 + - T1211 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/ShieldBreak/defender_kernel_object.log + source: XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_error_report_created_in_reportqueue_manually.yml b/detections/endpoint/windows_error_report_created_in_reportqueue_manually.yml new file mode 100644 index 00000000000..23ce74f1623 --- /dev/null +++ b/detections/endpoint/windows_error_report_created_in_reportqueue_manually.yml @@ -0,0 +1,84 @@ +name: Windows Error Report Created in ReportQueue Manually +id: c3b33d42-dd28-41bc-8abd-407654a5c9bc +version: 1 +creation_date: '2026-08-17' +modification_date: '2026-08-18' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects a .wer file being written into the Windows Error Reporting ReportQueue directory by a process other than the standard error-reporting binaries. + Windows Error Reporting normally populates ReportQueue only through werfault.exe, werfaultsecure.exe, or wermgr.exe following an actual application crash. + In the ShieldBreak exploit, the attacker fabricates a .wer report directly and manually invokes the QueueReporting scheduled task, which causes wermgr.exe to process the report and load an attacker-planted phantom DLL at SYSTEM integrity. + If confirmed malicious, this activity indicates preparation for a local privilege escalation attempt abusing Windows Error Reporting. +data_source: + - Sysmon EventID 11 +search: |- + `sysmon` + EventCode=11 + action IN ("created","modified") + file_name="*.wer" + file_path="*\\ReportQueue\\*" + NOT process_path IN ( + "*\\svchost.exe", + "*\\werfault.exe", + "*\\werfaultsecure.exe", + "*\\wermgr.exe" + ) + | fillnull + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest file_name file_path file_hash action + process_name process_path process_id user vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_error_report_created_in_reportqueue_manually_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting logs with file creation events from your endpoints. If you are using Sysmon, you must have EventID 11 (FileCreate) enabled, and the FileCreate section of the configuration must include TargetFilename paths ending in .wer or containing ReportQueue, since these are commonly excluded by default configurations. +known_false_positives: |- + Crash-reporting or telemetry agents that integrate with Windows Error Reporting may stage .wer files outside the standard WER binaries. Tune by Image as necessary for your environment. +references: + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet + - https://isc.sans.edu/diary/22536 +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 40 + message: A suspicious process [$process_name$] created a Windows Error Reporting report [$file_path$] on [$dest$] +threat_objects: + - field: process_name + type: process_name + - field: file_path + type: file_path +analytic_story: + - RoguePlanet + - Windows Privilege Escalation + - Windows Error Reporting Service Elevation of Privilege Vulnerability +asset_type: Endpoint +mitre_attack_id: + - T1068 + - T1053.005 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/ShieldBreak/wer_file_creation.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_phantom_dll_created_on_disk.yml b/detections/endpoint/windows_phantom_dll_created_on_disk.yml new file mode 100644 index 00000000000..d953b9f1e62 --- /dev/null +++ b/detections/endpoint/windows_phantom_dll_created_on_disk.yml @@ -0,0 +1,111 @@ +name: Windows Phantom DLL Created on Disk +id: 34cb2dfb-1dec-4b6b-bc72-c3904e5e4521 +version: 2 +creation_date: '2026-08-17' +modification_date: '2026-08-20' +author: Onur Mustafa Erdogan, Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + The following analytic detects creation of DLL files with names associated with phantom DLL hijacking opportunities. + These DLLs are usually absent from standard Windows installations, but legitimate Windows components or services may attempt to load them when they are present in expected search paths such as System32. + Phantom DLL hijacking involves placing a malicious DLL where a legitimate process will search for a non-existent dependency, allowing the attacker-controlled library to execute in that process context. + ShieldBreak is one example where the exploit redirects a privileged Defender-driven write into C:\Windows\System32\phoneinfo.dll and then triggers Windows Error Reporting so wermgr.exe loads the planted DLL at SYSTEM integrity. + If confirmed malicious, this activity can indicate preparation for code execution, persistence, or local privilege escalation through DLL search order hijacking. +data_source: + - Sysmon EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + from datamodel=Endpoint.Filesystem where + + Filesystem.action IN ("created","modified") + + Filesystem.file_path IN ( + "*:\\Windows\\System32\\axeonoffhelper.dll", + "*:\\Windows\\System32\\cdpsgshims.dll", + "*:\\Windows\\System32\\oci.dll", + "*:\\Windows\\System32\\offdmpsvc.dll", + "*:\\Windows\\System32\\shellchromeapi.dll", + "*:\\Windows\\System32\\TSMSISrv.dll", + "*:\\Windows\\System32\\TSVIPSrv.dll", + "*:\\Windows\\System32\\wbem\\wbemcomn.dll", + "*:\\Windows\\System32\\WLBSCTRL.dll", + "*:\\Windows\\System32\\wow64log.dll", + "*:\\Windows\\System32\\WptsExtensions.dll", + "*\\phoneinfo.dll", + "*\\SprintCSP.dll" + ) + by Filesystem.action Filesystem.dest Filesystem.file_hash + Filesystem.file_name Filesystem.file_path Filesystem.process_id + Filesystem.user Filesystem.vendor_product + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_phantom_dll_created_on_disk_filter` +how_to_implement: |- + To successfully implement this search, you need file creation telemetry from Windows endpoints mapped into the Endpoint.Filesystem datamodel. + If you are using Sysmon, enable EventID 11 and ensure the FileCreate configuration captures the full target filename for DLL creations in Windows system paths. +known_false_positives: |- + Some legacy or third-party components may create DLLs with these names for legitimate compatibility reasons, but creation in Windows system paths should be uncommon. + Review the creating process, signer, file hash, path, and whether the DLL is expected on the host before tuning. +references: + - http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html + - https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/ + - https://decoded.avast.io/martinchlumecky/png-steganography/ + - https://github.com/blackarrowsec/redteam-research/tree/26e6fc0c0d30d364758fa11c2922064a9a7fd309/LPE%20via%20StorSvc + - https://github.com/Wh04m1001/SysmonEoP + - https://itm4n.github.io/cdpsvc-dll-hijacking/ + - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992 + - https://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/ + - https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/ + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/ + - https://www.hexacorn.com/blog/2016/06/02/beyond-good-ol-run-key-part-40/ + - https://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/ + - https://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/ + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet + - https://x.com/0gtweet/status/1564131230941122561 +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: A phantom DLL candidate named [$file_name$] was created at [$file_path$] on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: file_name + type: file_name + - field: file_path + type: file_path +analytic_story: + - RoguePlanet + - Windows Privilege Escalation + - Windows Defense Evasion Tactics +asset_type: Endpoint +mitre_attack_id: + - T1574.001 + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/ShieldBreak/phoneinfo_dll_created.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_process_injection_wermgr_child_process.yml b/detections/endpoint/windows_process_injection_wermgr_child_process.yml index 66f47b20669..14dce5c439f 100644 --- a/detections/endpoint/windows_process_injection_wermgr_child_process.yml +++ b/detections/endpoint/windows_process_injection_wermgr_child_process.yml @@ -1,8 +1,8 @@ name: Windows Process Injection Wermgr Child Process id: 360ae6b0-38b5-4328-9e2b-bc9436cddb17 -version: 11 +version: 12 creation_date: '2022-10-27' -modification_date: '2026-05-13' +modification_date: '2026-08-18' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -49,6 +49,7 @@ intermediate_findings: analytic_story: - Qakbot - Windows Error Reporting Service Elevation of Privilege Vulnerability + - RoguePlanet asset_type: Endpoint mitre_attack_id: - T1055 diff --git a/detections/endpoint/windows_wermgr_spawning_system_integrity_process.yml b/detections/endpoint/windows_wermgr_spawning_system_integrity_process.yml new file mode 100644 index 00000000000..61822ae2030 --- /dev/null +++ b/detections/endpoint/windows_wermgr_spawning_system_integrity_process.yml @@ -0,0 +1,90 @@ +name: Windows Wermgr Spawning System Integrity Process +id: d39634c8-7ce7-4503-a5da-73ca3c758fb9 +version: 1 +creation_date: '2026-08-17' +modification_date: '2026-08-18' +author: Onur Mustafa Erdogan, Splunk +status: production +type: TTP +description: |- + The following analytic detects WerMgr.exe (Windows Error Reporting) spawning a child process running at SYSTEM integrity level. + WerMgr.exe normally runs at the integrity level of the reporting user or as a background SYSTEM-owned service that does not launch interactive children. + In the ShieldBreak exploit, WerMgr.exe is manually triggered via the QueueReporting scheduled task and loads an attacker-planted phantom DLL (phoneinfo.dll), which then spawns an elevated shell. + If confirmed malicious, this activity indicates successful local privilege escalation to SYSTEM. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.parent_process_name="WerMgr.exe" + ( + Processes.process_integrity_level="System" + OR + Processes.user IN ("*$", "System") + ) + + by Processes.action Processes.dest Processes.parent_process_name Processes.parent_process_path + Processes.parent_process Processes.parent_process_id Processes.process_name + Processes.process_path Processes.process Processes.process_id Processes.process_hash + Processes.process_integrity_level Processes.user Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_wermgr_spawning_system_integrity_process_filter` +how_to_implement: |- + This detection is based on Process creation events. Make sure you are ingesting logs that contain parent process details and fields that indicate privilege level, such as user name or integrity level. If you are using Sysmon, make sure to enable logging of child processes of WerMgr.exe. +known_false_positives: |- + No false positives have been identified at this time. + WerMgr.exe spawning a SYSTEM-integrity child process is not expected under normal Windows Error Reporting operation. +references: + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet + - https://isc.sans.edu/diary/22536 +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: The [$parent_process_name$] process spawned [$process_name$] running at SYSTEM integrity level on $dest$ + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process + type: process + - field: process_name + type: process_name +analytic_story: + - RoguePlanet + - Windows Privilege Escalation + - Windows Error Reporting Service Elevation of Privilege Vulnerability +asset_type: Endpoint +mitre_attack_id: + - T1068 + - T1134.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/ShieldBreak/system_integrity_process.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/stories/rogueplanet.yml b/stories/rogueplanet.yml index 5ad81b05746..d050586cbc6 100644 --- a/stories/rogueplanet.yml +++ b/stories/rogueplanet.yml @@ -1,9 +1,9 @@ name: RoguePlanet id: eafb5ab2-71bb-4da9-a541-015d002f01f1 -version: 1 +version: 2 creation_date: '2026-06-11' -modification_date: '2026-06-11' -author: Teoderick Contreras, Splunk +modification_date: '2026-08-17' +author: Teoderick Contreras, Onur Mustafa Erdogan, Splunk status: production description: |- RoguePlanet is a publicly released proof-of-concept exploit targeting a race condition in Microsoft Windows Defender. The attack abuses Defender scanning behavior, NTFS alternate data streams, virtual ISO mounting, volume shadow copy paths, and opportunistic oplocks to achieve local privilege escalation to SYSTEM. @@ -17,13 +17,22 @@ narrative: | From a detection standpoint, the most durable observables are Sysmon Event ID 15 records showing :WDFOO alternate data streams on wermgr.exe under RP_* temp directories, MsMpEng.exe touching those same paths, and the initial RoguePlanet.exe process writing ADS content. Secondary signals include creation of RP_* directories, virtual disk attach activity, reparse-point manipulation, and a user-context process later spawning SYSTEM-integrity children. - This analytic story groups detections that surface alternate data stream abuse, suspicious Defender-adjacent file activity, and privilege escalation patterns consistent with RoguePlanet and similar Windows Defender bypass research. Security teams should treat any matching activity as high priority, validate patch and Defender configuration status, and isolate affected endpoints pending vendor guidance. + ShieldBreak is a related proof-of-concept published by NightmareEclipse that exploits the same underlying weakness in Defender's scanning pipeline, targeting Windows Server 2025 rather than client builds. A low-privileged executable creates a working directory under C:\ShieldBreak_{GUID}\, registers a fake cloud storage provider, and creates a cloud file placeholder named BERLIN with a stream ADS. It loads mpclient.dll, Defender's own client API library, and directs Defender to scan a path resolved through the object manager under \BaseNamedObjects\Restricted\, hydrating the placeholder on demand. + + ShieldBreak wins its race through symbolic link manipulation rather than oplocks: an object-manager symlink initially resolves the scan target to the working directory, then is swapped to resolve through a CLFS path so that a locked Defender artifact file (BERLIN.blf) is produced instead. A second symbolic link, created over a local administrative share targeting 127.0.0.1, redirects that locked file to \Windows\System32\phoneinfo.dll, so the subsequent hydration writes the attacker's payload directly into a privileged system directory. The exploit then fabricates a Windows Error Report under the WER ReportQueue directory and manually executes the QueueReporting scheduled task, causing wermgr.exe to load phoneinfo.dll -- a classic phantom-DLL hijack target -- which steals a SYSTEM token and spawns an elevated shell. + + This analytic story groups detections that surface alternate data stream abuse, suspicious Defender-adjacent file and module-load activity, Windows Error Reporting abuse, and privilege escalation patterns consistent with RoguePlanet, ShieldBreak, and similar Windows Defender bypass research. Security teams should treat any matching activity as high priority, validate patch and Defender configuration status, and isolate affected endpoints pending vendor guidance. references: - https://github.com/MSNightmare/RoguePlanet/tree/main - https://attack.mitre.org/techniques/T1068/ - https://attack.mitre.org/techniques/T1564/004/ - https://attack.mitre.org/techniques/T1211/ - https://car.mitre.org/analytics/CAR-2020-08-001/ + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.picussecurity.com/resource/blog/rogueplanet-anatomy-of-the-nightmare-eclipse-microsoft-defender-zero-day#from-rce-to-lpe:-the-smb-and-vhdx-origin-story + - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet + - https://www.hexacorn.com/blog/2016/06/02/beyond-good-ol-run-key-part-40/ + - https://secret.club/2020/07/01/diagtrack.html category: - Adversary Tactics product: From b21862c1c7821eb6194ecf391cd3363b9b8f8e59 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Fri, 21 Aug 2026 12:21:24 +0200 Subject: [PATCH 068/162] Add New Detections Against Malicious Python Package Activities (#4205) --------- Co-authored-by: Nasreddine Bencherchali --- ...n_network_traffic_during_package_build.yml | 112 ++++++++++++++++++ ...e_creation_during_package_installation.yml | 106 +++++++++++++++++ ...dification_during_package_installation.yml | 106 +++++++++++++++++ ...s_creation_during_package_installation.yml | 107 +++++++++++++++++ .../malicious_python_package_installation.yml | 28 +++++ 5 files changed, 459 insertions(+) create mode 100644 detections/endpoint/python_network_traffic_during_package_build.yml create mode 100644 detections/endpoint/python_pth_file_creation_during_package_installation.yml create mode 100644 detections/endpoint/python_pythonpath_modification_during_package_installation.yml create mode 100644 detections/endpoint/python_site_hooks_creation_during_package_installation.yml create mode 100644 stories/malicious_python_package_installation.yml diff --git a/detections/endpoint/python_network_traffic_during_package_build.yml b/detections/endpoint/python_network_traffic_during_package_build.yml new file mode 100644 index 00000000000..eeb6f097b73 --- /dev/null +++ b/detections/endpoint/python_network_traffic_during_package_build.yml @@ -0,0 +1,112 @@ +name: Python Network Traffic During Package Build +id: 03c9c504-2294-44da-8180-beefe1ca8ba8 +version: 1 +creation_date: '2026-08-21' +modification_date: '2026-08-21' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects a Python process making an outbound network connection during package installation. + Adversaries can abuse `setup.py` build scripts by leveraging `distutils`/`setuptools` command classes to execute arbitrary code, including network beacons to third-party domains, the moment a malicious Python package is installed. + This activity is significant because it allows adversaries to establish a foothold or exfiltrate data without any direct interaction from the victim beyond running `pip install`. + If confirmed malicious, this could indicate a successful software supply chain compromise. +data_source: + - Sysmon EventID 1 AND Sysmon EventID 3 +search: |- + `sysmon` + ( + EventID=1 + ( + process="*_in_process.py*" + OR + process_name=python.exe + ) + ) + OR + ( + EventID=3 + dest_ip!="" + process_name=python.exe + ) + + | eval dest=if(EventID=3, Computer, dest) + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(parent_process_id) as parent_process_id + values(parent_process_path) as parent_process_path + values(parent_process_name) as parent_process_name + values(parent_process) as parent_process + values(process_path) as process_path + values(process_name) as process_name + values(process) as process + values(dest_ip) as dest_ip + values(dest_host) as dest_host + + by dest source process_id + + | search process="* build_wheel*" + + | table firstTime lastTime + parent_process_id parent_process_path parent_process_name parent_process + process_id process_path process_name process + dest_ip dest_host + dest source + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `python_network_traffic_during_package_build_filter` +how_to_implement: |- + The detection is based on data that originates from Sysmon. To implement this search, you must ingest logs + with process creation (EventID 1) and network connection (EventID 3) events, mapped via the appropriate + Splunk Technology Add-on. Use the Splunk Common Information Model (CIM) to normalize the field names. +known_false_positives: |- + Python packages may contact software repositories, mirror sites during build time. + Investigate the destination and package content to determine legitimacy. +references: + - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: A Python process [$process$] on [$dest$] made an outbound network connection to [$dest_ip$] with hostname [$dest_host$] during package installation. +threat_objects: + - field: process + type: process + - field: dest_ip + type: ip_address + - field: dest_host + type: domain +analytic_story: + - Malicious Python Package Installation + - Ingress Tool Transfer + - Command And Control + - Compromised Windows Host +asset_type: Endpoint +mitre_attack_id: + - T1195.002 + - T1059.006 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/python_network_traffic/python_network_traffic.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/python_pth_file_creation_during_package_installation.yml b/detections/endpoint/python_pth_file_creation_during_package_installation.yml new file mode 100644 index 00000000000..c7c514aee1d --- /dev/null +++ b/detections/endpoint/python_pth_file_creation_during_package_installation.yml @@ -0,0 +1,106 @@ +name: Python PTH File Creation During Package Installation +id: bf581b86-39cd-48b7-9312-d9affb48a8bc +version: 1 +creation_date: '2026-08-21' +modification_date: '2026-08-21' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the creation of a Python path configuration (`.pth`) file in conjunction with a package installation process. + Path configuration files placed under `site-packages` or `dist-packages` are executed with every subsequent invocation of Python, allowing adversaries to achieve persistence on the victim endpoint regardless of build method or distribution type. + This technique was used by the threat actor group TeamPCP during the supply chain compromise of the `litellm` package. + If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host. +data_source: + - Sysmon EventID 1 AND Sysmon EventID 11 +search: |- + `sysmon` + EventID IN (1,11) + process_name="python.exe" + ( + process="* install *" + OR + ( + file_name="*.pth" + action="created" + ) + ) + | stats count min(_time) as firstTime + max(_time) as lastTime + values(parent_process_id) as parent_process_id + values(parent_process_path) as parent_process_path + values(parent_process_name) as parent_process_name + values(parent_process) as parent_process + values(process_path) as process_path + values(process_name) as process_name + values(process) as process + values(file_name) as file_name + values(file_path) as file_path + dc(EventID) as dc_event_id + + by dest source process_id + + | search dc_event_id>1 AND process!="*-- setuptools*" + + | table firstTime lastTime + parent_process_id parent_process_path parent_process_name parent_process + process_id process_path process_name process + file_name file_path + dest source + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `python_pth_file_creation_during_package_installation_filter` +how_to_implement: |- + This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1) + and file creation (EventID 11) events, ensuring that file creation events are collected for files with the .pth + extension. Ingest the data via the appropriate Splunk Technology Add-on and normalize field names using the + Splunk Common Information Model (CIM). +known_false_positives: |- + Legitimate packages, such as those managing namespace packages or editable installs, may create `.pth` files as part of normal installation. + Investigate the file contents and parent process to determine legitimacy. +references: + - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 30 + message: A Python .pth file called [$file_name$] located at [$file_path$] was created on [$dest$] during package installation using [$process$]. +threat_objects: + - field: process + type: process + - field: file_name + type: file_name + - field: file_path + type: file_path +analytic_story: + - Malicious Python Package Installation + - Compromised Windows Host + - Windows Persistence Techniques +asset_type: Endpoint +mitre_attack_id: + - T1546 + - T1195.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546/python_pth_file_creation/python_pth_file_creation.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/python_pythonpath_modification_during_package_installation.yml b/detections/endpoint/python_pythonpath_modification_during_package_installation.yml new file mode 100644 index 00000000000..a314b6e63eb --- /dev/null +++ b/detections/endpoint/python_pythonpath_modification_during_package_installation.yml @@ -0,0 +1,106 @@ +name: Python PYTHONPATH Modification During Package Installation +id: 00f01ba4-df01-4caa-90f6-187e4563a516 +version: 1 +creation_date: '2026-08-21' +modification_date: '2026-08-21' +author: Onur Mustafa Erdogan, Splunk +status: production +type: TTP +description: |- + The following analytic detects modification of the PYTHONPATH environment variable in conjunction with a package installation process. + Python looks up the `sys.path` variable, which is generated by combining user and site folders with `.pth` files and the value of the PYTHONPATH environment variable, to determine which directories to use for importing modules. + If an adversary is able to control the value of PYTHONPATH, they can point it to an attacker-controlled directory and hijack imported packages, achieving user-level persistence across future Python invocations and new shell sessions. + If confirmed malicious, this could result in arbitrary code execution every time Python is invoked by the affected user. +data_source: + - Sysmon EventID 1 AND Sysmon EventID 13 +search: |- + `sysmon` + EventID IN (1,13) + ( + parent_process="*\\site-packages\\pip\\*" + OR + ( + registry_path="*PYTHONPATH" + action="modified" + ) + ) + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(parent_process_id) as parent_process_id + values(parent_process_name) as parent_process_name + values(parent_process_path) as parent_process_path + values(parent_process) as parent_process + values(process_path) as process_path + values(process_name) as process_name + values(process) as process + values(registry_path) as registry_path + values(registry_value_data) as registry_value_data + dc(EventID) as dc_event_id + + by dest source process_id + + | search dc_event_id>1 + + | table firstTime lastTime + parent_process_id parent_process_path parent_process_name parent_process + process_id process_path process_name process + registry_path registry_value_data + dest source + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `python_pythonpath_modification_during_package_installation_filter` +how_to_implement: |- + This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1) + and registry modification (EventID 13) events, ensuring that registry modification events are collected for the + PYTHONPATH environment variable(\Environment\PYTHONPATH). Ingest the data via the appropriate Splunk Technology Add-on + and normalize field names using the Splunk Common Information Model (CIM). +known_false_positives: |- + Developers and legitimate installers may modify PYTHONPATH as part of normal environment configuration. + Investigate the new value and parent process to determine legitimacy. +references: + - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: The PYTHONPATH environment variable [$registry_path$] was modified to the value of [$registry_value_data$] on [$dest$] during package installation using [$process$]. + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process + type: process + - field: registry_value_data + type: registry_value_data +analytic_story: + - Malicious Python Package Installation + - Compromised Windows Host + - Windows Persistence Techniques + - Suspicious Windows Registry Activities + - Windows Registry Abuse +asset_type: Endpoint +mitre_attack_id: + - T1574.007 + - T1195.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.007/python_pythonpath_modification/python_pythonpath_modification.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/python_site_hooks_creation_during_package_installation.yml b/detections/endpoint/python_site_hooks_creation_during_package_installation.yml new file mode 100644 index 00000000000..43b5a52eafe --- /dev/null +++ b/detections/endpoint/python_site_hooks_creation_during_package_installation.yml @@ -0,0 +1,107 @@ +name: Python Site Hooks Creation During Package Installation +id: efaf40f5-779f-4b48-a941-b7d1a7c931ed +version: 1 +creation_date: '2026-08-21' +modification_date: '2026-08-21' +author: Onur Mustafa Erdogan, Splunk +status: production +type: TTP +description: |- + The following analytic detects the creation of a Python site hook file (`sitecustomize.py` or `usercustomize.py`) within a `site-packages`/`dist-packages` directory in conjunction with a package installation process. + Python's `site` module loads these hooks from directories on `sys.path` before Python is executed. + If an adversary manipulates or plants one of these files, they can hijack the Python environment and execute their payload with every Python invocation, achieving persistence on the victim endpoint. + The VIPERTUNNEL backdoor was reported to abuse site hooks in order to import and trigger DLL execution. + If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host. +data_source: + - Sysmon EventID 1 AND Sysmon EventID 11 +search: |- + `sysmon` + EventID IN (1,11) + ( + process="* install *" + OR + ( + action="created" + file_path="*-packages\\*" + file_path IN ("*sitecustomize.py", "*usercustomize.py") + ) + ) + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(parent_process_id) as parent_process_id + values(parent_process_path) as parent_process_path + values(parent_process_name) as parent_process_name + values(parent_process) as parent_process + values(process_path) as process_path + values(process_name) as process_name + values(process) as process + values(file_path) as file_path + values(file_name) as file_name + dc(EventID) as dc_event_id + by dest source process_id + + | search dc_event_id>1 + + | table firstTime lastTime + parent_process_id parent_process_path parent_process_name parent_process + process_id process_path process_name process + file_path file_name + dest source + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `python_site_hooks_creation_during_package_installation_filter` +how_to_implement: |- + This detection requires Sysmon event logs. Configure your environment to ingest Sysmon process creation (EventID 1) + and file creation (EventID 11) events, ensuring that file creation events are collected for files with the .py + extension. Ingest the data via the appropriate Splunk Technology Add-on and normalize field names using the + Splunk Common Information Model (CIM). +known_false_positives: |- + Some legitimate tooling and environment managers create or modify `sitecustomize.py`/`usercustomize.py` + as part of normal setup. Investigate the file contents and parent process to determine legitimacy. +references: + - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: A Python site hook file [$file_path$] was created on [$dest$] during package installation using [$process$]. + entity: + field: dest + type: system + score: 40 +threat_objects: + - field: process + type: process + - field: file_path + type: file_path + - field: file_name + type: file_name +analytic_story: + - Malicious Python Package Installation + - Compromised Windows Host + - Windows Persistence Techniques +asset_type: Endpoint +mitre_attack_id: + - T1546 + - T1195.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546/python_site_hooks_creation/python_site_hooks_creation.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/stories/malicious_python_package_installation.yml b/stories/malicious_python_package_installation.yml new file mode 100644 index 00000000000..d7d6635781a --- /dev/null +++ b/stories/malicious_python_package_installation.yml @@ -0,0 +1,28 @@ +name: Malicious Python Package Installation +id: 12e51c50-6b66-4ce7-83b8-95125ffd31e9 +version: 1 +creation_date: '2026-08-21' +modification_date: '2026-08-21' +author: Onur Mustafa Erdogan, Splunk +status: production +description: |- + This analytic story provides detection coverage for abuse of the Python package installation lifecycle, including install-time code execution, persistence via `.pth` path configuration files, Python site hooks, and PYTHONPATH environment variable manipulation. +narrative: |- + Python's popularity, readable syntax, and extensive third-party library ecosystem make it an attractive target for threat actors seeking to compromise developer devices and infrastructure. + Malicious packages and supply-chain attacks exploit the trust built into Python's packaging ecosystem to execute payloads at the moment of installation, without any direct interaction from the victim. Adversaries abuse several native Python features to achieve this. + `setup.py` build scripts can leverage `distutils`/`setuptools` command classes to execute arbitrary code, including + network beacons, during package installation. + Path configuration files (`.pth`) placed in `site-packages`/`dist-packages` are executed on every subsequent Python invocation, providing persistence; this technique was used by the threat actor group TeamPCP during the supply-chain compromise of the `litellm` package. Python's `site` module also loads `sitecustomize.py` and `usercustomize.py` hook files from directories on `sys.path`, which adversaries can plant or manipulate to hijack the Python environment and achieve persistence, as seen with the VIPERTUNNEL backdoor. + Finally, adversaries who can modify a user's `PYTHONPATH` environment variable can redirect module imports to attacker-controlled directories,achieving user-level persistence across new shell sessions. + This story detects these behaviors by correlating process creation, file creation, and registry modification telemetry around Python package installation activity. +references: + - https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/ +category: + - Adversary Tactics +usecase: Advanced Threat Detection +threat_group: + - TeamPCP +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud From 981dfb2a047c4ed6c4de61f38184e998be34df8c Mon Sep 17 00:00:00 2001 From: fe-brain Date: Mon, 24 Aug 2026 19:16:08 +0700 Subject: [PATCH 069/162] Update known_false_positives for Excessive Usage of NSLOOKUP App (#4231) --------- Co-authored-by: Nasreddine Bencherchali --- detections/endpoint/excessive_usage_of_nslookup_app.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 5b7e8644f40..413f138d496 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -1,8 +1,8 @@ name: Excessive Usage of NSLOOKUP App id: 0a69fdaa-a2b8-11eb-b16d-acde48001122 -version: 12 +version: 13 creation_date: '2021-04-22' -modification_date: '2026-05-13' +modification_date: '2026-08-24' author: Teoderick Contreras, Stanislav Miskovic, Splunk status: production type: Anomaly @@ -25,7 +25,7 @@ search: |- | `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of nslookup.exe may be used. -known_false_positives: No false positives have been identified at this time. +known_false_positives: Network or DNS monitoring tools that perform bulk nslookup checks against multiple domains in quick succession (e.g., CDN health checks, load balancer DNS validation scripts) may exceed the detection threshold as part of normal, scheduled operation. Hosts with limited historical baseline data may also cross the dynamic threshold more easily due to low computed average and standard deviation values. Tune the detection or add exceptions for known monitoring tool parent processes as needed. references: - https://www.mandiant.com/resources/fin7-spear-phishing-campaign-targets-personnel-involved-sec-filings - https://www.varonis.com/blog/dns-tunneling From 9a2c4a5df40cdfe3d4e11481110a8140fea776b1 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Mon, 24 Aug 2026 14:17:45 +0200 Subject: [PATCH 070/162] bump to contentctl-ng 1.1.1 in requirements (#4232) Co-authored-by: Nasreddine Bencherchali --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 628e150e83f..4bbb0e2cf01 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1 +1 @@ -contentctl-ng==1.0.2 +contentctl-ng==1.1.1 From c574888a5db1d41ac2b384d00f7b3ea76c1663e1 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 24 Aug 2026 14:47:41 +0200 Subject: [PATCH 071/162] Fix Issues & Deprecate Some Experimental Content (#4212) --- .../windows_event_log_security_5441.yml | 25 +++ .../windows_event_log_security_5447.yml | 101 ++++++++++++ .../esxi_encryption_settings_modified.yml | 29 +++- .../detect_f5_tmui_rce_cve_2020_5902.yml | 10 +- ..._append_command_to_profile_config_file.yml | 64 ++++++-- .../endpoint/ping_sleep_batch_command.yml | 50 ++++-- ...rsilencer_custom_outbound_filter_added.yml | 98 +++++++++++ ...form_filter_added_to_block_edr_process.yml | 153 ++++++++++++++++++ ...t_password_policy_to_unlimited_via_net.yml | 54 ++++--- 9 files changed, 526 insertions(+), 58 deletions(-) create mode 100644 data_sources/windows_event_log_security_5441.yml create mode 100644 data_sources/windows_event_log_security_5447.yml rename detections/{web => deprecated}/detect_f5_tmui_rce_cve_2020_5902.yml (84%) create mode 100644 detections/endpoint/windows_edrsilencer_custom_outbound_filter_added.yml create mode 100644 detections/endpoint/windows_filtering_platform_filter_added_to_block_edr_process.yml diff --git a/data_sources/windows_event_log_security_5441.yml b/data_sources/windows_event_log_security_5441.yml new file mode 100644 index 00000000000..e8a62868bd3 --- /dev/null +++ b/data_sources/windows_event_log_security_5441.yml @@ -0,0 +1,25 @@ +name: Windows Event Log Security 5441 +id: aac843ab-4cd6-4735-9557-cde0b504c9c9 +version: 1 +creation_date: '2026-08-23' +modification_date: '2026-08-23' +author: Nasreddine Bencherchali, Splunk +description: Logs Windows Filtering Platform filters that were present when the Base Filtering Engine started, including provider, filter, layer, conditions, and filter action metadata. +mitre_components: + - Firewall Metadata + - Security Policy Modification + - Application Log Content +source: XmlWinEventLog:Security +sourcetype: XmlWinEventLog +separator: EventCode +separator_value: '5441' +configuration: Enable the Audit Filtering Platform Policy Change subcategory to collect Windows Filtering Platform policy events. +supported_TA: + - name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 11.0.2 +fields: + - _time +output_fields: + - dest +example_log: '' diff --git a/data_sources/windows_event_log_security_5447.yml b/data_sources/windows_event_log_security_5447.yml new file mode 100644 index 00000000000..94e8f2a90cb --- /dev/null +++ b/data_sources/windows_event_log_security_5447.yml @@ -0,0 +1,101 @@ +name: Windows Event Log Security 5447 +id: b94e3b5d-d00f-4fed-88e9-c8ea87495618 +version: 1 +creation_date: '2026-08-23' +modification_date: '2026-08-23' +author: Nasreddine Bencherchali, Splunk +description: Logs Windows Filtering Platform runtime filter changes, including the change type, provider, filter, layer, conditions, and filter action metadata. +mitre_components: + - Firewall Rule Modification + - Security Policy Modification + - Application Log Content +source: XmlWinEventLog:Security +sourcetype: XmlWinEventLog +separator: EventCode +separator_value: '5447' +configuration: Enable the Audit Filtering Platform Policy Change subcategory to collect Windows Filtering Platform policy events. +supported_TA: + - name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 11.0.2 +fields: + - _time + - Action + - ActivityID + - CalloutKey + - CalloutName + - ChangeType + - Channel + - Computer + - Conditions + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - FilterId + - FilterKey + - FilterName + - FilterType + - Guid + - Keywords + - LayerId + - LayerKey + - LayerName + - Level + - Name + - Opcode + - ProcessID + - ProcessId + - ProviderKey + - ProviderName + - RecordNumber + - SystemTime + - System_Props_Xml + - Task + - ThreadID + - UserName + - UserSid + - Version + - Weight + - action + - app + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dvc + - dvc_nt_host + - event_id + - eventtype + - host + - id + - index + - linecount + - name + - product + - punct + - signature + - signature_id + - source + - sourcetype + - splunk_server + - status + - subject + - ta_windows_action + - tag + - tag::action + - tag::eventtype + - timeendpos + - timestartpos + - user + - vendor + - vendor_product +output_fields: + - dest +example_log: | + 5447001357300x8020000000000000153502136Securityar-win-dc.attackrange.local16824S-1-5-21-3344543075-1022232225-2459664213-500ATTACKRANGE\Administrator{a4b43ab7-75d5-4d88-a62c-8b5d2677c73d}Microsoft Corporation%%16384{da607736-f157-4bdd-9ad9-042516072b55}Custom Outbound Filter%%16387305460{c38d57d1-05a7-4c33-904f-7fbceee60e82}ALE Connect v4 Layer4818446744073709551615Condition ID: {d78e1e87-8644-4ea5-9437-d809ecefc971} Match value: Equal to Condition value: 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \.d.e.v.i.c.e.\. 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k. 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 33 00 5c 00 v.o.l.u.m.e.3.\. 00000030 70 00 72 00 6f 00 67 00-72 00 61 00 6d 00 64 00 p.r.o.g.r.a.m.d. 00000040 61 00 74 00 61 00 5c 00-6d 00 69 00 63 00 72 00 a.t.a.\.m.i.c.r. 00000050 6f 00 73 00 6f 00 66 00-74 00 5c 00 77 00 69 00 o.s.o.f.t.\.w.i. 00000060 6e 00 64 00 6f 00 77 00-73 00 20 00 64 00 65 00 n.d.o.w.s. .d.e. 00000070 66 00 65 00 6e 00 64 00-65 00 72 00 5c 00 70 00 f.e.n.d.e.r.\.p. 00000080 6c 00 61 00 74 00 66 00-6f 00 72 00 6d 00 5c 00 l.a.t.f.o.r.m.\. 00000090 34 00 2e 00 31 00 38 00-2e 00 32 00 36 00 30 00 4...1.8...2.6.0. 000000a0 34 00 30 00 2e 00 37 00-2d 00 30 00 5c 00 6d 00 4.0...7.-.0.\.m. 000000b0 73 00 6d 00 70 00 65 00-6e 00 67 00 2e 00 65 00 s.m.p.e.n.g...e. 000000c0 78 00 65 00 00 00 x.e...%%16389{00000000-0000-0000-0000-000000000000}- diff --git a/detections/application/esxi_encryption_settings_modified.yml b/detections/application/esxi_encryption_settings_modified.yml index fa76c3090d2..8742e7446f5 100644 --- a/detections/application/esxi_encryption_settings_modified.yml +++ b/detections/application/esxi_encryption_settings_modified.yml @@ -1,17 +1,34 @@ name: ESXi Encryption Settings Modified id: dbbbe26f-83fe-4ee3-8b77-ccf7fbd416c8 -version: 5 +version: 6 creation_date: '2025-07-11' -modification_date: '2026-05-13' +modification_date: '2026-08-12' author: Raven Tait, Splunk status: production type: TTP description: Detects the disabling of critical encryption enforcement settings on an ESXi host, such as secure boot or executable verification requirements, which may indicate an attempt to weaken hypervisor integrity or allow unauthorized code execution. data_source: - VMWare ESXi Syslog -search: '`esxi_syslog` Message="*system settings encryption set*" NOT Message="*shell.*" Message IN ("* -s *", "* -e *","*--require-secure-boot*", "*require-exec-installed-only*", "execInstalledOnly") | rex field=_raw "Z (?[\w\.]*)\s.*\]: \[(?\w+)\]:(?.+)" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_encryption_settings_modified_filter`' -how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. -known_false_positives: Limited false positives in most environments, however tune as needed. +search: |- + `esxi_syslog` + Message = "*system settings encryption set*" + NOT Message = "*shell.*" + Message IN ( + "* -e *", + "* -s *", + "*--require-secure-boot*", + "*execInstalledOnly*", + "*require-exec-installed-only*" + ) + | rex field=_raw "Z (?[\w\.]*)\s.*\]: \[(?\w+)\]:(?.+)" + | stats min(_time) as firstTime max(_time) as lastTime count by dest user command + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `esxi_encryption_settings_modified_filter` +how_to_implement: |- + This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. +known_false_positives: |- + Limited false positives in most environments, however tune as needed. drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -22,7 +39,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Encryption settings modified on ESXi host $dest$. + title: Encryption settings modified on ESXi host [$dest$]. entity: field: dest type: system diff --git a/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml b/detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml similarity index 84% rename from detections/web/detect_f5_tmui_rce_cve_2020_5902.yml rename to detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml index 888745f0821..f1845674e2c 100644 --- a/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml +++ b/detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml @@ -1,10 +1,10 @@ name: Detect F5 TMUI RCE CVE-2020-5902 id: 810e4dbc-d46e-11ea-87d0-0242ac130003 -version: 9 +version: 10 creation_date: '2020-08-04' -modification_date: '2026-05-13' +modification_date: '2026-08-10' author: Shannon Davis, Splunk -status: experimental +status: deprecated type: TTP description: The following analytic identifies remote code execution (RCE) attempts targeting F5 BIG-IP, BIG-IQ, and Traffix SDC devices, specifically exploiting CVE-2020-5902. It uses regex to detect patterns in syslog data that match known exploit strings such as "hsqldb;" and directory traversal sequences. This activity is significant because successful exploitation can allow attackers to execute arbitrary commands on the affected devices, leading to full system compromise. If confirmed malicious, this could result in unauthorized access, data exfiltration, or further lateral movement within the network. data_source: [] @@ -33,3 +33,7 @@ product: - Splunk Cloud category: web security_domain: network +deprecation_info: + reason: Detection deprecated as it is targeting a 6 years old CVE that is no longer relevant, since the OS version targeted is no longer supported by F5. As well, the fact that the detection has been set to experimental since 2020. + removed_in_version: 6.6.0 + replacement_content: [] diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml index 9ebd9e75979..c6ae3847820 100644 --- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml @@ -1,26 +1,57 @@ name: Linux Possible Append Command To Profile Config File id: 9c94732a-61af-11ec-91e3-acde48001122 -version: 11 +version: 12 creation_date: '2022-01-11' -modification_date: '2026-05-13' +modification_date: '2026-08-12' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious command-lines that modify user profile files to automatically execute scripts or executables upon system reboot. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving profile files like ~/.bashrc and /etc/profile. This activity is significant as it indicates potential persistence mechanisms used by adversaries to maintain access to compromised hosts. If confirmed malicious, this could allow attackers to execute arbitrary code upon reboot, leading to persistent control over the system and potential further exploitation. +description: |- + The following analytic detects suspicious command-lines that modify user profile files to automatically execute scripts or executables upon system reboot. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving profile files like ~/.bashrc and /etc/profile. + This activity is significant as it indicates potential persistence mechanisms used by adversaries to maintain access to compromised hosts. + If confirmed malicious, this could allow attackers to execute arbitrary code upon reboot, leading to persistent control over the system and potential further exploitation. data_source: - Sysmon for Linux EventID 1 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process = "*echo*" - AND - Processes.process IN("*~/.bashrc", "*~/.bash_profile", "*/etc/profile", "~/.bash_login", "*~/.profile", "~/.bash_logout") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process = "*echo*" + ( + Processes.process IN ("*/home/*", "*~/*") + Processes.process IN ( + "*/.bash_login*", + "*/.bash_logout*", + "*/.bash_profile*", + "*/.bashrc*", + "*/.profile*", + "*/etc/profile*" + ) + OR + ( + Processes.process_current_directory = "/home/*" + Processes.process IN ( + "*.bash_login*", + "*.bash_logout*", + "*.bash_profile*", + "*.bashrc*", + "*.profile*", + "* profile*" + ) + ) + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + process_current_directory Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -44,7 +75,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: a commandline $process$ that may modify profile files on $dest$ + message: The [$process_name$] process is attempting to modify Shell Profile files via the Command Line [$process$] on [$dest$] +threat_objects: + - field: process + type: process analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml index 37c510fdca8..b34b2835a41 100644 --- a/detections/endpoint/ping_sleep_batch_command.yml +++ b/detections/endpoint/ping_sleep_batch_command.yml @@ -1,16 +1,17 @@ name: Ping Sleep Batch Command id: ce058d6c-79f2-11ec-b476-acde48001122 -version: 16 +version: 17 creation_date: '2022-01-20' -modification_date: '2026-05-13' +modification_date: '2026-08-11' author: Teoderick Contreras, Splunk status: production type: Anomaly description: |- - The following analytic identifies the execution of ping sleep batch commands. - It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process command-line details. - This activity is significant as it indicates an attempt to delay malicious code execution, potentially evading detection or sandbox analysis. - If confirmed malicious, this technique allows attackers to bypass security measures, making it harder to detect and analyze their activities, thereby increasing the risk of prolonged unauthorized access and potential data exfiltration. + The following analytic identifies the use of ping commands as a delay or sleep mechanism within batch-style command execution. + It leverages process creation telemetry from Endpoint Detection and Response (EDR) agents and examines process and parent process command-line fields for ping commands that specify a count and are chained with additional commands using command separators or redirection operators. + While execution of the command may generate individual process creation events, such as a separate ping.exe process, this analytic specifically focuses on the original command string passed to a command interpreter, such as cmd.exe /c, that combines the ping-based delay with subsequent command execution. + Adversaries may use ping as an alternative to explicit sleep or timeout commands to introduce execution delays, potentially evading automated analysis, sandboxing, or behavior-based detection. + Because ping is commonly used for legitimate network troubleshooting, findings should be reviewed in the context of the complete command line, parent process, user, and commands executed before or after the delay. data_source: - Sysmon EventID 1 - CrowdStrike ProcessRollup2 @@ -22,13 +23,17 @@ search: |- FROM datamodel=Endpoint.Processes WHERE ( Processes.parent_process= "*ping*" - Processes.parent_process = *-n* + Processes.parent_process IN ( + "*-n*", + "*/n*" + ) Processes.parent_process IN ( "*& *", "*&*", "*&C:*", "*>*", - "*>*" + "*>*", + "*||*" ) ) OR @@ -38,13 +43,17 @@ search: |- OR Processes.original_file_name= "ping.exe" ) - Processes.process = *-n* + Processes.process IN ( + "*-n*", + "*/n*" + ) Processes.process IN ( "*& *", "*&*", "*&C:*", "*>*", - "*>*" + "*>*", + "*||*" ) ) @@ -61,8 +70,16 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ping_sleep_batch_command_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Administrator or network operator may execute this command. Please update the filter macros to remove false positives. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. + These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. + Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Administrators, network operators, scripts, and software installers may legitimately use ping commands as a simple delay mechanism between commands or operations. + Review the full command line, parent process, user context, and surrounding activity to determine whether the execution is expected. + Update the filter macro to exclude known legitimate command patterns or processes in your environment. references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ drilldown_searches: @@ -79,11 +96,16 @@ intermediate_findings: - field: user type: user score: 20 - message: suspicious $process$ commandline run on $dest$ + message: Potential ping-based execution delay detected on [$dest$] by [$user$] via [$process$] - field: dest type: system score: 20 - message: suspicious $process$ commandline run on $dest$ + message: Potential ping-based execution delay detected on [$dest$] by [$user$] via [$process$] +threat_objects: + - field: process + type: process + - field: parent_process + type: parent_process analytic_story: - Warzone RAT - Quasar RAT diff --git a/detections/endpoint/windows_edrsilencer_custom_outbound_filter_added.yml b/detections/endpoint/windows_edrsilencer_custom_outbound_filter_added.yml new file mode 100644 index 00000000000..0a1f79aff1e --- /dev/null +++ b/detections/endpoint/windows_edrsilencer_custom_outbound_filter_added.yml @@ -0,0 +1,98 @@ +name: Windows EDRSilencer Custom Outbound Filter Added +id: 67fea630-445d-4c70-a7d0-584fddb93b86 +version: 1 +creation_date: '2026-08-23' +modification_date: '2026-08-23' +author: Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + The following analytic detects the EDRSilencer-specific Windows Filtering Platform filter name "Custom Outbound Filter" when it is configured with a block action. + EDRSilencer creates WFP filters to block outbound traffic from EDR and security agent processes, impairing endpoint telemetry without requiring the tool binary to keep its original process name. + EventCode 5447 identifies creation of the runtime filter with ChangeType %%16384, while EventCode 5441 can show the same persistent filter when the Base Filtering Engine starts. +data_source: + - Windows Event Log Security 5441 + - Windows Event Log Security 5447 +search: |- + `wineventlog_security` + ( + ( + ( + EventCode=5447 + ChangeType IN ("%%16384", "Add") + ) + OR + EventCode=5441 + ) + Action IN ("%%16389", "Block") + FilterName="Custom Outbound Filter" + ) + + | eval user=coalesce(UserName,user,"unknown") + | eval filter_action=case(Action="%%16389","Block", true(), Action), + change_type=case(ChangeType="%%16384","Add", true(), ChangeType) + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(filter_action) as filter_action + values(change_type) as change_type + values(ProviderName) as provider_name + values(FilterType) as filter_type + values(FilterId) as filter_id + values(FilterKey) as filter_key + values(LayerName) as layer_name + values(LayerId) as layer_id + values(Conditions) as conditions + values(CalloutName) as callout_name + BY dest user process_id FilterName + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_edrsilencer_custom_outbound_filter_added_filter` +how_to_implement: |- + To implement this analytic, enable auditing for Windows Filtering Platform policy changes and ingest Windows Security Event Log data with EventCode 5447 and EventCode 5441. + The Splunk Add-on for Microsoft Windows should extract fields such as EventCode, ChangeType, FilterName, Conditions, and Action from XmlWinEventLog:Security events. +known_false_positives: |- + This filter name is associated with EDRSilencer behavior. + Validate whether any approved administrative tooling creates WFP block filters with the same name before tuning. +references: + - https://github.com/netero1010/EDRSilencer + - https://github.com/mthcht/awesome-lists/blob/main/Lists/Others/windows%20message%20tables/windows_messagetable_strings_list.csv + - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5447 + - https://learn.microsoft.com/en-us/windows/win32/fwp/auditing-and-logging +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: EDRSilencer WFP block filter [$FilterName$] was detected on [$dest$]. + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: FilterName + type: signature +analytic_story: + - Disabling Security Tools + - Security Solution Tampering +asset_type: Endpoint +mitre_attack_id: + - T1685 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1685/edr_silencer/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_filtering_platform_filter_added_to_block_edr_process.yml b/detections/endpoint/windows_filtering_platform_filter_added_to_block_edr_process.yml new file mode 100644 index 00000000000..38d0ae316df --- /dev/null +++ b/detections/endpoint/windows_filtering_platform_filter_added_to_block_edr_process.yml @@ -0,0 +1,153 @@ +name: Windows Filtering Platform Filter Added To Block EDR Process +id: 8bb64b2a-299e-4ddc-a7e1-037bdc5b904a +version: 1 +creation_date: '2026-08-23' +modification_date: '2026-08-23' +author: Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + The following analytic detects Windows Filtering Platform filters that are added and configured to block outbound traffic for known EDR and security agent processes. + Tools such as EDRSilencer abuse WFP to disrupt outbound telemetry from EDR processes, which can bypass detections that only look for the tool process name. + This detection looks for WFP add events with a block action and EDR process names embedded in the hexdump-like Conditions field. +data_source: + - Windows Event Log Security 5447 +search: |- + `wineventlog_security` + EventCode=5447 + ChangeType IN ("%%16384", "Add") + Action IN ("%%16389", "Block") + Conditions=* + + | eval conditions_text=coalesce(Conditions,"") + | rex mode=sed field=conditions_text "s/-/ /g" + | rex mode=sed field=conditions_text "s/[0-9A-Fa-f]{8}\s+([0-9A-Fa-f]{2}\s+){1,16}//g" + | eval conditions_normalized=lower(replace(conditions_text, "[^A-Za-z0-9]", "")) + | eval edr_process=case( + like(conditions_normalized, "%msmpengexe%"), "MsMpEng.exe", + like(conditions_normalized, "%mssenseexe%"), "MsSense.exe", + like(conditions_normalized, "%senseirexe%"), "SenseIR.exe", + like(conditions_normalized, "%sensendrexe%"), "SenseNdr.exe", + like(conditions_normalized, "%sensecncproxyexe%"), "SenseCncProxy.exe", + like(conditions_normalized, "%sensesampleuploaderexe%"), "SenseSampleUploader.exe", + like(conditions_normalized, "%winlogbeatexe%"), "winlogbeat.exe", + like(conditions_normalized, "%elasticagentexe%"), "elastic-agent.exe", + like(conditions_normalized, "%elasticendpointexe%"), "elastic-endpoint.exe", + like(conditions_normalized, "%filebeatexe%"), "filebeat.exe", + like(conditions_normalized, "%xagtexe%"), "xagt.exe", + like(conditions_normalized, "%qualysagentexe%"), "QualysAgent.exe", + like(conditions_normalized, "%sentinelagentexe%"), "SentinelAgent.exe", + like(conditions_normalized, "%sentinelagentworkerexe%"), "SentinelAgentWorker.exe", + like(conditions_normalized, "%sentinelservicehostexe%"), "SentinelServiceHost.exe", + like(conditions_normalized, "%sentinelstaticengineexe%"), "SentinelStaticEngine.exe", + like(conditions_normalized, "%logprocessorserviceexe%"), "LogProcessorService.exe", + like(conditions_normalized, "%sentinelstaticenginescannerexe%"), "SentinelStaticEngineScanner.exe", + like(conditions_normalized, "%sentinelhelperserviceexe%"), "SentinelHelperService.exe", + like(conditions_normalized, "%sentinelbrowsernativehostexe%"), "SentinelBrowserNativeHost.exe", + like(conditions_normalized, "%cylancesvcexe%"), "CylanceSvc.exe", + like(conditions_normalized, "%amsvcexe%"), "AmSvc.exe", + like(conditions_normalized, "%cramtrayexe%"), "CrAmTray.exe", + like(conditions_normalized, "%crssvcexe%"), "CrsSvc.exe", + like(conditions_normalized, "%executionpreventionsvcexe%"), "ExecutionPreventionSvc.exe", + like(conditions_normalized, "%cybereasonavexe%"), "CybereasonAV.exe", + like(conditions_normalized, "%cbexe%"), "cb.exe", + like(conditions_normalized, "%repmgrexe%"), "RepMgr.exe", + like(conditions_normalized, "%reputilsexe%"), "RepUtils.exe", + like(conditions_normalized, "%repuxexe%"), "RepUx.exe", + like(conditions_normalized, "%repwavexe%"), "RepWAV.exe", + like(conditions_normalized, "%repwscexe%"), "RepWSC.exe", + like(conditions_normalized, "%taniumclientexe%"), "TaniumClient.exe", + like(conditions_normalized, "%taniumcxexe%"), "TaniumCX.exe", + like(conditions_normalized, "%taniumdetectengineexe%"), "TaniumDetectEngine.exe", + like(conditions_normalized, "%trapsexe%"), "Traps.exe", + like(conditions_normalized, "%cyserverexe%"), "cyserver.exe", + like(conditions_normalized, "%cyveraserviceexe%"), "CyveraService.exe", + like(conditions_normalized, "%cyvrfsfltexe%"), "CyvrFsFlt.exe", + like(conditions_normalized, "%fortiedrexe%"), "fortiedr.exe", + like(conditions_normalized, "%sfcexe%"), "sfc.exe", + like(conditions_normalized, "%eiconnectorexe%"), "EIConnector.exe", + like(conditions_normalized, "%ekrnexe%"), "ekrn.exe", + like(conditions_normalized, "%hurukaiexe%"), "hurukai.exe", + like(conditions_normalized, "%cetasvcexe%"), "CETASvc.exe", + like(conditions_normalized, "%wscommunicatorexe%"), "WSCommunicator.exe", + like(conditions_normalized, "%endpointbasecampexe%"), "EndpointBasecamp.exe", + like(conditions_normalized, "%tmlistenexe%"), "TmListen.exe", + like(conditions_normalized, "%ntrtscanexe%"), "Ntrtscan.exe", + like(conditions_normalized, "%tmwscsvcexe%"), "TmWSCSvc.exe", + like(conditions_normalized, "%pccntmonexe%"), "PccNTMon.exe", + like(conditions_normalized, "%tmbmsrvexe%"), "TMBMSRV.exe", + like(conditions_normalized, "%cntaosmgrexe%"), "CNTAoSMgr.exe", + like(conditions_normalized, "%tmccsfexe%"), "TmCCSF.exe" + ) + | where isnotnull(edr_process) + | eval user=coalesce(UserName,user,"unknown") + + | eval filter_action=case(Action="%%16389","Block", true(), Action), + change_type=case(ChangeType="%%16384","Add", true(), ChangeType) + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(filter_action) as filter_action + values(change_type) as change_type + values(edr_process) as edr_process + values(ProviderName) as provider_name + values(FilterType) as filter_type + values(FilterId) as filter_id + values(LayerName) as layer_name + values(LayerId) as layer_id + values(Conditions) as conditions + values(CalloutName) as callout_name + + BY dest user process_id FilterName + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_filtering_platform_filter_added_to_block_edr_process_filter` +how_to_implement: |- + To implement this analytic, enable auditing for Windows Filtering Platform policy changes and ingest Windows Security Event Log data with EventCode 5447. The Splunk Add-on for Microsoft Windows should extract fields such as EventCode, ChangeType, FilterName, Conditions, and Action from XmlWinEventLog:Security events. +known_false_positives: |- + Legitimate firewall, VPN, EDR, and Group Policy changes can add WFP block filters. + Tune by approved ProviderName, LayerName, FilterName, or known administrative windows after validating the WFP filter context. +references: + - https://github.com/netero1010/EDRSilencer + - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5447 + - https://learn.microsoft.com/en-us/windows/win32/fwp/auditing-and-logging +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Windows Filtering Platform block filter targeting [$edr_process$] was detected on [$dest$]. + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: edr_process + type: process_name + - field: FilterName + type: signature +analytic_story: + - Disabling Security Tools + - Security Solution Tampering +asset_type: Endpoint +mitre_attack_id: + - T1685 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1685/edr_silencer/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml b/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml index 57fb47d17da..1c849a2aa44 100644 --- a/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml +++ b/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml @@ -1,38 +1,47 @@ name: Windows Set Account Password Policy To Unlimited Via Net id: 11f93009-8083-43fd-82a7-821fcbdc8342 -version: 7 +version: 8 creation_date: '2022-06-24' -modification_date: '2026-05-13' +modification_date: '2026-08-11' author: Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: The following analytic detects the use of net.exe to update user account policies to set passwords as non-expiring. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving "/maxpwage:unlimited" or "/maxpwage:49710", which achieve a similar outcome theoretically. This activity is significant as it can indicate an attempt to maintain persistence, escalate privileges, evade defenses, or facilitate lateral movement. If confirmed malicious, this behavior could allow an attacker to maintain long-term access to compromised accounts, potentially leading to further exploitation and unauthorized access to sensitive information. +description: |- + The following analytic detects the use of net.exe or net1.exe to configure the Windows maximum password age policy as unlimited. + It leverages process creation telemetry from Endpoint Detection and Response (EDR) agents and identifies executions of the `net accounts` command using the `/maxpwage:unlimited` option. + When specified, Windows configures the maximum password age with an unlimited value, effectively preventing passwords governed by the affected password policy from expiring. + This behavior is significant because an adversary may modify password expiration settings to weaken credential security controls and maintain access to compromised accounts for an extended period. + If confirmed malicious, this activity may indicate an attempt to establish or maintain persistence by preventing expected password rotation from invalidating credentials under the affected password policy. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE `process_net` - AND - Processes.process="* accounts *" - AND - (Processes.process="* /maxpwage:unlimited" - OR - Processes.process="/maxpwage:49710") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + `process_net` + Processes.process="* accounts *" + Processes.process IN ("* /maxpwage:unlimited*") + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_set_account_password_policy_to_unlimited_via_net_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: This behavior is not commonly seen in production environment and not advisable, filter as needed. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + This behavior is not commonly seen in production environment and not advisable, investigate the activity and determine if it is malicious. Apply additional filters to reduce false positives as needed. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ - https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/net-commands-on-operating-systems @@ -51,6 +60,11 @@ intermediate_findings: type: system score: 20 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to make non-expiring password on host user accounts. +threat_objects: + - field: parent_process + type: parent_process + - field: process + type: process analytic_story: - Ransomware - BlackByte Ransomware From a5e1ffd6db629f7ddfc5232a8a50e2c3c88a6909 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Mon, 24 Aug 2026 15:40:44 +0200 Subject: [PATCH 072/162] Fix issues in batch - v6.5.0 (#4233) --- detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml | 2 +- .../linux_possible_append_command_to_profile_config_file.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml b/detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml index f1845674e2c..657033ef5a0 100644 --- a/detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml +++ b/detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml @@ -35,5 +35,5 @@ category: web security_domain: network deprecation_info: reason: Detection deprecated as it is targeting a 6 years old CVE that is no longer relevant, since the OS version targeted is no longer supported by F5. As well, the fact that the detection has been set to experimental since 2020. - removed_in_version: 6.6.0 + removed_in_version: 6.8.0 replacement_content: [] diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml index c6ae3847820..e382b1d9060 100644 --- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml @@ -48,7 +48,7 @@ search: |- BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - process_current_directory Processes.process Processes.process_exec Processes.process_guid + Processes.process_current_directory Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product From 086196e9347c5be55f01920640e7c67763903656 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Tue, 25 Aug 2026 14:39:59 +0200 Subject: [PATCH 073/162] Update CODEOWNERS (#4234) --- .github/CODEOWNERS | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 058ddbe15f4..d51104e0810 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,3 +1,3 @@ -* @patel-bhavin @ljstella @nasbench @pyth0n1c @RavenTait @tccontre @rosplk @p4t12ick +* @patel-bhavin @ljstella @nasbench @pyth0n1c @RavenTait @tccontre @rosplk @p4t12ick @onurmerdogan /response_templates/ @kbouchardherjavecgroup @ccl0utier @henryy-splunk -/.github/workflows/response_templates/mcopenapi_public.yml @kbouchardherjavecgroup @ccl0utier @henryy-splunk \ No newline at end of file +/.github/workflows/response_templates/mcopenapi_public.yml @kbouchardherjavecgroup @ccl0utier @henryy-splunk From 9563bc31112ba537f0391af0bb40f9f9efa440d2 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 26 Aug 2026 12:35:06 -0700 Subject: [PATCH 074/162] updating minor text (#4237) --- detections/endpoint/excessive_usage_of_nslookup_app.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 413f138d496..89453e0e89a 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -6,7 +6,7 @@ modification_date: '2026-08-24' author: Teoderick Contreras, Stanislav Miskovic, Splunk status: production type: Anomaly -description: The following analytic detects excessive usage of the nslookup application, which may indicate potential DNS exfiltration attempts. It leverages Sysmon EventCode 1 to monitor process executions, specifically focusing on nslookup.exe. The detection identifies outliers by comparing the frequency of nslookup executions against a calculated threshold. This activity is significant as it can reveal attempts by malware or APT groups to exfiltrate data via DNS queries. If confirmed malicious, this behavior could allow attackers to stealthily transfer sensitive information out of the network, bypassing traditional data exfiltration defenses. +description: The following analytic detects excessive usage of the nslookup application, which may indicate potential DNS exfiltration attempts. It leverages Sysmon EventCode 1 to monitor process executions, specifically focusing on nslookup.exe. The detection identifies outliers by comparing the frequency of nslookup executions against a calculated threshold. This activity is significant as it can reveal attempts by malware or APT groups to exfiltrate data via DNS queries. If confirmed malicious,this behavior could allow attackers to stealthily transfer sensitive information out of the network, bypassing traditional data exfiltration defenses. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 From 0e6ea0aaf720dd5fb7687e35ce843be752b9f951 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Wed, 26 Aug 2026 22:37:08 +0200 Subject: [PATCH 075/162] Small Robot Fixes (#4238) * small fixes * Revert "small fixes" This reverts commit 07a1accbc57356750ef0fe0fbdeff867b51f54e8. * fixes --- .../linux_possible_append_command_to_profile_config_file.yml | 4 ++-- .../endpoint/python_network_traffic_during_package_build.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml index e382b1d9060..cd3a8eca4cd 100644 --- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml @@ -22,14 +22,14 @@ search: |- Processes.process = "*echo*" ( - Processes.process IN ("*/home/*", "*~/*") + Processes.process IN ("*/home/*", "*~/*", "*/etc/*") Processes.process IN ( "*/.bash_login*", "*/.bash_logout*", "*/.bash_profile*", "*/.bashrc*", "*/.profile*", - "*/etc/profile*" + "*/profile*" ) OR ( diff --git a/detections/endpoint/python_network_traffic_during_package_build.yml b/detections/endpoint/python_network_traffic_during_package_build.yml index eeb6f097b73..b5b36b69b29 100644 --- a/detections/endpoint/python_network_traffic_during_package_build.yml +++ b/detections/endpoint/python_network_traffic_during_package_build.yml @@ -46,7 +46,7 @@ search: |- by dest source process_id - | search process="* build_wheel*" + | search process="* build_wheel*" dest_ip=* | table firstTime lastTime parent_process_id parent_process_path parent_process_name parent_process From 870240cabb074a9ae0ae6522be5fd09786fca52c Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 27 Aug 2026 15:28:48 -0700 Subject: [PATCH 076/162] Update data source TA and install.yml app versions (#4235) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali --- data_sources/azure_active_directory.yml | 2 +- ...e_directory_add_app_role_assignment_to_service_principal.yml | 2 +- data_sources/azure_active_directory_add_member_to_role.yml | 2 +- .../azure_active_directory_add_owner_to_application.yml | 2 +- data_sources/azure_active_directory_add_service_principal.yml | 2 +- data_sources/azure_active_directory_add_unverified_domain.yml | 2 +- data_sources/azure_active_directory_consent_to_application.yml | 2 +- .../azure_active_directory_disable_strong_authentication.yml | 2 +- data_sources/azure_active_directory_enable_account.yml | 2 +- data_sources/azure_active_directory_invite_external_user.yml | 2 +- .../azure_active_directory_microsoftgraphactivitylogs.yml | 2 +- .../azure_active_directory_noninteractiveusersigninlogs.yml | 2 +- .../azure_active_directory_reset_password_(by_admin).yml | 2 +- .../azure_active_directory_set_domain_authentication.yml | 2 +- data_sources/azure_active_directory_sign_in_activity.yml | 2 +- data_sources/azure_active_directory_update_application.yml | 2 +- .../azure_active_directory_update_authorization_policy.yml | 2 +- data_sources/azure_active_directory_update_user.yml | 2 +- .../azure_active_directory_user_registered_security_info.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_account.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_runbook.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_webhook.yml | 2 +- data_sources/azure_monitor_activity.yml | 2 +- 23 files changed, 23 insertions(+), 23 deletions(-) diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index ff54229c4ac..2d23314af07 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 output_fields: - dest - user diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index dabaaa7d982..9b4849dfc4d 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index 148ad9f53d6..d33f35db271 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -17,7 +17,7 @@ separator_value: Add member to role supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index 6a3682061cd..23184c3e129 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -17,7 +17,7 @@ separator_value: Add owner to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index a89d51760a4..bbbac95edf0 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index 86ec0e593c7..5328a53ec26 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -17,7 +17,7 @@ separator_value: Add unverified domain supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 2d3dddff8e8..7d826f53702 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -17,7 +17,7 @@ separator_value: Consent to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index 10b5050e7b3..8dec1243776 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -16,7 +16,7 @@ separator_value: Disable Strong Authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 2926d693c9a..6dd0b04531c 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -16,7 +16,7 @@ separator_value: Enable account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 5c989625b73..1c33eb52974 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -16,7 +16,7 @@ separator_value: Invite external user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml index 51cf097b188..87b07760be3 100644 --- a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml +++ b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}' diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml index 161a1d8a1a3..82caf1ffca2 100644 --- a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml +++ b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - action - additional_details diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index bf82955119e..27824f14293 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -16,7 +16,7 @@ separator_value: Reset password (by admin) supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 3b2864dfe1b..e3286081b2e 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -16,7 +16,7 @@ separator_value: Set domain authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index ec07057d4d2..ad9f8217761 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -16,7 +16,7 @@ separator_value: Sign-in activity supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index 94311f56f83..8824c6cce76 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -16,7 +16,7 @@ separator_value: Update application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index adb75dd369f..020e6ab111c 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -16,7 +16,7 @@ separator_value: Update authorization policy supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index 81c651980d2..c1828749459 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -15,7 +15,7 @@ separator_value: Update user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index 3b99c45001e..4227fb11439 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -15,7 +15,7 @@ separator_value: User registered security info supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - Level diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index c08a28064fa..9cc05a766cf 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 6a5cb1015f4..6c791561668 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation Runbook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index 0527fe91051..caa8c9ca1a1 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation webhook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - _time - authorization.action diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index c9824bf8650..8aa47b20cf3 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.2 fields: - column - action From 1e23c3e023e60ef9034cf66eb3858773cf9a77bd Mon Sep 17 00:00:00 2001 From: Casey McGinley <127444568+cmcginley-splunk@users.noreply.github.com> Date: Thu, 27 Aug 2026 15:32:30 -0700 Subject: [PATCH 077/162] chore: bump contentctl.yml and build.yml to 6.6.0 (#4240) Co-authored-by: research bot Co-authored-by: Nasreddine Bencherchali --- build.yml | 2 +- contentctl.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build.yml b/build.yml index aee844016c1..b3a9aac0538 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.5.0 +app_version: 6.6.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index b1f828f54ed..116199c358b 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.5.0 + version: 6.6.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU From 58f87ebacaa3a3e693fbe94883ba0e13cda4e0b6 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 31 Aug 2026 02:15:11 -0700 Subject: [PATCH 078/162] Update data source TA and install.yml app versions (#4246) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/g_suite_drive.yml | 2 +- data_sources/g_suite_gmail.yml | 2 +- data_sources/google_workspace.yml | 2 +- data_sources/google_workspace_login_failure.yml | 2 +- data_sources/google_workspace_login_success.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/data_sources/g_suite_drive.yml b/data_sources/g_suite_drive.yml index b647bf3974f..fb7e5f1b31e 100644 --- a/data_sources/g_suite_drive.yml +++ b/data_sources/g_suite_drive.yml @@ -16,7 +16,7 @@ sourcetype: gsuite:drive:json supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 5.0.0 + version: 5.0.1 fields: - _time - email diff --git a/data_sources/g_suite_gmail.yml b/data_sources/g_suite_gmail.yml index 47a7e83990f..2c599a4533b 100644 --- a/data_sources/g_suite_gmail.yml +++ b/data_sources/g_suite_gmail.yml @@ -15,7 +15,7 @@ sourcetype: gsuite:gmail:bigquery supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 5.0.0 + version: 5.0.1 fields: - _time - action_type diff --git a/data_sources/google_workspace.yml b/data_sources/google_workspace.yml index bde99e8ec1d..8459c1a0de1 100644 --- a/data_sources/google_workspace.yml +++ b/data_sources/google_workspace.yml @@ -10,7 +10,7 @@ sourcetype: gws:reports:login supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 5.0.0 + version: 5.0.1 fields: - action - actor.callerType diff --git a/data_sources/google_workspace_login_failure.yml b/data_sources/google_workspace_login_failure.yml index 774e7c89217..4e26bd7ec61 100644 --- a/data_sources/google_workspace_login_failure.yml +++ b/data_sources/google_workspace_login_failure.yml @@ -17,7 +17,7 @@ separator_value: login_failure supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 5.0.0 + version: 5.0.1 fields: - _time - actor.email diff --git a/data_sources/google_workspace_login_success.yml b/data_sources/google_workspace_login_success.yml index 727e82de8e7..5701798e570 100644 --- a/data_sources/google_workspace_login_success.yml +++ b/data_sources/google_workspace_login_success.yml @@ -17,7 +17,7 @@ separator_value: login_success supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 5.0.0 + version: 5.0.1 fields: - _time - actor.email From 6e80f2911c9ae6e6577ffbbcac0dc3bac76a4efa Mon Sep 17 00:00:00 2001 From: Cole Munz Date: Mon, 31 Aug 2026 04:17:45 -0500 Subject: [PATCH 079/162] Fix original_file_name field typo in whoami and arp discovery detections (#4245) Co-authored-by: Nasreddine Bencherchali --- .../endpoint/network_connection_discovery_with_arp.yml | 6 +++--- detections/endpoint/system_user_discovery_with_whoami.yml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/network_connection_discovery_with_arp.yml b/detections/endpoint/network_connection_discovery_with_arp.yml index 29915a85421..f1074df0d86 100644 --- a/detections/endpoint/network_connection_discovery_with_arp.yml +++ b/detections/endpoint/network_connection_discovery_with_arp.yml @@ -1,8 +1,8 @@ name: Network Connection Discovery With Arp id: ae008c0f-83bd-4ed4-9350-98d4328e15d2 -version: 10 +version: 11 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-08-30' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -22,7 +22,7 @@ search: |- ( Processes.process_name="arp.exe" OR - Processes.process_original_file_name="arp.exe" + Processes.original_file_name="arp.exe" ) Processes.process IN ( "* -a*", diff --git a/detections/endpoint/system_user_discovery_with_whoami.yml b/detections/endpoint/system_user_discovery_with_whoami.yml index 952697b9f19..79d629583e5 100644 --- a/detections/endpoint/system_user_discovery_with_whoami.yml +++ b/detections/endpoint/system_user_discovery_with_whoami.yml @@ -1,8 +1,8 @@ name: System User Discovery With Whoami id: 894fc43e-6f50-47d5-a68b-ee9ee23e18f4 -version: 11 +version: 12 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-08-30' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -16,7 +16,7 @@ search: |- WHERE ( Processes.process_name="whoami.exe" OR - Processes.process_original_file_name="whoami.exe" + Processes.original_file_name="whoami.exe" ) BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid From ad15a0a3cb3ff29dca19160dd5bce30ebad89f78 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 1 Sep 2026 02:04:58 -0700 Subject: [PATCH 080/162] Update data source TA and install.yml app versions (#4252) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/cisco_secure_access_dns.yml | 2 +- data_sources/cisco_secure_access_firewall.yml | 2 +- data_sources/cisco_secure_access_proxy.yml | 2 +- data_sources/linux_auditd_add_user.yml | 2 +- data_sources/linux_auditd_cwd.yml | 2 +- data_sources/linux_auditd_daemon_abort.yml | 2 +- data_sources/linux_auditd_daemon_end.yml | 2 +- data_sources/linux_auditd_daemon_start.yml | 2 +- data_sources/linux_auditd_execve.yml | 2 +- data_sources/linux_auditd_path.yml | 2 +- data_sources/linux_auditd_proctitle.yml | 2 +- data_sources/linux_auditd_service_stop.yml | 2 +- data_sources/linux_auditd_syscall.yml | 2 +- data_sources/linux_messages_syslog.yml | 2 +- data_sources/linux_secure.yml | 2 +- 15 files changed, 15 insertions(+), 15 deletions(-) diff --git a/data_sources/cisco_secure_access_dns.yml b/data_sources/cisco_secure_access_dns.yml index 81ad9560349..e1ce31ca6d7 100644 --- a/data_sources/cisco_secure_access_dns.yml +++ b/data_sources/cisco_secure_access_dns.yml @@ -12,7 +12,7 @@ sourcetype: cisco:cloud_security:dns supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.53 + version: 1.0.54 fields: - RecordType - ReplyCode diff --git a/data_sources/cisco_secure_access_firewall.yml b/data_sources/cisco_secure_access_firewall.yml index d4cd0e777ca..4faa2e264e3 100644 --- a/data_sources/cisco_secure_access_firewall.yml +++ b/data_sources/cisco_secure_access_firewall.yml @@ -10,7 +10,7 @@ sourcetype: cisco:cloud_security:firewall supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.53 + version: 1.0.54 fields: - _time - action diff --git a/data_sources/cisco_secure_access_proxy.yml b/data_sources/cisco_secure_access_proxy.yml index b49c8c2dfe7..1c96a73ef5b 100644 --- a/data_sources/cisco_secure_access_proxy.yml +++ b/data_sources/cisco_secure_access_proxy.yml @@ -12,7 +12,7 @@ sourcetype: cisco:cloud_security:proxy supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.53 + version: 1.0.54 fields: - _time - action diff --git a/data_sources/linux_auditd_add_user.yml b/data_sources/linux_auditd_add_user.yml index 835c71b6a86..e65107d021a 100644 --- a/data_sources/linux_auditd_add_user.yml +++ b/data_sources/linux_auditd_add_user.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - msg - type diff --git a/data_sources/linux_auditd_cwd.yml b/data_sources/linux_auditd_cwd.yml index 49224274460..3ef7f828d7f 100644 --- a/data_sources/linux_auditd_cwd.yml +++ b/data_sources/linux_auditd_cwd.yml @@ -13,7 +13,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - cwd - date_hour diff --git a/data_sources/linux_auditd_daemon_abort.yml b/data_sources/linux_auditd_daemon_abort.yml index e311d746000..5446dd0ae72 100644 --- a/data_sources/linux_auditd_daemon_abort.yml +++ b/data_sources/linux_auditd_daemon_abort.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_end.yml b/data_sources/linux_auditd_daemon_end.yml index 46c537bc68a..6d4a8b23749 100644 --- a/data_sources/linux_auditd_daemon_end.yml +++ b/data_sources/linux_auditd_daemon_end.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_start.yml b/data_sources/linux_auditd_daemon_start.yml index 5c6aa25a0f5..c22e10f4847 100644 --- a/data_sources/linux_auditd_daemon_start.yml +++ b/data_sources/linux_auditd_daemon_start.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - type - op diff --git a/data_sources/linux_auditd_execve.yml b/data_sources/linux_auditd_execve.yml index 231d750fc2c..ca072eadbb8 100644 --- a/data_sources/linux_auditd_execve.yml +++ b/data_sources/linux_auditd_execve.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - msg - type diff --git a/data_sources/linux_auditd_path.yml b/data_sources/linux_auditd_path.yml index b368989f155..2fb58ab7acc 100644 --- a/data_sources/linux_auditd_path.yml +++ b/data_sources/linux_auditd_path.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - msg - type diff --git a/data_sources/linux_auditd_proctitle.yml b/data_sources/linux_auditd_proctitle.yml index 1950f4a8ebe..a344eab2758 100644 --- a/data_sources/linux_auditd_proctitle.yml +++ b/data_sources/linux_auditd_proctitle.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - proctitle - msg diff --git a/data_sources/linux_auditd_service_stop.yml b/data_sources/linux_auditd_service_stop.yml index cdc8d643e7c..124257f391d 100644 --- a/data_sources/linux_auditd_service_stop.yml +++ b/data_sources/linux_auditd_service_stop.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - msg - type diff --git a/data_sources/linux_auditd_syscall.yml b/data_sources/linux_auditd_syscall.yml index 5e99e36493c..9993eff085b 100644 --- a/data_sources/linux_auditd_syscall.yml +++ b/data_sources/linux_auditd_syscall.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - msg - type diff --git a/data_sources/linux_messages_syslog.yml b/data_sources/linux_messages_syslog.yml index 574409798ec..93e9235f301 100644 --- a/data_sources/linux_messages_syslog.yml +++ b/data_sources/linux_messages_syslog.yml @@ -15,7 +15,7 @@ sourcetype: linux_messages_syslog supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - _time - action diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index 648850c8d00..5c10d18458a 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -16,7 +16,7 @@ sourcetype: linux_secure supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - _time - action From da62dd80fa475b38ddb548838bae04c10742eb2d Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 3 Sep 2026 02:27:20 -0700 Subject: [PATCH 081/162] Update data source TA and install.yml app versions (#4255) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/splunk_common_information_model_(cim).yml | 2 +- install.yml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/data_sources/splunk_common_information_model_(cim).yml b/data_sources/splunk_common_information_model_(cim).yml index b3be82871fc..29dd90ca3f9 100644 --- a/data_sources/splunk_common_information_model_(cim).yml +++ b/data_sources/splunk_common_information_model_(cim).yml @@ -10,4 +10,4 @@ sourcetype: not_applicable supported_TA: - name: Splunk Common Information Model (CIM) url: https://splunkbase.splunk.com/app/1621 - version: 8.6.0 + version: 8.7.0 diff --git a/install.yml b/install.yml index 1abe7d5b2bf..f487b52fedb 100644 --- a/install.yml +++ b/install.yml @@ -3,7 +3,7 @@ apps: hardcoded_path: dist/DA-ESS-ContentUpdate.tar.gz - appid: SplunkEnterpriseSecuritySuite url: https://splunkbase.splunk.com/app/263 - version: 8.6.1 + version: 8.7.0 - appid: Splunk_TA_microsoft-iis url: https://splunkbase.splunk.com/app/3185 version: 2.0.0 @@ -30,7 +30,7 @@ apps: version: 1.9.4 - appid: SA-admon url: https://splunkbase.splunk.com/app/6853 - version: 1.1.2 + version: 1.1.3 - appid: TA-crowdstrike-falcon-event-streams url: https://splunkbase.splunk.com/app/5082 version: 3.7.2 @@ -39,4 +39,4 @@ apps: version: 4.0.4 - appid: Splunk_SA_CIM url: https://splunkbase.splunk.com/app/1621 - version: 8.6.0 + version: 8.7.0 From ecb99de1319145b88bd8fecde1078bbec2c8aa79 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 3 Sep 2026 22:29:06 +0200 Subject: [PATCH 082/162] Add NIST RMF Dashboard [Alpha] (#4254) --- .../update_nist_ai_rmf_detection_map.yml | 58 + app_template/default/data/ui/nav/default.xml | 7 +- dashboards/nist_ai_rmf_control_coverage.json | 1032 +++++++++++++++++ dashboards/nist_ai_rmf_control_coverage.yml | 9 + lookups/csv/detection_subcategory_map.csv | 33 + lookups/csv/detection_subcategory_map.yml | 8 + lookups/csv/nist_ai_rmf_subcategories.csv | 73 ++ lookups/csv/nist_ai_rmf_subcategories.yml | 8 + .../generate_nist_ai_rmf_detection_map.py | 404 +++++++ .../nist_ai_rmf_data_sources.yml | 43 + 10 files changed, 1674 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/update_nist_ai_rmf_detection_map.yml create mode 100644 dashboards/nist_ai_rmf_control_coverage.json create mode 100644 dashboards/nist_ai_rmf_control_coverage.yml create mode 100644 lookups/csv/detection_subcategory_map.csv create mode 100644 lookups/csv/detection_subcategory_map.yml create mode 100644 lookups/csv/nist_ai_rmf_subcategories.csv create mode 100644 lookups/csv/nist_ai_rmf_subcategories.yml create mode 100644 scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py create mode 100644 scripts/nist_dashboard/nist_ai_rmf_data_sources.yml diff --git a/.github/workflows/update_nist_ai_rmf_detection_map.yml b/.github/workflows/update_nist_ai_rmf_detection_map.yml new file mode 100644 index 00000000000..96f4d998acf --- /dev/null +++ b/.github/workflows/update_nist_ai_rmf_detection_map.yml @@ -0,0 +1,58 @@ +name: NIST AI RMF Detection Map Update + +on: + workflow_dispatch: + schedule: + - cron: '25 06 * * *' + +permissions: + contents: write + pull-requests: write + +jobs: + update-nist-ai-rmf-detection-map: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v7 + with: + ref: develop + + - name: Set up Python + uses: actions/setup-python@v6 + with: + python-version: '3.14' + architecture: x64 + + - name: Install Python dependencies + run: | + pip install PyYAML==6.0.3 + + - name: Generate NIST AI RMF detection map + run: | + python scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py --modified-date "$(date -u +%F)" + echo "Changed NIST AI RMF lookup files:" + git status --short -- lookups/csv/detection_subcategory_map.csv lookups/csv/detection_subcategory_map.yml + + - name: Create NIST AI RMF detection map update pull request + uses: peter-evans/create-pull-request@v8 + with: + token: ${{ github.token }} + commit-message: Update NIST AI RMF detection map + branch: auto-nist-ai-rmf-detection-map-${{ github.run_number }} + base: develop + title: Automated NIST AI RMF detection map update ${{ github.run_number }} + body: | + This PR updates the generated NIST AI RMF detection-to-subcategory lookup. + + The workflow runs: + + ```bash + python scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py --modified-date "$(date -u +%F)" + ``` + + When `lookups/csv/detection_subcategory_map.csv` changes, the generator also bumps `lookups/csv/detection_subcategory_map.yml` by incrementing `version` and setting `modification_date`. + add-paths: | + lookups/csv/detection_subcategory_map.csv + lookups/csv/detection_subcategory_map.yml diff --git a/app_template/default/data/ui/nav/default.xml b/app_template/default/data/ui/nav/default.xml index 6357d847015..1738ee90689 100644 --- a/app_template/default/data/ui/nav/default.xml +++ b/app_template/default/data/ui/nav/default.xml @@ -2,7 +2,12 @@ - + + + + + + Docs Explore in ES diff --git a/dashboards/nist_ai_rmf_control_coverage.json b/dashboards/nist_ai_rmf_control_coverage.json new file mode 100644 index 00000000000..1fc65b630cc --- /dev/null +++ b/dashboards/nist_ai_rmf_control_coverage.json @@ -0,0 +1,1032 @@ +{ + "visualizations": { + "viz_BQYxvvZQ": { + "type": "splunk.markdown", + "options": { + "markdown": "# Configuration\n\n## Required lookups\n- `nist_ai_rmf_subcategories`: NIST AI RMF reference rows.\n- `detection_subcategory_map`: ESCU detection-to-RMF mapping.\n\n## Macros\n- Configure the AI detection macros for your environment: `mcp_server`, `m365_exported_ediscovery_prompt_logs`, `aws_bedrock_claude`, `ollama_server`, `cisco_ai_defense`.\n- Put index, source, and sourcetype constraints in macros.\n\n## Live findings\n- The Finding Window controls only live risk/notable panels. Coverage, inventory, and QA panels are lookup based.\n- Live panels read `index=risk` and `index=notable`.\n- Enable and schedule mapped ESCU detections and enable risk or notable output.\n- Supported saved-search title format: `ESCU - - Rule`." + } + }, + "viz_QTxzlSCU": { + "type": "splunk.singlevalue", + "options": { + "unit": "%", + "numberPrecision": 1, + "backgroundColor": "> majorValue | rangeValue(convertedColorRange)" + }, + "context": { + "convertedColorRange": [ + { + "from": 75, + "value": "#4C8B5B" + }, + { + "from": 25, + "to": 75, + "value": "#C99A3B" + }, + { + "to": 25, + "value": "#B5432F" + } + ] + }, + "dataSources": { + "primary": "ds_BRlMOk7d" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Overall Coverage" + }, + "viz_cnGGAaf6": { + "type": "splunk.singlevalue", + "options": { + "backgroundColor": "> majorValue | rangeValue(convertedColorRange)" + }, + "context": { + "convertedColorRange": [ + { + "from": 1, + "value": "#4C8B5B" + }, + { + "to": 1, + "value": "#C9CDD1" + } + ] + }, + "dataSources": { + "primary": "ds_gt18ik5M" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Covered Subcategories" + }, + "viz_7wqkM9gb": { + "type": "splunk.singlevalue", + "options": { + "backgroundColor": "> majorValue | rangeValue(convertedColorRange)" + }, + "context": { + "convertedColorRange": [ + { + "from": 10, + "value": "#B5432F" + }, + { + "from": 1, + "to": 10, + "value": "#C99A3B" + }, + { + "to": 1, + "value": "#4C8B5B" + } + ] + }, + "dataSources": { + "primary": "ds_vZrhxFOJ" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Evidence Gaps" + }, + "viz_4Ftbhr59": { + "type": "splunk.singlevalue", + "options": { + "backgroundColor": "> majorValue | rangeValue(convertedColorRange)" + }, + "context": { + "convertedColorRange": [ + { + "from": 1, + "value": "#2F6E7A" + }, + { + "to": 1, + "value": "#C9CDD1" + } + ] + }, + "dataSources": { + "primary": "ds_2SqA5f9A" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Evidence Mappings" + }, + "viz_eW41wskU": { + "type": "splunk.pie", + "options": { + "seriesColorsByField": { + "Covered": "#4C8B5B", + "No Automated Evidence": "#C9CDD1" + } + }, + "dataSources": { + "primary": "ds_63nvtA3f" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Overall Subcategory Coverage" + }, + "viz_73j82pok": { + "type": "splunk.table", + "options": { + "count": 6, + "drilldown": "none", + "showInternalFields": false + }, + "dataSources": { + "primary": "ds_eLy1BISV" + }, + "title": "Current AI Data Sources" + }, + "viz_kKUYcPFZ": { + "type": "splunk.column", + "options": { + "yAxisAbbreviation": "off", + "y2AxisAbbreviation": "off", + "showRoundedY2AxisLabels": false, + "legendTruncation": "ellipsisMiddle", + "showY2MajorGridLines": true, + "yAxisTitleText": "Coverage %", + "yAxisMax": 100, + "seriesColorsByField": { + "coverage_pct": "#2F6E7A" + }, + "legendDisplay": "off" + }, + "dataSources": { + "primary": "ds_hS1OJKg4" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Coverage % by RMF Function" + }, + "viz_hnOFRoBD": { + "type": "splunk.table", + "options": { + "count": 6, + "drilldown": "none", + "showInternalFields": false, + "columnFormat": { + "Issues": { + "rowBackgroundColors": "> table | seriesByName(\"Issues\") | rangeValue(IssuesColumnColorConfig)" + } + } + }, + "context": { + "IssuesColumnColorConfig": [ + { + "to": 1, + "value": "#8FBC8F" + }, + { + "from": 1, + "to": 5, + "value": "#C99A3B" + }, + { + "from": 5, + "value": "#B5432F" + } + ] + }, + "dataSources": { + "primary": "ds_OrjFXleV" + }, + "title": "Lookup QA" + }, + "viz_rBY5q7BC": { + "type": "splunk.table", + "options": { + "count": 5, + "drilldown": "none", + "showInternalFields": false, + "columnFormat": { + "Gaps": { + "rowBackgroundColors": "> table | seriesByName(\"Gaps\") | rangeValue(GapsColumnColorConfig)" + } + } + }, + "context": { + "GapsColumnColorConfig": [ + { + "to": 2, + "value": "#C9CDD1" + }, + { + "from": 2, + "to": 5, + "value": "#C99A3B" + }, + { + "from": 5, + "value": "#B5432F" + } + ] + }, + "dataSources": { + "primary": "ds_7kk8BZgQ" + }, + "title": "Coverage Gaps by Category" + }, + "viz_6bpl5nqi": { + "type": "splunk.table", + "options": { + "count": 15, + "drilldown": "none", + "showInternalFields": false, + "columnFormat": { + "Coverage Score": { + "rowBackgroundColors": "> table | seriesByName(\"Coverage Score\") | rangeValue(CoverageScoreColumnColorConfig)" + }, + "Confidence": { + "rowBackgroundColors": "> table | seriesByName(\"Confidence\") | matchValue(ConfidenceColumnColorConfig)" + }, + "Status": { + "rowBackgroundColors": "> table | seriesByName(\"Status\") | matchValue(StatusColumnColorConfig)" + } + } + }, + "context": { + "CoverageScoreColumnColorConfig": [ + { + "to": 1, + "value": "#D3D3D3" + }, + { + "from": 1, + "to": 80, + "value": "#E8C66A" + }, + { + "from": 80, + "to": 100, + "value": "#8FBC8F" + }, + { + "from": 100, + "value": "#4C8B5B" + } + ], + "ConfidenceColumnColorConfig": [ + { + "match": "Production detection", + "value": "#8FBC8F" + }, + { + "match": "High-confidence mapping", + "value": "#CFE8D4" + }, + { + "match": "Mapped evidence", + "value": "#E8C66A" + }, + { + "match": "Gap", + "value": "#D3D3D3" + } + ], + "StatusColumnColorConfig": [ + { + "match": "Covered", + "value": "#8FBC8F" + }, + { + "match": "No Automated Evidence", + "value": "#D3D3D3" + } + ] + }, + "dataSources": { + "primary": "ds_Twm3TjaW" + }, + "title": "NIST AI RMF Coverage Matrix" + }, + "viz_DsBuvQrU": { + "type": "splunk.bar", + "options": { + "yAxisAbbreviation": "off", + "y2AxisAbbreviation": "off", + "showRoundedY2AxisLabels": false, + "legendTruncation": "ellipsisMiddle", + "showY2MajorGridLines": true, + "stackMode": "stacked", + "xAxisTitleText": "Detections", + "seriesColorsByField": { + "High confidence": "#4C8B5B", + "Medium confidence": "#C99A3B", + "Needs review": "#B5432F", + "Validated legacy": "#2F6E7A", + "Mapped": "#C9CDD1" + }, + "legendDisplay": "right" + }, + "dataSources": { + "primary": "ds_985blmZV" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Mapping Confidence by AI System" + }, + "viz_kSKQYeUh": { + "type": "splunk.column", + "options": { + "yAxisAbbreviation": "off", + "y2AxisAbbreviation": "off", + "showRoundedY2AxisLabels": false, + "legendTruncation": "ellipsisMiddle", + "showY2MajorGridLines": true, + "stackMode": "stacked", + "yAxisTitleText": "Findings", + "seriesColorsByField": { + "critical": "#7A1F1F", + "high": "#B5432F", + "medium": "#C99A3B", + "low": "#4C8B5B", + "info": "#C9CDD1" + }, + "legendDisplay": "right" + }, + "dataSources": { + "primary": "ds_GuKtVyMD" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Recent Finding Volume" + }, + "viz_xPLJvtKV": { + "type": "splunk.line", + "options": { + "yAxisAbbreviation": "off", + "y2AxisAbbreviation": "off", + "showRoundedY2AxisLabels": false, + "legendTruncation": "ellipsisMiddle", + "showY2MajorGridLines": true, + "yAxisTitleText": "Findings", + "seriesColorsByField": { + "MCP": "#2F6E7A", + "M365 Copilot": "#96702C", + "AWS Bedrock Claude": "#4C8B5B", + "Ollama": "#B5432F", + "No live findings": "#C9CDD1" + }, + "legendDisplay": "right" + }, + "dataSources": { + "primary": "ds_baqBk8nw" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Recent Findings Over Time" + }, + "viz_Rn9Wgakt": { + "type": "splunk.table", + "options": { + "count": 6, + "drilldown": "none", + "showInternalFields": false, + "columnFormat": { + "Findings": { + "rowBackgroundColors": "> table | seriesByName(\"Findings\") | rangeValue(FindingsColumnColorConfig)" + } + } + }, + "context": { + "FindingsColumnColorConfig": [ + { + "to": 2, + "value": "#C9CDD1" + }, + { + "from": 2, + "to": 5, + "value": "#C99A3B" + }, + { + "from": 5, + "value": "#B5432F" + } + ] + }, + "dataSources": { + "primary": "ds_dm3yXtFo" + }, + "title": "Top Active Entities" + }, + "viz_FSxVef4D": { + "type": "splunk.table", + "options": { + "count": 6, + "drilldown": "none", + "showInternalFields": false, + "columnFormat": { + "severity": { + "rowBackgroundColors": "> table | seriesByName(\"severity\") | matchValue(severityColumnColorConfig)" + } + } + }, + "context": { + "severityColumnColorConfig": [ + { + "match": "critical", + "value": "#7A1F1F" + }, + { + "match": "high", + "value": "#B5432F" + }, + { + "match": "medium", + "value": "#E8C66A" + }, + { + "match": "low", + "value": "#8FBC8F" + }, + { + "match": "info", + "value": "#C9CDD1" + } + ] + }, + "dataSources": { + "primary": "ds_zqqriYdp" + }, + "title": "Recent Findings Detail" + }, + "viz_liveReadiness": { + "type": "splunk.table", + "options": { + "count": 10, + "drilldown": "none", + "showInternalFields": false, + "columnFormat": { + "Readiness": { + "rowBackgroundColors": "> table | seriesByName(\"Readiness\") | matchValue(ReadinessColumnColorConfig)" + } + } + }, + "context": { + "ReadinessColumnColorConfig": [ + { + "match": "Ready", + "value": "#8FBC8F" + }, + { + "match": "Disabled", + "value": "#E8C66A" + }, + { + "match": "Not scheduled", + "value": "#E8C66A" + }, + { + "match": "No risk/notable action", + "value": "#C99A3B" + }, + { + "match": "Missing saved search", + "value": "#B5432F" + } + ] + }, + "dataSources": { + "primary": "ds_live_readiness" + }, + "title": "Live Findings Readiness" + } + }, + "dataSources": { + "ds_coverage_base": { + "type": "ds.search", + "options": { + "query": "| inputlookup nist_ai_rmf_subcategories\n| eval rmf_row=1\n| fields function category_id subcategory_id subcategory_text rmf_row\n| append\n [ | inputlookup detection_subcategory_map\n | eval selected_ai_system=case(len($ai_system_filter|s$)==0 OR $ai_system_filter|s$==\"*\" OR $ai_system_filter|s$==\"__all__\" OR match($ai_system_filter|s$, \"^\\$.*\\$$\"), \"*\", true(), $ai_system_filter|s$)\n | where selected_ai_system==\"*\" OR ai_system==selected_ai_system\n | eval subcategory_ids=split(coalesce(subcategory_ids,\"\"), \"|\")\n | mvexpand subcategory_ids\n | eval subcategory_id=trim(subcategory_ids)\n | where subcategory_id!=\"\"\n | eval mapped_detection=1\n | eval production_detection=if(lower(coalesce(detection_status,\"\"))==\"production\", 1, 0)\n | eval mapping_confidence=lower(coalesce(mapping_confidence,\"mapped\"))\n | eval mapping_state=case(\n mapping_confidence==\"validated\", \"Validated legacy evidence\",\n mapping_confidence==\"high\", \"High-confidence mapping\",\n mapping_confidence==\"medium\", \"Medium-confidence mapping\",\n mapping_confidence==\"review\", \"Review mapping\",\n mapping_confidence==\"mapped\", \"Mapped legacy evidence\",\n true(), \"Mapped evidence\")\n | fields subcategory_id detection_name ai_system mapped_detection production_detection mapping_confidence mapping_state mapping_source mapping_reason detection_status detection_type analytic_stories data_sources ]\n| stats values(function) as function values(category_id) as category_id values(subcategory_text) as subcategory_text values(detection_name) as detections values(ai_system) as ai_systems dc(detection_name) as detection_count sum(mapped_detection) as mapped_rows sum(production_detection) as production_detections values(mapping_confidence) as mapping_confidence values(mapping_state) as mapping_state values(mapping_source) as mapping_source values(detection_status) as detection_status by subcategory_id\n| eval function=mvindex(function,0), category_id=mvindex(category_id,0), subcategory_text=mvindex(subcategory_text,0)\n| where isnotnull(function) AND isnotnull(category_id)\n| eval detection_count=coalesce(detection_count,0), mapped_rows=coalesce(mapped_rows,0), production_detections=coalesce(production_detections,0)\n| eval status=if(detection_count>0,\"Covered\",\"No Automated Evidence\")\n| eval mapping_confidence_text=mvjoin(mapping_confidence,\"|\")\n| eval confidence=case(production_detections>0,\"Production detection\", match(mapping_confidence_text,\"high\"),\"High-confidence mapping\", detection_count>0,\"Mapped evidence\", true(),\"Gap\")\n| eval selected_function=case($function_filter|s$==\"GOVERN\" OR $function_filter|s$==\"MAP\" OR $function_filter|s$==\"MEASURE\" OR $function_filter|s$==\"MANAGE\", $function_filter|s$, true(), \"*\")\n| where selected_function==\"*\" OR function==selected_function\n| fields - selected_function\n| eval selected_status=case($status_filter|s$==\"Covered\" OR $status_filter|s$==\"No Automated Evidence\", $status_filter|s$, true(), \"*\")\n| where selected_status==\"*\" OR status==selected_status\n| fields - selected_status mapping_confidence_text\n| table function category_id subcategory_id subcategory_text status confidence detection_count production_detections detections ai_systems mapping_state mapping_source detection_status", + "queryParameters": { + "earliest": "0", + "latest": "now" + } + }, + "name": "ds_coverage_base" + }, + "ds_live_findings_base": { + "type": "ds.search", + "options": { + "query": "search (index=risk OR index=notable)\n [ | inputlookup detection_subcategory_map\n | eval selected_ai_system=$ai_system_filter|s$\n | eval selected_ai_system=case(len(selected_ai_system)==0 OR selected_ai_system==\"*\" OR selected_ai_system==\"__all__\" OR match(selected_ai_system, \"^\\$.*\\$$\"), \"*\", true(), selected_ai_system)\n | where selected_ai_system==\"*\" OR ai_system==selected_ai_system\n | eval savedsearch_title=if(match(detection_name,\"^ESCU - .+ - Rule$\"), detection_name, \"ESCU - \".detection_name.\" - Rule\")\n | eval savedsearch_title=trim(savedsearch_title)\n | where match(savedsearch_title,\"^ESCU - [A-Za-z0-9][A-Za-z0-9 _.\\-]{0,180} - Rule$\")\n | stats values(savedsearch_title) as savedsearch_title dc(savedsearch_title) as savedsearch_count\n | eval quoted=\"\\\"\".mvjoin(savedsearch_title,\"\\\",\\\"\").\"\\\"\"\n | eval search=if(savedsearch_count>0, \"(source IN (\".quoted.\") OR search_name IN (\".quoted.\") OR savedsearch_name IN (\".quoted.\") OR orig_source IN (\".quoted.\") OR rule_name IN (\".quoted.\"))\", \"source=\\\"__nist_ai_no_match__\\\"\")\n | return $search ]\n| eval finding_source=case(index=\"risk\",\"risk\", index=\"notable\",\"notable\", true(),index)\n| eval savedsearch_title=coalesce(if(match(search_name,\"^ESCU - .+ - Rule$\"),search_name,null()), if(match(source,\"^ESCU - .+ - Rule$\"),source,null()), if(match(savedsearch_name,\"^ESCU - .+ - Rule$\"),savedsearch_name,null()), if(match(rule_name,\"^ESCU - .+ - Rule$\"),rule_name,null()), if(match(orig_source,\"^ESCU - .+ - Rule$\"),orig_source,null()))\n| where isnotnull(savedsearch_title)\n| rex field=savedsearch_title \"^ESCU - (?.*?)(?: - Rule)?$\"\n| lookup detection_subcategory_map detection_name as detection OUTPUT ai_system subcategory_ids rmf_function analytic_stories\n| where isnotnull(ai_system)\n| eval nist_ai_finding_event_id=coalesce(event_id, source_event_id, sid, _cd, tostring(_time).\"|\".savedsearch_title.\"|\".coalesce(risk_object,\"\").\"|\".coalesce(dest,\"\").\"|\".coalesce(user,\"\").\"|\".coalesce(_raw,\"\"))\n| dedup nist_ai_finding_event_id detection\n| eval risk_numeric=tonumber(coalesce(calculated_risk_score, risk_score))\n| eval severity=case(\n finding_source=\"risk\", lower(coalesce(severity, case(risk_numeric>=80,\"critical\", risk_numeric>=50,\"high\", risk_numeric>=20,\"medium\", risk_numeric>0,\"low\", true(),\"unknown\"))),\n finding_source=\"notable\", lower(coalesce(severity, urgency, \"unknown\")),\n true(), lower(coalesce(severity,\"unknown\")))\n| eval entity=case(\n finding_source=\"risk\", coalesce(risk_object, normalized_risk_object, user, dest, src, host, \"unknown\"),\n finding_source=\"notable\", coalesce(risk_object, normalized_risk_object, user, dest, src, host, rule_name, \"unknown\"),\n true(), coalesce(risk_object, normalized_risk_object, user, dest, src, host, \"unknown\"))\n| eval target=case(\n finding_source=\"risk\", coalesce(risk_object_type, dest, src, user, host, \"\"),\n finding_source=\"notable\", coalesce(dest, src, user, host, \"\"),\n true(), coalesce(dest, src, user, host, \"\"))\n| eval detail=case(\n finding_source=\"risk\", coalesce(risk_message, source, search_name, detection, \"\"),\n finding_source=\"notable\", coalesce(rule_description, description, rule_name, detection, \"\"),\n true(), coalesce(risk_message, rule_description, source, detection, \"\"))\n| eval finding_type=case(finding_source=\"risk\", coalesce(analyticstories, rmf_function, \"Risk event\"), finding_source=\"notable\", coalesce(rmf_function, \"Notable event\"), true(), coalesce(rmf_function,\"Finding\"))\n| eval entity=coalesce(entity,\"unknown\")\n| eval source=coalesce(source, finding_source)\n| eval target=coalesce(target,\"\")\n| eval detail=substr(coalesce(detail,\"\"),1,500)\n| fields _time finding_source ai_system detection finding_type severity entity source target detail", + "queryParameters": { + "earliest": "$global_time.earliest$", + "latest": "$global_time.latest$" + } + }, + "name": "ds_live_findings_base" + }, + "ds_tvTy8Bkv": { + "type": "ds.search", + "options": { + "query": "| inputlookup detection_subcategory_map\n| where isnotnull(ai_system) AND ai_system!=\"\"\n| stats count by ai_system\n| sort ai_system", + "queryParameters": { + "earliest": "0", + "latest": "now" + } + }, + "name": "AI System search" + }, + "ds_BRlMOk7d": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| stats count as total count(eval(status==\"Covered\")) as covered\n| eval pct=if(total=0,0,round(100*covered/total,1))\n| fields pct" + }, + "name": "Overall Coverage - Single value search" + }, + "ds_gt18ik5M": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| stats count(eval(status==\"Covered\")) as covered\n| fields covered" + }, + "name": "Covered Subcategories - Single value search" + }, + "ds_vZrhxFOJ": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| stats count(eval(status==\"No Automated Evidence\")) as gaps\n| fields gaps" + }, + "name": "Evidence Gaps - Single value search" + }, + "ds_2SqA5f9A": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| stats sum(detection_count) as mapped_evidence\n| eval mapped_evidence=coalesce(mapped_evidence,0)\n| fields mapped_evidence" + }, + "name": "Evidence Mappings - Single value search" + }, + "ds_63nvtA3f": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| stats count by status\n| sort status" + }, + "name": "Overall Subcategory Coverage - Pie chart search" + }, + "ds_eLy1BISV": { + "type": "ds.search", + "options": { + "query": "| inputlookup detection_subcategory_map\n| eval selected_ai_system=case(len($ai_system_filter|s$)==0 OR $ai_system_filter|s$==\"*\" OR $ai_system_filter|s$==\"__all__\" OR match($ai_system_filter|s$, \"^\\$.*\\$$\"), \"*\", true(), $ai_system_filter|s$)\n| where selected_ai_system==\"*\" OR ai_system==selected_ai_system\n| where isnotnull(ai_system) AND ai_system!=\"\"\n| eval data_sources=coalesce(data_sources, ai_system)\n| eval data_source_list=split(data_sources,\"|\")\n| eval subcategory_ids=split(coalesce(subcategory_ids,\"\"), \"|\")\n| eval mapped_subcategories=mvcount(subcategory_ids)\n| eval production_detection=if(lower(coalesce(detection_status,\"\"))==\"production\", 1, 0)\n| eval mapping_confidence=lower(coalesce(mapping_confidence,\"mapped\"))\n| eval mapping_confidence=case(mapping_confidence==\"high\",\"High confidence\", mapping_confidence==\"medium\",\"Medium confidence\", mapping_confidence==\"review\",\"Needs review\", mapping_confidence==\"validated\",\"Validated legacy\", true(),\"Mapped\")\n| stats dc(detection_name) as detections values(data_source_list) as data_sources sum(mapped_subcategories) as mapped_subcategories sum(production_detection) as production_detections values(mapping_confidence) as mapping_confidence by ai_system\n| eval data_sources=mvjoin(mvsort(data_sources), \", \")\n| eval mapping_confidence=mvjoin(mvsort(mapping_confidence), \", \")\n| sort -detections ai_system\n| rename ai_system as \"AI System\", data_sources as \"Data Sources\", detections as \"Detections\", mapped_subcategories as \"Mapped Subcategories\", production_detections as \"Production Detections\", mapping_confidence as \"Mapping Confidence\"\n| table \"AI System\" \"Data Sources\" Detections \"Mapped Subcategories\" \"Production Detections\" \"Mapping Confidence\"", + "queryParameters": { + "earliest": "0", + "latest": "now" + } + }, + "name": "Current AI Data Sources - Table search" + }, + "ds_hS1OJKg4": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| stats count as total count(eval(status==\"Covered\")) as covered_n by function\n| eval coverage_pct=if(total=0,0,round(100*covered_n/total,1))\n| eval function_order=case(function=\"GOVERN\",1,function=\"MAP\",2,function=\"MEASURE\",3,function=\"MANAGE\",4,true(),99)\n| sort function_order\n| table function coverage_pct" + }, + "name": "Coverage % by RMF Function - Column chart search" + }, + "ds_OrjFXleV": { + "type": "ds.search", + "options": { + "query": "| makeresults\n| eval qa_check=\"Invalid subcategory IDs|Blank AI systems|Blank data sources|Duplicate mappings|Review mappings|Unexpected validated_count|Unsafe detection names\"\n| makemv delim=\"|\" qa_check\n| mvexpand qa_check\n| eval issue_count=0, examples=\"\"\n| append\n [ | inputlookup detection_subcategory_map\n | eval subcategory_ids=split(coalesce(subcategory_ids,\"\"),\"|\")\n | mvexpand subcategory_ids\n | eval subcategory_id=trim(subcategory_ids)\n | eval mapped=1\n | fields detection_name ai_system subcategory_id mapped\n | append\n [ | inputlookup nist_ai_rmf_subcategories\n | eval valid_rmf=1\n | fields subcategory_id valid_rmf ]\n | stats max(mapped) as mapped max(valid_rmf) as valid_rmf values(detection_name) as detections by subcategory_id\n | where mapped==1 AND isnull(valid_rmf)\n | eval qa_check=\"Invalid subcategory IDs\", examples=subcategory_id.\" / \".mvindex(detections,0), issue_count=1\n | fields qa_check issue_count examples ]\n| append\n [ | inputlookup detection_subcategory_map\n | where isnull(ai_system) OR trim(ai_system)==\"\"\n | eval qa_check=\"Blank AI systems\", issue_count=1, examples=coalesce(detection_name,\"\")\n | fields qa_check issue_count examples ]\n| append\n [ | inputlookup detection_subcategory_map\n | eval data_sources=coalesce(data_sources,\"\")\n | where isnull(data_sources) OR trim(data_sources)==\"\"\n | eval qa_check=\"Blank data sources\", issue_count=1, examples=coalesce(detection_name,\"\")\n | fields qa_check issue_count examples ]\n| append\n [ | inputlookup detection_subcategory_map\n | eval subcategory_ids=split(coalesce(subcategory_ids,\"\"),\"|\")\n | mvexpand subcategory_ids\n | eval subcategory_id=trim(subcategory_ids)\n | stats count as duplicate_count by detection_name ai_system subcategory_id\n | where duplicate_count>1\n | eval qa_check=\"Duplicate mappings\", issue_count=duplicate_count-1, examples=detection_name.\" / \".ai_system.\" / \".subcategory_id\n | fields qa_check issue_count examples ]\n| append\n [ | inputlookup detection_subcategory_map\n | eval mapping_confidence=lower(coalesce(mapping_confidence,\"\")), mapping_source=lower(coalesce(mapping_source,\"\"))\n | where mapping_confidence==\"review\" OR mapping_source==\"generated_review\"\n | eval qa_check=\"Review mappings\", issue_count=1, examples=coalesce(detection_name,\"\").\" / \".coalesce(mapping_reason,\"\")\n | fields qa_check issue_count examples ]\n| append\n [ | inputlookup detection_subcategory_map\n | where isnotnull(validated_count)\n | eval validated_count=trim(tostring(validated_count))\n | where validated_count!=\"\" AND lower(validated_count)!=\"null\" AND NOT match(validated_count,\"^[0-9]+$\")\n | eval qa_check=\"Unexpected validated_count\", issue_count=1, examples=coalesce(detection_name,\"\").\" / \".validated_count\n | fields qa_check issue_count examples ]\n| append\n [ | inputlookup detection_subcategory_map\n | eval expected_savedsearch=if(match(detection_name,\"^ESCU - .+ - Rule$\"), detection_name, \"ESCU - \".detection_name.\" - Rule\")\n | eval expected_savedsearch=trim(expected_savedsearch)\n | where NOT match(expected_savedsearch,\"^ESCU - [A-Za-z0-9][A-Za-z0-9 _.\\-]{0,180} - Rule$\")\n | eval qa_check=\"Unsafe detection names\", issue_count=1, examples=coalesce(detection_name,\"\")\n | fields qa_check issue_count examples ]\n| stats sum(issue_count) as Issues values(examples) as examples by qa_check\n| eval examples=mvfilter(examples!=\"\")\n| eval Examples=mvjoin(mvindex(examples,0,5), \"; \")\n| rename qa_check as \"QA Check\"\n| table \"QA Check\" Issues Examples\n| sort -Issues \"QA Check\"", + "queryParameters": { + "earliest": "0", + "latest": "now" + } + }, + "name": "Lookup QA - Table search" + }, + "ds_7kk8BZgQ": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| where status==\"No Automated Evidence\"\n| stats count as gaps values(subcategory_id) as subcategories by function category_id\n| rename function as Function, category_id as Category, gaps as Gaps, subcategories as Subcategories\n| sort -Gaps Function Category" + }, + "name": "Coverage Gaps by Category - Table search" + }, + "ds_Twm3TjaW": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| eval coverage_score=case(confidence==\"Production detection\",100, confidence==\"High-confidence mapping\",80, confidence==\"Mapped evidence\",60, true(),0)\n| eval function_order=case(function=\"GOVERN\",1,function=\"MAP\",2,function=\"MEASURE\",3,function=\"MANAGE\",4,true(),99)\n| sort function_order category_id subcategory_id\n| rename function as Function, category_id as Category, subcategory_id as Subcategory, coverage_score as \"Coverage Score\", confidence as Confidence, detection_count as Detections, production_detections as \"Production Detections\", ai_systems as \"AI Systems\", subcategory_text as \"Subcategory Text\", mapping_state as \"Mapping State\", detection_status as \"Detection Status\", status as Status\n| table Function Category Subcategory \"Coverage Score\" Confidence Detections \"Production Detections\" \"AI Systems\" \"Mapping State\" \"Detection Status\" \"Subcategory Text\" Status" + }, + "name": "NIST AI RMF Coverage Detail - Table search" + }, + "ds_985blmZV": { + "type": "ds.search", + "options": { + "query": "| inputlookup detection_subcategory_map\n| eval selected_ai_system=case(len($ai_system_filter|s$)==0 OR $ai_system_filter|s$==\"*\" OR $ai_system_filter|s$==\"__all__\" OR match($ai_system_filter|s$, \"^\\$.*\\$$\"), \"*\", true(), $ai_system_filter|s$)\n| where selected_ai_system==\"*\" OR ai_system==selected_ai_system\n| where isnotnull(ai_system) AND ai_system!=\"\"\n| eval mapping_confidence=lower(coalesce(mapping_confidence,\"mapped\"))\n| eval mapping_confidence=case(mapping_confidence==\"high\",\"High confidence\", mapping_confidence==\"medium\",\"Medium confidence\", mapping_confidence==\"review\",\"Needs review\", mapping_confidence==\"validated\",\"Validated legacy\", true(),\"Mapped\")\n| stats count as detections by ai_system mapping_confidence\n| chart sum(detections) over ai_system by mapping_confidence\n| fillnull value=0", + "queryParameters": { + "earliest": "0", + "latest": "now" + } + }, + "name": "Mapping Confidence by AI System - Bar chart search" + }, + "ds_GuKtVyMD": { + "type": "ds.chain", + "options": { + "extend": "ds_live_findings_base", + "query": "| chart count over ai_system by severity\n| appendpipe\n [ | stats count as result_count\n | where result_count==0\n | eval ai_system=\"No live findings\", info=0\n | fields - result_count ]\n| fillnull value=0" + }, + "name": "Recent Finding Volume - Column chart search" + }, + "ds_baqBk8nw": { + "type": "ds.chain", + "options": { + "extend": "ds_live_findings_base", + "query": "| timechart count by ai_system\n| appendpipe\n [ | stats count as result_count\n | where result_count==0\n | eval _time=now(), \"No live findings\"=0\n | fields _time \"No live findings\" ]\n| fillnull value=0" + }, + "name": "Recent Findings Over Time - Line chart search" + }, + "ds_dm3yXtFo": { + "type": "ds.chain", + "options": { + "extend": "ds_live_findings_base", + "query": "| stats count as findings dc(detection) as detection_types values(ai_system) as ai_systems values(severity) as severities values(finding_source) as finding_sources max(_time) as last_time by entity\n| eval lastSeen=strftime(last_time,\"%Y-%m-%d %H:%M:%S\")\n| rename entity as Entity, findings as Findings, detection_types as \"Detection Types\", ai_systems as \"AI Systems\", severities as Severities, finding_sources as \"Finding Sources\", lastSeen as \"Last Seen\"\n| sort -Findings\n| table Entity Findings \"Detection Types\" \"AI Systems\" Severities \"Finding Sources\" \"Last Seen\"\n| appendpipe\n [ | stats count as result_count\n | where result_count==0\n | eval Entity=\"No live findings\", Findings=0, \"Detection Types\"=\"Enable and schedule mapped AI detections\", \"AI Systems\"=\"Check Live Findings Readiness\", Severities=\"info\", \"Finding Sources\"=\"risk/notable\", \"Last Seen\"=\"No events in selected Finding Window\"\n | fields - result_count ]" + }, + "name": "Top Active Entities - Table search" + }, + "ds_zqqriYdp": { + "type": "ds.chain", + "options": { + "extend": "ds_live_findings_base", + "query": "| eval eventTime=strftime(_time,\"%Y-%m-%d %H:%M:%S\")\n| sort -_time\n| rename finding_source as source_type\n| table eventTime source_type ai_system severity entity detection target detail\n| appendpipe\n [ | stats count as result_count\n | where result_count==0\n | eval eventTime=\"\", source_type=\"Configuration\", ai_system=\"No live findings\", severity=\"info\", entity=\"No risk/notable events in selected window\", detection=\"Enable and schedule mapped AI detections\", target=\"\", detail=\"All mapped detections are disabled or no risk/notable output has been generated. Check Live Findings Readiness.\"\n | fields - result_count ]" + }, + "name": "Recent Findings Detail - Table search" + }, + "ds_live_readiness": { + "type": "ds.search", + "options": { + "query": "| inputlookup detection_subcategory_map\n| eval selected_ai_system=case(len($ai_system_filter|s$)==0 OR $ai_system_filter|s$==\"*\" OR $ai_system_filter|s$==\"__all__\" OR match($ai_system_filter|s$, \"^\\$.*\\$$\"), \"*\", true(), $ai_system_filter|s$)\n| where selected_ai_system==\"*\" OR ai_system==selected_ai_system\n| eval expected_savedsearch=if(match(detection_name,\"^ESCU - .+ - Rule$\"), detection_name, \"ESCU - \".detection_name.\" - Rule\")\n| eval expected_savedsearch=trim(expected_savedsearch)\n| where match(expected_savedsearch,\"^ESCU - [A-Za-z0-9][A-Za-z0-9 _.\\-]{0,180} - Rule$\")\n| eval mapped=1\n| fields ai_system data_sources detection_name expected_savedsearch mapped\n| append\n [ | rest /servicesNS/-/-/saved/searches splunk_server=local\n | rename title as expected_savedsearch\n | eval savedsearch_present=1\n | eval enabled=if(disabled==0 OR disabled==\"0\",\"Enabled\",\"Disabled\")\n | eval scheduled=if(is_scheduled==1 OR is_scheduled==\"1\",\"Scheduled\",\"Not scheduled\")\n | eval finding_output=case(match(actions,\"(^|,)risk(,|$)\") OR 'action.risk'==1 OR 'action.risk'==\"1\",\"Risk\", match(actions,\"(^|,)notable(,|$)\") OR 'action.notable'==1 OR 'action.notable'==\"1\",\"Notable\", true(),\"No risk/notable\")\n | eval schedule=coalesce(cron_schedule,\"\"), window=coalesce('dispatch.earliest_time',\"\").\" to \".coalesce('dispatch.latest_time',\"\")\n | fields expected_savedsearch savedsearch_present enabled scheduled finding_output schedule window ]\n| stats max(mapped) as mapped values(ai_system) as ai_system values(data_sources) as data_sources values(detection_name) as detection_name max(savedsearch_present) as savedsearch_present values(enabled) as enabled values(scheduled) as scheduled values(finding_output) as finding_output values(schedule) as schedule values(window) as window by expected_savedsearch\n| where mapped==1\n| eval present=if(savedsearch_present==1,\"Present\",\"Missing\")\n| eval enabled=coalesce(mvindex(enabled,0),\"Missing\")\n| eval scheduled=coalesce(mvindex(scheduled,0),\"Missing\")\n| eval finding_output=coalesce(mvindex(finding_output,0),\"Missing\")\n| eval readiness=case(present==\"Missing\",\"Missing saved search\", enabled!=\"Enabled\",\"Disabled\", scheduled!=\"Scheduled\",\"Not scheduled\", finding_output==\"No risk/notable\",\"No risk/notable action\", true(),\"Ready\")\n| eval data_sources=mvjoin(mvsort(data_sources),\", \")\n| eval schedule=coalesce(mvindex(schedule,0),\"\"), window=coalesce(mvindex(window,0),\"\")\n| sort readiness ai_system detection_name\n| rename ai_system as \"AI System\", detection_name as Detection, expected_savedsearch as \"Saved Search\", readiness as Readiness, finding_output as \"Finding Output\", schedule as Schedule, window as Window, data_sources as \"Data Sources\"\n| table \"AI System\" Detection \"Saved Search\" Readiness \"Finding Output\" Schedule Window \"Data Sources\"", + "queryParameters": { + "earliest": "0", + "latest": "now" + } + }, + "name": "Live Findings Readiness - Table search" + } + }, + "defaults": { + "dataSources": { + "ds.search": { + "options": { + "queryParameters": { + "latest": "$global_time.latest$", + "earliest": "$global_time.earliest$" + } + } + } + } + }, + "inputs": { + "input_JACuzsvA": { + "type": "input.timerange", + "options": { + "token": "global_time", + "defaultValue": "-90d@d,now" + }, + "title": "Finding Window" + }, + "input_3BYkUTy7": { + "type": "input.dropdown", + "options": { + "defaultValue": "*", + "items": [ + { + "value": "*", + "label": "All functions" + }, + { + "value": "GOVERN", + "label": "GOVERN" + }, + { + "value": "MAP", + "label": "MAP" + }, + { + "value": "MEASURE", + "label": "MEASURE" + }, + { + "value": "MANAGE", + "label": "MANAGE" + } + ], + "token": "function_filter" + }, + "title": "RMF Function" + }, + "input_rjZO3BZq": { + "type": "input.dropdown", + "options": { + "defaultValue": "*", + "items": [ + { + "value": "*", + "label": "All statuses" + }, + { + "value": "Covered", + "label": "Covered" + }, + { + "value": "No Automated Evidence", + "label": "No Automated Evidence" + } + ], + "token": "status_filter" + }, + "title": "Coverage Status" + }, + "input_jgTDQthW": { + "type": "input.dropdown", + "options": { + "defaultValue": "__all__", + "items": ">frame(label, value) | prepend(formattedStatics) | objects()", + "token": "ai_system_filter" + }, + "title": "AI System", + "context": { + "formattedConfig": { + "number": { + "prefix": "" + } + }, + "formattedStatics": ">statics | formatByType(formattedConfig)", + "statics": [ + [ + "All AI systems" + ], + [ + "__all__" + ] + ], + "label": ">primary | seriesByName(\"ai_system\") | renameSeries(\"label\") | formatByType(formattedConfig)", + "value": ">primary | seriesByName(\"ai_system\") | renameSeries(\"value\") | formatByType(formattedConfig)" + }, + "dataSources": { + "primary": "ds_tvTy8Bkv" + } + } + }, + "layout": { + "type": "grid", + "options": { + "submitButton": false, + "height": 4460, + "width": 1440, + "submitOnDashboardLoad": true + }, + "structure": [ + { + "item": "viz_BQYxvvZQ", + "type": "block", + "position": { + "x": 0, + "y": 0, + "w": 1440, + "h": 390 + } + }, + { + "item": "viz_QTxzlSCU", + "type": "block", + "position": { + "x": 0, + "y": 390, + "w": 360, + "h": 210 + } + }, + { + "item": "viz_cnGGAaf6", + "type": "block", + "position": { + "x": 360, + "y": 390, + "w": 360, + "h": 210 + } + }, + { + "item": "viz_7wqkM9gb", + "type": "block", + "position": { + "x": 720, + "y": 390, + "w": 360, + "h": 210 + } + }, + { + "item": "viz_4Ftbhr59", + "type": "block", + "position": { + "x": 1080, + "y": 390, + "w": 360, + "h": 210 + } + }, + { + "item": "viz_eW41wskU", + "type": "block", + "position": { + "x": 0, + "y": 600, + "w": 720, + "h": 300 + } + }, + { + "item": "viz_73j82pok", + "type": "block", + "position": { + "x": 720, + "y": 600, + "w": 720, + "h": 300 + } + }, + { + "item": "viz_kKUYcPFZ", + "type": "block", + "position": { + "x": 0, + "y": 900, + "w": 1440, + "h": 280 + } + }, + { + "item": "viz_hnOFRoBD", + "type": "block", + "position": { + "x": 0, + "y": 1180, + "w": 1440, + "h": 280 + } + }, + { + "item": "viz_rBY5q7BC", + "type": "block", + "position": { + "x": 0, + "y": 1460, + "w": 1440, + "h": 420 + } + }, + { + "item": "viz_6bpl5nqi", + "type": "block", + "position": { + "x": 0, + "y": 1880, + "w": 1440, + "h": 520 + } + }, + { + "item": "viz_DsBuvQrU", + "type": "block", + "position": { + "x": 0, + "y": 2400, + "w": 1440, + "h": 300 + } + }, + { + "item": "viz_kSKQYeUh", + "type": "block", + "position": { + "x": 0, + "y": 3060, + "w": 1440, + "h": 280 + } + }, + { + "item": "viz_liveReadiness", + "type": "block", + "position": { + "x": 0, + "y": 2700, + "w": 1440, + "h": 360 + } + }, + { + "item": "viz_xPLJvtKV", + "type": "block", + "position": { + "x": 0, + "y": 3340, + "w": 1440, + "h": 280 + } + }, + { + "item": "viz_Rn9Wgakt", + "type": "block", + "position": { + "x": 0, + "y": 3620, + "w": 1440, + "h": 420 + } + }, + { + "item": "viz_FSxVef4D", + "type": "block", + "position": { + "x": 0, + "y": 4040, + "w": 1440, + "h": 420 + } + } + ], + "globalInputs": [ + "input_JACuzsvA", + "input_3BYkUTy7", + "input_rjZO3BZq", + "input_jgTDQthW" + ] + }, + "description": "Maps AI-related ESCU detections and ESCU-generated risk/notable findings to NIST AI RMF subcategories for coverage review, gap analysis, and operational follow-up. Coverage is generated from detection metadata and configured AI data-source selectors; live findings are limited to standard ESCU rule saved-search output in the form ESCU - - Rule. The mapping is practitioner-maintained operational guidance and is not an official NIST or Splunk taxonomy.", + "title": "NIST AI RMF Control Coverage" +} diff --git a/dashboards/nist_ai_rmf_control_coverage.yml b/dashboards/nist_ai_rmf_control_coverage.yml new file mode 100644 index 00000000000..14cd65d6510 --- /dev/null +++ b/dashboards/nist_ai_rmf_control_coverage.yml @@ -0,0 +1,9 @@ +name: NIST AI RMF Control Coverage +id: 426d4e21-dace-4d38-b292-6cc49a376251 +version: 2 +creation_date: '2026-09-02' +modification_date: '2026-09-02' +author: Nasreddine Bencherchali, Rod Soto, Splunk +description: |- + Maps AI-related ESCU detections and ESCU-generated risk/notable findings to NIST AI RMF subcategories for coverage review, gap analysis, and operational follow-up. + Coverage is generated from detection metadata and configured AI data-source selectors; live findings are limited to standard ESCU rule saved-search output in the form "ESCU - - Rule". diff --git a/lookups/csv/detection_subcategory_map.csv b/lookups/csv/detection_subcategory_map.csv new file mode 100644 index 00000000000..391d63fab3e --- /dev/null +++ b/lookups/csv/detection_subcategory_map.csv @@ -0,0 +1,33 @@ +ai_system,data_sources,detection_name,detection_status,detection_type,analytic_stories,rmf_function,subcategory_ids,mapping_confidence,mapping_source,mapping_reason +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Cross Region Possible Inference Abuse,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude excessive use of tokens,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE|MANAGE,Measure 2.7|Manage 4.1|Manage 4.3,high,generated_rule,AI security and resilience evaluation signal; Post-deployment monitoring and response signal; Incident tracking or response signal +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Hostile Prompt Sentiment,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.6,high,generated_rule,Prompt-behavior and harmful-content measurement signal +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Possible Prompt Injection,production,Hunting,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Sensitive Data in Prompts,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Unusually Large Prompts,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal +Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Security Alerts by Application Name,production,Anomaly,Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal +Local LLM Frameworks,CrowdStrike ProcessRollup2|Sysmon EventID 1|Windows Event Log Security 4688,Windows Local LLM Framework Execution,production,Hunting,Suspicious Local LLM Frameworks,GOVERN|MAP,Govern 1.6|Map 4.1|Map 4.2,high,generated_rule,"AI system or access inventory signal; AI component, model, or service discovery signal; AI system operating context signal" +Local LLM Frameworks,Sysmon EventID 11,LLM Model File Creation,production,Hunting,Suspicious Local LLM Frameworks,GOVERN|MAP,Govern 1.6|Map 4.1,high,generated_rule,"AI system or access inventory signal; AI component, model, or service discovery signal" +Local LLM Frameworks,Sysmon EventID 22,Local LLM Framework DNS Query,production,Hunting,Suspicious Local LLM Frameworks,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" +M365 Copilot,M365 Copilot Graph API,M365 Copilot Application Usage Pattern Anomalies,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal +M365 Copilot,M365 Copilot Graph API,M365 Copilot Failed Authentication Patterns,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal +M365 Copilot,M365 Copilot Graph API,M365 Copilot Non Compliant Devices Accessing M365 Copilot,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,GOVERN,Govern 1.6,high,generated_rule,AI system or access inventory signal +M365 Copilot,M365 Copilot Graph API,M365 Copilot Session Origin Anomalies,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Agentic Jailbreak Attack,experimental,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Impersonation Jailbreak Attack,experimental,TTP,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Information Extraction Jailbreak Attack,experimental,TTP,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7|Measure 2.10,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal; Sensitive information or data-protection signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Jailbreak Attempts,experimental,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +MCP,MCP Server,MCP Filesystem Server Suspicious Extension Write,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal +MCP,MCP Server,MCP Github Suspicious Operation,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal +MCP,MCP Server,MCP Postgres Suspicious Query,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal +MCP,MCP Server,MCP Prompt Injection,production,TTP,Suspicious MCP Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +MCP,MCP Server,MCP Sensitive System File Search,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal +Ollama,Ollama Server,Ollama Abnormal Network Connectivity,experimental,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" +Ollama,Ollama Server,Ollama Abnormal Service Crash Availability Attack,experimental,Anomaly,Suspicious Ollama Activities,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal +Ollama,Ollama Server,Ollama Excessive API Requests,experimental,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal +Ollama,Ollama Server,Ollama Possible API Endpoint Scan Reconnaissance,experimental,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" +Ollama,Ollama Server,Ollama Possible Memory Exhaustion Resource Abuse,experimental,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal +Ollama,Ollama Server,Ollama Possible Model Exfiltration Data Leakage,experimental,Anomaly,Suspicious Ollama Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal +Ollama,Ollama Server,Ollama Possible RCE via Model Loading,experimental,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.7|Manage 4.3,high,generated_rule,AI security and resilience evaluation signal; Incident tracking or response signal +Ollama,Ollama Server,Ollama Suspicious Prompt Injection Jailbreak,experimental,Anomaly,Suspicious Ollama Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal diff --git a/lookups/csv/detection_subcategory_map.yml b/lookups/csv/detection_subcategory_map.yml new file mode 100644 index 00000000000..b98d706b65d --- /dev/null +++ b/lookups/csv/detection_subcategory_map.yml @@ -0,0 +1,8 @@ +name: detection_subcategory_map +id: 41c7e6c8-b835-4dd8-b7ed-b1f5d8476e84 +version: 2 +creation_date: '2026-09-02' +modification_date: '2026-09-02' +author: Nasreddine Bencherchali, Rod Soto, Splunk Threat Research Team +lookup_type: csv +description: Generated mapping of AI-related ESCU detections to NIST AI RMF subcategory IDs for dashboard coverage reporting. Regenerate with scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py when AI data sources or detections change. diff --git a/lookups/csv/nist_ai_rmf_subcategories.csv b/lookups/csv/nist_ai_rmf_subcategories.csv new file mode 100644 index 00000000000..55c4da35deb --- /dev/null +++ b/lookups/csv/nist_ai_rmf_subcategories.csv @@ -0,0 +1,73 @@ +"function","category_id","category_text","subcategory_id","subcategory_text" +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.1","Legal and regulatory requirements involving AI are understood, managed, and documented." +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.2","The characteristics of trustworthy AI are integrated into organizational policies, processes, procedures, and practices." +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.3","Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization's risk tolerance." +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.4","The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities." +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.5","Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review." +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.6","Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities." +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.7","Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization's trustworthiness." +"GOVERN","Govern 2","Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained for mapping, measuring, and managing AI risks.","Govern 2.1","Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization." +"GOVERN","Govern 2","Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained for mapping, measuring, and managing AI risks.","Govern 2.2","The organization's personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements." +"GOVERN","Govern 2","Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained for mapping, measuring, and managing AI risks.","Govern 2.3","Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment." +"GOVERN","Govern 3","Workforce diversity, equity, inclusion, and accessibility processes are prioritized in the mapping, measuring, and managing of AI risks throughout the lifecycle.","Govern 3.1","Decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds)." +"GOVERN","Govern 3","Workforce diversity, equity, inclusion, and accessibility processes are prioritized in the mapping, measuring, and managing of AI risks throughout the lifecycle.","Govern 3.2","Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems." +"GOVERN","Govern 4","Organizational teams are committed to a culture that considers and communicates AI risk.","Govern 4.1","Organizational policies and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts." +"GOVERN","Govern 4","Organizational teams are committed to a culture that considers and communicates AI risk.","Govern 4.2","Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly." +"GOVERN","Govern 4","Organizational teams are committed to a culture that considers and communicates AI risk.","Govern 4.3","Organizational practices are in place to enable AI testing, identification of incidents, and information sharing." +"GOVERN","Govern 5","Processes are in place for robust engagement with relevant AI actors.","Govern 5.1","Organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks." +"GOVERN","Govern 5","Processes are in place for robust engagement with relevant AI actors.","Govern 5.2","Mechanisms are established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation." +"GOVERN","Govern 6","Policies and procedures are in place to address AI risks and benefits arising from third-party software and data and other supply chain issues.","Govern 6.1","Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party's intellectual property or other rights." +"GOVERN","Govern 6","Policies and procedures are in place to address AI risks and benefits arising from third-party software and data and other supply chain issues.","Govern 6.2","Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk." +"MANAGE","Manage 1","AI risks based on assessments and other analytical output from the MAP and MEASURE functions are prioritized, responded to, and managed.","Manage 1.1","A determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed." +"MANAGE","Manage 1","AI risks based on assessments and other analytical output from the MAP and MEASURE functions are prioritized, responded to, and managed.","Manage 1.2","Treatment of documented AI risks is prioritized based on impact, likelihood, and available resources or methods." +"MANAGE","Manage 1","AI risks based on assessments and other analytical output from the MAP and MEASURE functions are prioritized, responded to, and managed.","Manage 1.3","Responses to the AI risks deemed high priority, as identified by the map function, are developed, planned, and documented. Risk response options can include mitigating, transferring, avoiding, or accepting." +"MANAGE","Manage 1","AI risks based on assessments and other analytical output from the MAP and MEASURE functions are prioritized, responded to, and managed.","Manage 1.4","Negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users are documented." +"MANAGE","Manage 2","Strategies to maximize AI benefits and minimize negative impacts are planned, prepared, implemented, documented, and informed by input from relevant AI actors.","Manage 2.1","Resources required to manage AI risks are taken into account - along with viable non-AI alternative systems, approaches, or methods - to reduce the magnitude or likelihood of potential impacts." +"MANAGE","Manage 2","Strategies to maximize AI benefits and minimize negative impacts are planned, prepared, implemented, documented, and informed by input from relevant AI actors.","Manage 2.2","Mechanisms are in place and applied to sustain the value of deployed AI systems." +"MANAGE","Manage 2","Strategies to maximize AI benefits and minimize negative impacts are planned, prepared, implemented, documented, and informed by input from relevant AI actors.","Manage 2.3","Procedures are followed to respond to and recover from a previously unknown risk when it is identified." +"MANAGE","Manage 2","Strategies to maximize AI benefits and minimize negative impacts are planned, prepared, implemented, documented, and informed by input from relevant AI actors.","Manage 2.4","Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use." +"MANAGE","Manage 3","AI risks and benefits from third-party entities are managed.","Manage 3.1","AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented." +"MANAGE","Manage 3","AI risks and benefits from third-party entities are managed.","Manage 3.2","Pre-trained models which are used for development are monitored as part of AI system regular monitoring and maintenance." +"MANAGE","Manage 4","Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored regularly.","Manage 4.1","Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management." +"MANAGE","Manage 4","Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored regularly.","Manage 4.2","Measurable activities for continual improvements are integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors." +"MANAGE","Manage 4","Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored regularly.","Manage 4.3","Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented." +"MAP","Map 1","Context is established and understood.","Map 1.1","Intended purposes, potentially beneficial uses, context-specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented. Considerations include: the specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes, uses, and risks across the development or product AI lifecycle; and related TEVV and system metrics." +"MAP","Map 1","Context is established and understood.","Map 1.2","Interdisciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation is documented. Opportunities for interdisciplinary collaboration are prioritized." +"MAP","Map 1","Context is established and understood.","Map 1.3","The organization's mission and relevant goals for AI technology are understood and documented." +"MAP","Map 1","Context is established and understood.","Map 1.4","The business value or context of business use has been clearly defined or - in the case of assessing existing AI systems - re-evaluated." +"MAP","Map 1","Context is established and understood.","Map 1.5","Organizational risk tolerances are determined and documented." +"MAP","Map 1","Context is established and understood.","Map 1.6","System requirements (e.g., 'the system shall respect the privacy of its users') are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks." +"MAP","Map 2","Categorization of the AI system is performed.","Map 2.1","The specific tasks and methods used to implement the tasks that the AI system will support are defined (e.g., classifiers, generative models, recommenders)." +"MAP","Map 2","Categorization of the AI system is performed.","Map 2.2","Information about the AI system's knowledge limits and how system output may be utilized and overseen by humans is documented. Documentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions." +"MAP","Map 2","Categorization of the AI system is performed.","Map 2.3","Scientific integrity and TEVV considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation." +"MAP","Map 3","AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood.","Map 3.1","Potential benefits of intended AI system functionality and performance are examined and documented." +"MAP","Map 3","AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood.","Map 3.2","Potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness - as connected to organizational risk tolerance - are examined and documented." +"MAP","Map 3","AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood.","Map 3.3","Targeted application scope is specified and documented based on the system's capability, established context, and AI system categorization." +"MAP","Map 3","AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood.","Map 3.4","Processes for operator and practitioner proficiency with AI system performance and trustworthiness - and relevant technical standards and certifications - are defined, assessed, and documented." +"MAP","Map 3","AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood.","Map 3.5","Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the govern function." +"MAP","Map 4","Risks and benefits are mapped for all components of the AI system including third-party software and data.","Map 4.1","Approaches for mapping AI technology and legal risks of its components - including the use of third-party data or software - are in place, followed, and documented, as are risks of infringement of a third party's intellectual property or other rights." +"MAP","Map 4","Risks and benefits are mapped for all components of the AI system including third-party software and data.","Map 4.2","Internal risk controls for components of the AI system, including third-party AI technologies, are identified and documented." +"MAP","Map 5","Impacts to individuals, groups, communities, organizations, and society are characterized.","Map 5.1","Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented." +"MAP","Map 5","Impacts to individuals, groups, communities, organizations, and society are characterized.","Map 5.2","Practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts are in place and documented." +"MEASURE","Measure 1","Appropriate methods and metrics are identified and applied.","Measure 1.1","Approaches and metrics for measurement of AI risks enumerated during the map function are selected for implementation starting with the most significant AI risks. The risks or trustworthiness characteristics that will not - or cannot - be measured are properly documented." +"MEASURE","Measure 1","Appropriate methods and metrics are identified and applied.","Measure 1.2","Appropriateness of AI metrics and effectiveness of existing controls are regularly assessed and updated, including reports of errors and potential impacts on affected communities." +"MEASURE","Measure 1","Appropriate methods and metrics are identified and applied.","Measure 1.3","Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. Domain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.1","Test sets, metrics, and details about the tools used during TEVV are documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.10","Privacy risk of the AI system - as identified in the map function - is examined and documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.11","Fairness and bias - as identified in the map function - are evaluated and results are documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.12","Environmental impact and sustainability of AI model training and management activities - as identified in the map function - are assessed and documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.13","Effectiveness of the employed TEVV metrics and processes in the measure function are evaluated and documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.2","Evaluations involving human subjects meet applicable requirements (including human subject protection) and are representative of the relevant population." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.3","AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s). Measures are documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.4","The functionality and behavior of the AI system and its components - as identified in the map function - are monitored when in production." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.5","The AI system to be deployed is demonstrated to be valid and reliable. Limitations of the generalizability beyond the conditions under which the technology was developed are documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.6","The AI system is evaluated regularly for safety risks - as identified in the map function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.7","AI system security and resilience - as identified in the map function - are evaluated and documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.8","Risks associated with transparency and accountability - as identified in the map function - are examined and documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.9","The AI model is explained, validated, and documented, and AI system output is interpreted within its context - as identified in the map function - to inform responsible use and governance." +"MEASURE","Measure 3","Mechanisms for tracking identified AI risks over time are in place.","Measure 3.1","Approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts." +"MEASURE","Measure 3","Mechanisms for tracking identified AI risks over time are in place.","Measure 3.2","Risk tracking approaches are considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available." +"MEASURE","Measure 3","Mechanisms for tracking identified AI risks over time are in place.","Measure 3.3","Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics." +"MEASURE","Measure 4","Feedback about efficacy of measurement is gathered and assessed.","Measure 4.1","Measurement approaches for identifying AI risks are connected to deployment context(s) and informed through consultation with domain experts and other end users. Approaches are documented." +"MEASURE","Measure 4","Feedback about efficacy of measurement is gathered and assessed.","Measure 4.2","Measurement results regarding AI system trustworthiness in deployment context(s) and across the AI lifecycle are informed by input from domain experts and relevant AI actors to validate whether the system is performing consistently as intended. Results are documented." +"MEASURE","Measure 4","Feedback about efficacy of measurement is gathered and assessed.","Measure 4.3","Measurable performance improvements or declines based on consultations with relevant AI actors, including affected communities, and field data about context-relevant risks and trustworthiness characteristics are identified and documented." diff --git a/lookups/csv/nist_ai_rmf_subcategories.yml b/lookups/csv/nist_ai_rmf_subcategories.yml new file mode 100644 index 00000000000..2381c3c4ef5 --- /dev/null +++ b/lookups/csv/nist_ai_rmf_subcategories.yml @@ -0,0 +1,8 @@ +name: nist_ai_rmf_subcategories +id: ac42b14f-4f89-45c9-bc3d-728109b3b3b1 +version: 1 +creation_date: '2026-09-02' +modification_date: '2026-09-02' +author: Nasreddine Bencherchali, Rod Soto, Splunk Threat Research Team +lookup_type: csv +description: NIST AI RMF function, category, and subcategory reference data used by the NIST AI RMF Control Coverage dashboard. diff --git a/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py b/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py new file mode 100644 index 00000000000..9b651f28e65 --- /dev/null +++ b/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py @@ -0,0 +1,404 @@ +#!/usr/bin/env python3 +"""Generate the NIST AI RMF detection-to-subcategory lookup from ESCU detections.""" + +from __future__ import annotations + +import argparse +import csv +import io +import re +import sys +from collections import defaultdict +from dataclasses import dataclass +from datetime import date +from pathlib import Path +from typing import Any + +import yaml + + +DEFAULT_CONFIG = Path("scripts/nist_dashboard/nist_ai_rmf_data_sources.yml") +DEFAULT_DETECTIONS_DIR = Path("detections") +DEFAULT_RMF_LOOKUP = Path("lookups/csv/nist_ai_rmf_subcategories.csv") +DEFAULT_OUTPUT = Path("lookups/csv/detection_subcategory_map.csv") +DEFAULT_METADATA = Path("lookups/csv/detection_subcategory_map.yml") + +FIELDNAMES = [ + "ai_system", + "data_sources", + "detection_name", + "detection_status", + "detection_type", + "analytic_stories", + "rmf_function", + "subcategory_ids", + "mapping_confidence", + "mapping_source", + "mapping_reason", +] + +FUNCTION_ORDER = { + "GOVERN": 1, + "MAP": 2, + "MEASURE": 3, + "MANAGE": 4, +} + + +@dataclass(frozen=True) +class DataSourceSelector: + name: str + ai_system: str + analytic_stories: tuple[str, ...] = () + + +@dataclass(frozen=True) +class MappingRule: + pattern: re.Pattern[str] + subcategory_ids: tuple[str, ...] + reason: str + confidence: str = "high" + + +RULES: tuple[MappingRule, ...] = ( + MappingRule( + re.compile(r"\b(non[- ]?compliant|unauthorized|unmanaged).*(device|ai|llm)|\b(local llm framework execution|model file creation)\b", re.I), + ("Govern 1.6",), + "AI system or access inventory signal", + ), + MappingRule( + re.compile(r"\b(local llm|framework dns|model file creation|network connectivity|api endpoint scan|reconnaissance|cross[- ]?region)\b", re.I), + ("Map 4.1",), + "AI component, model, or service discovery signal", + ), + MappingRule( + re.compile(r"\bwindows local llm framework execution\b", re.I), + ("Map 4.2",), + "AI system operating context signal", + ), + MappingRule( + re.compile(r"\b(unusually large|excessive.*tokens?|excessive.*api requests?|memory exhaustion|application usage pattern|session origin|behavior anomaly|failed authentication)\b", re.I), + ("Measure 2.4",), + "Production behavior monitoring signal", + ), + MappingRule( + re.compile(r"\b(prompt injection|jailbreak|ignore previous|system prompt override|hostile prompt|sentiment)\b", re.I), + ("Measure 2.6",), + "Prompt-behavior and harmful-content measurement signal", + ), + MappingRule( + re.compile(r"\b(prompt injection|jailbreak|agentic|impersonation|rce|remote code|model loading|suspicious extension write|github suspicious|postgres suspicious|tool invocation)\b", re.I), + ("Measure 2.7",), + "AI security and resilience evaluation signal", + ), + MappingRule( + re.compile(r"\b(sensitive data|credential|secret|api key|information extraction|system file|model exfiltration|data leakage|/etc/passwd|\.aws/credentials)\b", re.I), + ("Measure 2.10",), + "Sensitive information or data-protection signal", + ), + MappingRule( + re.compile(r"\b(failed authentication|service crash|availability|memory exhaustion|excessive.*api requests?|security alerts?|critical alerts?|high risk filesystem|exec tool|delete guardrail|delete knowledge base|delete model invocation logging)\b", re.I), + ("Manage 4.1",), + "Post-deployment monitoring and response signal", + ), + MappingRule( + re.compile(r"\b(high risk filesystem|exec tool|rce|remote code|incident|delete guardrail|delete knowledge base|delete model invocation logging)\b", re.I), + ("Manage 4.3",), + "Incident tracking or response signal", + ), +) + + +def parse_args() -> argparse.Namespace: + parser = argparse.ArgumentParser( + description=( + "Generate lookups/csv/detection_subcategory_map.csv from ESCU detection " + "metadata and a configured list of AI-related data sources." + ) + ) + parser.add_argument("--config", type=Path, default=DEFAULT_CONFIG, help=f"Data source config. Default: {DEFAULT_CONFIG}") + parser.add_argument( + "--data-source", + action="append", + default=[], + help="Additional data source name to include. The AI system defaults to the data source name.", + ) + parser.add_argument("--detections-dir", type=Path, default=DEFAULT_DETECTIONS_DIR, help=f"Detections directory. Default: {DEFAULT_DETECTIONS_DIR}") + parser.add_argument("--rmf-lookup", type=Path, default=DEFAULT_RMF_LOOKUP, help=f"NIST AI RMF subcategory lookup. Default: {DEFAULT_RMF_LOOKUP}") + parser.add_argument("--output", type=Path, default=DEFAULT_OUTPUT, help=f"CSV output path. Default: {DEFAULT_OUTPUT}") + parser.add_argument("--metadata", type=Path, default=DEFAULT_METADATA, help=f"Lookup metadata YAML to bump when --output changes. Default: {DEFAULT_METADATA}") + parser.add_argument("--modified-date", default=None, help="Metadata modification date in YYYY-MM-DD format. Default: today.") + parser.add_argument("--no-metadata-update", action="store_true", help="Do not bump lookup metadata when --output changes.") + parser.add_argument("--include-deprecated", action="store_true", help="Include detections under detections/deprecated and detections with deprecated status.") + parser.add_argument("--dry-run", action="store_true", help="Write generated CSV to stdout instead of --output.") + return parser.parse_args() + + +def as_list(value: Any) -> list[str]: + if value is None: + return [] + if isinstance(value, list): + return [str(item).strip() for item in value if str(item).strip()] + text = str(value).strip() + return [text] if text else [] + + +def norm(value: str) -> str: + return re.sub(r"\s+", " ", value.strip()).casefold() + + +def load_yaml(path: Path) -> dict[str, Any]: + with path.open(encoding="utf-8") as handle: + loaded = yaml.safe_load(handle) or {} + if not isinstance(loaded, dict): + raise ValueError(f"{path} must contain a YAML mapping") + return loaded + + +def load_selectors(config_path: Path, cli_data_sources: list[str]) -> list[DataSourceSelector]: + selectors: list[DataSourceSelector] = [] + + if config_path.exists(): + config = load_yaml(config_path) + configured_sources = config.get("data_sources", []) + if not isinstance(configured_sources, list): + raise ValueError(f"{config_path}: data_sources must be a list") + for item in configured_sources: + if isinstance(item, str): + selectors.append(DataSourceSelector(name=item, ai_system=item)) + continue + if not isinstance(item, dict): + raise ValueError(f"{config_path}: each data_sources entry must be a string or mapping") + name = str(item.get("name", "")).strip() + if not name: + raise ValueError(f"{config_path}: data source entry is missing name") + ai_system = str(item.get("ai_system") or name).strip() + stories = tuple(as_list(item.get("analytic_stories") or item.get("analytic_story"))) + selectors.append(DataSourceSelector(name=name, ai_system=ai_system, analytic_stories=stories)) + + for data_source in cli_data_sources: + data_source = data_source.strip() + if data_source: + selectors.append(DataSourceSelector(name=data_source, ai_system=data_source)) + + if not selectors: + raise ValueError("No data sources configured. Add --data-source or provide a config file.") + + deduped: dict[tuple[str, str, tuple[str, ...]], DataSourceSelector] = {} + for selector in selectors: + deduped[(norm(selector.name), norm(selector.ai_system), tuple(norm(s) for s in selector.analytic_stories))] = selector + return list(deduped.values()) + + +def load_valid_subcategories(path: Path) -> dict[str, str]: + valid: dict[str, str] = {} + with path.open(newline="", encoding="utf-8-sig") as handle: + reader = csv.DictReader(handle) + required = {"function", "subcategory_id"} + missing = required - set(reader.fieldnames or []) + if missing: + raise ValueError(f"{path} is missing required columns: {', '.join(sorted(missing))}") + for row in reader: + subcategory_id = (row.get("subcategory_id") or "").strip() + function = (row.get("function") or "").strip().upper() + if subcategory_id: + valid[subcategory_id] = function + if not valid: + raise ValueError(f"{path} did not contain any subcategory IDs") + return valid + + +def detection_files(root: Path, include_deprecated: bool) -> list[Path]: + files = sorted(root.rglob("*.yml")) + if include_deprecated: + return files + return [path for path in files if "deprecated" not in {part.casefold() for part in path.parts}] + + +def selector_matches(selector: DataSourceSelector, detection_data_sources: set[str], detection_stories: set[str]) -> bool: + if norm(selector.name) not in detection_data_sources: + return False + if selector.analytic_stories and not ({norm(story) for story in selector.analytic_stories} & detection_stories): + return False + return True + + +def confidence_rank(confidence: str) -> int: + return {"review": 1, "medium": 2, "high": 3}.get(confidence, 1) + + +def derive_mapping(detection: dict[str, Any], valid_subcategories: dict[str, str]) -> tuple[list[str], str, str, str]: + context_fields = [ + detection.get("name"), + detection.get("type"), + detection.get("status"), + " ".join(as_list(detection.get("data_source"))), + " ".join(as_list(detection.get("analytic_story"))), + ] + context = " ".join(str(field) for field in context_fields if field) + + subcategory_ids: list[str] = [] + reasons: list[str] = [] + confidence = "review" + for rule in RULES: + if rule.pattern.search(context): + for subcategory_id in rule.subcategory_ids: + if subcategory_id not in subcategory_ids: + subcategory_ids.append(subcategory_id) + if rule.reason not in reasons: + reasons.append(rule.reason) + if confidence_rank(rule.confidence) > confidence_rank(confidence): + confidence = rule.confidence + + if not subcategory_ids: + subcategory_ids = ["Measure 2.4"] + confidence = "review" + reasons = ["AI data source matched, but no specific RMF rule matched"] + + invalid = [subcategory_id for subcategory_id in subcategory_ids if subcategory_id not in valid_subcategories] + if invalid: + raise ValueError(f"{detection.get('name', '')} mapped to unknown RMF subcategories: {', '.join(invalid)}") + + functions = sorted( + {valid_subcategories[subcategory_id] for subcategory_id in subcategory_ids}, + key=lambda item: FUNCTION_ORDER.get(item, 99), + ) + mapping_source = "generated_rule" if confidence != "review" else "generated_review" + return subcategory_ids, "|".join(functions), confidence, "; ".join(reasons) + + +def rows_from_detections( + detections_dir: Path, + selectors: list[DataSourceSelector], + valid_subcategories: dict[str, str], + include_deprecated: bool, +) -> list[dict[str, str]]: + rows_by_key: dict[tuple[str, str], dict[str, str]] = {} + data_sources_by_key: dict[tuple[str, str], set[str]] = defaultdict(set) + + for path in detection_files(detections_dir, include_deprecated): + detection = load_yaml(path) + name = str(detection.get("name", "")).strip() + if not name: + continue + + status = str(detection.get("status", "")).strip() + if not include_deprecated and status.casefold() == "deprecated": + continue + + data_source_values = as_list(detection.get("data_source")) + story_values = as_list(detection.get("analytic_story")) + detection_data_sources = {norm(value) for value in data_source_values} + detection_stories = {norm(value) for value in story_values} + + matched_by_ai_system: dict[str, set[str]] = defaultdict(set) + for selector in selectors: + if selector_matches(selector, detection_data_sources, detection_stories): + matched_by_ai_system[selector.ai_system].add(selector.name) + + if not matched_by_ai_system: + continue + + subcategory_ids, rmf_function, confidence, reason = derive_mapping(detection, valid_subcategories) + for ai_system, matched_sources in matched_by_ai_system.items(): + key = (ai_system, name) + data_sources_by_key[key].update(matched_sources) + rows_by_key[key] = { + "ai_system": ai_system, + "data_sources": "", + "detection_name": name, + "detection_status": status, + "detection_type": str(detection.get("type", "")).strip(), + "analytic_stories": "|".join(story_values), + "rmf_function": rmf_function, + "subcategory_ids": "|".join(subcategory_ids), + "mapping_confidence": confidence, + "mapping_source": "generated_rule" if confidence != "review" else "generated_review", + "mapping_reason": reason, + } + + rows = list(rows_by_key.values()) + for row in rows: + key = (row["ai_system"], row["detection_name"]) + row["data_sources"] = "|".join(sorted(data_sources_by_key[key], key=str.casefold)) + rows.sort(key=lambda row: (row["ai_system"].casefold(), row["data_sources"].casefold(), row["detection_name"].casefold())) + return rows + + +def render_csv(rows: list[dict[str, str]]) -> str: + output = io.StringIO() + writer = csv.DictWriter(output, fieldnames=FIELDNAMES, lineterminator="\n") + writer.writeheader() + writer.writerows(rows) + return output.getvalue() + + +def write_csv_if_changed(content: str, output: Path | None) -> bool: + if output is None: + sys.stdout.write(content) + return True + + output.parent.mkdir(parents=True, exist_ok=True) + if output.exists() and output.read_text(encoding="utf-8") == content: + return False + + with output.open("w", newline="", encoding="utf-8") as handle: + handle.write(content) + return True + + +def validate_modified_date(value: str | None) -> str: + if value is None: + return date.today().isoformat() + if not re.fullmatch(r"\d{4}-\d{2}-\d{2}", value): + raise ValueError("--modified-date must use YYYY-MM-DD format") + return value + + +def bump_lookup_metadata(path: Path, modification_date: str) -> int: + metadata = load_yaml(path) + try: + version = int(metadata.get("version", 0)) + except (TypeError, ValueError) as exc: + raise ValueError(f"{path}: version must be an integer") from exc + + metadata["version"] = version + 1 + metadata["modification_date"] = modification_date + + with path.open("w", encoding="utf-8", newline="\n") as handle: + yaml.safe_dump(metadata, handle, sort_keys=False, width=120) + return metadata["version"] + + +def main() -> int: + args = parse_args() + selectors = load_selectors(args.config, args.data_source) + valid_subcategories = load_valid_subcategories(args.rmf_lookup) + rows = rows_from_detections(args.detections_dir, selectors, valid_subcategories, args.include_deprecated) + + if not rows: + raise ValueError("No detection mappings were generated. Check the configured data source names.") + + csv_content = render_csv(rows) + output_changed = write_csv_if_changed(csv_content, None if args.dry_run else args.output) + + message = f"Generated {len(rows)} detection mappings from {len(selectors)} data source selectors." + if not args.dry_run: + if output_changed and not args.no_metadata_update: + new_version = bump_lookup_metadata(args.metadata, validate_modified_date(args.modified_date)) + message += f" {args.metadata} bumped to version {new_version}." + elif output_changed: + message += " Output changed; metadata update skipped." + else: + message += " Output unchanged." + + print(message, file=sys.stderr) + return 0 + + +if __name__ == "__main__": + try: + raise SystemExit(main()) + except Exception as exc: + print(f"error: {exc}", file=sys.stderr) + raise SystemExit(1) diff --git a/scripts/nist_dashboard/nist_ai_rmf_data_sources.yml b/scripts/nist_dashboard/nist_ai_rmf_data_sources.yml new file mode 100644 index 00000000000..d20b0d09ce4 --- /dev/null +++ b/scripts/nist_dashboard/nist_ai_rmf_data_sources.yml @@ -0,0 +1,43 @@ +data_sources: + - name: AWS Bedrock Claude + ai_system: AWS Bedrock Claude + + - name: M365 Exported eDiscovery Prompts + ai_system: M365 Copilot + + - name: M365 Copilot Graph API + ai_system: M365 Copilot + + - name: MCP Server + ai_system: MCP + + - name: Ollama Server + ai_system: Ollama + + - name: Cisco AI Defense Alerts + ai_system: Cisco AI Defense + + - name: Sysmon EventID 11 + ai_system: Local LLM Frameworks + analytic_stories: + - Suspicious Local LLM Frameworks + + - name: Sysmon EventID 22 + ai_system: Local LLM Frameworks + analytic_stories: + - Suspicious Local LLM Frameworks + + - name: Sysmon EventID 1 + ai_system: Local LLM Frameworks + analytic_stories: + - Suspicious Local LLM Frameworks + + - name: Windows Event Log Security 4688 + ai_system: Local LLM Frameworks + analytic_stories: + - Suspicious Local LLM Frameworks + + - name: CrowdStrike ProcessRollup2 + ai_system: Local LLM Frameworks + analytic_stories: + - Suspicious Local LLM Frameworks From 9b137cefd950f7c04f9cb1affc7b71a7e79c93dd Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 4 Sep 2026 16:29:11 +0200 Subject: [PATCH 083/162] Content Updates & Fixes - Batch 6.6 (#4251) --- .../lolbas_with_network_traffic.yml | 12 +- ...ile_download_or_read_to_pipe_execution.yml | 12 +- detections/endpoint/icacls_deny_command.yml | 55 +++--- .../linux_data_destruction_command.yml | 60 ++++--- .../linux_ghostscript_exploitation.yml | 6 +- ...as_network_connection_on_uncommon_port.yml | 166 ++++++++++++++++++ .../lolbas_rare_network_connection.yml | 144 +++++++++++++++ detections/endpoint/macos_account_created.yml | 6 +- detections/endpoint/macos_data_chunking.yml | 6 +- .../endpoint/powershell_4104_hunting.yml | 139 +++++++++++---- .../endpoint/suspicious_wevtutil_usage.yml | 70 ++++++-- .../windows_process_execution_in_temp_dir.yml | 6 +- .../windows_suspicious_process_file_path.yml | 6 +- .../windows_tinycc_shellcode_execution.yml | 50 +++--- ...swow64_process_run_system32_executable.yml | 6 +- .../citrix_adc_exploitation_cve_2023_3519.yml | 18 +- removed/stories/lateral_movement.yml | 6 +- 17 files changed, 617 insertions(+), 151 deletions(-) rename detections/{endpoint => deprecated}/lolbas_with_network_traffic.yml (92%) create mode 100644 detections/endpoint/lolbas_network_connection_on_uncommon_port.yml create mode 100644 detections/endpoint/lolbas_rare_network_connection.yml diff --git a/detections/endpoint/lolbas_with_network_traffic.yml b/detections/deprecated/lolbas_with_network_traffic.yml similarity index 92% rename from detections/endpoint/lolbas_with_network_traffic.yml rename to detections/deprecated/lolbas_with_network_traffic.yml index 21fafb429e7..0910406a7c1 100644 --- a/detections/endpoint/lolbas_with_network_traffic.yml +++ b/detections/deprecated/lolbas_with_network_traffic.yml @@ -1,10 +1,10 @@ name: LOLBAS With Network Traffic id: 2820f032-19eb-497e-8642-25b04a880359 -version: 18 +version: 19 creation_date: '2023-02-02' -modification_date: '2026-05-13' +modification_date: '2026-08-24' author: Steven Dick -status: production +status: deprecated type: TTP description: The following analytic identifies the use of Living Off the Land Binaries and Scripts (LOLBAS) with network traffic. It leverages data from the Network Traffic data model to detect when native Windows binaries, often abused by adversaries, initiate network connections. This activity is significant as LOLBAS are frequently used to download malicious payloads, enabling lateral movement, command-and-control, or data exfiltration. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to organizational security. data_source: @@ -144,3 +144,9 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to high false positive rates from certain LOLBAS binaries with common legitimate network behavior. This broad analytic is being split into more manageable anomaly analytics with separate process groups and common-port tuning. + removed_in_version: 6.8.0 + replacement_content: + - LOLBAS Rare Network Connection + - LOLBAS Network Connection On Uncommon Port diff --git a/detections/endpoint/file_download_or_read_to_pipe_execution.yml b/detections/endpoint/file_download_or_read_to_pipe_execution.yml index 7afb8738003..df3d8bb192e 100644 --- a/detections/endpoint/file_download_or_read_to_pipe_execution.yml +++ b/detections/endpoint/file_download_or_read_to_pipe_execution.yml @@ -1,8 +1,8 @@ name: File Download or Read to Pipe Execution id: 26f86252-1549-45e1-a212-eb26840e86bc -version: 5 +version: 6 creation_date: '2025-10-24' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Michael Haag, Nasreddine Bencherchali, Splunk, DipsyTipsy status: production type: TTP @@ -56,7 +56,7 @@ search: | OR ``` Because the "sh" string can overlap and is a short atom we treat it in a special case ``` Processes.process IN ( - "*|sh" + "*|sh*" "* sh*" ) OR @@ -103,7 +103,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: An instance of $process_name$ was identified on endpoint $dest$ attempting to immediately read or download a file and run it via a shell. + title: An instance of [$process_name$] was identified on endpoint [$dest$] attempting to immediately read or download a file and run it via a shell via the CommandLine [$process$] via the ParentProcess [$parent_process$]. entity: field: user type: user @@ -113,10 +113,10 @@ intermediate_findings: - field: dest type: system score: 50 - message: An instance of $process_name$ was identified on endpoint $dest$ attempting to immediately read or download a file and run it via a shell. + message: An instance of [$process_name$] was identified on endpoint [$dest$] attempting to immediately read or download a file and run it via a shell via the CommandLine [$process$] via the ParentProcess [$parent_process$]. threat_objects: - field: process - type: process_name + type: process - field: process_name type: process_name analytic_story: diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index b4a97dd8d02..034bbb883c3 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -1,34 +1,47 @@ name: Icacls Deny Command id: cf8d753e-a8fe-11eb-8f58-acde48001122 -version: 14 +version: 15 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Teoderick Contreras, Splunk status: production type: Anomaly description: | - The following analytic detects instances where an adversary modifies - security permissions of a file or directory using commands like "icacls.exe", "cacls.exe", - or "xcacls.exe" with deny options. It leverages data from Endpoint Detection and - Response (EDR) agents, focusing on process names and command-line executions. This - activity is significant as it is commonly used by Advanced Persistent Threats (APTs) - and coinminer scripts to evade detection and impede access to critical files. If - confirmed malicious, this could allow attackers to maintain persistence and hinder - incident response efforts. + The following analytic detects instances where an adversary modifies security permissions of a file or directory using commands like "icacls.exe", "cacls.exe", or "xcacls.exe" with deny options. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. + This activity is significant as it is commonly used by Advanced Persistent Threats (APTs) and coinminer scripts to evade detection and impede access to critical files. + If confirmed malicious, this could allow attackers to maintain persistence and hinder incident response efforts. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: | - | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where - Processes.process_name IN ( "icacls.exe", "cacls.exe", "xcacls.exe") AND - Processes.process IN ("*/deny*", "*/d:*", "*/d ") - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + From datamodel=Endpoint.Processes Where + + Processes.process_name IN ( + "icacls.exe", + "cacls.exe", + "xcacls.exe" + ) + Processes.process IN ( + "*/deny*", + "*/d:*", + "*/d *" + ) + + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -60,11 +73,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: Process name $process_name$ with deny argument executed by $user$ to change security permission of a specific file or directory on host $dest$ + message: Process name [$process_name$] with deny argument executed by [$user$] to change security permission of a specific file or directory on host [$dest$]. - field: user type: user score: 20 - message: Process name $process_name$ with deny argument executed by $user$ to change security permission of a specific file or directory on host $dest$ + message: Process name [$process_name$] with deny argument executed by [$user$] to change security permission of a specific file or directory on host [$dest$]. analytic_story: - Azorult - Sandworm Tools diff --git a/detections/endpoint/linux_data_destruction_command.yml b/detections/endpoint/linux_data_destruction_command.yml index da89fb867b1..ba11f557e11 100644 --- a/detections/endpoint/linux_data_destruction_command.yml +++ b/detections/endpoint/linux_data_destruction_command.yml @@ -1,32 +1,48 @@ name: Linux Data Destruction Command id: b11d3979-b2f7-411b-bb1a-bd00e642173b -version: 12 +version: 13 creation_date: '2023-02-08' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on the 'rm' command with force recursive deletion and the '--no-preserve-root' option. This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred. If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host. Immediate investigation and response are crucial to mitigate potential damage. +type: Anomaly +description: |- + The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on the 'rm' command with the '--no-preserve-root' option. + This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred. + If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host. + Immediate investigation and response are crucial to mitigate potential damage. data_source: - Sysmon for Linux EventID 1 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process_name = "rm" - AND - Processes.process IN ("* -rf*", "* -fr*") - AND - Processes.process = "* --no-preserve-root" - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name = "rm" + Processes.process = "* --no-preserve-root*" + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `linux_data_destruction_command_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. + These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. + To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. + The logs must also be mapped to the `Processes` node of the `Endpoint` data model. + Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: No false positives have been identified at this time. references: - https://cert.gov.ua/article/3718487 @@ -40,18 +56,12 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: a $process_name$ execute rm command with --no-preserve-root parmeter that can wipe root files on $dest$ - entity: - field: user - type: user - score: 50 intermediate_findings: entities: - field: dest type: system score: 50 - message: a $process_name$ execute rm command with --no-preserve-root parmeter that can wipe root files on $dest$ + message: The process [$process_name$] was executed with the command [$process$] that allows for the removal of files from the root directory on [$dest$]. analytic_story: - AwfulShred - Data Destruction diff --git a/detections/endpoint/linux_ghostscript_exploitation.yml b/detections/endpoint/linux_ghostscript_exploitation.yml index 39c1533e182..a3c7d729290 100644 --- a/detections/endpoint/linux_ghostscript_exploitation.yml +++ b/detections/endpoint/linux_ghostscript_exploitation.yml @@ -1,8 +1,8 @@ name: Linux Ghostscript Exploitation id: 580f99d8-a4c8-4ef1-9c84-f355867bca41 -version: 1 +version: 2 creation_date: '2026-07-08' -modification_date: '2026-07-08' +modification_date: '2026-09-01' author: Raven Tait, Splunk status: production type: TTP @@ -22,7 +22,7 @@ search: |- "*/gs", "*/ghostscript" ) - Processes.process="sh -c*" + Processes.process="*sh -c*" by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash Processes.parent_process_name diff --git a/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml b/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml new file mode 100644 index 00000000000..bba241d4c1c --- /dev/null +++ b/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml @@ -0,0 +1,166 @@ +name: LOLBAS Network Connection On Uncommon Port +id: a6628e6d-be28-4278-b17d-6b5a32968eea +version: 1 +creation_date: '2026-08-24' +modification_date: '2026-08-24' +author: Steven Dick, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: | + The following analytic identifies Living Off the Land Binaries and Scripts (LOLBAS) that can legitimately initiate public network connections but are communicating over uncommon destination ports. + It leverages the Network Traffic data model and applies per-binary common-port exclusions to reduce false positives while preserving suspicious non-standard communication. + This behavior may indicate payload download, command-and-control, proxy execution, or attempts to blend malicious traffic into trusted Windows binaries. + Join this detection with the Process Execution events to provide context and avoid false positives. +data_source: + - Sysmon EventID 3 +search: | + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Network_Traffic.All_Traffic where + + All_Traffic.app IN ( + "*\\bitsadmin.exe", + "*\\certutil.exe", + "*\\cmstp.exe", + "*\\cscript.exe", + "*\\ftp.exe", + "*\\hh.exe", + "*\\ie4uinit.exe", + "*\\ieexec.exe", + "*\\msbuild.exe", + "*\\msdt.exe", + "*\\mshta.exe", + "*\\msiexec.exe", + "*\\presentationhost.exe", + "*\\settingsynchost.exe", + "*\\syncappvpublishingserver.exe", + "*\\workfolders.exe", + "*\\wscript.exe", + "*\\wuauclt.exe" + ) + + NOT All_Traffic.dest_ip IN ( + "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", + "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16", + "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", + "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", + "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", + "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", + "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", + "203.0.113.0/24", "240.0.0.0/4" + ) + + NOT ( + ( + All_Traffic.app IN ( + "*\\cscript.exe", + "*\\wscript.exe" + ) + All_Traffic.dest_port IN ("80", "443", "3128") + ) + OR + ( + All_Traffic.app="*\\ftp.exe" + All_Traffic.dest_port IN ("20", "21", "989", "990") + ) + OR + ( + All_Traffic.app IN ( + "*\\bitsadmin.exe", + "*\\certutil.exe", + "*\\cmstp.exe", + "*\\hh.exe", + "*\\ieexec.exe", + "*\\msbuild.exe", + "*\\msdt.exe", + "*\\mshta.exe", + "*\\msiexec.exe", + "*\\presentationhost.exe", + "*\\settingsynchost.exe", + "*\\syncappvpublishingserver.exe", + "*\\workfolders.exe", + "*\\wuauclt.exe" + ) + All_Traffic.dest_port IN ("80", "443") + ) + OR + ( + All_Traffic.app IN ( + "*\\certutil.exe", + "*\\ie4uinit.exe" + ) + All_Traffic.dest_port IN ("389") + ) + ) + + by All_Traffic.action All_Traffic.app All_Traffic.dest + All_Traffic.dest_ip All_Traffic.dest_port + All_Traffic.direction All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src + All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user + All_Traffic.vendor_product + + | `drop_dm_object_name(All_Traffic)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `lolbas_network_connection_on_uncommon_port_filter` +how_to_implement: |- + To successfully implement this detection you must ingest events into the Network Traffic data model that contain the source, destination, destination port, and communicating process name in the app field. + Sysmon EventID 3 is a common source for this data when normalized into the Network Traffic data model. +known_false_positives: |- + Legitimate software installation, support tooling, scripting, synchronization, or update workflows may still use uncommon ports in some environments. + Tune approved destinations, ports, and process paths with the analytic filter macro. +references: + - https://lolbas-project.github.io/# + - https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/ +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: LOLBAS process [$app$] on [$src$] connected to public destination [$dest_ip$] over uncommon port [$dest_port$]. +threat_objects: + - field: app + type: process_name + - field: dest_ip + type: ip_address +analytic_story: + - Fake CAPTCHA Campaigns + - Living Off The Land + - Malicious Inno Setup Loader + - Water Gamayun + - APT37 Rustonotto and FadeStealer + - GhostRedirector IIS Module and Rungan Backdoor + - Hellcat Ransomware + - NetSupport RMM Tool Abuse +asset_type: Endpoint +mitre_attack_id: + - T1105 + - T1567 + - T1218 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: network +tests: + - name: Common Port Suppression Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + expected_results: 0 + test_type: unit diff --git a/detections/endpoint/lolbas_rare_network_connection.yml b/detections/endpoint/lolbas_rare_network_connection.yml new file mode 100644 index 00000000000..f6bc5c36555 --- /dev/null +++ b/detections/endpoint/lolbas_rare_network_connection.yml @@ -0,0 +1,144 @@ +name: LOLBAS Rare Network Connection +id: d09b66cc-269b-4675-81b5-a3dabe4f5ac2 +version: 1 +creation_date: '2026-08-24' +modification_date: '2026-08-24' +author: Steven Dick, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: | + The following analytic identifies public network connections initiated by Living Off the Land Binaries and Scripts (LOLBAS) that rarely require direct outbound network access. + It leverages the Network Traffic data model and focuses on native Windows binaries where any public destination should be investigated and explicitly approved. + This activity may indicate proxy execution, process injection, payload download, command-and-control, or other abuse of trusted binaries to evade security controls. + Keep in mind that some of these binaries, such as Netsh.exe, Gpscript.exe, Wmic.exe, etc., will occasionally communicate with public network resources to perform their intended function. + Exclude said processes from the detection if they are too noisy for your environment. + Join this detection with the Process Execution events to provide context and avoid false positives. +data_source: + - Sysmon EventID 3 +search: | + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Network_Traffic.All_Traffic where + + All_Traffic.app IN ( + "*\\at.exe", + "*\\atbroker.exe", + "*\\certoc.exe", + "*\\diskshadow.exe", + "*\\dnscmd.exe", + "*\\extexport.exe", + "*\\forfiles.exe", + "*\\gpscript.exe", + "*\\infdefaultinstall.exe", + "*\\installutil.exe", + "*\\makecab.exe", + "*\\mavinject.exe", + "*\\microsoft.workflow.compiler.exe", + "*\\msconfig.exe", + "*\\netsh.exe", + "*\\notepad.exe", + "*\\odbcconf.exe", + "*\\offlinescannershell.exe", + "*\\pcalua.exe", + "*\\pcwrun.exe", + "*\\pnputil.exe", + "*\\rasautou.exe", + "*\\regasm.exe", + "*\\register-cimprovider.exe", + "*\\regsvcs.exe", + "*\\regsvr32.exe", + "*\\runonce.exe", + "*\\runscripthelper.exe", + "*\\schtasks.exe", + "*\\scriptrunner.exe", + "*\\stordiag.exe", + "*\\ttdinject.exe", + "*\\tttracer.exe", + "*\\verclsid.exe", + "*\\wab.exe", + "*\\wmic.exe", + "*\\xwizard.exe" + ) + + NOT All_Traffic.dest_ip IN ( + "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", + "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16", + "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", + "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", + "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", + "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", + "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", + "203.0.113.0/24", "240.0.0.0/4" + ) + + by All_Traffic.action All_Traffic.app All_Traffic.dest + All_Traffic.dest_ip All_Traffic.dest_port + All_Traffic.direction All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src + All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user + All_Traffic.vendor_product + + | `drop_dm_object_name(All_Traffic)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `lolbas_rare_network_connection_filter` +how_to_implement: |- + To successfully implement this detection you must ingest events into the Network Traffic data model that contain the source, destination, destination port, and communicating process name in the app field. Sysmon EventID 3 is a common source for this data when normalized into the Network Traffic data model. +known_false_positives: |- + Limited legitimate administrative automation and scripts may cause false positives. + Any recurring use of these binaries for public network access should be reviewed, approved, and filtered with the analytic filter macro. + Notepad.exe can now communicate with Microsoft's service "apsaiservices.microsoft.com" over port 443 to provide AI services. Apply filtering if this behavior is known in your environment. + PowerShell, PowerShell ISE, PowerShell 7 (pwsh.exe), and cmd.exe are intentionally excluded from this analytic because they are too noisy. +references: + - https://lolbas-project.github.io/# + - https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/ +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: A rare public network connection from LOLBAS process [$app$] was observed on [$src$] to [$dest_ip$] over port [$dest_port$]. +threat_objects: + - field: app + type: process_name + - field: dest_ip + type: ip_address +analytic_story: + - Fake CAPTCHA Campaigns + - Living Off The Land + - Malicious Inno Setup Loader + - Water Gamayun + - APT37 Rustonotto and FadeStealer + - GhostRedirector IIS Module and Rungan Backdoor + - Hellcat Ransomware + - NetSupport RMM Tool Abuse +asset_type: Endpoint +mitre_attack_id: + - T1105 + - T1567 + - T1218 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/macos_account_created.yml b/detections/endpoint/macos_account_created.yml index 64f46cb85e2..80b1f4b0565 100644 --- a/detections/endpoint/macos_account_created.yml +++ b/detections/endpoint/macos_account_created.yml @@ -1,8 +1,8 @@ name: MacOS Account Created id: 491004ae-694f-453e-b1e0-fc1e65daeea1 -version: 3 +version: 4 creation_date: '2026-04-14' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Raven Tait, Splunk status: production type: Anomaly @@ -19,7 +19,7 @@ search: |- from datamodel=Endpoint.Processes where ( - Processes.process = "*sysadminctl" + Processes.process = "*sysadminctl*" Processes.process = "*-addUser*" ) OR diff --git a/detections/endpoint/macos_data_chunking.yml b/detections/endpoint/macos_data_chunking.yml index d3d5acda779..4fb29f13823 100644 --- a/detections/endpoint/macos_data_chunking.yml +++ b/detections/endpoint/macos_data_chunking.yml @@ -1,8 +1,8 @@ name: MacOS Data Chunking id: 7f1c8bed-9bd4-40b0-a1df-c262cbade0fc -version: 3 +version: 4 creation_date: '2026-04-14' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Raven Tait, Splunk status: production type: Anomaly @@ -20,7 +20,7 @@ search: |- from datamodel=Endpoint.Processes where ( - Processes.process = "dd *" + Processes.process IN ("*/dd *", "dd *") Processes.process = "* if=*" ) OR diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index d8fb84f944f..b52db6e54f6 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,8 +1,8 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 -version: 28 +version: 29 creation_date: '2021-08-19' -modification_date: '2026-07-20' +modification_date: '2026-09-03' author: Michael Haag, Splunk status: production type: Hunting @@ -14,36 +14,109 @@ data_source: search: |- `powershell` EventCode=4104 - | eval DoIt = if(match(ScriptBlockText,"(?i)(\$doit)"), "4", 0) - | eval enccom=if(match(ScriptBlockText,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)") OR match(ScriptBlockText, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) - | eval suspcmdlet=if(match(ScriptBlockText, "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-Jboss|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|get-net\S+|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|Kerberos.*(policy|ticket)|netfirewall|Uninstall-Windows|Verb\s+Runas|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0) - | eval base64 = if(match(lower(ScriptBlockText),"frombase64"), "4", 0) - | eval empire=if(match(lower(ScriptBlockText),"system.net.webclient") AND match(lower(ScriptBlockText), "frombase64string") ,5,0) - | eval mimikatz=if(match(lower(ScriptBlockText),"mimikatz") OR match(lower(ScriptBlockText), "-dumpcr") OR match(lower(ScriptBlockText), "SEKURLSA::Pth") OR match(lower(ScriptBlockText), "kerberos::ptt") OR match(lower(ScriptBlockText), "kerberos::golden") ,5,0) - | eval iex=if(match(ScriptBlockText, "(?i)iex|invoke-expression"),2,0) - | eval webclient=if(match(lower(ScriptBlockText),"http") OR match(lower(ScriptBlockText),"web(client|request)") OR match(lower(ScriptBlockText),"socket") OR match(lower(ScriptBlockText),"download(file|string)") OR match(lower(ScriptBlockText),"bitstransfer") OR match(lower(ScriptBlockText),"internetexplorer.application") OR match(lower(ScriptBlockText),"xmlhttp"),5,0) - | eval get = if(match(lower(ScriptBlockText),"get-"), "1", 0) - | eval rundll32 = if(match(lower(ScriptBlockText),"rundll32"), "4", 0) - | eval suspkeywrd=if(match(ScriptBlockText, "(?i)(bitstransfer|mimik|metasp|AssemblyBuilderAccess|Reflection\.Assembly|shellcode|injection|cnvert|shell\.application|start-process|Rc4ByteStream|System\.Security\.Cryptography|lsass\.exe|localadmin|LastLoggedOn|hijack|BackupPrivilege|ngrok|comsvcs|backdoor|brute.?force|Port.?Scan|Exfiltration|exploit|DisableRealtimeMonitoring|beacon)"),1,0) - | eval syswow64 = if(match(lower(ScriptBlockText),"syswow64"), "3", 0) - | eval httplocal = if(match(lower(ScriptBlockText),"http://127.0.0.1"), "4", 0) - | eval reflection = if(match(lower(ScriptBlockText),"reflection"), "1", 0) - | eval invokewmi=if(match(lower(ScriptBlockText), "(?i)(wmiobject|WMIMethod|RemoteWMI|PowerShellWmi|wmicommand)"),5,0) - | eval downgrade=if(match(ScriptBlockText, "(?i)([-]ve*r*s*i*o*n*\s+2)") OR match(lower(ScriptBlockText),"powershell -version"),3,0) - | eval compressed=if(match(ScriptBlockText, "(?i)GZipStream|::Decompress|IO.Compression|write-zip|(expand|compress)-Archive"),5,0) - | eval invokecmd = if(match(lower(ScriptBlockText),"invoke-command"), "4", 0) - | addtotals fieldname=Score DoIt, enccom, suspcmdlet, suspkeywrd, compressed, downgrade, mimikatz, iex, empire, rundll32, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get - | stats values(Score) - BY UserID, Computer, DoIt, - enccom, compressed, downgrade, - iex, mimikatz, rundll32, - empire, webclient, syswow64, - httplocal, reflection, invokewmi, - invokecmd, base64, get, - suspcmdlet, suspkeywrd - | rename Computer as dest, UserID as user - | `powershell_4104_hunting_filter` -how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. + + ScriptBlockText IN ( + "*-dumpcr%*", "*::decompress*", "*Add-Exfiltration*", "*Add-Persistence*", "*Add-RegBackdoor*", + "*Add-ScrnSaveBackdoor*", "*AmsiBypass*", "*assemblybuilderaccess*", "*backdoor*", + "*backupprivilege*", "*beacon*", "*bitstransfer*", "*Brute-Force*", "*BruteForce*", + "*CachedRDPConnection*", "*Check-VM*", "*cnvert*", "*compress-archive*", "*ComputerProperty*", + "*comsvcs*", "*copy-vss*", "*CreateShortcut*", "*disablerealtimemonitoring*", + "*Do-Exfiltration*", "*downloadfile*", "*downloadstring*", "*Enabled-DuplicateToken*", + "*EXEonRemote*", "*exfiltration*", "*expand-archive*", "*Exploit-*", "*exploit*", + "*Find-*", "*Frombase64_keyword*", "*Get-ApplicationHost*", "*Get-ChromeDump*", + "*Get-ClipboardContents*", "*Get-FoxDump*", "*Get-GPPPassword*", "*Get-IndexedItem*", + "*Get-Keystrokes*", "*Get-PassHash*", "*Get-RegAlwaysInstallElevated*", "*Get-RegAutoLogon*", + "*Get-RickAstley*", "*Get-Screenshot*", "*Get-SecurityPackages*", "*Get-ServiceFilePermission*", + "*Get-ServicePermission*", "*Get-ServiceUnquoted*", "*Get-SiteListPassword*", + "*Get-System*", "*Get-TimedScreenshot*", "*Get-UnattendedInstallFile*", + "*Get-Unconstrained*", "*Get-VaultCredential*", "*Get-VulnAutoRun*", + "*Get-VulnSchTask*", "*Gupt-Backdoor*", "*gzipstream*", "*hijack*", + "*HTTP-Login*", "*IEX *", "*injection*", "*Install-Service*", + "*Install-ServiceBinary*", "*Install-SSP*", "*internetexplorer.application*", + "*Invoke-*", "*io.compression*", "*kerberos::*", "*lastloggedon*", + "*localadmin*", "*LSASecret*", "*lsass.exe*", "*MailRaider*", "*metasp*", + "*mimikatz*", "*NEEEEWWW*", "*netfirewall*", "*NetworkRelay*", + "*New-HoneyHash*", "*ngrok*", "*nishang*", "*Out-Minidump*", + "*out-shortcut*", "*Port-Scan*", "*PortScan*", "*PowerBreach*", + "*PowerShellIcmp*", "*PowerShelludp*", "*powershellwmi*", "*PowerUp*", "*PowerView*", + "*rc4bytestream*", "*reflection.assembly*", "*remoteps*", "*remotewmi*", + "*Remove-Update*", "*SEKURLSA::*", "*Set-MacAttribute*", "*Set-Wallpaper*", + "*shell.application*", "*shellcode*", "*Show-TargetScreen*", "*Start-CaptureServer*", + "*start-process*", "*system.security.cryptography*", "*Uninstall-Windows*", "*UserProperty*", + "*VolumeShadowCopyTools*", "*WebClient*", "*webrequest*", "*wmicommand*", + "*wmimethod*", "*wmiobject*", "*write-zip*", "*xmlhttp*", + ) + + | eval script_lower=lower(ScriptBlockText) + + | eval ecnoded_command_keyword=if(match(ScriptBlockText,"(?i)(?:^|\\s)(?:/(?!/)|--?|–{1,2}|—{1,2}|―{1,2})(?:ec|encodedcommand|encodedcomman|encodedcomma|encodedcomm|encodedcom|encodedco|encodedc|encoded|encode|encod|enco|enc|en|e(?=\\s))\\s+['\\\"]?[A-Za-z0-9+/=]{5,}['\\\"]?"), 4, 0) + + | eval suspicious_cmdlets=if(match(ScriptBlockText, "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|netfirewall|Uninstall-Windows|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0) + + | eval base64_keyword=if(like(script_lower,"%frombase64_keyword%"), 4, 0) + + | eval empire=if(like(script_lower,"%system.net.webclient%") AND like(script_lower,"%frombase64_keywordstring%"),5,0) + + | eval mimikatz=if(like(script_lower,"%mimikatz%") OR like(script_lower,"%-dumpcr%") OR like(script_lower,"%sekurlsa::pth%") OR like(script_lower,"%kerberos::ptt%") OR like(script_lower,"%kerberos::golden%"),5,0) + + | eval invoke_expression_keyword=if(like(script_lower,"%iex %") OR like(script_lower,"%invoke-expression %"),2,0) + + | eval webclient=if(like(script_lower,"%webclient%") OR like(script_lower,"%webrequest%") OR like(script_lower,"%downloadfile%") OR like(script_lower,"%downloadstring%") OR like(script_lower,"%bitstransfer%") OR like(script_lower,"%internetexplorer.application%") OR like(script_lower,"%xmlhttp%"),5,0) + + | eval suspicious_keyword=if(match(script_lower, "(metasp|assemblybuilderaccess|reflection\.assembly|shellcode|injection|cnvert|shell\.application|start-process |rc4bytestream|system\.security\.cryptography|lsass\.exe|localadmin|lastloggedon|hijack|backupprivilege|ngrok|comsvcs|backdoor|brute.?force|port.?scan|exfiltration|exploit|disablerealtimemonitoring|beacon)"),1,0) + + | eval invoke_wmi_keyword=if(like(script_lower,"%wmiobject%") OR like(script_lower,"%wmimethod%") OR like(script_lower,"%remotewmi%") OR like(script_lower,"%powershellwmi%") OR like(script_lower,"%wmicommand%"),5,0) + + | eval downgrade_version=if(match(script_lower, "([-]ve*r*s*i*o*n*\s+2)") OR like(script_lower,"%powershell -version%"),3,0) + + | eval compression_keyword=if(match(script_lower, "gzipstream|::decompress|io.compression|write-zip|(expand|compress)-archive"),5,0) + + | eval invoke_command_keyword=if(like(script_lower,"%invoke-command%"), 4, 0) + + | eval Score=ecnoded_command_keyword + + suspicious_cmdlets + + suspicious_keyword + + compression_keyword + + downgrade_version + + mimikatz + + invoke_expression_keyword + + empire + + webclient + + invoke_wmi_keyword + + invoke_command_keyword + + base64_keyword + + | where Score>=4 OR mimikatz>0 OR suspicious_cmdlets>0 OR suspicious_keyword>0 + + | eval matched_rules=mvappend( + if(ecnoded_command_keyword>0, "Encoded Command Keywords", null()), + if(suspicious_cmdlets>0, "Suspicious Cmdlets", null()), + if(base64_keyword>0, "Base64 Keyword", null()), + if(empire>0, "Empire Framework Commands", null()), + if(mimikatz>0, "Mimikatz Keywords or Strings", null()), + if(invoke_expression_keyword>0, "Invoke Expression Keywords", null()), + if(webclient>0, "Webclient Keywords", null()), + if(suspicious_keyword>0, "Potentially Suspicious Keywords or Strings", null()), + if(invoke_wmi_keyword>0, "Invoke WMI Keywords", null()), + if(downgrade_version>0, "PowerShell Downgrade Version Attempt", null()), + if(compression_keyword>0, "Compression Keywords", null()), + if(invoke_command_keyword>0, "Invoke Command Keywords", null()) + ) + + | eval matched_rules=mvfilter(isnotnull(matched_rules)) + + | rename Computer as dest, UserID as user + + | stats max(Score) as Score values(matched_rules) as matched_rules + BY user dest ScriptBlockId + + | eval matched_rules=mvjoin(matched_rules, ", ") + + | `powershell_4104_hunting_filter` +how_to_implement: |- + The following Hunting analytic requires PowerShell operational logs to be ingested with ScriptBlockLogging enabled. + Modify the powershell macro as needed to match the sourcetype or add index. + This analytic is specific to EventID 4104, or PowerShell Script Block Logging. known_false_positives: Limited false positives. May filter as needed. references: - https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md @@ -90,6 +163,8 @@ analytic_story: asset_type: Endpoint mitre_attack_id: - T1059.001 + - T1689 + - T1003 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index 64062460cb2..1ac3be2323f 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -1,31 +1,73 @@ name: Suspicious wevtutil Usage id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f -version: 20 +version: 21 creation_date: '2019-10-16' -modification_date: '2026-05-13' -author: David Dorsey, Michael Haag, Teoderick Contreras, Splunk +modification_date: '2026-08-23' +author: David Dorsey, Michael Haag, Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production type: TTP -description: The following analytic detects the usage of wevtutil.exe with parameters for clearing event logs such as Application, Security, Setup, Trace, or System. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations. If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise. +description: |- + The following analytic detects the usage of wevtutil.exe with parameters for clearing event logs such as Application, Security, Setup, Trace, or System. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. + This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations. + If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*") Processes.process IN ("*System*", "*Security*", "*Setup*", "*Application*", "*trace*", "*powershell*", "Sysmon") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + ( + Processes.process_name="wevtutil.exe" + OR + Processes.original_file_name="wevtutil.exe" + ) + + Processes.process IN ("* cl *", "*clear-log*") + Processes.process IN ( + "*/Trace*", + "*AMSI/Debug*", + "*Application*", + "*CiscoSecureEndpoint*", + "*Microsoft-Windows-BitLocker*", + "*Microsoft-Windows-Bits*", + "*Microsoft-Windows-CAPI2*", + "*Microsoft-Windows-Kernel-File*", + "*Microsoft-Windows-Kernel-Process*", + "*Microsoft-Windows-LDAP*", + "*Microsoft-Windows-PowerShell*", + "*Microsoft-Windows-Sysmon*", + "*Microsoft-Windows-TerminalServices-LocalSessionManager*", + "*Microsoft-Windows-TerminalServices-RemoteConnectionManager*", + "*Microsoft-Windows-WMI-Activity*", + "*OpenSSH/*", + "*PowerShellCore/*", + "*Security*", + "*Setup*", + "*System*", + "*Windows Firewall With Advanced Security*", + "*Windows PowerShell*" + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_wevtutil_usage_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md diff --git a/detections/endpoint/windows_process_execution_in_temp_dir.yml b/detections/endpoint/windows_process_execution_in_temp_dir.yml index 0f799e87ecd..3d7554e0a29 100644 --- a/detections/endpoint/windows_process_execution_in_temp_dir.yml +++ b/detections/endpoint/windows_process_execution_in_temp_dir.yml @@ -1,8 +1,8 @@ name: Windows Process Execution in Temp Dir id: f6fbe929-4187-4ba4-901e-8a34be838443 -version: 12 +version: 13 creation_date: '2021-05-07' -modification_date: '2026-06-08' +modification_date: '2026-09-01' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -37,7 +37,7 @@ intermediate_findings: message: Suspicious process $process_name$ running from temp directory- $process_path$ on host- $dest$ threat_objects: - field: process_path - type: process_name + type: file_path analytic_story: - AgentTesla - XWorm diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index bae7c631445..4cf1735d21c 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,8 +1,8 @@ name: Windows Suspicious Process File Path id: ecddae4e-3d4b-41e2-b3df-e46a88b38521 -version: 28 +version: 29 creation_date: '2021-05-07' -modification_date: '2026-08-14' +modification_date: '2026-09-01' author: Teoderick Contreras, Splunk status: production type: TTP @@ -37,7 +37,7 @@ finding: score: 50 threat_objects: - field: process_path - type: process_name + type: file_path analytic_story: - StealC Stealer - PlugX diff --git a/detections/endpoint/windows_tinycc_shellcode_execution.yml b/detections/endpoint/windows_tinycc_shellcode_execution.yml index 4b2ce5bd041..0d0bbec806c 100644 --- a/detections/endpoint/windows_tinycc_shellcode_execution.yml +++ b/detections/endpoint/windows_tinycc_shellcode_execution.yml @@ -1,35 +1,43 @@ name: Windows TinyCC Shellcode Execution id: fdb6774e-e465-4912-86e3-63cf9ab91491 -version: 3 +version: 4 creation_date: '2026-03-16' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Michael Haag, Splunk status: production type: TTP description: | - Detects abuse of Tiny-C-Compiler (TinyCC) for shellcode execution, where tcc.exe is renamed to masquerade as svchost.exe and used to compile and execute C source files containing shellcode. This technique was observed in the Lotus Blossom Chrysalis backdoor campaign, where attackers renamed tcc.exe to svchost.exe and executed conf.c containing Metasploit block_api shellcode with the flags -nostdlib -run. - TinyCC is a legitimate C compiler, but its ability to compile and execute code on-the-fly makes it attractive to attackers seeking to evade detection. The combination of a renamed compiler binary executing from non-standard locations with suspicious flags is a strong indicator of malicious activity. + Detects abuse of Tiny-C-Compiler (TinyCC) for shellcode execution, where tcc.exe is renamed to masquerade as svchost.exe and used to compile and execute C source files containing shellcode. + This technique was observed in the Lotus Blossom Chrysalis backdoor campaign, where attackers renamed "tcc.exe" to "svchost.exe", and executed a file named "conf.c" containing Metasploit block_api shellcode with the flags -nostdlib -run. + TinyCC is a legitimate C compiler, but its ability to compile and execute code on-the-fly makes it attractive to attackers seeking to evade detection. + The combination of a renamed compiler binary executing from non-standard locations with suspicious flags is a strong indicator of malicious activity. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes where - Processes.process_name IN ("svchost.exe", "tcc.exe") - Processes.process="* -nostdlib*" - Processes.process="* -run*" - Processes.process IN ("*.c", "*conf.c*") - NOT Processes.process_path IN ( + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_name IN ("svchost.exe", "tcc.exe") + Processes.process="* -nostdlib*" + Processes.process="* -run*" + Processes.process IN ("*.c", "*conf.c*") + NOT Processes.process_path IN ( "*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*" - ) - by Processes.action Processes.dest Processes.user Processes.process Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process_name Processes.process_id - Processes.process_exec Processes.process_guid Processes.process_hash - Processes.process_integrity_level Processes.process_path - Processes.original_file_name Processes.user_id Processes.vendor_product + ) + + By Processes.action Processes.dest Processes.user Processes.process Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process_name Processes.process_id + Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_integrity_level Processes.process_path + Processes.original_file_name Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -61,7 +69,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: TinyCC compiler execution on $dest$ by user $user$ from $process_path$, indicating potential malicious code execution. + title: TinyCC compiler execution on [$dest$] by user [$user$] from [$process_path$] via the CommandLine [$process$] from the ParentProcess [$parent_process$], indicating potential malicious code execution. entity: field: user type: user @@ -71,7 +79,7 @@ intermediate_findings: - field: dest type: system score: 50 - message: TinyCC compiler execution on $dest$ by user $user$ from $process_path$, indicating potential malicious code execution. + message: TinyCC compiler execution on [$dest$] by user [$user$] from [$process_path$] via the CommandLine [$process$] from the ParentProcess [$parent_process$], indicating potential malicious code execution. threat_objects: - field: process type: process diff --git a/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml b/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml index a029952d943..aef8ef031fe 100644 --- a/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml +++ b/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml @@ -1,8 +1,8 @@ name: Windows Unusual SysWOW64 Process Run System32 Executable id: e4602172-db86-4315-86df-da66fb40bcde -version: 6 +version: 7 creation_date: '2022-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -32,7 +32,7 @@ intermediate_findings: message: a 32 bit process execute 64 bit executable on [$dest$]. threat_objects: - field: process_path - type: process_name + type: file_path analytic_story: - DarkGate Malware - Salt Typhoon diff --git a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml index 95a935dad41..f844c996807 100644 --- a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml +++ b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml @@ -1,8 +1,8 @@ name: Citrix ADC Exploitation CVE-2023-3519 id: 76ac2dcb-333c-4a77-8ae9-2720cfae47a8 -version: 9 +version: 10 creation_date: '2023-07-21' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Michael Haag, Splunk status: production type: Hunting @@ -21,16 +21,18 @@ search: |- Web.http_method=POST Web.url IN ( "*/cgi/logout", + "*/cgi/samlart?samlart=*", + "*/cgi/samlauth", + "*/gwtest/formssso?event=start&target=*", + "*/netscaler/ns_gui/vpn/*", "*/saml/activelogin", - "*/saml/login", - "/cgi/samlart?samlart=*", - "/cgi/samlauth", - "/gwtest/formssso?event=start&target=*", - "/netscaler/ns_gui/vpn/*" + "*/saml/login" ) - BY Web.http_user_agent, Web.status + + BY Web.http_user_agent Web.status Web.http_method Web.url Web.url_length Web.src Web.dest + | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/removed/stories/lateral_movement.yml b/removed/stories/lateral_movement.yml index c719981403e..e3583c0a181 100644 --- a/removed/stories/lateral_movement.yml +++ b/removed/stories/lateral_movement.yml @@ -1,8 +1,8 @@ name: Lateral Movement id: 399d65dc-1f08-499b-a259-abd9051f38ad -version: 3 +version: 4 creation_date: '2023-02-21' -modification_date: '2026-05-13' +modification_date: '2026-08-26' author: David Dorsey, Splunk status: removed description: "DEPRECATED IN FAVOR OF ACTIVE DIRECTORY LATERAL MOVEMENT. Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts." @@ -21,4 +21,4 @@ deprecation_info: reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity removed_in_version: 5.2.0 replacement_content: - - Compromised User Account + - Active Directory Lateral Movement From e86ae0ff5c0190ef92d74700952c254666d588cf Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Fri, 4 Sep 2026 20:47:14 +0200 Subject: [PATCH 084/162] Minor Fixes Against False Positive Patterns (#4249) --------- Co-authored-by: Nasreddine Bencherchali --- ...ux_adding_crontab_using_list_parameter.yml | 11 ++- .../jscript_execution_using_cscript_app.yml | 70 +++++++++++------ .../endpoint/linux_crontab_enumeration.yml | 76 ++++++++++++++++++ .../windows_private_keys_discovery.yml | 78 ++++++++++++++----- 4 files changed, 188 insertions(+), 47 deletions(-) rename detections/{endpoint => deprecated}/linux_adding_crontab_using_list_parameter.yml (91%) create mode 100644 detections/endpoint/linux_crontab_enumeration.yml diff --git a/detections/endpoint/linux_adding_crontab_using_list_parameter.yml b/detections/deprecated/linux_adding_crontab_using_list_parameter.yml similarity index 91% rename from detections/endpoint/linux_adding_crontab_using_list_parameter.yml rename to detections/deprecated/linux_adding_crontab_using_list_parameter.yml index 379e5c61832..6c550de21dd 100644 --- a/detections/endpoint/linux_adding_crontab_using_list_parameter.yml +++ b/detections/deprecated/linux_adding_crontab_using_list_parameter.yml @@ -1,10 +1,10 @@ name: Linux Adding Crontab Using List Parameter id: 52f6d751-1fd4-4c74-a4c9-777ecfeb5c58 -version: 11 +version: 12 creation_date: '2021-12-21' -modification_date: '2026-05-13' +modification_date: '2026-09-03' author: Teoderick Contreras, Bhavin Patel, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects suspicious modifications to cron jobs on Linux systems using the crontab command with list parameters. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it may indicate an attempt to establish persistence or execute malicious code on a schedule. If confirmed malicious, the impact could include unauthorized code execution, data destruction, or other damaging outcomes. Further investigation should analyze the added cron job, its associated command, and any related processes. data_source: @@ -60,3 +60,8 @@ tests: source: not_applicable sourcetype: cisco:isovalent:processExec test_type: unit +deprecation_info: + reason: Detection deprecated as its name and description are not matching the behavior of the search. The search is looking for crontab command with list parameter, not adding a new cron job. + removed_in_version: 6.8.0 + replacement_content: + - Linux Crontab Enumeration diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml index 422eeccc3e8..4082fc5412e 100644 --- a/detections/endpoint/jscript_execution_using_cscript_app.yml +++ b/detections/endpoint/jscript_execution_using_cscript_app.yml @@ -1,39 +1,60 @@ name: Jscript Execution Using Cscript App id: 002f1e24-146e-11ec-a470-acde48001122 -version: 13 +version: 14 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-08-31' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects the execution of JScript using the cscript.exe process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This behavior is significant because JScript files are typically executed by wscript.exe, making cscript.exe execution unusual and potentially indicative of malicious activity, such as the FIN7 group's tactics. If confirmed malicious, this activity could allow attackers to execute arbitrary scripts, leading to code execution, data exfiltration, or further system compromise. +type: Anomaly +description: |- + The following analytic detects the execution of JScript using the cscript.exe process. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. + This behavior is significant because JScript files are typically executed by wscript.exe, making cscript.exe execution unusual and potentially indicative of malicious activity, such as the FIN7 group's tactics. + If confirmed malicious, this activity could allow attackers to execute arbitrary scripts, leading to code execution, data exfiltration, or further system compromise. data_source: - Sysmon EventID 1 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE ( + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + ( + ( Processes.parent_process_name = "cscript.exe" - AND Processes.parent_process = "*//e:jscript*" ) - OR (Processes.process_name = "cscript.exe" AND Processes.process = "*//e:jscript*") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + OR + ( + Processes.process_name = "cscript.exe" + Processes.process = "*//e:jscript*" + ) + ) + + NOT Processes.process="*/Job:AgentHIScript*" + NOT Processes.parent_process="*/Job:AgentHIScript*" + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `jscript_execution_using_cscript_app_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: No false positives have been identified at this time. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Symantec Host Integrity check uses Jscript through cscript.exe references: - https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation - https://attack.mitre.org/groups/G0046/ + - https://nasbench.medium.com/symantec-endpoint-protection-meets-com-using-symantec-sshelper-as-a-lolbin-40d515a121ce drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -43,18 +64,17 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: Process name $process_name$ with commandline $process$ to execute jscript on $dest$ - entity: - field: user - type: user - score: 50 intermediate_findings: entities: - field: dest type: system - score: 50 - message: Process name $process_name$ with commandline $process$ to execute jscript on $dest$ + score: 20 + message: The process [$parent_process_name$] with commandline [$parent_process$] launched [$process_name$] with commandline [$process$] on [$dest$] +threat_objects: + - field: parent_process + type: process + - field: process + type: process analytic_story: - FIN7 - Remcos diff --git a/detections/endpoint/linux_crontab_enumeration.yml b/detections/endpoint/linux_crontab_enumeration.yml new file mode 100644 index 00000000000..fbbe3ecedd9 --- /dev/null +++ b/detections/endpoint/linux_crontab_enumeration.yml @@ -0,0 +1,76 @@ +name: Linux Crontab Enumeration +id: 8ef82980-0e95-43d7-a802-b488b668d14f +version: 1 +creation_date: '2026-09-03' +modification_date: '2026-09-03' +author: Teoderick Contreras, Bhavin Patel, Onur Mustafa Erdogan, Splunk +status: production +type: Hunting +description: |- + The following analytic detects the use of the crontab command with the list parameter (-l) to enumerate scheduled tasks configured in the invoking user's crontab on Linux systems. + Adversaries may use this information to identify persistence mechanisms, scheduled execution, or potential privilege escalation opportunities. + The use of crontab -l is also common administrative activity and may require tuning based on the executing user, parent process, and environment. +data_source: + - Sysmon for Linux EventID 1 + - Cisco Isovalent Process Exec +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name = "crontab" + Processes.process= "* -l*" + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_crontab_enumeration_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +references: + - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ + - https://cert.gov.ua/article/39518 +analytic_story: + - Cisco Isovalent Suspicious Activity + - Industroyer2 + - Linux Privilege Escalation + - Linux Living Off The Land + - Data Destruction + - Linux Persistence Techniques + - Scheduled Tasks + - Gomir + - VoidLink Cloud-Native Linux Malware +asset_type: Endpoint +mitre_attack_id: + - T1053.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/crontab_list_parameter/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux + test_type: unit + - name: True Positive Test - Cisco Isovalent + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_isovalent/cisco_isovalent.log + source: not_applicable + sourcetype: cisco:isovalent:processExec + test_type: unit diff --git a/detections/endpoint/windows_private_keys_discovery.yml b/detections/endpoint/windows_private_keys_discovery.yml index 987fe3bc56a..b55f95f5e91 100644 --- a/detections/endpoint/windows_private_keys_discovery.yml +++ b/detections/endpoint/windows_private_keys_discovery.yml @@ -1,36 +1,71 @@ name: Windows Private Keys Discovery id: 5c1c2877-06c0-40ee-a1a2-db71f1372b5b -version: 12 +version: 13 creation_date: '2022-12-06' -modification_date: '2026-05-13' +modification_date: '2026-08-31' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic identifies processes that retrieve information related to private key files, often used by post-exploitation tools like winpeas. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that search for private key certificates. This activity is significant as it indicates potential attempts to locate insecurely stored credentials, which adversaries can exploit for privilege escalation, persistence, or remote service authentication. If confirmed malicious, this behavior could allow attackers to access sensitive information, escalate privileges, or maintain persistence within the compromised environment. +description: |- + The following analytic identifies processes that retrieve information related to private key files, often used by post-exploitation tools like winpeas. + This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that search for private key certificates. + This activity is significant as it indicates potential attempts to locate insecurely stored credentials, which adversaries can exploit for privilege escalation, persistence, or remote service authentication. + If confirmed malicious, this behavior could allow attackers to access sensitive information, escalate privileges, or maintain persistence within the compromised environment. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process = "*dir *" - OR - Processes.process = "*findstr*" - AND - Processes.process IN ( "*.rdg*", "*.gpg*", "*.pgp*", "*.p12*", "*.der*", "*.csr*", "*.cer*", "*.ovpn*", "*.key*", "*.ppk*", "*.p12*", "*.pem*", "*.pfx*", "*.p7b*", "*.asc*") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name IN ( + "cmd.exe", + "findstr.exe", + "powershell.exe", + "pwsh.exe" + ) + Processes.process IN ( + "*.asc*", + "*.cer*", + "*.csr*", + "*.der*", + "*.gpg*", + "*.key*", + "*.ovpn*", + "*.p12*", + "*.p12*", + "*.p7b*", + "*.pem*", + "*.pfx*", + "*.pgp*", + "*.ppk*", + "*.rdg*" + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + + | regex process="(?i)[^\.\-\_\$a-zA-Z](dir\s|findstr)" + | regex process="(?i)\.(?:rdg|gpg|pgp|p12|der|csr|cer|ovpn|key|ppk|p12|pem|pfx|p7b|asc)\b" + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_private_keys_discovery_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: No false positives have been identified at this time. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Very long command line arguments may contain these keywords in irrelevant sections of the code. references: - https://attack.mitre.org/techniques/T1552/004/ - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS @@ -49,7 +84,12 @@ intermediate_findings: - field: dest type: system score: 20 - message: a process with commandline $process$ that can retrieve information related to private keys on $dest$ + message: A process with commandline [$process$] that can retrieve information related to private keys was executed on [$dest$] +threat_objects: + - field: parent_process + type: process + - field: process + type: process analytic_story: - Windows Post-Exploitation - Prestige Ransomware From 3e317f4d735e8862fd2d0b142e53179efc022fd9 Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Sat, 5 Sep 2026 17:29:37 +0200 Subject: [PATCH 085/162] macOS detection: MacOS AppleScript Shell Execution and Compilation (#4257) --------- Co-authored-by: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali --- ...script_shell_execution_and_compilation.yml | 93 +++++++++++++++++++ 1 file changed, 93 insertions(+) create mode 100644 detections/endpoint/macos_applescript_shell_execution_and_compilation.yml diff --git a/detections/endpoint/macos_applescript_shell_execution_and_compilation.yml b/detections/endpoint/macos_applescript_shell_execution_and_compilation.yml new file mode 100644 index 00000000000..be5632f1187 --- /dev/null +++ b/detections/endpoint/macos_applescript_shell_execution_and_compilation.yml @@ -0,0 +1,93 @@ +name: MacOS AppleScript Shell Execution and Compilation +id: ceee1f2b-4b40-4721-b91e-40d1134e9dc4 +version: 1 +creation_date: '2026-09-03' +modification_date: '2026-09-03' +author: Radka Viskova, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the use of macOS AppleScript utilities to execute shell commands or compile AppleScript containing shell-command logic. + The analytic identifies `osascript` invocations using AppleScript's `do shell script` command, which executes shell commands on the host. + It also identifies `osacompile` invocations referencing `do shell script`. `osacompile` compiles AppleScript into a compiled script but does not execute it directly. + Adversaries may abuse these utilities to execute shell commands, stage AppleScript payloads, or prepare scripts for later execution. Matches involving `osacompile` should be interpreted as script compilation or staging rather than confirmed shell-command execution. +data_source: + - Osquery Results +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name IN ("osascript", "osacompile") + Processes.process="*do *" + Processes.process="* shell *" + Processes.process="* script*" + + BY Processes.action Processes.dest Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | eval activity_type=case( + process_name="osascript", "AppleScript Shell Command Execution", + process_name="osacompile", "AppleScript Compilation or Staging" + ) + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + + | table firstTime lastTime dest user activity_type parent_process process parent_process_name parent_process_exec parent_process_guid parent_process_id parent_process_path process_exec process_guid process_hash process_id process_integrity_level process_name process_path action user_id vendor_product + + | `macos_applescript_shell_execution_and_compilation_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the TA-OSquery (https://splunkbase.splunk.com/app/8574) must be deployed in order to have the osquery data populate the data models. +known_false_positives: |- + Legitimate administrative scripts or automation tools using Applescript. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059/002/ + - https://www.loobins.io/binaries/osascript/ + - https://redcanary.com/threat-detection-report/techniques/applescript/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: AppleScript shell execution or compilation via [$process_name$] with commandline [$process$] was observed on [$dest$]. +threat_objects: + - field: process + type: process +analytic_story: + - MacOS Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript_do_shell_script/osascript_do_shell_script.log + source: osquery + sourcetype: osquery:results + test_type: unit From e99ef188ec0dc299be0baf2ce3c9543a5d60a21b Mon Sep 17 00:00:00 2001 From: themaryjo Date: Sat, 5 Sep 2026 19:45:50 +0200 Subject: [PATCH 086/162] Add `Browser Spawned Unix Shell with External Connection` (#4256) --------- Co-authored-by: oerdogan Co-authored-by: Nasreddine Bencherchali --- ...ed_unix_shell_with_external_connection.yml | 116 ++++++++++++++++++ 1 file changed, 116 insertions(+) create mode 100644 detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml diff --git a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml new file mode 100644 index 00000000000..768ff926ec8 --- /dev/null +++ b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml @@ -0,0 +1,116 @@ +name: Cisco NVM - Browser Spawned Unix Shell with External Connection +id: 6f2de8d1-9a2d-4c7a-9b8c-3b8a2f7d0e41 +version: 1 +creation_date: '2026-09-02' +modification_date: '2026-09-02' +author: Maria Jose Erquiaga, Splunk +status: production +type: Anomaly +description: | + Detects a Unix-based (Linux or macOS) browser process spawning a Unix shell that establishes an outbound connection to an external destination. + This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension on Linux or macOS systems. + The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows. +data_source: + - Cisco Network Visibility Module Flow Data +search: | + `cisco_network_visibility_module_flowdata` + process_path IN ( + "*/bash", + "*/csh", + "*/dash", + "*/fish", + "*/sh", + "*/tcsh", + "*/zsh" + ) + parent_process_path IN ( + "*/arc", "*/brave", "*/brave-browser", "*/chrome", "*/chromium", "*/duckduckgo", "*/firefox", "*/firefox-bin", + "*/google chrome", "*/google-chrome", "*/librewolf", "*/microsoft edge", "*/msedge", "*/opera", + "*/opera gx", "*/safari", "*/tor browser", "*/vivaldi", "*/waterfox" + ) + NOT dest IN ( + "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10", + "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", + "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", + "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24", + "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1" + ) + + | stats count + min(_time) as firstTime + max(_time) as lastTime + values(parent_process_hash) as parent_process_hash + values(process_hash) as process_hash + values(module_name_list) as module_name_list + values(module_hash_list) as module_hash_list + values(dest_port) as dest_port + values(dest_hostname) as dest_hostname + + by src src_ip dest dest_ip bytes_in bytes_out + user process_id process_name process_path process + parent_process_id parent_process_name parent_process_path parent_process + + | table + firstTime lastTime user + parent_process_path parent_process_name parent_process parent_process_hash + process_path process_name process process_hash process_id + module_name_list module_hash_list + src src_ip dest_hostname dest dest_ip dest_port bytes_in bytes_out + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `cisco_nvm___browser_spawned_unix_shell_with_external_connection_filter` +how_to_implement: | + This search requires Network Visibility Module logs, which includes the flow data sourcetype. + This search uses an input macro named `cisco_network_visibility_module_flowdata`. + We strongly recommend that you specify your environment-specific configurations + (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + Replace the macro definition with configurations for your Splunk environment. + The search also uses a post-filter macro designed to filter out known false positives. + The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). +known_false_positives: | + Legitimate workflows may launch Unix command interpreters from browser contexts, including developer tooling, software installers, SSO helpers, browser extensions, and automation wrappers. Tuning may be required for approved applications, users, and destinations. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059/ + - https://redcanary.com/threat-detection-report/threats/socgholish/ +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src="$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: A Unix-based browser process [$parent_process$] spawned shell [$process$] on host [$src$], which made an outbound connection to external destination [$dest_hostname$] with IP [$dest_ip$] on port [$dest_port$]. +threat_objects: + - field: process + type: process + - field: dest_ip + type: ip_address + - field: dest_hostname + type: domain +analytic_story: + - Cisco Network Visibility Module Analytics +asset_type: Endpoint +mitre_attack_id: + - T1059 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test - Cisco NVM + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log + source: not_applicable + sourcetype: cisco:nvm:flowdata:v2 + test_type: unit From aaf2ed21ff396a4847d71566c6e76ffbee807f49 Mon Sep 17 00:00:00 2001 From: Raven Tait <93157481+RavenTait@users.noreply.github.com> Date: Sun, 6 Sep 2026 15:16:06 -0400 Subject: [PATCH 087/162] Add Coverage For CVE-2026-47301 (#4236) --------- Co-authored-by: oerdogan Co-authored-by: Nasreddine Bencherchali --- .../endpoint/powershell_4104_hunting.yml | 9 +- ...ndows_builtin_account_name_was_changed.yml | 79 +++++++++++++ .../endpoint/windows_cab_file_on_disk.yml | 73 +++++++++--- ..._was_planted_in_sms_provider_directory.yml | 88 ++++++++++++++ ...xec_spawned_a_suspicious_child_process.yml | 110 ++++++++++++++++++ 5 files changed, 339 insertions(+), 20 deletions(-) create mode 100644 detections/endpoint/windows_builtin_account_name_was_changed.yml create mode 100644 detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml create mode 100644 detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index b52db6e54f6..26265588195 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -16,7 +16,8 @@ search: |- EventCode=4104 ScriptBlockText IN ( - "*-dumpcr%*", "*::decompress*", "*Add-Exfiltration*", "*Add-Persistence*", "*Add-RegBackdoor*", + "*-dumpcr%*", "* -version *", "*::decompress*", + "*Add-Exfiltration*", "*Add-Persistence*", "*Add-RegBackdoor*", "*Add-ScrnSaveBackdoor*", "*AmsiBypass*", "*assemblybuilderaccess*", "*backdoor*", "*backupprivilege*", "*beacon*", "*bitstransfer*", "*Brute-Force*", "*BruteForce*", "*CachedRDPConnection*", "*Check-VM*", "*cnvert*", "*compress-archive*", "*ComputerProperty*", @@ -24,8 +25,8 @@ search: |- "*Do-Exfiltration*", "*downloadfile*", "*downloadstring*", "*Enabled-DuplicateToken*", "*EXEonRemote*", "*exfiltration*", "*expand-archive*", "*Exploit-*", "*exploit*", "*Find-*", "*Frombase64_keyword*", "*Get-ApplicationHost*", "*Get-ChromeDump*", - "*Get-ClipboardContents*", "*Get-FoxDump*", "*Get-GPPPassword*", "*Get-IndexedItem*", - "*Get-Keystrokes*", "*Get-PassHash*", "*Get-RegAlwaysInstallElevated*", "*Get-RegAutoLogon*", + "*Get-ClipboardContents*", "*Get-*Credent*", "*Get-FoxDump*", "*Get-GPPPassword*", "*Get-IndexedItem*", + "*Get-Keystrokes*", "*Get-PassHash*", "*Get-*Password*", "*Get-RegAlwaysInstallElevated*", "*Get-RegAutoLogon*", "*Get-RickAstley*", "*Get-Screenshot*", "*Get-SecurityPackages*", "*Get-ServiceFilePermission*", "*Get-ServicePermission*", "*Get-ServiceUnquoted*", "*Get-SiteListPassword*", "*Get-System*", "*Get-TimedScreenshot*", "*Get-UnattendedInstallFile*", @@ -67,7 +68,7 @@ search: |- | eval invoke_wmi_keyword=if(like(script_lower,"%wmiobject%") OR like(script_lower,"%wmimethod%") OR like(script_lower,"%remotewmi%") OR like(script_lower,"%powershellwmi%") OR like(script_lower,"%wmicommand%"),5,0) - | eval downgrade_version=if(match(script_lower, "([-]ve*r*s*i*o*n*\s+2)") OR like(script_lower,"%powershell -version%"),3,0) + | eval downgrade_version=if(like(script_lower, "% -version 2%"),3,0) | eval compression_keyword=if(match(script_lower, "gzipstream|::decompress|io.compression|write-zip|(expand|compress)-archive"),5,0) diff --git a/detections/endpoint/windows_builtin_account_name_was_changed.yml b/detections/endpoint/windows_builtin_account_name_was_changed.yml new file mode 100644 index 00000000000..5981a964fbc --- /dev/null +++ b/detections/endpoint/windows_builtin_account_name_was_changed.yml @@ -0,0 +1,79 @@ +name: Windows Builtin Account Name Was Changed +id: 65e6e8b9-c68c-460f-beb8-48cfe91b4d21 +version: 1 +creation_date: '2026-08-24' +modification_date: '2026-08-24' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects renaming of Windows built-in accounts via Event ID 4781. + It identifies renames targeting accounts with well-known reserved RIDs (500-504): Administrator, Guest, krbtgt, DefaultAccount, and WDAGUtilityAccount, by matching the TargetSid field against the S-1-5-21-*-50[0-4] pattern. + Attackers commonly rename the built-in Administrator account to evade detections that alert on the literal account name, while retaining the full privileges of the RID-500 account. + Renaming Guest, krbtgt, or other reserved accounts is highly unusual in any legitimate environment. +data_source: + - Windows Event Log Security 4781 +search: |- + `wineventlog_security` + EventCode=4781 + TargetSid="S-1-5-21-*" + + | where match(TargetSid, "S-1-5-21-.*-50[0-4]$") + + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest OldTargetUserName NewTargetUserName + TargetSid SubjectLogonId + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_builtin_account_name_was_changed_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. +known_false_positives: |- + Renaming built-in accounts is uncommon in most environments but may occur during initial system hardening or CIS benchmark compliance efforts. + Validate the source user, logon ID, and timing against expected change control windows before tuning. +references: + - https://attack.mitre.org/techniques/T1078/003/ + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4781 + - https://nvd.nist.gov/vuln/detail/cve-2026-47301 + - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca + - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations +drilldown_searches: + - name: View the detection results for - "$dest$" and "$OldTargetUserName$" + search: '%original_detection_search% | search dest = "$dest$" OldTargetUserName = "$OldTargetUserName$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Built-in account [$OldTargetUserName$] (SID [$TargetSid$]) was renamed to [$NewTargetUserName$] on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: NewTargetUserName + type: user +analytic_story: + - Windows Defense Evasion Tactics + - Compromised Windows Host +asset_type: Endpoint +mitre_attack_id: + - T1078.003 + - T1036.010 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.003/builtin_account_rename/windows_security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_cab_file_on_disk.yml b/detections/endpoint/windows_cab_file_on_disk.yml index 5d9220feba9..878f72ce355 100644 --- a/detections/endpoint/windows_cab_file_on_disk.yml +++ b/detections/endpoint/windows_cab_file_on_disk.yml @@ -1,30 +1,66 @@ name: Windows CAB File on Disk id: 622f08d0-69ef-42c2-8139-66088bc25acd -version: 11 +version: 12 creation_date: '2023-11-16' -modification_date: '2026-05-13' -author: Michael Haag, Splunk +modification_date: '2026-08-24' +author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: The following analytic detects .cab files being written to disk. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on events where the file name is '*.cab' and the action is 'write'. This activity is significant as .cab files can be used to deliver malicious payloads, including embedded .url files that execute harmful code. If confirmed malicious, this behavior could lead to unauthorized code execution and potential system compromise. Analysts should review the file path and associated artifacts for further investigation. +description: |- + The following analytic detects .cab files being written to disk. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on events where the file name is '*.cab' and the action is 'write'. + This activity can be significant as .cab files can be used to deliver malicious payloads, including embedded .url files that execute harmful code. + If confirmed malicious, this behavior could lead to unauthorized code execution and potential system compromise. + Analysts should review the file path and associated artifacts for further investigation. data_source: - Sysmon EventID 11 search: |- - | tstats `security_content_summariesonly` count values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - WHERE ( - Filesystem.file_name=*.cab - ) - BY Filesystem.action Filesystem.dest Filesystem.file_access_time - Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time - Filesystem.file_name Filesystem.file_path Filesystem.file_acl - Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product + | tstats `security_content_summariesonly` + count values(Filesystem.file_path) as file_path + min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Filesystem WHERE + + Filesystem.action IN ("created", "modified") + Filesystem.file_name="*.cab" + NOT Filesystem.file_path IN ( + "*\\AppData\\Local\\Microsoft\\*", + "*\\Windows Kits\\10\\ADK\\Installers\\*", + "C:\\Program Files (x86)\\*", + "C:\\Program Files\\*", + "C:\\ProgramData\\Microsoft\\*", + "C:\\ProgramData\\Package Cache\\*", + "C:\\Windows\\appcompat\\*", + "C:\\Windows\\Logs\\CBS\\*", + "C:\\Windows\\servicing\\*", + "C:\\Windows\\SoftwareDistribution\\*", + "C:\\Windows\\System32\\*", + "C:\\Windows\\SystemApps\\*", + "C:\\Windows\\SysWOW64\\*", + "C:\\Windows\\WinSxS\\*", + ) + + BY Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl + Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name("Filesystem")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cab_file_on_disk_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: False positives will only be present if a process legitimately writes a .cab file to disk. Modify the analytic as needed by file path. Filter as needed. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. + These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. + To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. + The logs must also be mapped to the `Processes` node of the `Endpoint` data model. + Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Some false positives are expected from user controlled folders. references: - https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2023-10-25-IOCs-from-DarkGate-activity.txt drilldown_searches: @@ -41,11 +77,16 @@ intermediate_findings: - field: dest type: system score: 20 - message: A .cab file was written to disk on endpoint $dest$. + message: The file [$file_path$] with a .cab extension was written to disk on endpoint $dest$. +threat_objects: + - field: file_path + type: file_path analytic_story: - DarkGate Malware - APT37 Rustonotto and FadeStealer asset_type: Endpoint +cve: + - CVE-2026-47301 mitre_attack_id: - T1566.001 product: diff --git a/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml b/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml new file mode 100644 index 00000000000..dff7ccf275d --- /dev/null +++ b/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml @@ -0,0 +1,88 @@ +name: Windows SCCM Adsource DLL Was Planted In SMS Provider Directory +id: 4f55b07b-7aeb-47f4-a234-b222a902276b +version: 1 +creation_date: '2026-08-20' +modification_date: '2026-08-20' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects the creation or modification of adsource.dll or other staging files with the name adsource_*.dll within the SCCM SMS Provider bin directory, consistent with exploitation of CVE-2026-47301. + This abuses a DLL side-loading vulnerability in the Microsoft Configuration Manager SMS Provider component. + An attacker can plant a malicious adsource.dll in the SCCMProvider bin\X64 path, causing the SMS Provider service to load the attacker-controlled library in a privileged context. + The presence of renamed dlls alongside adsource.dll is a strong indicator of the classic DLL hijacking pattern where the legitimate library has been renamed so the malicious replacement can proxy calls to it. + If confirmed malicious, this activity represents a privilege escalation vector that can result in SYSTEM-level code execution on any host running the SCCM SMS Provider role. +data_source: + - Sysmon EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Filesystem where + + Filesystem.action IN ("created", "modified") + Filesystem.file_name IN ( + "adsource.dll", + "adsource_*.dll" + ) + Filesystem.file_path="*Microsoft Configuration Manager\\bin\\X64\\*" + + BY Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl + Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_sccm_adsource_dll_was_planted_in_sms_provider_directory_filter` +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. If you are using Sysmon, you must have EventID 11 (FileCreate) enabled, and the FileCreate section of the configuration must include TargetFilename paths ending in .dll or "Microsoft Configuration Manager\bin\X64\" folder. +known_false_positives: |- + Legitimate SCCM upgrades or hotfix installations may create or replace adsource.dll in the bin\X64 directory. + Validate the file hash and digital signature of any detected adsource.dll against the expected version for the installed SCCM build before tuning. +references: + - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca + - https://nvd.nist.gov/vuln/detail/cve-2026-47301 + - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Suspicious SCCM adsource DLL [$file_name$] detected at [$file_path$] on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: file_name + type: file_name + - field: file_path + type: file_path +analytic_story: + - Windows Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2026-47301 +mitre_attack_id: + - T1574.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/sccm_adsource_dll/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml b/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml new file mode 100644 index 00000000000..e93cc7f6930 --- /dev/null +++ b/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml @@ -0,0 +1,110 @@ +name: Windows SCCM Smsexec Spawned a Suspicious Child Process +id: 72091a05-3008-4330-b43e-f5e070134ec1 +version: 1 +creation_date: '2026-08-24' +modification_date: '2026-08-24' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects shells, scripting engines, and common post-exploitation utilities spawned as child processes of smsexec.exe. + smsexec.exe is the core SCCM SMS Executive service process and has no legitimate reason to launch interactive shells or scripting interpreters. + An attacker who plants a malicious adsource.dll in the SCCMProvider bin\X64 directory will obtain code execution in the SCCM service context, typically resulting in a SYSTEM-level child process being spawned under smsexec.exe. + If confirmed malicious, this activity represents successful exploitation of the SCCM SMS Executive service and should be treated as a full host compromise. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.parent_process_name="smsexec.exe" + Processes.process_name IN ( + "bitsadmin.exe", + "certutil.exe", + "cmd.exe", + "conhost.exe", + "cscript.exe", + "curl.exe", + "mshta.exe", + "net.exe", + "net1.exe", + "powershell.exe", + "pwsh.exe", + "reg.exe", + "regsvr32.exe", + "rundll32.exe", + "wmic.exe", + "wscript.exe" + ) + + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_sccm_smsexec_spawned_a_suspicious_child_process_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + smsexec.exe is not expected to spawn interactive shells or scripting engines under normal operating conditions. + False positives are unlikely. Validate the full command line and file hash of any match before tuning. +references: + - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca + - https://attack.mitre.org/techniques/T1574/001/ + - https://attack.mitre.org/techniques/T1068/ + - https://nvd.nist.gov/vuln/detail/cve-2026-47301 + - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 50 + message: Suspicious child process [$process_name$] with Command Line [$process$] spawned by [$parent_process_path$] on [$dest$] +threat_objects: + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Windows Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2026-47301 +mitre_attack_id: + - T1574.001 + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/sccm_adsource_dll/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit From 4265636126f24ed21e104ceea149df6f6821abd9 Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Mon, 7 Sep 2026 00:14:40 +0200 Subject: [PATCH 088/162] macOS detection: MacOS Osascript Displaying Suspicious User Prompt (#4250) --------- Co-authored-by: oerdogan Co-authored-by: Nasreddine Bencherchali --- ...ript_displaying_suspicious_user_prompt.yml | 101 ++++++++++++++++++ 1 file changed, 101 insertions(+) create mode 100644 detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml diff --git a/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml b/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml new file mode 100644 index 00000000000..b3a93b80666 --- /dev/null +++ b/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml @@ -0,0 +1,101 @@ +name: MacOS Osascript Displaying Suspicious User Prompt +id: d565ae18-7db6-460c-a2eb-a7109f18bc5e +version: 1 +creation_date: '2026-08-03' +modification_date: '2026-08-31' +author: Radka Viskova, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the execution of the macOS osascript utility with AppleScript commands that display a dialog or alert containing potentially deceptive, credential-related, or security-themed content. + Adversaries may abuse osascript to present fake system messages or credential prompts and trick users into disclosing sensitive information. + This detection is based on command-line content and should be reviewed with the parent process, executing user, script content, and surrounding endpoint activity. +data_source: + - Osquery Results +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name="osascript" + Processes.process IN ( + "*display alert*", + "*display dialog*" + ) + Processes.process IN ( + "*access System*", + "*authentication*", + "*credentials*", + "*critical update*", + "*needs your attention*", + "*password*", + "*security update*", + "*system error*", + "*verify*", + "*with hidden answer*" + ) + + BY Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_osascript_displaying_suspicious_user_prompt_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Legitimate administrative, MDM, software deployment, support, or automation scripts may use osascript to display dialogs or alerts. Review the parent process, executing user, script content, signer, and known administrative tooling before suppressing the activity. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/tactics/TA0006/ + - https://attack.mitre.org/techniques/T1056/002/ + - https://attack.mitre.org/techniques/T1059/002/ + - https://www.loobins.io/binaries/osascript/ + - https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/#cq=i1 + - https://www.infostealers.com/article/an-infostealers-brewin-cuckoo-atomicstealer-get-creative/ + - https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: The osascript utility executed a command containing dialog-related and potentially deceptive content on endpoint [$dest$] with the Command Line [$process$]. +threat_objects: + - field: process + type: process +analytic_story: + - MacOS Privilege Escalation +asset_type: Endpoint +mitre_attack_id: + - T1059.002 + - T1056.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log + source: osquery + sourcetype: osquery:results + test_type: unit From 225e7057961666cbab51df615146d82e0d73eeee Mon Sep 17 00:00:00 2001 From: themaryjo Date: Mon, 7 Sep 2026 02:03:40 +0200 Subject: [PATCH 089/162] Add Socat Utility Detections (#4253) --------- Co-authored-by: oerdogan Co-authored-by: Nasreddine Bencherchali --- ...network_listener_binding_an_executable.yml | 91 +++++++++++++++++++ ...cp_connection_with_local_echo_disabled.yml | 90 ++++++++++++++++++ 2 files changed, 181 insertions(+) create mode 100644 detections/endpoint/socat_network_listener_binding_an_executable.yml create mode 100644 detections/endpoint/socat_remote_tcp_connection_with_local_echo_disabled.yml diff --git a/detections/endpoint/socat_network_listener_binding_an_executable.yml b/detections/endpoint/socat_network_listener_binding_an_executable.yml new file mode 100644 index 00000000000..2ff67a8fe48 --- /dev/null +++ b/detections/endpoint/socat_network_listener_binding_an_executable.yml @@ -0,0 +1,91 @@ +name: Socat Network Listener Binding an Executable +id: 72482d45-1d05-46f5-bb6c-e2b709a8073a +version: 1 +creation_date: '2026-08-27' +modification_date: '2026-08-27' +author: Maria Jose Erquiaga, Splunk +status: production +type: TTP +description: |- + The following analytic detects the execution of the socat utility with command-line arguments that configure a TCP or OpenSSL listener and bind an executable to incoming connections. + Socat is a legitimate network utility, but this behavior may be used to expose executables, establish bind shells, facilitate remote command execution, or support lateral movement. +data_source: + - Osquery Results + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count + min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_name="socat*" + Processes.process="*exec:*" + Processes.process="*-listen:*" + + by Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `socat_network_listener_binding_an_executable_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Developers, network engineers, and system administrators may use socat to expose benign executables for protocol testing, debugging, data transformation, or troubleshooting. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059 + - https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/ + - https://gtfobins.github.io/gtfobins/socat/ + - https://hackers-arise.com/socat-the-advanced-hackers-network-tool/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Socat was executed with a TCP or OpenSSL listener configured to pass inbound connections to an executable via [$process$] on endpoint [$dest$] by user [$user$]. + entity: + field: dest + type: system + score: 50 +intermediate_findings: + entities: + - field: user + type: user + score: 50 + message: Socat was executed with a TCP or OpenSSL listener configured to pass inbound connections to an executable via [$process$] on endpoint [$dest$] by user [$user$]. +threat_objects: + - field: process + type: process +analytic_story: + - MacOS Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059 + - T1572 +product: + - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.log + source: osqueryd.results.log + sourcetype: osquery:results + test_type: unit diff --git a/detections/endpoint/socat_remote_tcp_connection_with_local_echo_disabled.yml b/detections/endpoint/socat_remote_tcp_connection_with_local_echo_disabled.yml new file mode 100644 index 00000000000..cc264218561 --- /dev/null +++ b/detections/endpoint/socat_remote_tcp_connection_with_local_echo_disabled.yml @@ -0,0 +1,90 @@ +name: Socat Remote TCP Connection with Local Echo Disabled +id: 458c6c37-116d-4f01-8267-f09f5b82cd14 +version: 1 +creation_date: '2026-08-27' +modification_date: '2026-08-27' +author: Maria Jose Erquiaga, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects execution of the socat utility with a remote TCP or OpenSSL connection and local terminal echo disabled. + This configuration may be used for interactive terminal sessions, password handling, automation, or network debugging. + When observed in an unexpected context, such as execution by an unusual parent process or connection to an untrusted endpoint, it may indicate suspicious remote access activity. +data_source: + - Osquery Results + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_name="socat*" + Processes.process="*echo=0*" + Processes.process IN ( + "*openssl:*", + "*tcp:*", + "*tcp4:*", + "*tcp6:*" + ) + + by Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `socat_remote_tcp_connection_with_local_echo_disabled_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Developers and network engineers may use socat with local echo disabled for legitimate TCP debugging, protocol testing, terminal handling, or troubleshooting. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059 + - https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/ + - https://gtfobins.github.io/gtfobins/socat/ + - https://hackers-arise.com/socat-the-advanced-hackers-network-tool/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Socat was executed with local terminal echo disabled and a remote TCP or OpenSSL connection via Command Line [$process$] on endpoint [$dest$] by user [$user$]. +threat_objects: + - field: process + type: process +analytic_story: + - MacOS Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059 + - T1572 +product: + - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.log + source: osquery + sourcetype: osquery:results + test_type: unit From 855be185ec399520f5014edc089cd64b354c79b6 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Mon, 7 Sep 2026 15:14:33 +0200 Subject: [PATCH 090/162] Batch Fixes from Code Review (#4259) --- .github/workflows/update_nist_ai_rmf_detection_map.yml | 1 + detections/endpoint/powershell_4104_hunting.yml | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/update_nist_ai_rmf_detection_map.yml b/.github/workflows/update_nist_ai_rmf_detection_map.yml index 96f4d998acf..7d832fed6e8 100644 --- a/.github/workflows/update_nist_ai_rmf_detection_map.yml +++ b/.github/workflows/update_nist_ai_rmf_detection_map.yml @@ -18,6 +18,7 @@ jobs: uses: actions/checkout@v7 with: ref: develop + persist-credentials: false - name: Set up Python uses: actions/setup-python@v6 diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 26265588195..27058a26859 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -24,7 +24,7 @@ search: |- "*comsvcs*", "*copy-vss*", "*CreateShortcut*", "*disablerealtimemonitoring*", "*Do-Exfiltration*", "*downloadfile*", "*downloadstring*", "*Enabled-DuplicateToken*", "*EXEonRemote*", "*exfiltration*", "*expand-archive*", "*Exploit-*", "*exploit*", - "*Find-*", "*Frombase64_keyword*", "*Get-ApplicationHost*", "*Get-ChromeDump*", + "*Find-*", "*Frombase64*", "*Get-ApplicationHost*", "*Get-ChromeDump*", "*Get-ClipboardContents*", "*Get-*Credent*", "*Get-FoxDump*", "*Get-GPPPassword*", "*Get-IndexedItem*", "*Get-Keystrokes*", "*Get-PassHash*", "*Get-*Password*", "*Get-RegAlwaysInstallElevated*", "*Get-RegAutoLogon*", "*Get-RickAstley*", "*Get-Screenshot*", "*Get-SecurityPackages*", "*Get-ServiceFilePermission*", @@ -54,9 +54,9 @@ search: |- | eval suspicious_cmdlets=if(match(ScriptBlockText, "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|netfirewall|Uninstall-Windows|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0) - | eval base64_keyword=if(like(script_lower,"%frombase64_keyword%"), 4, 0) + | eval base64_keyword=if(like(script_lower,"%Frombase64%"), 4, 0) - | eval empire=if(like(script_lower,"%system.net.webclient%") AND like(script_lower,"%frombase64_keywordstring%"),5,0) + | eval empire=if(like(script_lower,"%system.net.webclient%") AND like(script_lower,"%Frombase64%"),5,0) | eval mimikatz=if(like(script_lower,"%mimikatz%") OR like(script_lower,"%-dumpcr%") OR like(script_lower,"%sekurlsa::pth%") OR like(script_lower,"%kerberos::ptt%") OR like(script_lower,"%kerberos::golden%"),5,0) From 5b9754b4742405f2f75bedb4b2976d3025f9c723 Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Mon, 7 Sep 2026 18:51:05 +0200 Subject: [PATCH 091/162] Batch fixes from code review (#4260) --- detections/endpoint/powershell_4104_hunting.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 27058a26859..006d345909f 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -16,7 +16,7 @@ search: |- EventCode=4104 ScriptBlockText IN ( - "*-dumpcr%*", "* -version *", "*::decompress*", + "*-dumpcr*", "* -version *", "*::decompress*", "*Add-Exfiltration*", "*Add-Persistence*", "*Add-RegBackdoor*", "*Add-ScrnSaveBackdoor*", "*AmsiBypass*", "*assemblybuilderaccess*", "*backdoor*", "*backupprivilege*", "*beacon*", "*bitstransfer*", "*Brute-Force*", "*BruteForce*", @@ -54,9 +54,9 @@ search: |- | eval suspicious_cmdlets=if(match(ScriptBlockText, "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|netfirewall|Uninstall-Windows|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0) - | eval base64_keyword=if(like(script_lower,"%Frombase64%"), 4, 0) + | eval base64_keyword=if(like(script_lower,"%frombase64%"), 4, 0) - | eval empire=if(like(script_lower,"%system.net.webclient%") AND like(script_lower,"%Frombase64%"),5,0) + | eval empire=if(like(script_lower,"%system.net.webclient%") AND like(script_lower,"%frombase64%"),5,0) | eval mimikatz=if(like(script_lower,"%mimikatz%") OR like(script_lower,"%-dumpcr%") OR like(script_lower,"%sekurlsa::pth%") OR like(script_lower,"%kerberos::ptt%") OR like(script_lower,"%kerberos::golden%"),5,0) From 4cd62e811c5eddf1245c780d48823d7b38998566 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Tue, 8 Sep 2026 10:56:33 +0200 Subject: [PATCH 092/162] Detection Against Content Copied From Browsers Executed through Run (#4261) --- data_sources/sysmon_eventid_24.yml | 84 ++++++++++++++++ ...ntent_copied_from_browser_was_executed.yml | 97 +++++++++++++++++++ 2 files changed, 181 insertions(+) create mode 100644 data_sources/sysmon_eventid_24.yml create mode 100644 detections/endpoint/windows_content_copied_from_browser_was_executed.yml diff --git a/data_sources/sysmon_eventid_24.yml b/data_sources/sysmon_eventid_24.yml new file mode 100644 index 00000000000..66a49773a64 --- /dev/null +++ b/data_sources/sysmon_eventid_24.yml @@ -0,0 +1,84 @@ +name: Sysmon EventID 24 +id: ae023710-3dbb-4de3-a1b2-5477a8ab74f9 +version: 1 +creation_date: '2024-09-07' +modification_date: '2024-09-07' +author: Onur Mustafa Erdogan, Splunk +description: Logs whenever new content is copied into the clipboard, including details about the associated process, hash of the content, and the time of copying. +mitre_components: + - Process Metadata + - Process Access + - Application Log Content + - OS API Execution +source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +sourcetype: XmlWinEventLog +separator: EventID +separator_value: '24' +configuration: https://github.com/SwiftOnSecurity/sysmon-config +supported_TA: + - name: Splunk Add-on for Sysmon + url: https://splunkbase.splunk.com/app/5709 + version: 5.0.1 +fields: + - _time + - Archived + - Channel + - ClientInfo + - Computer + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - Guid + - Hashes + - IMPHASH + - Image + - Keywords + - Level + - MD5 + - Name + - Opcode + - ProcessGuid + - ProcessID + - ProcessId + - RecordID + - RecordNumber + - RuleName + - SHA256 + - SecurityID + - Session + - SrcHost + - SystemTime + - System_Props_Xml + - Task + - ThreadID + - TimeCreated + - User + - UserID + - UtcTime + - Version + - host + - id + - index + - source + - sourcetype + - splunk_server + - tag + - tag::eventtype +output_fields: + - dest + - dvc + - event_id + - process_exec + - process_guid + - process_hash + - process_id + - process_name + - process_path + - severity + - splunk_server + - user + - vendor_product +example_log: 24542400x8000000000000000274447Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-09-07 14:37:28.999{1b43529b-bf4f-6a9e-e4eb-020000006600}8988C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe2user EC2AMAZ-FKEOM7G\Administrator hostname OERDOGAN-M-7N5YMD5=F2CD63BD7E2B5F9B738F589AF3BB1F8F,SHA256=397EE4CA855D96072D57E89ABFCA9F83634DAEA133E5302CB0766E87FDC3FEFC,IMPHASH=00000000000000000000000000000000false - failed with error 1337EC2AMAZ-FKEOM7G\Administrator diff --git a/detections/endpoint/windows_content_copied_from_browser_was_executed.yml b/detections/endpoint/windows_content_copied_from_browser_was_executed.yml new file mode 100644 index 00000000000..ad9d1785906 --- /dev/null +++ b/detections/endpoint/windows_content_copied_from_browser_was_executed.yml @@ -0,0 +1,97 @@ +name: Windows Content Copied from Browser was Executed +id: 5d1fdbcb-5ed9-4190-85c8-7f9026450a0b +version: 1 +creation_date: '2026-09-07' +modification_date: '2026-09-07' +author: Onur Mustafa Erdogan, Splunk +status: production +type: TTP +description: |- + The following analytic correlates modifications to the Windows RunMRU registry key with clipboard content + changes initiated by browsers. It aims to detect ClickFix scenarios in which commands copied + from a browser are subsequently executed on the Windows system through the Run dialog box. +data_source: + - Sysmon EventID 13 AND Sysmon EventID 24 +search: |- + `sysmon` + EventID IN (13, 24) + ( + registry_key_name=*RunMRU* + OR + process_name IN ( + "360se.exe", "arc.exe", "atlas.exe", "avastbrowser.exe", "avgbrowser.exe", "blpbrowser.exe", "brave.exe", "braveupdate.exe", + "chrome.exe", "chromium.exe", "coccoc.exe", "dragon.exe", "duckduckgo.exe", "epic.exe", "firefox.exe", "ghost.exe", + "iexplore.exe", "iridium.exe", "iron.exe", "maxthon.exe", "microsoftedge.exe", "microsoftedgeupdate.exe", "msedge.exe", + "msedgewebview2.exe", "opera.exe", "opera_autoupdate.exe", "perplexity.exe", "rave.exe", "safari.exe", "shift.exe", + "sidekick.exe", "thorium.exe", "torch.exe", "vivaldi.exe", "wavebrowser.exe", "whale.exe", "zen.exe" + ) + ) + | eval trimmed_command = rtrim(registry_value_data, "\1") + | eval utf16le_command = urldecode(replace(trimmed_command, "(.)", "\1%00")) + | eval sha256_process=upper(sha256(utf16le_command)) + | eval hash_command=coalesce(SHA256,sha256_process) + | stats min(_time) as firstTime max(_time) as lastTime values(process_name) as process_name + values(trimmed_command) as process values(EventID) as EventID dc(EventID) as dc_EventID count + by hash_command dest user + | search dc_EventID>1 + | eval process_name = mvfilter( + process_name IN ( + "360se.exe", "arc.exe", "atlas.exe", "avastbrowser.exe", "avgbrowser.exe", "blpbrowser.exe", "brave.exe", "braveupdate.exe", + "chrome.exe", "chromium.exe", "coccoc.exe", "dragon.exe", "duckduckgo.exe", "epic.exe", "firefox.exe", "ghost.exe", + "iexplore.exe", "iridium.exe", "iron.exe", "maxthon.exe", "microsoftedge.exe", "microsoftedgeupdate.exe", "msedge.exe", + "msedgewebview2.exe", "opera.exe", "opera_autoupdate.exe", "perplexity.exe", "rave.exe", "safari.exe", "shift.exe", + "sidekick.exe", "thorium.exe", "torch.exe", "vivaldi.exe", "wavebrowser.exe", "whale.exe", "zen.exe" + ) + ) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_content_copied_from_browser_was_executed_filter` +how_to_implement: |- + This detection requires Sysmon event logs. Configure your environment to ingest Sysmon registry modification (Event ID 13) + and clipboard change (Event ID 24) events. Ensure that registry modification events are collected for the RunMRU registry key + and clipboard change events are collected from common browser processes. Ingest the data through the appropriate Splunk technology + add-on and normalize field names using the Splunk Common Information Model (CIM). +known_false_positives: No false positives have been identified at this time. +references: + - https://socradar.io/blog/doublecup-clickfix-loader-devicemanager-rats/ + - https://www.huntress.com/blog/clickfix-matanbuchus-astarionrat-analysis +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: The content [$process$] was copied from [$process_name$] to the clipboard and was executed through the Run dialog box on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process + type: process + - field: hash_command + type: process_hash +analytic_story: + - Fake CAPTCHA Campaigns +asset_type: Endpoint +mitre_attack_id: + - T1202 + - T1059.001 + - T1059.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/windows_browser_copy_paste/windows_browser_copy_paste.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit From 2216f46e725cff8149beb2820663e8c15e5ce782 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 18 Sep 2026 15:51:19 -0700 Subject: [PATCH 093/162] Update data source TA and install.yml app versions (#4274) --- data_sources/asl_aws_cloudtrail.yml | 2 +- data_sources/aws_bedrock_claude.yml | 2 +- data_sources/aws_cloudfront.yml | 2 +- data_sources/aws_cloudtrail.yml | 2 +- data_sources/aws_cloudtrail_assumerolewithsaml.yml | 2 +- data_sources/aws_cloudtrail_consolelogin.yml | 2 +- data_sources/aws_cloudtrail_copyobject.yml | 2 +- data_sources/aws_cloudtrail_createaccesskey.yml | 2 +- data_sources/aws_cloudtrail_createkey.yml | 2 +- data_sources/aws_cloudtrail_createloginprofile.yml | 2 +- data_sources/aws_cloudtrail_createnetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_createpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_createsnapshot.yml | 2 +- data_sources/aws_cloudtrail_createtask.yml | 2 +- data_sources/aws_cloudtrail_createvirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deactivatemfadevice.yml | 2 +- data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_deletealarms.yml | 2 +- data_sources/aws_cloudtrail_deletedetector.yml | 2 +- data_sources/aws_cloudtrail_deletegroup.yml | 2 +- data_sources/aws_cloudtrail_deleteguardrail.yml | 2 +- data_sources/aws_cloudtrail_deleteipset.yml | 2 +- data_sources/aws_cloudtrail_deleteknowledgebase.yml | 2 +- data_sources/aws_cloudtrail_deleteloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deleteloggroup.yml | 2 +- data_sources/aws_cloudtrail_deletelogstream.yml | 2 +- ...aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deletenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_deletepolicy.yml | 2 +- data_sources/aws_cloudtrail_deleterule.yml | 2 +- data_sources/aws_cloudtrail_deleterulegroup.yml | 2 +- data_sources/aws_cloudtrail_deletesnapshot.yml | 2 +- data_sources/aws_cloudtrail_deletetrail.yml | 2 +- data_sources/aws_cloudtrail_deletevirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deletewebacl.yml | 2 +- data_sources/aws_cloudtrail_describeeventaggregates.yml | 2 +- data_sources/aws_cloudtrail_describeimagescanfindings.yml | 2 +- data_sources/aws_cloudtrail_describesnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_getobject.yml | 2 +- data_sources/aws_cloudtrail_getpassworddata.yml | 2 +- data_sources/aws_cloudtrail_invokemodel.yml | 2 +- data_sources/aws_cloudtrail_jobcreated.yml | 2 +- data_sources/aws_cloudtrail_listfoundationmodels.yml | 2 +- data_sources/aws_cloudtrail_modifydbinstance.yml | 2 +- data_sources/aws_cloudtrail_modifyimageattribute.yml | 2 +- data_sources/aws_cloudtrail_modifysnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_putbucketacl.yml | 2 +- data_sources/aws_cloudtrail_putbucketlifecycle.yml | 2 +- data_sources/aws_cloudtrail_putbucketreplication.yml | 2 +- data_sources/aws_cloudtrail_putbucketversioning.yml | 2 +- data_sources/aws_cloudtrail_putimage.yml | 2 +- data_sources/aws_cloudtrail_putkeypolicy.yml | 2 +- data_sources/aws_cloudtrail_replacenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_setdefaultpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_stoplogging.yml | 2 +- data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_updateloginprofile.yml | 2 +- data_sources/aws_cloudtrail_updatesamlprovider.yml | 2 +- data_sources/aws_cloudtrail_updatetrail.yml | 2 +- data_sources/aws_cloudwatchlogs_vpcflow.yml | 2 +- data_sources/aws_security_hub.yml | 2 +- data_sources/azure_active_directory.yml | 2 +- ...e_directory_add_app_role_assignment_to_service_principal.yml | 2 +- data_sources/azure_active_directory_add_member_to_role.yml | 2 +- .../azure_active_directory_add_owner_to_application.yml | 2 +- data_sources/azure_active_directory_add_service_principal.yml | 2 +- data_sources/azure_active_directory_add_unverified_domain.yml | 2 +- data_sources/azure_active_directory_consent_to_application.yml | 2 +- .../azure_active_directory_disable_strong_authentication.yml | 2 +- data_sources/azure_active_directory_enable_account.yml | 2 +- data_sources/azure_active_directory_invite_external_user.yml | 2 +- .../azure_active_directory_microsoftgraphactivitylogs.yml | 2 +- .../azure_active_directory_noninteractiveusersigninlogs.yml | 2 +- .../azure_active_directory_reset_password_(by_admin).yml | 2 +- .../azure_active_directory_set_domain_authentication.yml | 2 +- data_sources/azure_active_directory_sign_in_activity.yml | 2 +- data_sources/azure_active_directory_update_application.yml | 2 +- .../azure_active_directory_update_authorization_policy.yml | 2 +- data_sources/azure_active_directory_update_user.yml | 2 +- .../azure_active_directory_user_registered_security_info.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_account.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_runbook.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_webhook.yml | 2 +- data_sources/azure_monitor_activity.yml | 2 +- data_sources/cisco_ai_defense_alerts.yml | 2 +- data_sources/cisco_asa_logs.yml | 2 +- data_sources/cisco_duo_activity.yml | 2 +- data_sources/cisco_duo_administrator.yml | 2 +- data_sources/cisco_isovalent_process_connect.yml | 2 +- data_sources/cisco_isovalent_process_exec.yml | 2 +- data_sources/cisco_isovalent_process_kprobe.yml | 2 +- data_sources/cisco_network_visibility_module_flow_data.yml | 2 +- data_sources/cisco_network_visibility_module_osquery.yml | 2 +- data_sources/cisco_secure_access_dns.yml | 2 +- data_sources/cisco_secure_access_firewall.yml | 2 +- data_sources/cisco_secure_access_proxy.yml | 2 +- .../cisco_secure_firewall_threat_defense_connection_event.yml | 2 +- .../cisco_secure_firewall_threat_defense_file_event.yml | 2 +- .../cisco_secure_firewall_threat_defense_intrusion_event.yml | 2 +- data_sources/crowdstrike_falcon_stream_alert.yml | 2 +- data_sources/crowdstrike_processrollup2.yml | 2 +- data_sources/github_enterprise_audit_logs.yml | 2 +- data_sources/github_organizations_audit_logs.yml | 2 +- data_sources/nginx_access.yml | 2 +- 105 files changed, 105 insertions(+), 105 deletions(-) diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index 177d51fa859..6fd1fe38ab6 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -24,7 +24,7 @@ separator: api.operation supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 output_fields: - dest - user diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index 801a3882ead..5ca8401b63d 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -14,7 +14,7 @@ separator_value: ModelInvocationLog supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - accountId diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index e725a27c95d..f74d5622d50 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -17,7 +17,7 @@ sourcetype: aws:cloudfront:accesslogs supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index 9ce661d9697..771112afc14 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -11,4 +11,4 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 diff --git a/data_sources/aws_cloudtrail_assumerolewithsaml.yml b/data_sources/aws_cloudtrail_assumerolewithsaml.yml index 87c2702b279..a6cec23c064 100644 --- a/data_sources/aws_cloudtrail_assumerolewithsaml.yml +++ b/data_sources/aws_cloudtrail_assumerolewithsaml.yml @@ -18,7 +18,7 @@ separator_value: AssumeRoleWithSAML supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index 1c5f94ecab4..2ff6e5b7143 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -18,7 +18,7 @@ separator_value: ConsoleLogin supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_copyobject.yml b/data_sources/aws_cloudtrail_copyobject.yml index 042284fe756..4a3d0da1704 100644 --- a/data_sources/aws_cloudtrail_copyobject.yml +++ b/data_sources/aws_cloudtrail_copyobject.yml @@ -17,7 +17,7 @@ separator_value: CopyObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index 90d25a6c4b4..b0d5da0175d 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -17,7 +17,7 @@ separator_value: CreateAccessKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index 66946e91610..d0438d39af5 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -17,7 +17,7 @@ separator_value: CreateKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createloginprofile.yml b/data_sources/aws_cloudtrail_createloginprofile.yml index e9c79a8b1ae..6a3bc6f3c0b 100644 --- a/data_sources/aws_cloudtrail_createloginprofile.yml +++ b/data_sources/aws_cloudtrail_createloginprofile.yml @@ -17,7 +17,7 @@ separator_value: CreateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index c1153a30680..c63acbb7eca 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -17,7 +17,7 @@ separator_value: CreateNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index 00c450ca5dc..e66f77171f1 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -17,7 +17,7 @@ separator_value: CreatePolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index 621812b8ec1..c1b0c920e41 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -17,7 +17,7 @@ separator_value: CreateSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createtask.yml b/data_sources/aws_cloudtrail_createtask.yml index f84b2cf0026..5288b8cbd48 100644 --- a/data_sources/aws_cloudtrail_createtask.yml +++ b/data_sources/aws_cloudtrail_createtask.yml @@ -17,7 +17,7 @@ separator_value: CreateTask supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml index bcc8f0593cb..47342a57d8f 100644 --- a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml @@ -17,7 +17,7 @@ separator_value: CreateVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deactivatemfadevice.yml b/data_sources/aws_cloudtrail_deactivatemfadevice.yml index 9c87fc438ac..9e8c0336a0c 100644 --- a/data_sources/aws_cloudtrail_deactivatemfadevice.yml +++ b/data_sources/aws_cloudtrail_deactivatemfadevice.yml @@ -17,7 +17,7 @@ separator_value: DeactivateMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml index 4364c100004..f328e4afb8e 100644 --- a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: DeleteAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletealarms.yml b/data_sources/aws_cloudtrail_deletealarms.yml index 9aa28412573..81b65bfb0df 100644 --- a/data_sources/aws_cloudtrail_deletealarms.yml +++ b/data_sources/aws_cloudtrail_deletealarms.yml @@ -17,7 +17,7 @@ separator_value: DeleteAlarms supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index 39d29d1a6fc..9dd19beb76e 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -17,7 +17,7 @@ separator_value: DeleteDetector supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index d190093d91f..eaaed2c8444 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteguardrail.yml b/data_sources/aws_cloudtrail_deleteguardrail.yml index bcf4fd5f848..bcf5a76f984 100644 --- a/data_sources/aws_cloudtrail_deleteguardrail.yml +++ b/data_sources/aws_cloudtrail_deleteguardrail.yml @@ -14,7 +14,7 @@ separator_value: DeleteGuardrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 6cb149284f9..8ca44cb9048 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -16,7 +16,7 @@ separator_value: DeleteIPSet supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deleteknowledgebase.yml b/data_sources/aws_cloudtrail_deleteknowledgebase.yml index 0bacc4bbb41..86bd7aab68c 100644 --- a/data_sources/aws_cloudtrail_deleteknowledgebase.yml +++ b/data_sources/aws_cloudtrail_deleteknowledgebase.yml @@ -14,7 +14,7 @@ separator_value: DeleteKnowledgeBase supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml index d8aa0af29a5..206581102ad 100644 --- a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index 32a576295d7..45377a711cc 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index fb8e5147f61..9f3946121af 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogStream supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml index 6518df5b567..c7139fe37ee 100644 --- a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml @@ -14,7 +14,7 @@ separator_value: DeleteModelInvocationLoggingConfiguration supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index 26b3ce7198e..c0350a47118 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -16,7 +16,7 @@ separator_value: DeleteNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index f5c3a384fe7..8b3f877fa33 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -15,7 +15,7 @@ separator_value: DeletePolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index 95f67eb714a..eaf32e0d25f 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -17,7 +17,7 @@ separator_value: DeleteRule supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deleterulegroup.yml b/data_sources/aws_cloudtrail_deleterulegroup.yml index 888baf1d853..9a977502fa5 100644 --- a/data_sources/aws_cloudtrail_deleterulegroup.yml +++ b/data_sources/aws_cloudtrail_deleterulegroup.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deletesnapshot.yml b/data_sources/aws_cloudtrail_deletesnapshot.yml index e8eb028bb97..73fae76c7dc 100644 --- a/data_sources/aws_cloudtrail_deletesnapshot.yml +++ b/data_sources/aws_cloudtrail_deletesnapshot.yml @@ -17,7 +17,7 @@ separator_value: DeleteSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index 2a0af889973..0ff1b8bf84d 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -17,7 +17,7 @@ separator_value: DeleteTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml index bd587aed866..124ec4fdcdd 100644 --- a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml @@ -15,7 +15,7 @@ separator_value: DeleteVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index 3d389b31f62..b970da776a4 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -15,7 +15,7 @@ separator_value: DeleteWebACL supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_describeeventaggregates.yml b/data_sources/aws_cloudtrail_describeeventaggregates.yml index 5aa835619d9..1cef1f3ceeb 100644 --- a/data_sources/aws_cloudtrail_describeeventaggregates.yml +++ b/data_sources/aws_cloudtrail_describeeventaggregates.yml @@ -15,7 +15,7 @@ separator_value: DescribeEventAggregates supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index 191afb2bcec..435cf6402eb 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -16,7 +16,7 @@ separator_value: DescribeImageScanFindings supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describesnapshotattribute.yml b/data_sources/aws_cloudtrail_describesnapshotattribute.yml index e31315d18cd..2130bc1392f 100644 --- a/data_sources/aws_cloudtrail_describesnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_describesnapshotattribute.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - action - app diff --git a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml index 27e9e0b3f16..b66fcd5be46 100644 --- a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: GetAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_getobject.yml b/data_sources/aws_cloudtrail_getobject.yml index 160dfe1db5b..954e0181fb0 100644 --- a/data_sources/aws_cloudtrail_getobject.yml +++ b/data_sources/aws_cloudtrail_getobject.yml @@ -16,7 +16,7 @@ separator_value: GetObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index 4c419b3a636..7e6ef7089ff 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -15,7 +15,7 @@ separator_value: GetPasswordData supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_invokemodel.yml b/data_sources/aws_cloudtrail_invokemodel.yml index d2d1b63ce6f..d2595753a7c 100644 --- a/data_sources/aws_cloudtrail_invokemodel.yml +++ b/data_sources/aws_cloudtrail_invokemodel.yml @@ -14,7 +14,7 @@ separator_value: InvokeModel supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_jobcreated.yml b/data_sources/aws_cloudtrail_jobcreated.yml index c421ba7cb94..d18e6de7ea7 100644 --- a/data_sources/aws_cloudtrail_jobcreated.yml +++ b/data_sources/aws_cloudtrail_jobcreated.yml @@ -15,7 +15,7 @@ separator_value: JobCreated supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_listfoundationmodels.yml b/data_sources/aws_cloudtrail_listfoundationmodels.yml index f3898a66797..8fa39552820 100644 --- a/data_sources/aws_cloudtrail_listfoundationmodels.yml +++ b/data_sources/aws_cloudtrail_listfoundationmodels.yml @@ -14,7 +14,7 @@ separator_value: ListFoundationModels supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index 3613f843e82..82d2e091096 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -16,7 +16,7 @@ separator_value: ModifyDBInstance supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index 4d47df2492d..5391f2dc6fd 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -15,7 +15,7 @@ separator_value: ModifyImageAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index 1027f7c5f23..72d88079740 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -14,7 +14,7 @@ separator_value: ModifySnapshotAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putbucketacl.yml b/data_sources/aws_cloudtrail_putbucketacl.yml index 4877ea119c8..a2c348f7a8b 100644 --- a/data_sources/aws_cloudtrail_putbucketacl.yml +++ b/data_sources/aws_cloudtrail_putbucketacl.yml @@ -15,7 +15,7 @@ separator_value: PutBucketAcl supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index daa93d4c05c..5d3dd4b85aa 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -15,7 +15,7 @@ separator_value: PutBucketLifecycle supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketreplication.yml b/data_sources/aws_cloudtrail_putbucketreplication.yml index 452914db259..9eca3486105 100644 --- a/data_sources/aws_cloudtrail_putbucketreplication.yml +++ b/data_sources/aws_cloudtrail_putbucketreplication.yml @@ -14,7 +14,7 @@ separator_value: PutBucketReplication supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketversioning.yml b/data_sources/aws_cloudtrail_putbucketversioning.yml index ebcd3e95b4f..8a52e1dd161 100644 --- a/data_sources/aws_cloudtrail_putbucketversioning.yml +++ b/data_sources/aws_cloudtrail_putbucketversioning.yml @@ -14,7 +14,7 @@ separator_value: PutBucketVersioning supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index d95a8e337fc..dae12350ea2 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -15,7 +15,7 @@ separator_value: PutImage supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 57b95d703a1..3f1d2fd448e 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -13,7 +13,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 40e4c9ae5d8..85693fd2c76 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -15,7 +15,7 @@ separator_value: ReplaceNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index 83e554a5ca4..188e83923bc 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -15,7 +15,7 @@ separator_value: SetDefaultPolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index de9423c9c53..c7bbbe699df 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -14,7 +14,7 @@ separator_value: StopLogging supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml index 106b623c2c5..559857b474c 100644 --- a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: UpdateAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index f62c9e64176..b9140c0c4b1 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -15,7 +15,7 @@ separator_value: UpdateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatesamlprovider.yml b/data_sources/aws_cloudtrail_updatesamlprovider.yml index e8c6c5ae94b..613fcc77504 100644 --- a/data_sources/aws_cloudtrail_updatesamlprovider.yml +++ b/data_sources/aws_cloudtrail_updatesamlprovider.yml @@ -16,7 +16,7 @@ separator_value: UpdateSAMLProvider supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index c609919c95d..a5c3a3a362e 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -15,7 +15,7 @@ separator_value: UpdateTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - app diff --git a/data_sources/aws_cloudwatchlogs_vpcflow.yml b/data_sources/aws_cloudwatchlogs_vpcflow.yml index b165f0ace89..62efe791219 100644 --- a/data_sources/aws_cloudwatchlogs_vpcflow.yml +++ b/data_sources/aws_cloudwatchlogs_vpcflow.yml @@ -12,7 +12,7 @@ source: aws_cloudwatchlogs_vpcflow sourcetype: aws:cloudwatchlogs:vpcflow supported_TA: - name: Splunk Add-on for AWS - version: 8.2.2 + version: 8.3.0 url: https://splunkbase.splunk.com/app/1876 fields: - _raw diff --git a/data_sources/aws_security_hub.yml b/data_sources/aws_security_hub.yml index 64fc6abb3b9..e6f4e5bc3d6 100644 --- a/data_sources/aws_security_hub.yml +++ b/data_sources/aws_security_hub.yml @@ -15,7 +15,7 @@ sourcetype: aws:securityhub:finding supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 + version: 8.3.0 fields: - _time - AwsAccountId diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index 2d23314af07..8cf3fced717 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 output_fields: - dest - user diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index 9b4849dfc4d..5ea501b2a51 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index d33f35db271..3f30e5003c3 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -17,7 +17,7 @@ separator_value: Add member to role supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index 23184c3e129..0d1814a1fb2 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -17,7 +17,7 @@ separator_value: Add owner to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index bbbac95edf0..1056b51476a 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index 5328a53ec26..05ae6170ff8 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -17,7 +17,7 @@ separator_value: Add unverified domain supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 7d826f53702..9d099b746ff 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -17,7 +17,7 @@ separator_value: Consent to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index 8dec1243776..bb9c0cdbc0c 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -16,7 +16,7 @@ separator_value: Disable Strong Authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 6dd0b04531c..8d5fac1a5e3 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -16,7 +16,7 @@ separator_value: Enable account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 1c33eb52974..047ac126b8e 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -16,7 +16,7 @@ separator_value: Invite external user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml index 87b07760be3..00f450cc02e 100644 --- a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml +++ b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}' diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml index 82caf1ffca2..d945db01a4e 100644 --- a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml +++ b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - action - additional_details diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index 27824f14293..5290f93d7f3 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -16,7 +16,7 @@ separator_value: Reset password (by admin) supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index e3286081b2e..8e31d2ba706 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -16,7 +16,7 @@ separator_value: Set domain authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index ad9f8217761..9512febc428 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -16,7 +16,7 @@ separator_value: Sign-in activity supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index 8824c6cce76..68973cf9bf8 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -16,7 +16,7 @@ separator_value: Update application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index 020e6ab111c..11b8c70a60a 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -16,7 +16,7 @@ separator_value: Update authorization policy supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index c1828749459..f68bb2e219f 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -15,7 +15,7 @@ separator_value: Update user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index 4227fb11439..758efd25fa6 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -15,7 +15,7 @@ separator_value: User registered security info supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index 9cc05a766cf..26b38ab8856 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 6c791561668..fc2ceb32333 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation Runbook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index caa8c9ca1a1..1b8fe4bbadc 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation webhook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - _time - authorization.action diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index 8aa47b20cf3..8a57ac3379f 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.2 + version: 6.3.3 fields: - column - action diff --git a/data_sources/cisco_ai_defense_alerts.yml b/data_sources/cisco_ai_defense_alerts.yml index 1c672354b46..2eba8da4082 100644 --- a/data_sources/cisco_ai_defense_alerts.yml +++ b/data_sources/cisco_ai_defense_alerts.yml @@ -11,5 +11,5 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: diff --git a/data_sources/cisco_asa_logs.yml b/data_sources/cisco_asa_logs.yml index 61d0ec4d563..ea89feb7976 100644 --- a/data_sources/cisco_asa_logs.yml +++ b/data_sources/cisco_asa_logs.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - Cisco_ASA_action - Cisco_ASA_message_id diff --git a/data_sources/cisco_duo_activity.yml b/data_sources/cisco_duo_activity.yml index 57f78a420bc..c230fb13246 100644 --- a/data_sources/cisco_duo_activity.yml +++ b/data_sources/cisco_duo_activity.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - access_device.browser - access_device.browser_version diff --git a/data_sources/cisco_duo_administrator.yml b/data_sources/cisco_duo_administrator.yml index ba87861cc13..2c18d1907f1 100644 --- a/data_sources/cisco_duo_administrator.yml +++ b/data_sources/cisco_duo_administrator.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - action - actionlabel diff --git a/data_sources/cisco_isovalent_process_connect.yml b/data_sources/cisco_isovalent_process_connect.yml index 2ed3fe00592..812d0fb4e7a 100644 --- a/data_sources/cisco_isovalent_process_connect.yml +++ b/data_sources/cisco_isovalent_process_connect.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processConnect supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - _time - app diff --git a/data_sources/cisco_isovalent_process_exec.yml b/data_sources/cisco_isovalent_process_exec.yml index 53b8c8dcd6c..09638fe7ace 100644 --- a/data_sources/cisco_isovalent_process_exec.yml +++ b/data_sources/cisco_isovalent_process_exec.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processExec supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - _time - cluster_name diff --git a/data_sources/cisco_isovalent_process_kprobe.yml b/data_sources/cisco_isovalent_process_kprobe.yml index 82e8b8c3d40..4308ee3d7eb 100644 --- a/data_sources/cisco_isovalent_process_kprobe.yml +++ b/data_sources/cisco_isovalent_process_kprobe.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - _time - app diff --git a/data_sources/cisco_network_visibility_module_flow_data.yml b/data_sources/cisco_network_visibility_module_flow_data.yml index 402fddfdd52..945246997d4 100644 --- a/data_sources/cisco_network_visibility_module_flow_data.yml +++ b/data_sources/cisco_network_visibility_module_flow_data.yml @@ -10,7 +10,7 @@ sourcetype: cisco:nvm:flowdata:v2 supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - action - aliul diff --git a/data_sources/cisco_network_visibility_module_osquery.yml b/data_sources/cisco_network_visibility_module_osquery.yml index 569f2e8972c..2c206157555 100644 --- a/data_sources/cisco_network_visibility_module_osquery.yml +++ b/data_sources/cisco_network_visibility_module_osquery.yml @@ -10,7 +10,7 @@ sourcetype: cisco:nvm:osquery:v2 supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - current_page - date_hour diff --git a/data_sources/cisco_secure_access_dns.yml b/data_sources/cisco_secure_access_dns.yml index e1ce31ca6d7..d3fd4107529 100644 --- a/data_sources/cisco_secure_access_dns.yml +++ b/data_sources/cisco_secure_access_dns.yml @@ -12,7 +12,7 @@ sourcetype: cisco:cloud_security:dns supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.54 + version: 1.0.55 fields: - RecordType - ReplyCode diff --git a/data_sources/cisco_secure_access_firewall.yml b/data_sources/cisco_secure_access_firewall.yml index 4faa2e264e3..853d99563c6 100644 --- a/data_sources/cisco_secure_access_firewall.yml +++ b/data_sources/cisco_secure_access_firewall.yml @@ -10,7 +10,7 @@ sourcetype: cisco:cloud_security:firewall supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.54 + version: 1.0.55 fields: - _time - action diff --git a/data_sources/cisco_secure_access_proxy.yml b/data_sources/cisco_secure_access_proxy.yml index 1c96a73ef5b..47cd6ad46e6 100644 --- a/data_sources/cisco_secure_access_proxy.yml +++ b/data_sources/cisco_secure_access_proxy.yml @@ -12,7 +12,7 @@ sourcetype: cisco:cloud_security:proxy supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.54 + version: 1.0.55 fields: - _time - action diff --git a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml index 3a199b6f486..5daa5a49a9c 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - AC_RuleAction - action diff --git a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml index 84d09c58379..5ef3eb6005c 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - app - Application diff --git a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml index db18b5a342d..0f5beb9d50c 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - Application - Classification diff --git a/data_sources/crowdstrike_falcon_stream_alert.yml b/data_sources/crowdstrike_falcon_stream_alert.yml index 2ff079b443f..7f538f050dc 100644 --- a/data_sources/crowdstrike_falcon_stream_alert.yml +++ b/data_sources/crowdstrike_falcon_stream_alert.yml @@ -17,7 +17,7 @@ separator: event.DetectName supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 3.1.2 + version: 3.2.0 fields: - action - description diff --git a/data_sources/crowdstrike_processrollup2.yml b/data_sources/crowdstrike_processrollup2.yml index a44d6511adb..8eebac571f6 100644 --- a/data_sources/crowdstrike_processrollup2.yml +++ b/data_sources/crowdstrike_processrollup2.yml @@ -18,7 +18,7 @@ separator_value: ProcessRollup2 supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 3.1.2 + version: 3.2.0 fields: - AuthenticationId - AuthenticationId_meaning diff --git a/data_sources/github_enterprise_audit_logs.yml b/data_sources/github_enterprise_audit_logs.yml index 266202314d9..b95f95aa81c 100644 --- a/data_sources/github_enterprise_audit_logs.yml +++ b/data_sources/github_enterprise_audit_logs.yml @@ -10,7 +10,7 @@ sourcetype: httpevent supported_TA: - name: Splunk Add-on for Github url: https://splunkbase.splunk.com/app/6254 - version: 4.0.0 + version: 4.0.1 fields: - _document_id - action diff --git a/data_sources/github_organizations_audit_logs.yml b/data_sources/github_organizations_audit_logs.yml index 1a187a6d09d..8896f64c89c 100644 --- a/data_sources/github_organizations_audit_logs.yml +++ b/data_sources/github_organizations_audit_logs.yml @@ -10,7 +10,7 @@ sourcetype: github:cloud:audit supported_TA: - name: Splunk Add-on for Github url: https://splunkbase.splunk.com/app/6254 - version: 4.0.0 + version: 4.0.1 fields: - _document_id - action diff --git a/data_sources/nginx_access.yml b/data_sources/nginx_access.yml index 3b205f39323..670fccc69c0 100644 --- a/data_sources/nginx_access.yml +++ b/data_sources/nginx_access.yml @@ -16,7 +16,7 @@ sourcetype: nginx:plus:kv supported_TA: - name: Splunk Add-on for NGINX url: https://splunkbase.splunk.com/app/3258 - version: 3.3.1 + version: 3.3.2 fields: - _time - action From 7b6385a2f27505500c8d18cebca9a83513d33b39 Mon Sep 17 00:00:00 2001 From: Raven Tait <93157481+RavenTait@users.noreply.github.com> Date: Fri, 18 Sep 2026 18:52:37 -0400 Subject: [PATCH 094/162] Deprecate macos reopened applications (#4273) Co-authored-by: Nasreddine Bencherchali --- .../macos___re_opened_applications.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) rename detections/{endpoint => deprecated}/macos___re_opened_applications.yml (90%) diff --git a/detections/endpoint/macos___re_opened_applications.yml b/detections/deprecated/macos___re_opened_applications.yml similarity index 90% rename from detections/endpoint/macos___re_opened_applications.yml rename to detections/deprecated/macos___re_opened_applications.yml index b81a9593cce..a2d8614cec2 100644 --- a/detections/endpoint/macos___re_opened_applications.yml +++ b/detections/deprecated/macos___re_opened_applications.yml @@ -1,10 +1,10 @@ name: MacOS - Re-opened Applications id: 40bb64f9-f619-4e3d-8732-328d40377c4b -version: 8 +version: 9 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-09-18' author: Jamie Windley, Splunk -status: experimental +status: deprecated type: TTP description: The following analytic identifies processes referencing plist files that determine which applications are re-opened when a user reboots their MacOS machine. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes related to "com.apple.loginwindow." This activity is significant because it can indicate attempts to persist across reboots, a common tactic used by attackers to maintain access. If confirmed malicious, this could allow an attacker to execute code or maintain persistence on the affected system, potentially leading to further compromise. data_source: @@ -43,3 +43,7 @@ product: - Splunk Cloud category: endpoint security_domain: threat +deprecation_info: + reason: Detection deprecated as it is targeting a method of persistence that has been disabled in MacOS for years. As well, the fact that the detection has been set to experimental since 2020. + removed_in_version: 6.10.0 + replacement_content: [] From 790ce0a21ba8e1a521e28407216a66037ceb6776 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Mon, 21 Sep 2026 13:30:58 +0200 Subject: [PATCH 095/162] Multiple Detections Against Recent ClickFix Campaigns (#4269) --------- Co-authored-by: Nasreddine Bencherchali --- ...finger_exe_connecting_to_a_remote_host.yml | 94 +++++++++++++++ ...age_within_cmd_exe_to_execute_commands.yml | 99 +++++++++++++++ ...xecuting_js_script_in_immediate_folder.yml | 114 ++++++++++++++++++ ...ing_ironlanguages_repository_on_github.yml | 93 ++++++++++++++ 4 files changed, 400 insertions(+) create mode 100644 detections/endpoint/windows_finger_exe_connecting_to_a_remote_host.yml create mode 100644 detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml create mode 100644 detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml create mode 100644 detections/endpoint/windows_process_accessing_ironlanguages_repository_on_github.yml diff --git a/detections/endpoint/windows_finger_exe_connecting_to_a_remote_host.yml b/detections/endpoint/windows_finger_exe_connecting_to_a_remote_host.yml new file mode 100644 index 00000000000..40b37b55986 --- /dev/null +++ b/detections/endpoint/windows_finger_exe_connecting_to_a_remote_host.yml @@ -0,0 +1,94 @@ +name: Windows Finger.exe Connecting to a Remote Host +id: 86a5686a-7bc4-469c-9f88-2620279ede6e +version: 1 +creation_date: '2026-09-16' +modification_date: '2026-09-16' +author: Onur Mustafa Erdogan, Splunk +status: production +type: TTP +description: |- + The following analytic identifies the `finger.exe` utility being spawned with a command line containing an `@` character, indicating a remote host/server was specified. + The Finger protocol utility is largely obsolete in modern environments and has been abused by adversaries as a living-off-the-land binary (LOLBIN) to retrieve encoded payloads or establish covert command-and-control communication with an attacker-controlled finger server. + This behavior is uncommon in legitimate enterprise usage and warrants investigation. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + FROM datamodel=Endpoint.Processes WHERE + + ( + Processes.process_name="finger.exe" + OR + Processes.original_file_name="finger.exe" + ) + Processes.process="*@*" + + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_finger_exe_connecting_to_a_remote_host_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are + designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this + search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must + ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons + that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data + model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: No false positives have been identified at this time. +references: + - https://packetwatch.com/resources/threat-profile/clickfix-abuses-finger-to-deliver-castleloader + - https://lolbas-project.github.io/lolbas/Binaries/Finger/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: The [$process_path$] utility was used to connect to a remote host via the Command Line [$process$] from [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process + type: process +analytic_story: + - Command And Control + - Compromised Windows Host + - Fake CAPTCHA Campaigns + - Windows Post-Exploitation + - Living Off The Land +asset_type: Endpoint +mitre_attack_id: + - T1071 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071/finger_remote_host/finger_remote_host.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml b/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml new file mode 100644 index 00000000000..a4e9eadf4ae --- /dev/null +++ b/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml @@ -0,0 +1,99 @@ +name: Windows For Loop Usage Within Cmd.exe To Execute Commands +id: a4ce9079-fc8f-4749-982a-13197c8cf977 +version: 1 +creation_date: '2026-09-16' +modification_date: '2026-09-16' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies the use of a `for /f` loop with the `delims=` option within `cmd.exe`, a technique commonly used to parse and extract data from the output of other commands. + Adversaries and malicious scripts leverage this pattern to programmatically process command output for discovery, data extraction, or execution purposes while evading simpler detection logic. +data_source: + - Sysmon EventID 1 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.parent_process="*for /f*" + Processes.parent_process="*delims=*" + NOT Processes.user="SYSTEM" + NOT Processes.user="*$" + NOT Processes.parent_process IN ( + "*__VIARelease*", + "*:\\Program Files\\Microsoft SQL Server\\*", + "*^| findstr *" + ) + + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_for_loop_usage_within_cmd_exe_to_execute_commands_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. + These agents are designed to provide security-related telemetry from the endpoints where the agent + is installed. To implement this search, you must ingest logs that contain the process GUID, process + name, and parent process. Additionally, you must ingest complete command-line executions. These logs + must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. + The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk + Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Administrators or power users may use `for /f` loops with `delims=` in legitimate scripts for automation or troubleshooting purposes. +references: + - https://packetwatch.com/resources/threat-profile/clickfix-abuses-finger-to-deliver-castleloader +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: The [$process_name$] utility was invoked with a For loop via the Command Line [$process$] on [$dest$]. +threat_objects: + - field: process + type: process + - field: parent_process_name + type: parent_process_name +analytic_story: + - Compromised Windows Host + - Fake CAPTCHA Campaigns + - Living Off The Land + - Suspicious Command-Line Executions + - Windows Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/cmd_for_loop/cmd_for_loop.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml b/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml new file mode 100644 index 00000000000..9c9c995c1e6 --- /dev/null +++ b/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml @@ -0,0 +1,114 @@ +name: Windows Node.exe Executing JS Script In Immediate Folder +id: b22af614-2e48-4d43-aea2-93017500ef0c +version: 1 +creation_date: '2026-09-16' +modification_date: '2026-09-16' +author: Onur Mustafa Erdogan, Splunk +status: production +type: TTP +description: |- + The following analytic identifies `node.exe` directly executing a single `.js` script located in the same directory it was launched from, where that directory is an unusual location such as a user profile, PerfLogs, ProgramData, or Temp folder. + Legitimate Node.js application, module, and package manager directories are excluded. + This pattern is commonly associated with malware loaders and second-stage payloads that leverage the Node.js runtime to execute JavaScript outside of a typical development or application context. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + ( + Processes.process_name="node.exe" + OR + Processes.original_file_name="node.exe" + ) + Processes.process="*js" + Processes.process_path IN ( + "*:\\Users\\*", + "*:\\PerfLogs\\*", + "*:\\ProgramData\\*", + "*:\\Temp\\*") + NOT Processes.process_path IN ( + "*\\AppData\\Local\\*", + "*\\AppData\\Roaming\\*", + "*\\node\\*", + "*\\nodejs\\*", + "*\\nvm\\*" + ) + + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id + Processes.process_current_directory Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | eval process_args=split(process, " ") + | eval script_name=mvindex(process_args, 1) + | eval process_args_count=mvcount(process_args) + | regex script_name="(?i)^[^\\\/]+\.js$" + | where like(process_path, process_current_directory.process_name) AND process_args_count=2 + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_node_exe_executing_js_script_in_immediate_folder_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are + designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this + search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must + ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons + that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. + Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate custom Node.js tooling or utility scripts that are intentionally placed and executed from a user profile, PerfLogs, ProgramData, or Temp directory may trigger this analytic. +references: + - https://www.bluevoyant.com/blog/clickfix-to-nodejs-rat + - https://www.microsoft.com/en-us/security/blog/2026/05/20/mini-shai-hulud-compromised-antv-npm-packages-enable-ci-cd-credential-theft/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Node.exe executed script [$script_name$] from an unusual directory on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process + type: process + - field: script_name + type: file_name +analytic_story: + - Compromised Windows Host + - Fake CAPTCHA Campaigns + - Windows Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059.007 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.007/node_execute_js_script/node_execute_js_script.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_process_accessing_ironlanguages_repository_on_github.yml b/detections/endpoint/windows_process_accessing_ironlanguages_repository_on_github.yml new file mode 100644 index 00000000000..fa994a611a1 --- /dev/null +++ b/detections/endpoint/windows_process_accessing_ironlanguages_repository_on_github.yml @@ -0,0 +1,93 @@ +name: Windows Process Accessing IronLanguages Repository On GitHub +id: bcdc2543-8c33-44c8-a723-5b7b93e06788 +version: 1 +creation_date: '2026-09-16' +modification_date: '2026-09-16' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies a process command line referencing the IronLanguages GitHub repository, which hosts .NET implementation of popular scripting engines. + Adversaries have downloaded these .NET implementations to avoid getting detected by security controls while executing their payloads. + This activity is uncommon in typical enterprise environments outside of software development contexts. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + FROM datamodel=Endpoint.Processes WHERE + + Processes.process="*/ironlanguages/*" + Processes.process="*github.com*" + + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_process_accessing_ironlanguages_repository_on_github_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents + are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement + this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, + you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk + Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node + of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and + speed up the data modeling process. +known_false_positives: |- + Software developers or DevOps personnel may legitimately clone or download the IronPython repository from GitHub for development purposes. + Filter as needed based on known developer hosts or users in your environment. +references: + - https://packetwatch.com/resources/threat-profile/clickfix-abuses-finger-to-deliver-castleloader + - https://github.com/IronLanguages/ironpython3 +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: The Process [$process_name$] with the Command Line [$process$] accessed the IronLanguages GitHub repository on [$dest$]. +threat_objects: + - field: process + type: process +analytic_story: + - Compromised Windows Host + - Fake CAPTCHA Campaigns + - Ingress Tool Transfer + - Windows Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059 + - T1105 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/ironlanguage_download/ironlanguage_download.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit From da1d6113045fea587dfa89694dd4971ed70aea1b Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 21 Sep 2026 16:03:16 +0200 Subject: [PATCH 096/162] Add Some Missing Threat Objects & References (#4262) --------- Co-authored-by: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> --- ...os_xe_webui_programmatic_configuration.yml | 9 +-- ...itten_outside_of_the_outlook_directory.yml | 7 +- .../application/esxi_audit_tampering.yml | 36 ++++++++-- .../application/esxi_bulk_vm_termination.yml | 47 ++++++++++-- .../xmrig_driver_loaded.yml | 12 +++- .../creation_of_lsass_dump_with_taskmgr.yml | 38 ++++++---- .../endpoint/suspicious_wevtutil_usage.yml | 11 +-- .../windows_eventlog_cleared_via_wevtutil.yml | 71 ++++++++++++++----- ...outlook_credentials_access_in_registry.yml | 37 ++++++++-- ..._file_creation_in_confluence_directory.yml | 21 ++++-- .../windows_vulnerable_driver_installed.yml | 7 +- ...rmgr_alternate_data_stream_in_temp_dir.yml | 9 ++- detections/network/dns_kerberos_coercion.yml | 7 +- ...ernal_horizontal_port_scan_nmap_top_20.yml | 7 +- ...ftp_authentication_bypass_exploitation.yml | 7 +- ...rushftp_max_simultaneous_users_from_ip.yml | 7 +- ...g4shell_jndi_payload_injection_attempt.yml | 9 ++- ...oad_injection_with_outbound_connection.yml | 12 +++- ...se_screenconnect_authentication_bypass.yml | 9 ++- .../web/plain_http_post_exfiltrated_data.yml | 7 +- .../unusually_long_content_type_length.yml | 9 ++- 21 files changed, 286 insertions(+), 93 deletions(-) rename detections/{endpoint => deprecated}/xmrig_driver_loaded.yml (89%) diff --git a/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml b/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml index 8a226473725..8beac37a157 100644 --- a/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml +++ b/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml @@ -1,13 +1,13 @@ name: Cisco IOS XE WebUI Programmatic Configuration id: f9686576-a23d-4c4d-bfad-a45499dc448a -version: 1 +version: 2 creation_date: '2026-05-19' -modification_date: '2026-05-19' +modification_date: '2026-09-08' author: Nasreddine Bencherchali status: production type: Anomaly description: | - This analytic detects Cisco IOS-XE configuration changes performed by the WebUI WSMA process. + The following analytic detects Cisco IOS-XE configuration changes performed by the WebUI WSMA process. data_source: - Cisco IOS Logs search: |- @@ -47,7 +47,8 @@ intermediate_findings: - field: user type: user score: 20 - message: User $user$ performed Cisco IOS-XE WebUI programmatic configuration on $dest$. + message: User [$user$] performed Cisco IOS-XE WebUI programmatic configuration on [$dest$] via [$process$] on [$vty$]. +threat_objects: [] analytic_story: - Salt Typhoon asset_type: Network diff --git a/detections/application/email_files_written_outside_of_the_outlook_directory.yml b/detections/application/email_files_written_outside_of_the_outlook_directory.yml index 229731bdfff..211609724d0 100644 --- a/detections/application/email_files_written_outside_of_the_outlook_directory.yml +++ b/detections/application/email_files_written_outside_of_the_outlook_directory.yml @@ -1,8 +1,8 @@ name: Email files written outside of the Outlook directory id: 8d52cf03-ba25-4101-aa78-07994aed4f74 -version: 13 +version: 14 creation_date: '2020-04-29' -modification_date: '2026-07-02' +modification_date: '2026-09-08' author: Bhavin Patel, Splunk status: production type: Anomaly @@ -55,6 +55,9 @@ intermediate_findings: type: system score: 20 message: A new email file [$file_name$] was written to [$file_path$] on endpoint $dest$ by user $user$. +threat_objects: + - field: file_path + type: file_path analytic_story: - Collection and Staging asset_type: Endpoint diff --git a/detections/application/esxi_audit_tampering.yml b/detections/application/esxi_audit_tampering.yml index d0936d95ff6..269ff72aeba 100644 --- a/detections/application/esxi_audit_tampering.yml +++ b/detections/application/esxi_audit_tampering.yml @@ -1,17 +1,36 @@ name: ESXi Audit Tampering id: c48a155b-2861-417a-813c-220f5272cf01 -version: 5 +version: 6 creation_date: '2025-07-11' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Raven Tait, Splunk status: production type: TTP -description: This detection identifies the use of the esxcli system auditrecords commands, which can be used to tamper with logging on an ESXi host. This action may indicate an attempt to evade detection or hinder forensic analysis by preventing the recording of system-level audit events. +description: |- + The following analytic identifies the use of the esxcli system auditrecords commands, which can be used to tamper with logging on an ESXi host. + This action may indicate an attempt to evade detection or hinder forensic analysis by preventing the recording of system-level audit events. data_source: - VMWare ESXi Syslog -search: '`esxi_syslog` Message="*esxcli system auditrecords*" Message IN ("*remote*","*local*") NOT Message = "*[shell*" | rex field=_raw "Z (?[\w\.]+)\s" | rex field=_raw "[\w+]\]: (?.*)" | rex field=full_command "\[(?.*)]:\s(?.*)" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_audit_tampering_filter`' -how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. -known_false_positives: Limited false positives in most environments, however tune as needed. +search: |- + `esxi_syslog` + Message="*esxcli system auditrecords*" + Message IN ("*remote*","*local*") + NOT Message = "*[shell*" + + | rex field=_raw "Z (?[\w\.]+)\s" + | rex field=_raw "[\w+]\]: (?.*)" + | rex field=full_command "\[(?.*)]:\s(?.*)" + + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest user command + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `esxi_audit_tampering_filter` +how_to_implement: |- + This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. +known_false_positives: No false positives have been identified at this time. references: - https://detect.fyi/detecting-and-responding-to-esxi-compromise-with-splunk-f33998ce7823 drilldown_searches: @@ -24,11 +43,14 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Audit tampering activity on ESXi host $dest$. + title: Audit tampering activity via [$command$] on ESXi host [$dest$]. entity: field: dest type: system score: 50 +threat_objects: + - field: command + type: command analytic_story: - ESXi Post Compromise - Black Basta Ransomware diff --git a/detections/application/esxi_bulk_vm_termination.yml b/detections/application/esxi_bulk_vm_termination.yml index ba4f702548e..4f8cd6c99d0 100644 --- a/detections/application/esxi_bulk_vm_termination.yml +++ b/detections/application/esxi_bulk_vm_termination.yml @@ -1,17 +1,49 @@ name: ESXi Bulk VM Termination id: cfe094b4-0737-4a33-9d63-e0562ce2b883 -version: 4 +version: 5 creation_date: '2025-07-11' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Raven Tait, Splunk status: production type: TTP -description: This detection identifies when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads. +description: |- + The following analytic detects when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads. data_source: - VMWare ESXi Syslog -search: '`esxi_syslog` | rex field=_raw "\s\[(?[^\]]+)\]:\s(?.+)$" | rex field=_raw "Z (?[\w\.]+)\s.*:\s(?esxcli\s.+)" | eval command=mvappend(esxicli_Command, shell_Command) | where isnotnull(command) | search (command="pkill -9 vmx-*") OR ( command="*esxcli*" AND command="*--format-param*" AND command="*vm process list*" AND command="*awk*" AND command="*esxcli vm process kill*") | stats min(_time) as firstTime max(_time) as lastTime values(_time) as timeStamp values(command) as commands values(user) as user by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_bulk_vm_termination_filter`' -how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. -known_false_positives: Limited false positives in most environments, however tune as needed. +search: |- + `esxi_syslog` + Message IN ( + "*pkill -9 *" + "*process kill*" + ) + | rex field=_raw "\s\[(?[^\]]+)\]:\s(?.+)$" + | rex field=_raw "Z (?[\w\.]+)\s.*:\s(?esxcli\s.+)" + | eval command=mvappend(esxicli_Command, shell_Command) + | where isnotnull(command) + | search (command="pkill -9 vmx-*") + OR + ( + command="*esxcli*" + command="*--format-param*" + command="*vm process list*" + command="*awk*" + command="*esxcli vm process kill*" + ) + | stats min(_time) as firstTime + max(_time) as lastTime + values(_time) as timeStamp + values(command) as commands + + by dest user + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `esxi_bulk_vm_termination_filter` +how_to_implement: |- + This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. +known_false_positives: No false positives have been identified at this time. +references: + - https://www.securityweek.com/microsoft-says-ransomware-gangs-exploiting-just-patched-vmware-esxi-flaw/ drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -22,11 +54,12 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Bulk VM termination activity on ESXi host $dest$. + title: Bulk VM termination activity on ESXi host [$dest$]. entity: field: dest type: system score: 50 +threat_objects: [] analytic_story: - ESXi Post Compromise - Black Basta Ransomware diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/deprecated/xmrig_driver_loaded.yml similarity index 89% rename from detections/endpoint/xmrig_driver_loaded.yml rename to detections/deprecated/xmrig_driver_loaded.yml index a6e725500ee..efd2ac89a25 100644 --- a/detections/endpoint/xmrig_driver_loaded.yml +++ b/detections/deprecated/xmrig_driver_loaded.yml @@ -1,10 +1,10 @@ name: XMRIG Driver Loaded id: 90080fa6-a8df-11eb-91e4-acde48001122 -version: 10 +version: 11 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP description: The following analytic detects the installation of the XMRIG coinminer driver on a system. It identifies the loading of the `WinRing0x64.sys` driver, commonly associated with XMRIG, by analyzing Sysmon EventCode 6 logs for specific signatures and image loads. This activity is significant because XMRIG is an open-source CPU miner frequently exploited by adversaries to mine cryptocurrency illicitly. If confirmed malicious, this activity could lead to unauthorized resource consumption, degraded system performance, and potential financial loss due to unauthorized cryptocurrency mining. data_source: @@ -49,3 +49,9 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated as it is inacurate. WinRing0x64.sys is not related to XMRIG. It is a driver that is used to access the hardware ring0. + removed_in_version: 6.10.0 + replacement_content: + - Windows Vulnerable Driver Installed + - Windows Vulnerable Driver Loaded diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml index 744a19680f8..25294be65c0 100644 --- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml +++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml @@ -1,24 +1,33 @@ name: Creation of lsass Dump with Taskmgr id: b2fbe95a-9c62-4c12-8a29-24b97e84c0cd -version: 14 +version: 15 creation_date: '2019-12-11' -modification_date: '2026-05-13' +modification_date: '2026-09-21' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic detects the creation of an lsass.exe process dump using Windows Task Manager. It leverages Sysmon EventID 11 to identify file creation events where the target filename matches *lsass*.dmp. This activity is significant because creating an lsass dump can be a precursor to credential theft, as the dump file contains sensitive information such as user passwords. If confirmed malicious, an attacker could use the lsass dump to extract credentials and escalate privileges, potentially compromising the entire network. +description: |- + The following analytic detects the creation of an lsass.exe process dump using Windows Task Manager. + It leverages Sysmon EventID 11 to identify file creation events where the target filename matches *lsass*.dmp. + This activity is significant because creating an lsass dump can be a precursor to credential theft, as the dump file contains sensitive information such as user passwords. data_source: - Sysmon EventID 11 search: |- - `sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp - | stats count min(_time) as firstTime max(_time) as lastTime - BY action dest file_name - file_path process_guid process_id - user_id vendor_product process_name - TargetFilename - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `creation_of_lsass_dump_with_taskmgr_filter` + `sysmon` + EventID=11 + process_name=taskmgr.exe + file_path=*lsass*.dmp + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY action dest + file_name file_path + process_name process_guid process_id + user_id vendor_product + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `creation_of_lsass_dump_with_taskmgr_filter` how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 11 for detecting file create of lsass.dmp. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. known_false_positives: Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. references: @@ -35,11 +44,14 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: $process_name$ was identified on endpoint $dest$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager. + title: The process [$process_name$] was identified on endpoint [$dest$] writing [$file_path$] to disk. entity: field: dest type: system score: 50 +threat_objects: + - field: file_path + type: file_path analytic_story: - Credential Dumping - CISA AA22-257A diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index 1ac3be2323f..bde70a84a00 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -1,8 +1,8 @@ name: Suspicious wevtutil Usage id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f -version: 21 +version: 22 creation_date: '2019-10-16' -modification_date: '2026-08-23' +modification_date: '2026-09-21' author: David Dorsey, Michael Haag, Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -81,7 +81,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Wevtutil.exe being used to clear Event Logs on $dest$ by $user$ + title: The EventLog was cleared using the [$process_name$] utility with the Command Line [$process$] on [$dest$] by [$user$]. entity: field: user type: user @@ -91,7 +91,10 @@ intermediate_findings: - field: dest type: system score: 50 - message: Wevtutil.exe being used to clear Event Logs on $dest$ by $user$ + message: The EventLog was cleared using the [$process_name$] utility with the Command Line [$process$] on [$dest$] by [$user$]. +threat_objects: + - field: process + type: process analytic_story: - Windows Log Manipulation - Ransomware diff --git a/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml b/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml index be93dd54bb2..836c6880c57 100644 --- a/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml +++ b/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml @@ -1,27 +1,65 @@ name: Windows Eventlog Cleared Via Wevtutil id: fdb829a8-db84-4832-b64b-3e964cd44f01 -version: 7 +version: 8 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-21' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly description: | - The following analytic detects the usage of wevtutil.exe with the "clear-log" parameter in order to clear the contents of logs. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations. If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise. + The following analytic detects the usage of wevtutil.exe with the "clear-log" parameter in order to clear the contents of logs. + Clearing the event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count values(Processes.process) as process + min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name=wevtutil.exe + Processes.process IN ("* cl *", "*clear-log*") + + ``` + We exclude the following strings to avoid detection overlap and double coverage since they are already covered by the "Suspicious wevtutil Usage" detection. + ``` + NOT Processes.process IN ( + "*/Trace*", + "*AMSI/Debug*", + "*Application*", + "*CiscoSecureEndpoint*", + "*Microsoft-Windows-BitLocker*", + "*Microsoft-Windows-Bits*", + "*Microsoft-Windows-CAPI2*", + "*Microsoft-Windows-Kernel-File*", + "*Microsoft-Windows-Kernel-Process*", + "*Microsoft-Windows-LDAP*", + "*Microsoft-Windows-PowerShell*", + "*Microsoft-Windows-Sysmon*", + "*Microsoft-Windows-TerminalServices-LocalSessionManager*", + "*Microsoft-Windows-TerminalServices-RemoteConnectionManager*", + "*Microsoft-Windows-WMI-Activity*", + "*OpenSSH/*", + "*PowerShellCore/*", + "*Security*", + "*Setup*", + "*System*", + "*Windows Firewall With Advanced Security*", + "*Windows PowerShell*" + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -44,11 +82,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: Eventlog was cleared using the Wevtutil.exe utility on $dest$ by $user$ - - field: user - type: user - score: 20 - message: Eventlog was cleared using the Wevtutil.exe utility on $dest$ by $user$ + message: The EventLog was cleared using the [$process_name$] utility with the Command Line [$process$] on [$dest$] by [$user$]. +threat_objects: + - field: process + type: process analytic_story: - Windows Log Manipulation - Ransomware diff --git a/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml b/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml index ccdf81a36d6..31d8f46e31e 100644 --- a/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml +++ b/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml @@ -1,15 +1,39 @@ name: Windows Unsecured Outlook Credentials Access In Registry id: 36334123-077d-47a2-b70c-6c7b3cc85049 -version: 14 +version: 15 creation_date: '2024-02-22' -modification_date: '2026-06-25' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects unauthorized access to Outlook credentials stored in the Windows registry. It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles. This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts. If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk. +description: |- + The following analytic detects unauthorized access to Outlook credentials stored in the Windows registry. + It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles. + This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts. + If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk. data_source: - Windows Event Log Security 4663 -search: '`wineventlog_security` EventCode=4663 object_file_path IN ("*\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676*", "*\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676*") AND process_name != *\\outlook.exe | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unsecured_outlook_credentials_access_in_registry_filter`' +search: |- + `wineventlog_security` + EventCode=4663 + object_file_path IN ( + "*\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676*", + "*\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676*" + ) + NOT process_name IN ( + "*\\HxOutlook.exe", + "*\\Outlook.exe" + ) + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by EventCode object_file_name object_file_path + process_name process_path process_id dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_unsecured_outlook_credentials_access_in_registry_filter` how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." known_false_positives: third party software may access this outlook registry. references: @@ -29,7 +53,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: A suspicious process $process_name$ accessing outlook credentials registry on $dest$ + message: A suspicious process [$process_name$] accessing outlook credentials registry [$object_file_path$] on [$dest$]. +threat_objects: + - field: process_name + type: process_name analytic_story: - StealC Stealer - Snake Keylogger diff --git a/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml b/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml index 8d84834feda..bd0469d430a 100644 --- a/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml +++ b/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml @@ -1,13 +1,13 @@ name: Windows Unusual File Creation in Confluence Directory id: aa9d80d9-ed47-44da-aceb-2909ca4dc19e -version: 2 +version: 3 creation_date: '2021-09-02' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Raven Tait, Splunk status: production type: Anomaly description: |- - Detects executable file formats being created within the Confluence main directory. + The following analytic detects executable file formats being created within the Confluence main directory. This can be indicative of exploitation of the Confluence web services to stage malware. This won't catch adversaries who modify the output location outside the Confluence directory when exploiting. data_source: @@ -32,7 +32,7 @@ search: |- "*.vbs" ) - by Filesystem.dest Filesystem.file_create_time Filesystem.process_path + by Filesystem.dest Filesystem.file_create_time Filesystem.process_path Filesystem.process_name Filesystem.process_guid Filesystem.process_id Filesystem.file_path Filesystem.action Filesystem.file_name Filesystem.user Filesystem.vendor_product @@ -40,8 +40,15 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unusual_file_creation_in_confluence_directory_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Some legitimate administrative or development activities may create executable files in the Confluence directory. Review and filter based on approved maintenance processes. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Some legitimate administrative or development activities may create executable files in the Confluence directory. + Review and filter based on approved maintenance processes. +references: + - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-289a + - https://confluence.atlassian.com/security/cve-2023-22515-broken-access-control-vulnerability-in-confluence-data-center-and-server-1295682276.html + - https://www.rapid7.com/blog/post/2023/10/04/etr-cve-2023-22515-zero-day-privilege-escalation-in-confluence-server-and-data-center/ drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -56,7 +63,7 @@ intermediate_findings: - field: dest type: system score: 20 - message: Executable file created under a Confluence path at $file_path$ on $dest$. + message: The process [$process_name$] created an executable file under a Confluence path at [$file_path$] on [$dest$]. threat_objects: - field: file_path type: file_path diff --git a/detections/endpoint/windows_vulnerable_driver_installed.yml b/detections/endpoint/windows_vulnerable_driver_installed.yml index e2832a332f5..4884e5dd26e 100644 --- a/detections/endpoint/windows_vulnerable_driver_installed.yml +++ b/detections/endpoint/windows_vulnerable_driver_installed.yml @@ -1,8 +1,8 @@ name: Windows Vulnerable Driver Installed id: 1dda7586-57be-4a1b-8de1-a9ad802b9a7f -version: 10 +version: 11 creation_date: '2020-01-19' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Dean Luxton status: production type: TTP @@ -38,6 +38,9 @@ finding: field: dest type: system score: 50 +threat_objects: + - field: ImagePath + type: file_path analytic_story: - Windows Drivers - Void Manticore diff --git a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml index b3ff2e6f634..54fd1c50a9b 100644 --- a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml +++ b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml @@ -1,8 +1,8 @@ name: Windows Wermgr Alternate Data Stream in Temp Dir id: 65222e9b-9d0b-4bfe-8da1-199b98e1d44a -version: 1 +version: 2 creation_date: '2026-06-11' -modification_date: '2026-06-11' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -47,7 +47,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: A [$process_name$] created a wermgr.exe alternate stream in the temp directory on $dest$ by $user$ + message: The process [$process_name$] owned by [$user$] created a Wermgr.exe alternate data stream in [$file_path$] on [$dest$] +threat_objects: + - field: file_path + type: file_path analytic_story: - RoguePlanet asset_type: Endpoint diff --git a/detections/network/dns_kerberos_coercion.yml b/detections/network/dns_kerberos_coercion.yml index c5ec0f6c163..3b6869045af 100644 --- a/detections/network/dns_kerberos_coercion.yml +++ b/detections/network/dns_kerberos_coercion.yml @@ -1,8 +1,8 @@ name: DNS Kerberos Coercion id: 8551252d-b5b6-4b6e-8a82-51460aeb29a3 -version: 5 +version: 6 creation_date: '2025-11-18' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Raven Tait, Splunk status: production type: TTP @@ -42,6 +42,9 @@ finding: field: src type: system score: 50 +threat_objects: + - field: query + type: dns_query analytic_story: - Compromised Windows Host - Suspicious DNS Traffic diff --git a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml index 3e03807d675..800abe5718a 100644 --- a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml +++ b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml @@ -1,8 +1,8 @@ name: Internal Horizontal Port Scan NMAP Top 20 id: 3141a041-4f57-4277-9faa-9305ca1f8e5b -version: 12 +version: 13 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Dean Luxton status: production type: TTP @@ -77,6 +77,9 @@ finding: field: src_ip type: system score: 50 +threat_objects: + - field: src_ip + type: ip_address analytic_story: - Network Discovery - Cisco Secure Firewall Threat Defense Analytics diff --git a/detections/web/crushftp_authentication_bypass_exploitation.yml b/detections/web/crushftp_authentication_bypass_exploitation.yml index f86f476bc0c..58545166f2e 100644 --- a/detections/web/crushftp_authentication_bypass_exploitation.yml +++ b/detections/web/crushftp_authentication_bypass_exploitation.yml @@ -1,8 +1,8 @@ name: CrushFTP Authentication Bypass Exploitation id: 82eb7f64-d219-4e21-acfe-956de84c1a35 -version: 6 +version: 7 creation_date: '2025-04-14' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Michael Haag, Splunk status: production type: TTP @@ -37,6 +37,9 @@ intermediate_findings: type: system score: 50 message: Potential CrushFTP authentication bypass exploitation from IP $src_ip$ as user $user$ +threat_objects: + - field: process + type: process analytic_story: - CrushFTP Vulnerabilities - Hellcat Ransomware diff --git a/detections/web/crushftp_max_simultaneous_users_from_ip.yml b/detections/web/crushftp_max_simultaneous_users_from_ip.yml index 2417444f997..58f97fc476a 100644 --- a/detections/web/crushftp_max_simultaneous_users_from_ip.yml +++ b/detections/web/crushftp_max_simultaneous_users_from_ip.yml @@ -1,8 +1,8 @@ name: CrushFTP Max Simultaneous Users From IP id: 75dfd9f4-ca64-45d0-9422-4bde6d26a59e -version: 5 +version: 6 creation_date: '2025-04-14' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Michael Haag, Splunk status: production type: Anomaly @@ -31,6 +31,9 @@ intermediate_findings: type: system score: 20 message: Potential brute force or automated attack against CrushFTP detected from IP $src_ip$ +threat_objects: + - field: src_ip + type: ip_address analytic_story: - CrushFTP Vulnerabilities asset_type: Web Server diff --git a/detections/web/log4shell_jndi_payload_injection_attempt.yml b/detections/web/log4shell_jndi_payload_injection_attempt.yml index a1ea25c3f5f..e6c6582a0f7 100644 --- a/detections/web/log4shell_jndi_payload_injection_attempt.yml +++ b/detections/web/log4shell_jndi_payload_injection_attempt.yml @@ -1,8 +1,8 @@ name: Log4Shell JNDI Payload Injection Attempt id: c184f12e-5c90-11ec-bf1f-497c9a704a72 -version: 9 +version: 10 creation_date: '2021-12-13' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Jose Hernandez status: production type: Anomaly @@ -38,6 +38,11 @@ intermediate_findings: type: system score: 20 message: CVE-2021-44228 Log4Shell triggered for host $dest$ +threat_objects: + - field: http_user_agent + type: http_user_agent + - field: url + type: url analytic_story: - Log4Shell CVE-2021-44228 - CISA AA22-257A diff --git a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml index bfe6480c262..7f045881426 100644 --- a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml +++ b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml @@ -1,13 +1,14 @@ name: Log4Shell JNDI Payload Injection with Outbound Connection id: 69afee44-5c91-11ec-bf1f-497c9a704a72 -version: 9 +version: 10 creation_date: '2021-12-13' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Jose Hernandez status: production type: Anomaly description: The following analytic detects Log4Shell JNDI payload injections via outbound connections. It identifies suspicious LDAP lookup functions in web logs, such as `${jndi:ldap://PAYLOAD_INJECTED}`, and correlates them with network traffic to known malicious IP addresses. This detection leverages the Web and Network_Traffic data models in Splunk. Monitoring this activity is crucial as it targets vulnerabilities in Java web applications using log4j, potentially leading to remote code execution. If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, and compromise sensitive data within the affected environment. -data_source: [] +data_source: + - Splunk Stream IP search: |- | from datamodel Web.Web | rex field=_raw max_match=0 "[jJnNdDiI]{4}(\:|\%3A|\/|\%2F)(?\w+)(\:\/\/|\%3A\%2F\%2F)(\$\{.*?\}(\.)?)?(?[a-zA-Z0-9\.\-\_\$]+)" | join affected_host type=inner [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic by All_Traffic.dest | `drop_dm_object_name(All_Traffic)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename dest AS affected_host] @@ -37,6 +38,11 @@ intermediate_findings: type: system score: 20 message: CVE-2021-44228 Log4Shell triggered for host $dest$ +threat_objects: + - field: http_user_agent + type: http_user_agent + - field: url + type: url analytic_story: - Log4Shell CVE-2021-44228 - CISA AA22-320A diff --git a/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml b/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml index 154858839f1..bae64a63da9 100644 --- a/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml +++ b/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml @@ -1,8 +1,8 @@ name: Nginx ConnectWise ScreenConnect Authentication Bypass id: b3f7a803-e802-448b-8eb2-e796b223bccc -version: 11 +version: 12 creation_date: '2024-02-22' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Michael Haag, Splunk status: production type: TTP @@ -41,6 +41,11 @@ finding: field: dest type: system score: 50 +threat_objects: + - field: http_user_agent + type: http_user_agent + - field: url + type: url analytic_story: - ConnectWise ScreenConnect Vulnerabilities - Seashell Blizzard diff --git a/detections/web/plain_http_post_exfiltrated_data.yml b/detections/web/plain_http_post_exfiltrated_data.yml index e6432c5fffc..4a01f107873 100644 --- a/detections/web/plain_http_post_exfiltrated_data.yml +++ b/detections/web/plain_http_post_exfiltrated_data.yml @@ -1,8 +1,8 @@ name: Plain HTTP POST Exfiltrated Data id: e2b36208-a364-11eb-8909-acde48001122 -version: 13 +version: 14 creation_date: '2021-04-22' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: TTP @@ -37,6 +37,9 @@ finding: field: src_ip type: system score: 50 +threat_objects: + - field: dest_ip + type: ip_address analytic_story: - Data Exfiltration - Command And Control diff --git a/detections/web/unusually_long_content_type_length.yml b/detections/web/unusually_long_content_type_length.yml index f5b0a3f1ed7..d7975e1a33b 100644 --- a/detections/web/unusually_long_content_type_length.yml +++ b/detections/web/unusually_long_content_type_length.yml @@ -1,8 +1,8 @@ name: Unusually Long Content-Type Length id: 57a0a2bf-353f-40c1-84dc-29293f3c35b7 -version: 7 +version: 8 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Bhavin Patel, Splunk status: experimental type: Anomaly @@ -29,6 +29,11 @@ intermediate_findings: type: system score: 20 message: Unusually Long Content-Type Length ($http_content_type_length$ characters) In Web Request from $src$ +threat_objects: + - field: http_user_agent + type: http_user_agent + - field: url + type: url analytic_story: - Apache Struts Vulnerability asset_type: Web Server From 4ad49471064677a5a763130bd5c303379428f3aa Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 21 Sep 2026 16:05:20 +0200 Subject: [PATCH 097/162] Update EventID 10 Analytics (#4276) --- data_sources/sysmon_eventid_10.yml | 6 +- ...windows_process_injection_into_notepad.yml | 11 +++- ...redential_dumping_through_lsass_access.yml | 64 ++++++++++++------ ...ticket_exports_through_winlogon_access.yml | 55 +++++++++++++--- ...lation_winlogon_duplicate_token_handle.yml | 53 +++++++++++++-- ...ogon_duplicate_handle_in_uncommon_path.yml | 51 +++++++++++++-- ...plication_in_known_uac_bypass_binaries.yml | 56 ++++++++++++++-- .../windows_possible_credential_dumping.yml | 65 ++++++++++++++----- ...jection_into_commonly_abused_processes.yml | 53 ++++++++------- .../windows_terminating_lsass_process.yml | 52 +++++++++------ .../windows_wmi_impersonate_token.yml | 51 +++++++++++++-- 11 files changed, 398 insertions(+), 119 deletions(-) rename detections/{endpoint => deprecated}/windows_process_injection_into_notepad.yml (92%) diff --git a/data_sources/sysmon_eventid_10.yml b/data_sources/sysmon_eventid_10.yml index d1ba331c5b8..7c13a96041f 100644 --- a/data_sources/sysmon_eventid_10.yml +++ b/data_sources/sysmon_eventid_10.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 10 id: 659cd5a8-148a-4c59-ade1-05f41ac1b096 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-09-21' author: Patrick Bareiss, Splunk description: Logs events where one process accesses another process, typically for memory reads or injections, including details about the source and target processes. mitre_components: @@ -101,8 +101,6 @@ fields: output_fields: - dest - user_id - - parent_process_name - - parent_process_guid - process_name - process_guid - process_id diff --git a/detections/endpoint/windows_process_injection_into_notepad.yml b/detections/deprecated/windows_process_injection_into_notepad.yml similarity index 92% rename from detections/endpoint/windows_process_injection_into_notepad.yml rename to detections/deprecated/windows_process_injection_into_notepad.yml index 07b256cded5..d4869ca37be 100644 --- a/detections/endpoint/windows_process_injection_into_notepad.yml +++ b/detections/deprecated/windows_process_injection_into_notepad.yml @@ -1,10 +1,10 @@ name: Windows Process Injection into Notepad id: b8340d0f-ba48-4391-bea7-9e793c5aae36 -version: 13 +version: 14 creation_date: '2023-02-24' -modification_date: '2026-05-13' +modification_date: '2026-09-21' author: Michael Haag, Splunk -status: production +status: deprecated type: Anomaly description: The following analytic detects process injection into Notepad.exe using Sysmon EventCode 10. It identifies suspicious GrantedAccess requests (0x40 and 0x1fffff) to Notepad.exe, excluding common system paths like System32, Syswow64, and Program Files. This behavior is often associated with the SliverC2 framework by BishopFox. Monitoring this activity is crucial as it may indicate an initial payload attempting to execute malicious code within Notepad.exe. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment. data_source: @@ -55,3 +55,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated as it is already covered by the" Windows Process Injection into Commonly Abused Processes" detection. + removed_in_version: 6.10.0 + replacement_content: + - Windows Process Injection into Commonly Abused Processes diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index e2a9be602fc..975c102a407 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -1,33 +1,54 @@ name: Detect Credential Dumping through LSASS access id: 2c365e57-4414-4540-8dc0-73ab10729996 -version: 15 +version: 16 creation_date: '2019-12-11' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Patrick Bareiss, Splunk status: production type: TTP -description: The following analytic detects attempts to read LSASS memory, indicative of credential dumping. It leverages Sysmon EventCode 10, filtering for specific access permissions (0x1010 and 0x1410) on the lsass.exe process. This activity is significant because it suggests an attacker is trying to extract credentials from LSASS memory, potentially leading to unauthorized access, data breaches, and compromise of sensitive information. If confirmed malicious, this could enable attackers to escalate privileges, move laterally within the network, or exfiltrate data. Extensive triage is necessary to differentiate between malicious and benign activities. +description: |- + The following analytic detects attempts to read LSASS memory, indicative of credential dumping. + It leverages Sysmon EventCode 10 and checks for "PROCESS_VM_READ" with query information access on lsass.exe. data_source: - Sysmon EventID 10 search: |- - `sysmon` EventCode=10 TargetImage=*lsass.exe (GrantedAccess=0x1010 OR GrantedAccess=0x1410) - | stats count min(_time) as firstTime max(_time) as lastTime - BY CallTrace EventID GrantedAccess - Guid Opcode ProcessID - SecurityID SourceImage SourceProcessGUID - SourceProcessId TargetImage TargetProcessGUID - TargetProcessId UserID dest - granted_access parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path - process_exec process_guid process_id - process_name process_path signature - signature_id user_id vendor_product - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `detect_credential_dumping_through_lsass_access_filter` + `sysmon` + EventCode=10 + TargetImage="*\\lsass.exe" + + ``` + Convert GrantedAccess from hexadecimal to decimal. + Match "PROCESS_VM_READ" with either "PROCESS_QUERY_LIMITED_INFORMATION" or "PROCESS_QUERY_INFORMATION", which represent the either the "0x1010" or "0x1410" hexadecimal masks. + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_VM_READ = 16 + | eval PROCESS_QUERY_LIMITED_INFORMATION = 4096 + | eval PROCESS_QUERY_INFORMATION = 1024 + | eval vm_read_set = bit_and(g_access_decimal, PROCESS_VM_READ) + | eval query_limited_set = bit_and(g_access_decimal, PROCESS_QUERY_LIMITED_INFORMATION) + | eval query_information_set = bit_and(g_access_decimal, PROCESS_QUERY_INFORMATION) + | where vm_read_set == PROCESS_VM_READ + AND query_limited_set == PROCESS_QUERY_LIMITED_INFORMATION + AND (query_information_set == 0 OR query_information_set == PROCESS_QUERY_INFORMATION) + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `detect_credential_dumping_through_lsass_access_filter` how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. known_false_positives: The activity may be legitimate. Other tools can access lsass for legitimate reasons, and it's possible this event could be generated in those cases. In these cases, false positives should be fairly obvious and you may need to tweak the search to eliminate noise. -references: [] +references: + - https://www.microsoft.com/en-us/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks/ + - https://attack.mitre.org/techniques/T1003/001/ drilldown_searches: - name: View the detection results for - "$dest$" and "$TargetImage$" search: '%original_detection_search% | search dest = "$dest$" TargetImage = "$TargetImage$"' @@ -38,11 +59,14 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: The $SourceImage$ has attempted access to read $TargetImage$ was identified on endpoint $dest$, this is indicative of credential dumping and should be investigated. + title: The process [$SourceImage$] requested read access via the access mask [$granted_access$] to [$TargetImage$] on [$dest$], which may indicate credential dumping. entity: field: dest type: system score: 50 +threat_objects: + - field: SourceImage + type: file_path analytic_story: - Detect Zerologon Attack - CISA AA23-347A diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml index 8b18aec0c04..28850f03f50 100644 --- a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml +++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml @@ -1,17 +1,54 @@ name: Rubeus Kerberos Ticket Exports Through Winlogon Access id: 5ed8c50a-8869-11ec-876f-acde48001122 -version: 14 +version: 15 creation_date: '2022-02-07' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Mauricio Velazco, Splunk status: production type: TTP -description: The following analytic detects a process accessing the winlogon.exe system process, indicative of the Rubeus tool attempting to export Kerberos tickets from memory. This detection leverages Sysmon EventCode 10 logs, focusing on processes obtaining a handle to winlogon.exe with specific access rights. This activity is significant as it often precedes pass-the-ticket attacks, where adversaries use stolen Kerberos tickets to move laterally within an environment. If confirmed malicious, this could allow attackers to bypass normal access controls, escalate privileges, and persist within the network, posing a severe security risk. +description: |- + The following analytic detects an uncommon process requesting full access rights to winlogon.exe, which may indicate Rubeus exporting Kerberos tickets from memory. + It leverages Sysmon EventCode 10 and checks for full-access rights, specifically the value 0x1f3fff. data_source: - Sysmon EventID 10 -search: '`sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe (GrantedAccess=0x1f3fff) (SourceImage!=C:\\Windows\\system32\\svchost.exe AND SourceImage!=C:\\Windows\\system32\\lsass.exe AND SourceImage!=C:\\Windows\\system32\\LogonUI.exe AND SourceImage!=C:\\Windows\\system32\\smss.exe AND SourceImage!=C:\\Windows\\system32\\wbem\\wmiprvse.exe) | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`' -how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. -known_false_positives: Legitimate applications may obtain a handle for winlogon.exe. Filter as needed +search: |- + `sysmon` + EventCode=10 + TargetImage="*:\\Windows\\system32\\winlogon.exe" + NOT SourceImage IN ( + "C:\\Windows\\system32\\LogonUI.exe", + "C:\\Windows\\system32\\lsass.exe", + "C:\\Windows\\system32\\smss.exe", + "C:\\Windows\\system32\\svchost.exe", + "C:\\Windows\\system32\\wbem\\wmiprvse.exe" + ) + + ``` + Convert GrantedAccess from hexadecimal to decimal. 0x1f3fff is the legacy full-access mask observed for this activity. + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_ALL_ACCESS_LEGACY = 2047999 + | eval legacy_full_access_set = bit_and(g_access_decimal, PROCESS_ALL_ACCESS_LEGACY) + | where legacy_full_access_set == PROCESS_ALL_ACCESS_LEGACY + + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter` +how_to_implement: |- + This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. +known_false_positives: |- + No false positives have been identified at this time. references: - https://github.com/GhostPack/Rubeus - https://web.archive.org/web/20210725005734/http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/ @@ -26,14 +63,14 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Winlogon.exe was accessed by $SourceImage$ on $dest$ + title: The process [$SourceImage$] requested full access via the access mask [$granted_access$] to [$TargetImage$] on [$dest$]. entity: field: dest type: system score: 50 threat_objects: - - field: TargetImage - type: process + - field: SourceImage + type: file_path analytic_story: - CISA AA23-347A - Active Directory Kerberos Attacks diff --git a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml index fee41b3ad00..b29ba78c190 100644 --- a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml +++ b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml @@ -1,17 +1,58 @@ name: Windows Access Token Manipulation Winlogon Duplicate Token Handle id: dda126d7-1d99-4f0b-b72a-4c14031f9398 -version: 9 +version: 10 creation_date: '2022-09-01' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Hunting -description: The following analytic detects a process attempting to access winlogon.exe to duplicate its handle. This is identified using Sysmon EventCode 10, focusing on processes targeting winlogon.exe with specific access rights. This activity is significant because it is a common technique used by adversaries to escalate privileges by leveraging the high privileges and security tokens associated with winlogon.exe. If confirmed malicious, this could allow an attacker to gain elevated privileges, potentially leading to full system compromise and unauthorized access to sensitive information. +description: |- + The following analytic detects a process requesting duplicate-handle and query-limited-information access to winlogon.exe. + It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000). data_source: - Sysmon EventID 10 -search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") GrantedAccess = 0x1040 | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_access_token_manipulation_winlogon_duplicate_token_handle_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: It is possible legitimate applications will request access to winlogon, filter as needed. +search: |- + `sysmon` + EventCode=10 + TargetImage="*:\\Windows\\system32\\winlogon.exe" + + NOT SourceImage IN ( + "C:\\Windows\\system32\\LogonUI.exe", + "C:\\Windows\\system32\\lsass.exe", + "C:\\Windows\\system32\\smss.exe", + "C:\\Windows\\system32\\svchost.exe", + "C:\\Windows\\system32\\wbem\\wmiprvse.exe" + ) + + ``` + Convert GrantedAccess from hexadecimal to decimal. + 0x1040 combines PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000). + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_DUP_HANDLE = 64 + | eval PROCESS_QUERY_LIMITED_INFORMATION = 4096 + | eval duplicate_handle_set = bit_and(g_access_decimal, PROCESS_DUP_HANDLE) + | eval query_limited_set = bit_and(g_access_decimal, PROCESS_QUERY_LIMITED_INFORMATION) + | where duplicate_handle_set == PROCESS_DUP_HANDLE + AND query_limited_set == PROCESS_QUERY_LIMITED_INFORMATION + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_access_token_manipulation_winlogon_duplicate_token_handle_filter` +how_to_implement: |- + To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: |- + It is possible legitimate applications will request access to winlogon, filter as needed. references: - https://docs.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-duplicatehandle - https://attack.mitre.org/techniques/T1134/001/ diff --git a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml index a0e87a811c6..c6f811f2d9e 100644 --- a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml +++ b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml @@ -1,16 +1,53 @@ name: Windows Access Token Winlogon Duplicate Handle In Uncommon Path id: b8f7ed6b-0556-4c84-bffd-839c262b0278 -version: 12 +version: 13 creation_date: '2022-09-01' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects a process attempting to duplicate the handle of winlogon.exe from an uncommon or public source path. This is identified using Sysmon EventCode 10, focusing on processes targeting winlogon.exe with specific access rights and excluding common system paths. This activity is significant because it may indicate an adversary trying to escalate privileges by leveraging the high-privilege tokens associated with winlogon.exe. If confirmed malicious, this could allow the attacker to gain elevated access, potentially leading to full system compromise and persistent control over the affected host. +description: |- + The following analytic detects duplicate-handle and query-limited-information access to winlogon.exe from an uncommon or public source path. + It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000). data_source: - Sysmon EventID 10 -search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") AND GrantedAccess = 0x1040 AND NOT (SourceImage IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_access_token_winlogon_duplicate_handle_in_uncommon_path_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +search: |- + `sysmon` + EventCode=10 + TargetImage="*:\\Windows\\System32\\winlogon.exe" + NOT SourceImage IN ( + "%SystemRoot%\\*", + "C:\\Program Files (x86)\\*", + "C:\\Program Files\\*", + "C:\\Windows\\*" + ) + + ``` + Convert GrantedAccess from hexadecimal to decimal. 0x1040 combines PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000). + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_DUP_HANDLE = 64 + | eval PROCESS_QUERY_LIMITED_INFORMATION = 4096 + | eval duplicate_handle_set = bit_and(g_access_decimal, PROCESS_DUP_HANDLE) + | eval query_limited_set = bit_and(g_access_decimal, PROCESS_QUERY_LIMITED_INFORMATION) + | where duplicate_handle_set == PROCESS_DUP_HANDLE + AND query_limited_set == PROCESS_QUERY_LIMITED_INFORMATION + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_access_token_winlogon_duplicate_handle_in_uncommon_path_filter` +how_to_implement: |- + To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: It is possible legitimate applications will request access to winlogon, filter as needed. references: - https://docs.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-duplicatehandle @@ -29,10 +66,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: A process $SourceImage$ is duplicating the handle token of winlogon.exe on $dest$ + message: The process [$SourceImage$] requested duplicate-handle access [$granted_access$] to [$TargetImage$] on [$dest$] threat_objects: - field: SourceImage - type: process_name + type: file_path analytic_story: - Brute Ratel C4 - PathWiper diff --git a/detections/endpoint/windows_handle_duplication_in_known_uac_bypass_binaries.yml b/detections/endpoint/windows_handle_duplication_in_known_uac_bypass_binaries.yml index f0d086a2ebd..051bcd7b7bc 100644 --- a/detections/endpoint/windows_handle_duplication_in_known_uac_bypass_binaries.yml +++ b/detections/endpoint/windows_handle_duplication_in_known_uac_bypass_binaries.yml @@ -1,15 +1,57 @@ name: Windows Handle Duplication in Known UAC-Bypass Binaries id: d7369bf5-1315-4138-b927-2dd8bb8c1da7 -version: 4 +version: 5 creation_date: '2025-11-07' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious handle duplication activity targeting known Windows utilities such as ComputerDefaults.exe, Eventvwr.exe, and others. This technique is commonly used to escalate privileges or bypass UAC by inheriting or injecting elevated tokens or handles. The detection focuses on non-standard use of DuplicateHandle or token duplication where process, thread, or token handles are copied into the context of trusted, signed utilities. Such behavior may indicate attempts to execute with elevated rights without user consent. Alerts enable rapid triage using process trees, handle data, token attributes, command-lines, and binary hashes. +description: |- + The following analytic detects duplicate-handle access to known UAC-bypass binaries from a non-standard source path. + It leverages Sysmon EventCode 10, converts GrantedAccess from hexadecimal, and checks for PROCESS_DUP_HANDLE. data_source: - Sysmon EventID 10 -search: '`sysmon` EventCode=10 TargetImage IN("*\\ComputerDefaults.exe", "*\\eventvwr.exe*", "*\\fodhelper.exe","*\\slui.exe","*\\sdclt.exe","*\\mmc.exe", "*\\colorcpl.exe","*\\wsreset.exe","*\\esentutl.exe", "*\PkgMgr.exe") AND NOT (SourceImage IN ("*C:\\Windows\\system32\\*","*C:\\Windows\\syswow64\\*","*C:\\Program Files\\*", "*C:\\Program Files (x86)\\*","%systemroot%\\*")) | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) | eval PROCESS_DUP_HANDLE = 64 | eval dup_handle_set = bit_and (g_access_decimal, PROCESS_DUP_HANDLE) | where dup_handle_set == PROCESS_DUP_HANDLE | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage GrantedAccess PROCESS_DUP_HANDLE g_access_decimal dup_handle_set Guid Opcode ProcessID SecurityID SourceProcessGUID SourceProcessId TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product CallTrace EventID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_handle_duplication_in_known_uac_bypass_binaries_filter`' +search: |- + `sysmon` + EventCode=10 + TargetImage IN( + "*\\colorcpl.exe", + "*\\ComputerDefaults.exe", + "*\\esentutl.exe", + "*\\eventvwr.exe", + "*\\fodhelper.exe", + "*\\mmc.exe", + "*\\sdclt.exe", + "*\\slui.exe", + "*\\wsreset.exe", + "*\\PkgMgr.exe" + ) + NOT SourceImage IN ( + "C:\\Windows\\System32\\*", + "C:\\Windows\\SysWOW64\\*", + "C:\\Program Files\\*", + "C:\\Program Files (x86)\\*", + "%SystemRoot%\\*" + ) + + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_DUP_HANDLE = 64 + | eval dup_handle_set = bit_and (g_access_decimal, PROCESS_DUP_HANDLE) + | where dup_handle_set == PROCESS_DUP_HANDLE + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_handle_duplication_in_known_uac_bypass_binaries_filter` how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: It is possible legitimate applications will request access to list of know abused Windows UAC binaries process, filter as needed. references: @@ -28,10 +70,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: A process $SourceImage$ is duplicating the handle token of $TargetImage$ on $dest$ + message: The process [$SourceImage$] requested duplicate-handle access [$granted_access$] to [$TargetImage$] on [$dest$] threat_objects: - - field: parent_process_name - type: parent_process_name + - field: SourceImage + type: file_path analytic_story: - Castle RAT asset_type: Endpoint diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml index 2b3d0e2ab15..9d8d8f18398 100644 --- a/detections/endpoint/windows_possible_credential_dumping.yml +++ b/detections/endpoint/windows_possible_credential_dumping.yml @@ -1,17 +1,58 @@ name: Windows Possible Credential Dumping id: e4723b92-7266-11ec-af45-acde48001122 -version: 14 +version: 15 creation_date: '2022-01-11' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Michael Haag, Splunk status: production -type: TTP -description: The following analytic detects potential credential dumping by identifying specific GrantedAccess permission requests and CallTrace DLLs targeting the LSASS process. It leverages Sysmon EventCode 10 logs, focusing on access requests to lsass.exe and call traces involving debug and native API DLLs like dbgcore.dll, dbghelp.dll, and ntdll.dll. This activity is significant as credential dumping can lead to unauthorized access to sensitive credentials. If confirmed malicious, attackers could gain elevated privileges and persist within the environment, posing a severe security risk. +type: Anomaly +description: |- + The following analytic detects possible credential dumping by identifying suspicious process access to LSASS with credential-dumping-related call traces. + It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_QUERY_LIMITED_INFORMATION (0x1000) and PROCESS_DUP_HANDLE (0x40). data_source: - Sysmon EventID 10 -search: '`sysmon` EventCode=10 TargetImage=*\\lsass.exe granted_access IN ("0x01000", "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*", "*kernelbase.dll*", "*kernel32.dll*") NOT SourceUser IN ("NT AUTHORITY\\SYSTEM", "NT AUTHORITY\\NETWORK SERVICE") | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_possible_credential_dumping_filter`' +search: |- + `sysmon` + EventCode=10 + TargetImage=*\\lsass.exe + CallTrace IN ( + "*dbgcore.dll*", + "*dbghelp.dll*", + "*kernel32.dll*", + "*kernelbase.dll*", + "*ntdll.dll*" + ) + NOT SourceUser IN ( + "NT AUTHORITY\\SYSTEM", + "NT AUTHORITY\\NETWORK SERVICE" + ) + + ``` + We looking for a value of PROCESS_QUERY_LIMITED_INFORMATION (0x1000) or PROCESS_DUP_HANDLE (0x40). + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_QUERY_LIMITED_INFORMATION = 4096 + | eval PROCESS_DUP_HANDLE = 64 + | eval query_limited_set = bit_and(g_access_decimal, PROCESS_QUERY_LIMITED_INFORMATION) + | eval duplicate_handle_set = bit_and(g_access_decimal, PROCESS_DUP_HANDLE) + | where query_limited_set == PROCESS_QUERY_LIMITED_INFORMATION + OR duplicate_handle_set == PROCESS_DUP_HANDLE + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_possible_credential_dumping_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required. -known_false_positives: False positives will occur based on GrantedAccess 0x1010 and 0x1400, filter based on source image as needed or remove them. Concern is Cobalt Strike usage of Mimikatz will generate 0x1010 initially, but later be caught. +known_false_positives: False positives will occur when legitimate tools request query-limited or duplicate-handle access to LSASS. Filter based on source image as needed. Cobalt Strike usage of Mimikatz may generate this activity. references: - https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump @@ -28,21 +69,15 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: A process, $SourceImage$, has loaded $TargetImage$ that are typically related to credential dumping on $dest$. Review for further details. - entity: - field: user_id - type: user - score: 50 intermediate_findings: entities: - field: dest type: system - score: 50 - message: A process, $SourceImage$, has loaded $TargetImage$ that are typically related to credential dumping on $dest$. Review for further details. + score: 20 + message: The process [$SourceImage$] requested suspicious access mask [$granted_access$] to [$TargetImage$] on [$dest$], which may indicate credential dumping. threat_objects: - field: SourceImage - type: process + type: file_path analytic_story: - Detect Zerologon Attack - CISA AA22-264A diff --git a/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml b/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml index a9958f0f9d7..0883c32e6b0 100644 --- a/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml +++ b/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml @@ -1,12 +1,16 @@ name: Windows Process Injection into Commonly Abused Processes id: 1e1dedc6-f6f3-41a0-9dd7-a1245904fe75 -version: 8 +version: 9 creation_date: '2023-02-24' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: 0xC0FFEEEE, Github Community status: production type: Anomaly -description: The following analytic detects process injection into executables that are commonly abused using Sysmon EventCode 10. It identifies suspicious GrantedAccess requests (0x40 and 0x1fffff) to processes such as notepad.exe, wordpad.exe and calc.exe, excluding common system paths like System32, Syswow64, and Program Files. This behavior is often associated with the SliverC2 framework by BishopFox. Monitoring this activity is crucial as it may indicate an initial payload attempting to execute malicious code. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment. +description: |- + The following analytic detects potential process injection attempts into executables that are commonly abused leveraging Sysmon EventCode 10. + It identifies Access Mask requests (0x40 and 0x1fffff) to processes such as notepad.exe, wordpad.exe and calc.exe, excluding common system paths like System32, Syswow64, and Program Files. + This activity was associated with the SliverC2 framework by BishopFox. + Monitoring this activity may indicate an initial payload attempting to execute malicious code. data_source: - Sysmon EventID 10 search: |- @@ -16,11 +20,7 @@ search: |- "*\\backgroundtaskhost.exe", "*\\calc.exe", "*\\CalculatorApp.exe", - "*\\chrome.exe", "*\\dllhost.exe", - "*\\edge.exe", - "*\\firefox.exe", - "*\\lsass.exe", "*\\mspaint.exe", "*\\notepad.exe", "*\\regsvr32.exe", @@ -40,23 +40,32 @@ search: |- "*:\\Windows\\SysWOW64\\*" ) - GrantedAccess IN ( - "0x1f3fff", - "0x1fffff", - "0x40" - ) + ``` + Convert GrantedAccess from hexadecimal to decimal. The original access values represent PROCESS_DUP_HANDLE, modern full process access, and legacy full process access. + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_DUP_HANDLE = 64 + | eval PROCESS_ALL_ACCESS = 2097151 + | eval PROCESS_ALL_ACCESS_LEGACY = 2047999 + | eval duplicate_handle_set = bit_and(g_access_decimal, PROCESS_DUP_HANDLE) + | eval full_access_set = bit_and(g_access_decimal, PROCESS_ALL_ACCESS) + | eval legacy_full_access_set = bit_and(g_access_decimal, PROCESS_ALL_ACCESS_LEGACY) + | where duplicate_handle_set == PROCESS_DUP_HANDLE + OR full_access_set == PROCESS_ALL_ACCESS + OR legacy_full_access_set == PROCESS_ALL_ACCESS_LEGACY - | stats values(user) as user - min(_time) as firstTime - max(_time) as lastTime count - by dest user_id parent_process_name parent_process_guid - process_name process_guid process_id signature SourceImage - TargetImage GrantedAccess CallTrace + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product | eval CallTrace=split(CallTrace, "|") + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | table firstTime lastTime dest user_id parent_process_name parent_process_guid process_name process_guid process_id signature SourceImage TargetImage GrantedAccess CallTrace | `windows_process_injection_into_commonly_abused_processes_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: False positives may be present based on SourceImage paths, particularly those with a legitimate reason for accessing lsass.exe or regsvr32.exe. If removing the paths is important, realize svchost and many native binaries inject into processes consistently. Restrict or tune as needed. @@ -78,12 +87,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: An instance of $SourceImage$ injecting into $TargetImage$ was identified on endpoint $dest$. + message: The process [$SourceImage$] requested a potentially malicious process injection related access mask [$granted_access$] to [$TargetImage$] on [$dest$]. threat_objects: - field: SourceImage - type: process - - field: TargetImage - type: process + type: file_path analytic_story: - BishopFox Sliver Adversary Emulation Framework - Earth Alux diff --git a/detections/endpoint/windows_terminating_lsass_process.yml b/detections/endpoint/windows_terminating_lsass_process.yml index 1dc7294e2e6..94b634ef688 100644 --- a/detections/endpoint/windows_terminating_lsass_process.yml +++ b/detections/endpoint/windows_terminating_lsass_process.yml @@ -1,30 +1,42 @@ name: Windows Terminating Lsass Process id: 7ab3c319-a4e7-4211-9e8c-40a049d0dba6 -version: 15 +version: 16 creation_date: '2022-03-28' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects a suspicious process attempting to terminate the Lsass.exe process. It leverages Sysmon EventCode 10 logs to identify processes granted PROCESS_TERMINATE access to Lsass.exe. This activity is significant because Lsass.exe is a critical process responsible for enforcing security policies and handling user credentials. If confirmed malicious, this behavior could indicate an attempt to perform credential dumping, privilege escalation, or evasion of security policies, potentially leading to unauthorized access and persistence within the environment. +description: |- + The following analytic detects a process requesting PROCESS_TERMINATE access to Lsass.exe. + It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_TERMINATE (0x1). data_source: - Sysmon EventID 10 search: |- - `sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess = 0x1 - | stats count min(_time) as firstTime max(_time) as lastTime - BY CallTrace EventID GrantedAccess - Guid Opcode ProcessID - SecurityID SourceImage SourceProcessGUID - SourceProcessId TargetImage TargetProcessGUID - TargetProcessId UserID dest - granted_access parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path - process_exec process_guid process_id - process_name process_path signature - signature_id user_id vendor_product - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_terminating_lsass_process_filter` + `sysmon` + EventCode=10 + TargetImage="*\\lsass.exe" + + ``` + PROCESS_TERMINATE is 0x1. + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_TERMINATE = 1 + | eval terminate_set = bit_and(g_access_decimal, PROCESS_TERMINATE) + | where terminate_set == PROCESS_TERMINATE + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_terminating_lsass_process_filter` how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. known_false_positives: No false positives have been identified at this time. references: @@ -43,10 +55,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: a process $SourceImage$ terminates Lsass process on $dest$ + message: A process [$SourceImage$] requested PROCESS_TERMINATE access [$granted_access$] to Lsass.exe on [$dest$]. threat_objects: - field: TargetImage - type: process + type: file_path analytic_story: - Data Destruction - Double Zero Destructor diff --git a/detections/endpoint/windows_wmi_impersonate_token.yml b/detections/endpoint/windows_wmi_impersonate_token.yml index 014c341e645..5c9648a1bbd 100644 --- a/detections/endpoint/windows_wmi_impersonate_token.yml +++ b/detections/endpoint/windows_wmi_impersonate_token.yml @@ -1,15 +1,53 @@ name: Windows WMI Impersonate Token id: cf192860-2d94-40db-9a51-c04a2e8a8f8b -version: 10 +version: 11 creation_date: '2022-10-26' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects potential WMI token impersonation activities in a process or command. It leverages Sysmon EventCode 10 to identify instances where `wmiprvse.exe` has a duplicate handle or full granted access in a target process. This behavior is significant as it is commonly used by malware like Qakbot for privilege escalation or defense evasion. If confirmed malicious, this activity could allow an attacker to gain elevated privileges, evade defenses, and maintain persistence within the environment. +description: |- + The following analytic detects WMI token impersonation by identifying `wmiprvse.exe` requesting the query, VM, and duplicate-handle rights associated with WMI process access. + It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_QUERY_INFORMATION (0x400), PROCESS_QUERY_LIMITED_INFORMATION (0x1000), PROCESS_VM_OPERATION (0x8), PROCESS_VM_READ (0x10), PROCESS_VM_WRITE (0x20), PROCESS_DUP_HANDLE (0x40), and PROCESS_ALL_ACCESS (0x1f3fff). data_source: - Sysmon EventID 10 -search: '`sysmon` EventCode=10 SourceImage = "*\\wmiprvse.exe" GrantedAccess IN ("0x1478", "0x1fffff") | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wmi_impersonate_token_filter`' +search: |- + `sysmon` + EventCode=10 + SourceImage="*\\wmiprvse.exe" + + ``` + The 0x1478 mask combines query, VM, and duplicate-handle rights; + The 0x1fffff mas is full process access. + Additional requested rights are allowed. + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_QUERY_INFORMATION = 1024 + | eval PROCESS_QUERY_LIMITED_INFORMATION = 4096 + | eval PROCESS_VM_OPERATION = 8 + | eval PROCESS_VM_READ = 16 + | eval PROCESS_VM_WRITE = 32 + | eval PROCESS_DUP_HANDLE = 64 + | eval WMI_REQUIRED_ACCESS = PROCESS_QUERY_INFORMATION + PROCESS_QUERY_LIMITED_INFORMATION + PROCESS_VM_OPERATION + PROCESS_VM_READ + PROCESS_VM_WRITE + PROCESS_DUP_HANDLE + | eval PROCESS_ALL_ACCESS = 2097151 + | eval wmi_access_set = bit_and(g_access_decimal, WMI_REQUIRED_ACCESS) + | eval full_access_set = bit_and(g_access_decimal, PROCESS_ALL_ACCESS) + | where wmi_access_set == WMI_REQUIRED_ACCESS + OR full_access_set == PROCESS_ALL_ACCESS + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_wmi_impersonate_token_filter` how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. known_false_positives: administrator may execute impersonate wmi object script for auditing. Filter is needed. references: @@ -29,7 +67,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: wmiprvse.exe process having a duplicate or full Granted Access $GrantedAccess$ to $TargetImage$ process on $dest$ + message: The [$SourceImage$] requested the access mask [$granted_access$] from [$TargetImage$] on [$dest$]. This may indicate WMI token impersonation. +threat_objects: + - field: SourceImage + type: file_path analytic_story: - Qakbot - Water Gamayun From 0389108b78d31725ea28059b261ccfde4245b508 Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Mon, 21 Sep 2026 16:31:35 +0200 Subject: [PATCH 098/162] macOS detection: MacOS Osascript Executing Interactive Shell (#4271) --------- Co-authored-by: onurmerdogan Co-authored-by: Nasreddine Bencherchali --- ..._osascript_executing_interactive_shell.yml | 86 +++++++++++++++++++ 1 file changed, 86 insertions(+) create mode 100644 detections/endpoint/macos_osascript_executing_interactive_shell.yml diff --git a/detections/endpoint/macos_osascript_executing_interactive_shell.yml b/detections/endpoint/macos_osascript_executing_interactive_shell.yml new file mode 100644 index 00000000000..c308ce8fc1b --- /dev/null +++ b/detections/endpoint/macos_osascript_executing_interactive_shell.yml @@ -0,0 +1,86 @@ +name: MacOS Osascript Executing Interactive Shell +id: 01168215-d1c7-4a37-8bd3-c5b64664c947 +version: 1 +creation_date: '2026-09-18' +modification_date: '2026-09-18' +author: Radka Viskova, Splunk +status: production +type: Anomaly +description: |- + This analytic detects the macOS osascript utility being used with an interactive Bash invocation, identified by the presence + of "bash -i" in the command line. + Adversaries may abuse osascript and AppleScript's shell execution capabilities to launch + interactive shells, establish remote access, or execute post-exploitation commands. +data_source: + - Osquery Results +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name="osascript" + Processes.process="*bash *" + Processes.process="* -i*" + + BY Processes.action Processes.dest Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_osascript_executing_interactive_shell_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Legitimate administrative scripts, MDM workflows, software deployment tools, developer automation, or support utilities may use osascript to invoke an interactive shell. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059/002/ + - https://attack.mitre.org/techniques/T1059/004/ + - https://redcanary.com/threat-detection-report/techniques/applescript/ + - https://www.loobins.io/binaries/osascript/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: The Osascript utility with the command line [$process$] was observed on [$dest$] executing an interactive Bash command line. +threat_objects: + - field: process + type: process +analytic_story: + - MacOS Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059.002 + - T1059.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1059.002/osascript_spawns_shell_process/osascript_spawns_shell_process.log + source: osquery + sourcetype: osquery:results + test_type: unit From 840306f240c78b68682629d297f3561efaa6ff03 Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Mon, 21 Sep 2026 16:33:25 +0200 Subject: [PATCH 099/162] macOS detection: Osascript Long Lived Connection To Remote Host (#4270) --------- Co-authored-by: onurmerdogan Co-authored-by: Nasreddine Bencherchali --- ...network_connection_for_a_long_duration.yml | 104 ++++++++++++++++++ 1 file changed, 104 insertions(+) create mode 100644 detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml diff --git a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml new file mode 100644 index 00000000000..b2215aab9f5 --- /dev/null +++ b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml @@ -0,0 +1,104 @@ +name: Cisco NVM - Osascript Network Connection for a Long Duration +id: 6bc88a9d-f7de-4257-b526-acf15bc5a517 +version: 1 +creation_date: '2026-09-18' +modification_date: '2026-09-18' +author: Radka Viskova, Splunk +status: production +type: Anomaly +description: |- + This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds). + Adversaries may abuse osascript and AppleScript shell execution to establish long-lived command-and-control or remote connections. +data_source: + - Cisco Network Visibility Module Flow Data +search: |- + `cisco_network_visibility_module_flowdata` + ( + parent_process_name="osascript" + OR + process_name="osascript" + ) + + ``` + FSS stands for Flow Start Seconds + FES stands for Flow End Seconds + ``` + | eval duration=fes-fss + + | where duration>600 + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(parent_process_hash) as parent_process_hash + values(process_hash) as process_hash + values(dest_port) as dest_port + values(dest_hostname) as dest_hostname + values(http_method) as http_method + by src dest transport parent_process_path parent_process_name + parent_process parent_process_id process_path process_name + process process_id user duration + + | eval duration=tostring(duration)." seconds" + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `cisco_nvm___osascript_network_connection_for_a_long_duration_filter` +how_to_implement: |- + This search requires Network Visibility Module logs, which includes the flow data sourcetype. + This search uses an input macro named `cisco_network_visibility_module_flowdata`. + We strongly recommend that you specify your environment-specific configurations + (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + Replace the macro definition with configurations for your Splunk environment. + The search also uses a post-filter macro designed to filter out known false positives. + The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). +known_false_positives: |- + Legitimate administrative scripting, automation, software deployment, or support workflows that use osascript for long-running network operations. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/tactics/TA0011/ + - https://attack.mitre.org/techniques/T1059/002/ + - https://attack.mitre.org/techniques/T1071/001/ + - https://www.loobins.io/binaries/osascript/ +drilldown_searches: + - name: View detection results for "$src$" and "$dest$" + search: '%original_detection_search% | search src="$src$" dest="$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for "$src$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: The macOS host [$src$] used the Osascript utility with the command line [$process$] and a parent process [$parent_process_name$] to initiate a network connection to [$dest$] lasting [$duration$] minutes. +threat_objects: + - field: parent_process_name + type: process_name + - field: process_name + type: process_name + - field: dest + type: ip_address +analytic_story: + - Command And Control + - Cisco Network Visibility Module Analytics + - MacOS Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059.002 + - T1071.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1059.002/osascript_long_lived_connection_to_remote_host/osascript_long_lived_connection_to_remote_host.log + source: not_applicable + sourcetype: cisco:nvm:flowdata:v2 + test_type: unit From 8fb56503f76fc2b903c0bc484e17f1f9caf74662 Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Mon, 21 Sep 2026 16:34:56 +0200 Subject: [PATCH 100/162] macOS detection: Osascript Executing JavaScript Code With Objective-C (#4272) --------- Co-authored-by: onurmerdogan Co-authored-by: Nasreddine Bencherchali --- ...pt_executing_javascript_code_with_objc.yml | 86 +++++++++++++++++++ 1 file changed, 86 insertions(+) create mode 100644 detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml diff --git a/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml b/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml new file mode 100644 index 00000000000..370282b1704 --- /dev/null +++ b/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml @@ -0,0 +1,86 @@ +name: MacOS Osascript Executing JavaScript Code With ObjC +id: 9ad44dce-7291-47f8-84a7-e343a5147242 +version: 1 +creation_date: '2026-09-18' +modification_date: '2026-09-18' +author: Radka Viskova, Splunk +status: production +type: Anomaly +description: |- + This analytic detects the macOS osascript utility executing JavaScript for Automation (JXA) code, identified by + the "-l JavaScript" interpreter flag, with references to the Objective-C bridge. Adversaries may abuse JXA and + Objective-C APIs to interact with macOS applications, access native system functionality, execute commands, or + perform post-exploitation activity. +data_source: + - Osquery Results +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name="osascript" + Processes.process="*-l *" + Processes.process="* JavaScript*" + Processes.process="*ObjC.*" + + BY Processes.action Processes.dest Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_osascript_executing_javascript_code_with_objc_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Scripts that legitimately invoke utility Osascript with JavaScript for automation or system management. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059/002/ + - https://attack.mitre.org/techniques/T1059/007/ + - https://www.loobins.io/binaries/osascript/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 30 + message: The Osascript utility with the command line [$process$] was observed on [$dest$] executing JXA code with Objective-C bridge references. +threat_objects: + - field: process + type: process +analytic_story: + - MacOS Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059.002 + - T1059.007 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective_C/osascript_JavaScript_command_execution_Objective_C.log + source: osquery + sourcetype: osquery:results + test_type: unit From a45339f1bb0d535ac8f679d77b04eb320e8f5bb3 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 21 Sep 2026 17:01:24 +0200 Subject: [PATCH 101/162] Bump contentctl.yml and build.yml to 6.7.0 (#4277) * Update build.yml * Update contentctl.yml --- build.yml | 2 +- contentctl.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build.yml b/build.yml index b3a9aac0538..c3377966ae0 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.6.0 +app_version: 6.7.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index 116199c358b..1ffa66afdee 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.6.0 + version: 6.7.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU From 1f178cb752c6a23893b82993e5d974d472d868a2 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 21 Sep 2026 18:12:17 +0200 Subject: [PATCH 102/162] Tune and Add More Context to Noisy Detections (#4263) --- .../windows_event_log_security_4740.yml | 97 +++++++++++++++++++ ...network_connection_for_a_long_duration.yml | 2 +- ...detect_excessive_user_account_lockouts.yml | 53 +++++++--- ...xecuting_js_script_in_immediate_folder.yml | 24 +++-- .../prohibited_network_traffic_allowed.yml | 71 +++++++++----- 5 files changed, 201 insertions(+), 46 deletions(-) create mode 100644 data_sources/windows_event_log_security_4740.yml diff --git a/data_sources/windows_event_log_security_4740.yml b/data_sources/windows_event_log_security_4740.yml new file mode 100644 index 00000000000..f085e94675e --- /dev/null +++ b/data_sources/windows_event_log_security_4740.yml @@ -0,0 +1,97 @@ +name: Windows Event Log Security 4740 +id: 387936fa-efa9-425d-9f1b-487425250ea9 +version: 1 +creation_date: '2026-09-08' +modification_date: '2026-09-08' +author: Nasreddine Bencherchali, Splunk +description: Logs when a user account is locked out. It includes details about the account that was locked out, the subject, and additional information. +mitre_components: + - User Account Metadata +source: XmlWinEventLog:Security +sourcetype: XmlWinEventLog +separator: EventCode +separator_value: '4740' +supported_TA: + - name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 11.0.2 +fields: + - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - Category + - change_type + - Channel + - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - eventtype + - Guid + - host + - id + - Keywords + - Level + - linecount + - Logon_ID + - name + - Name + - object + - object_attrs + - object_category + - Opcode + - ProcessID + - product + - punct + - Record + - result + - session_id + - severity + - severity_id + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_Category + - tag + - tag::eventtype + - Target_User_Name + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp + - user + - user_group + - user_name + - vendor + - vendor_product + - Version +output_fields: + - dest +example_log: 4740001382400x8020000000000000394306Securityar-win-dc.attackrange.localtestATTACKRANGE\testNT AUTHORITY\SYSTEMAR-WIN-DC$ATTACKRANGE0x3e7 diff --git a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml index b2215aab9f5..2b52bc33861 100644 --- a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml +++ b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml @@ -73,7 +73,7 @@ intermediate_findings: - field: src type: system score: 20 - message: The macOS host [$src$] used the Osascript utility with the command line [$process$] and a parent process [$parent_process_name$] to initiate a network connection to [$dest$] lasting [$duration$] minutes. + message: The macOS host [$src$] used the Osascript utility with the command line [$process$] and a parent process [$parent_process_name$] to initiate a network connection to [$dest$] lasting [$duration$]. threat_objects: - field: parent_process_name type: process_name diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml index c78c5143c48..5cb6d13d5e9 100644 --- a/detections/endpoint/detect_excessive_user_account_lockouts.yml +++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml @@ -1,26 +1,53 @@ name: Detect Excessive User Account Lockouts id: 95a7f9a5-6096-437e-a19e-86f42ac609bd -version: 15 +version: 16 creation_date: '2020-04-29' -modification_date: '2026-05-13' -author: David Dorsey, Splunk +modification_date: '2026-09-08' +author: David Dorsey, Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: The following analytic identifies user accounts experiencing an excessive number of lockouts within a short timeframe. It leverages the 'Change' data model, specifically focusing on events where the result indicates a lockout. This activity is significant as it may indicate a brute-force attack or misconfiguration, both of which require immediate attention. If confirmed malicious, this behavior could lead to account compromise, unauthorized access, and potential lateral movement within the network. -data_source: [] +description: |- + The following analytic identifies user accounts experiencing more than 5 account lockouts within a 5-minute time window. + It leverages the 'Change' data model and groups account lockout events into 5-minute time buckets to identify a high frequency of lockouts associated with the same user and destination. + This activity may indicate password spraying, brute-force activity, or repeated authentication attempts using invalid or outdated credentials. + If confirmed malicious, this behavior may indicate an attempt to gain unauthorized access to user accounts and could precede further compromise or lateral movement within the environment. +data_source: + - Windows Event Log Security 4740 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change.All_Changes - WHERE All_Changes.result="*lock*" - BY All_Changes.user All_Changes.result + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + values(All_Changes.result) as "Result" + values(All_Changes.action) as "Action" + values(All_Changes.object_category) as "Object Category" + + FROM datamodel=Change.All_Changes WHERE + + All_Changes.action="lockout" + + BY _time span=5m + All_Changes.dest All_Changes.user + | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Account_Management")` + + | eval lockout_count = 5 + | where count > lockout_count + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | search count > 5 | `detect_excessive_user_account_lockouts_filter` -how_to_implement: ou must ingest your Windows security event logs in the `Change` datamodel under the nodename is `Account_Management`, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment. -known_false_positives: It is possible that a legitimate user is experiencing an issue causing multiple account login failures leading to lockouts. -references: [] +how_to_implement: |- + You must ingest your Windows Security Event Logs or similar data into the Change data model under the Account_Management node for this search to execute successfully. + The detection triggers when more than 5 account lockouts for the same user and destination occur within a 5-minute time bucket. + The lockout threshold and time window can be adjusted based on the authentication patterns and account-management practices in your environment. +known_false_positives: |- + Legitimate users may generate multiple account lockouts after repeatedly entering an incorrect password. + False positives may also occur when pre-configured accounts continue attempting authentication with outdated stored credentials after a password change. This can commonly occur with credentials configured for printers, network shares, services, scheduled tasks, applications, mapped drives, or other systems that automatically authenticate on behalf of a user. +references: + - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4740 + - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-lockout-threshold + - https://techcommunity.microsoft.com/blog/microsoft-security-baselines/configuring-account-lockout/701040/ drilldown_searches: - name: View the detection results for - "$user$" search: '%original_detection_search% | search user = "$user$"' @@ -35,7 +62,7 @@ intermediate_findings: - field: user type: user score: 20 - message: Excessive user account lockouts for $user$ in a short period of time + message: User [$user$] experienced more than [$lockout_count$] account lockouts within a 5-minute time window. analytic_story: - Active Directory Password Spraying - Scattered Lapsus$ Hunters diff --git a/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml b/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml index 9c9c995c1e6..12620b32bc1 100644 --- a/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml +++ b/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml @@ -28,16 +28,24 @@ search: |- ) Processes.process="*js" Processes.process_path IN ( - "*:\\Users\\*", "*:\\PerfLogs\\*", "*:\\ProgramData\\*", - "*:\\Temp\\*") - NOT Processes.process_path IN ( - "*\\AppData\\Local\\*", - "*\\AppData\\Roaming\\*", - "*\\node\\*", - "*\\nodejs\\*", - "*\\nvm\\*" + "*:\\Temp\\*", + "*:\\Users\\*" + ) + ( + NOT Processes.process_path IN ( + "*\\AppData\\Roaming\\*", + "*\\node\\*", + "*\\nodejs\\*", + "*\\nvm\\*" + ) + AND + ( + NOT Processes.process_path = "*\\AppData\\Local\\*" + OR + Processes.process_path = "*\\AppData\\Local\\Temp\\*" + ) ) by Processes.action Processes.dest Processes.original_file_name diff --git a/detections/network/prohibited_network_traffic_allowed.yml b/detections/network/prohibited_network_traffic_allowed.yml index 155b55babb0..8f68a973649 100644 --- a/detections/network/prohibited_network_traffic_allowed.yml +++ b/detections/network/prohibited_network_traffic_allowed.yml @@ -1,30 +1,56 @@ name: Prohibited Network Traffic Allowed id: ce5a0962-849f-4720-a678-753fe6674479 -version: 14 +version: 15 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Rico Valdez, Splunk status: production -type: TTP -description: The following analytic detects instances where network traffic, identified by port and transport layer protocol as prohibited in the "lookup_interesting_ports" table, is allowed. It uses the Network_Traffic data model to cross-reference traffic data against predefined security policies. This activity is significant for a SOC as it highlights potential misconfigurations or policy violations that could lead to unauthorized access or data exfiltration. If confirmed malicious, this could allow attackers to bypass network defenses, leading to potential data breaches and compromising the organization's security posture. +type: Anomaly +description: |- + The following analytic detects instances where network traffic, identified by port and transport layer protocol as prohibited in the "lookup_interesting_ports" table, is allowed. + It uses the Network_Traffic data model to cross-reference traffic data against predefined security policies. + This activity is significant for a SOC as it highlights potential misconfigurations or policy violations that could lead to unauthorized access or data exfiltration. + If confirmed malicious, this could allow attackers to bypass network defenses, leading to potential data breaches and compromising the organization's security posture. data_source: - Cisco Secure Firewall Threat Defense Connection Event search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Traffic - WHERE All_Traffic.action IN ("allowed", "allow") [ - | inputlookup interesting_ports_lookup where is_prohibited="true" - | table dest_port transport - | dedup dest_port transport - | rename dest_port as All_Traffic.dest_port - | rename transport as All_Traffic.transport] by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action All_Traffic.dvc All_Traffic.src_port All_Traffic.vendor_product All_Traffic.rule + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + values(All_Traffic.src_port) as src_port + values(All_Traffic.action) as action + values(All_Traffic.rule) as rule + + FROM datamodel=Network_Traffic WHERE + + All_Traffic.action IN ("allowed", "allow") + [ + | inputlookup interesting_ports_lookup where is_prohibited="true" + | table dest_port transport + | dedup dest_port transport + | rename dest_port as All_Traffic.dest_port + | rename transport as All_Traffic.transport + ] + + by All_Traffic.src_ip All_Traffic.dest_ip + All_Traffic.dest_port All_Traffic.dvc + All_Traffic.vendor_product + | lookup update=true interesting_ports_lookup dest_port as All_Traffic.dest_port transport as All_Traffic.transport OUTPUT app is_prohibited note + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")` | `prohibited_network_traffic_allowed_filter` -how_to_implement: In order to properly run this search, Splunk needs to ingest data from firewalls or other network control devices that mediate the traffic allowed into an environment. This is necessary so that the search can identify an 'action' taken on the traffic of interest. The search requires the Network_Traffic data model be populated. -known_false_positives: No false positives have been identified at this time. -references: [] +how_to_implement: |- + In order to properly run this search, Splunk needs to ingest data from firewalls or other network control devices that mediate the traffic allowed into an environment. + This is necessary so that the search can identify an 'action' taken on the traffic of interest. + The search also requires the Network_Traffic data model be populated. +known_false_positives: |- + The "interesting_ports_lookup" lookup considers communication to ports like 20, 21 for FTP, 23 for Telnet, 110 for POP3, etc. as prohibited traffic. Which may result in a lot of alerts in certain environments that still rely on these ports for legitimate traffic. Tune as needed. +references: + - https://securityscorecard.com/blog/ftp-security-risks/ + - https://secoraconsulting.com/blog/telnet-security-risks/ drilldown_searches: - name: View the detection results for - "$src_ip$" search: '%original_detection_search% | search src_ip = "$src_ip$"' @@ -34,12 +60,12 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: Potentially Prohibited Network Traffic allowed from $src_ip$ - entity: - field: src_ip - type: system - score: 50 +intermediate_findings: + entities: + - field: src_ip + type: system + score: 20 + message: Potentially Prohibited Network Traffic on Port [$dest_port$] via Protocol [$transport$] allowed from [$src_ip$]. threat_objects: - field: dest_ip type: ip_address @@ -57,13 +83,10 @@ product: - Splunk Cloud category: network security_domain: network -baselines: - - Count of Unique IPs Connecting to Ports tests: - name: Cisco Secure Firewall True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log source: not_applicable sourcetype: cisco:sfw:estreamer - description: PORTED MANUAL TEST - This detection uses a builtin lookup from Enterprise Security. - test_type: experimental + test_type: unit From 424a788f19d776853778cdefee89e744df622caf Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 21 Sep 2026 19:12:29 +0200 Subject: [PATCH 103/162] Fix Typo (#4278) --- detections/application/esxi_bulk_vm_termination.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/esxi_bulk_vm_termination.yml b/detections/application/esxi_bulk_vm_termination.yml index 4f8cd6c99d0..2153c20e66b 100644 --- a/detections/application/esxi_bulk_vm_termination.yml +++ b/detections/application/esxi_bulk_vm_termination.yml @@ -13,7 +13,7 @@ data_source: search: |- `esxi_syslog` Message IN ( - "*pkill -9 *" + "*pkill -9 *", "*process kill*" ) | rex field=_raw "\s\[(?[^\]]+)\]:\s(?.+)$" From 1a41f94ca5c6efede6a61cf83e75527ed84a8e1d Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 21 Sep 2026 20:34:27 +0200 Subject: [PATCH 104/162] Maybe This is It? (#4279) --- .../macos___re_opened_applications.yml | 2 +- detections/deprecated/xmrig_driver_loaded.yml | 2 +- ...detect_excessive_user_account_lockouts.yml | 53 +++++-------------- .../prohibited_network_traffic_allowed.yml | 2 +- 4 files changed, 16 insertions(+), 43 deletions(-) diff --git a/detections/deprecated/macos___re_opened_applications.yml b/detections/deprecated/macos___re_opened_applications.yml index a2d8614cec2..708d18b6276 100644 --- a/detections/deprecated/macos___re_opened_applications.yml +++ b/detections/deprecated/macos___re_opened_applications.yml @@ -44,6 +44,6 @@ product: category: endpoint security_domain: threat deprecation_info: - reason: Detection deprecated as it is targeting a method of persistence that has been disabled in MacOS for years. As well, the fact that the detection has been set to experimental since 2020. + reason: Detection deprecated as it is targeting a method of persistence that has been disabled in MacOS for years. As well, as the fact that the detection has been set to experimental since 2020. removed_in_version: 6.10.0 replacement_content: [] diff --git a/detections/deprecated/xmrig_driver_loaded.yml b/detections/deprecated/xmrig_driver_loaded.yml index efd2ac89a25..325f1d027df 100644 --- a/detections/deprecated/xmrig_driver_loaded.yml +++ b/detections/deprecated/xmrig_driver_loaded.yml @@ -50,7 +50,7 @@ tests: sourcetype: XmlWinEventLog test_type: unit deprecation_info: - reason: Detection deprecated as it is inacurate. WinRing0x64.sys is not related to XMRIG. It is a driver that is used to access the hardware ring0. + reason: Detection deprecated as it is inaccurate. WinRing0x64.sys is not related to XMRIG. It is a driver that is used to access the hardware ring0. removed_in_version: 6.10.0 replacement_content: - Windows Vulnerable Driver Installed diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml index 5cb6d13d5e9..c78c5143c48 100644 --- a/detections/endpoint/detect_excessive_user_account_lockouts.yml +++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml @@ -1,53 +1,26 @@ name: Detect Excessive User Account Lockouts id: 95a7f9a5-6096-437e-a19e-86f42ac609bd -version: 16 +version: 15 creation_date: '2020-04-29' -modification_date: '2026-09-08' -author: David Dorsey, Nasreddine Bencherchali, Splunk +modification_date: '2026-05-13' +author: David Dorsey, Splunk status: production type: Anomaly -description: |- - The following analytic identifies user accounts experiencing more than 5 account lockouts within a 5-minute time window. - It leverages the 'Change' data model and groups account lockout events into 5-minute time buckets to identify a high frequency of lockouts associated with the same user and destination. - This activity may indicate password spraying, brute-force activity, or repeated authentication attempts using invalid or outdated credentials. - If confirmed malicious, this behavior may indicate an attempt to gain unauthorized access to user accounts and could precede further compromise or lateral movement within the environment. -data_source: - - Windows Event Log Security 4740 +description: The following analytic identifies user accounts experiencing an excessive number of lockouts within a short timeframe. It leverages the 'Change' data model, specifically focusing on events where the result indicates a lockout. This activity is significant as it may indicate a brute-force attack or misconfiguration, both of which require immediate attention. If confirmed malicious, this behavior could lead to account compromise, unauthorized access, and potential lateral movement within the network. +data_source: [] search: |- - | tstats `security_content_summariesonly` - count min(_time) as firstTime - max(_time) as lastTime - values(All_Changes.result) as "Result" - values(All_Changes.action) as "Action" - values(All_Changes.object_category) as "Object Category" - - FROM datamodel=Change.All_Changes WHERE - - All_Changes.action="lockout" - - BY _time span=5m - All_Changes.dest All_Changes.user - + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change.All_Changes + WHERE All_Changes.result="*lock*" + BY All_Changes.user All_Changes.result | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Account_Management")` - - | eval lockout_count = 5 - | where count > lockout_count - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | search count > 5 | `detect_excessive_user_account_lockouts_filter` -how_to_implement: |- - You must ingest your Windows Security Event Logs or similar data into the Change data model under the Account_Management node for this search to execute successfully. - The detection triggers when more than 5 account lockouts for the same user and destination occur within a 5-minute time bucket. - The lockout threshold and time window can be adjusted based on the authentication patterns and account-management practices in your environment. -known_false_positives: |- - Legitimate users may generate multiple account lockouts after repeatedly entering an incorrect password. - False positives may also occur when pre-configured accounts continue attempting authentication with outdated stored credentials after a password change. This can commonly occur with credentials configured for printers, network shares, services, scheduled tasks, applications, mapped drives, or other systems that automatically authenticate on behalf of a user. -references: - - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4740 - - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-lockout-threshold - - https://techcommunity.microsoft.com/blog/microsoft-security-baselines/configuring-account-lockout/701040/ +how_to_implement: ou must ingest your Windows security event logs in the `Change` datamodel under the nodename is `Account_Management`, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment. +known_false_positives: It is possible that a legitimate user is experiencing an issue causing multiple account login failures leading to lockouts. +references: [] drilldown_searches: - name: View the detection results for - "$user$" search: '%original_detection_search% | search user = "$user$"' @@ -62,7 +35,7 @@ intermediate_findings: - field: user type: user score: 20 - message: User [$user$] experienced more than [$lockout_count$] account lockouts within a 5-minute time window. + message: Excessive user account lockouts for $user$ in a short period of time analytic_story: - Active Directory Password Spraying - Scattered Lapsus$ Hunters diff --git a/detections/network/prohibited_network_traffic_allowed.yml b/detections/network/prohibited_network_traffic_allowed.yml index 8f68a973649..2235c3e236d 100644 --- a/detections/network/prohibited_network_traffic_allowed.yml +++ b/detections/network/prohibited_network_traffic_allowed.yml @@ -34,7 +34,7 @@ search: |- by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc - All_Traffic.vendor_product + All_Traffic.transport All_Traffic.vendor_product | lookup update=true interesting_ports_lookup dest_port as All_Traffic.dest_port transport as All_Traffic.transport OUTPUT app is_prohibited note From aea632a1484372e12cbbfd34c2a80d316bdbdd13 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 23 Sep 2026 10:56:16 -0700 Subject: [PATCH 105/162] Update Goolge Cloud TA (#4284) --- install.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/install.yml b/install.yml index f487b52fedb..f031247a96f 100644 --- a/install.yml +++ b/install.yml @@ -24,7 +24,7 @@ apps: version: 1.3.2 - appid: Splunk_TA_google-cloudplatform url: https://splunkbase.splunk.com/app/3088 - version: 5.1.1 + version: 5.2.0 - appid: utbox url: https://splunkbase.splunk.com/app/2734 version: 1.9.4 From 9640c033be1f2c2811cac0401e5f163ff4db011f Mon Sep 17 00:00:00 2001 From: Tessa Georgen <67936042+tjgeorgen@users.noreply.github.com> Date: Wed, 23 Sep 2026 14:00:31 -0400 Subject: [PATCH 106/162] expected_results should be 1 on lolbas detection (#4280) Co-authored-by: Nasreddine Bencherchali --- .../endpoint/lolbas_network_connection_on_uncommon_port.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml b/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml index bba241d4c1c..aa4777b88a4 100644 --- a/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml +++ b/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml @@ -162,5 +162,5 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog - expected_results: 0 + expected_results: 1 test_type: unit From 64acde7bf6df712c95e759fbcb76a841b5c8128d Mon Sep 17 00:00:00 2001 From: sbaker-gre Date: Thu, 24 Sep 2026 11:58:25 -0500 Subject: [PATCH 107/162] Azure AD consent detections: repair Scope regex broken by a line wrap (#4291) Co-authored-by: Nasreddine Bencherchali --- ...th_application_consent_granted_by_user.yml | 37 +++++++++++++++--- ..._consent_blocked_for_risky_application.yml | 39 ++++++++++++++++--- 2 files changed, 64 insertions(+), 12 deletions(-) diff --git a/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml b/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml index 80d1f91370f..7ac29c4a6b5 100644 --- a/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml +++ b/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml @@ -1,17 +1,42 @@ name: Azure AD OAuth Application Consent Granted By User id: 10ec9031-015b-4617-b453-c0c1ab729007 -version: 11 +version: 12 creation_date: '2023-11-16' -modification_date: '2026-05-13' +modification_date: '2026-09-24' author: Mauricio Velazco, Splunk status: production type: TTP -description: The following analytic detects when a user in an Azure AD environment grants consent to an OAuth application. It leverages Azure AD audit logs to identify events where users approve application consents. This activity is significant as it can expose organizational data to third-party applications, a common tactic used by malicious actors to gain unauthorized access. If confirmed malicious, this could lead to unauthorized access to sensitive information and resources. Immediate investigation is required to validate the application's legitimacy, review permissions, and mitigate potential risks. +description: |- + The following analytic detects when a user in an Azure AD environment grants consent to an OAuth application. It leverages Azure AD audit logs to identify events where users approve application consents. + This activity is significant as it can expose organizational data to third-party applications, a common tactic used by malicious actors to gain unauthorized access. + If confirmed malicious, this could lead to unauthorized access to sensitive information and resources. Immediate investigation is required to validate the application's legitimacy, review permissions, and mitigate potential risks. data_source: - Azure Active Directory Consent to application -search: "`azure_monitor_aad` operationName=\"Consent to application\" properties.result=success | rename properties.* as * | eval permissions_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Permissions\") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Permissions\"), -1) | eval permissions = mvindex('targetResources{}.modifiedProperties{}.newValue',permissions_index) | rex field=permissions \"Scope: (? [ ^,]+)\" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product Scope signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_oauth_application_consent_granted_by_user_filter`" -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category. -known_false_positives: False positives may occur if users are granting consents as part of legitimate application integrations or setups. It is crucial to review the application and the permissions it requests to ensure they align with organizational policies and security best practices. +search: |- + `azure_monitor_aad` + operationName="Consent to application" + properties.result=success + + | rename properties.* as * + + | eval permissions_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions"), -1) + | eval permissions = mvindex('targetResources{}.modifiedProperties{}.newValue',permissions_index) + | rex field=permissions "Scope: (?[^,]+)" + + | fillnull + + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest user src vendor_account vendor_product Scope signature + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `azure_ad_oauth_application_consent_granted_by_user_filter` +how_to_implement: |- + You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category. +known_false_positives: |- + False positives may occur if users are granting consents as part of legitimate application integrations or setups. + It is crucial to review the application and the permissions it requests to ensure they align with organizational policies and security best practices. references: - https://attack.mitre.org/techniques/T1528/ - https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/ diff --git a/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml b/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml index 33466bc2234..9fc6cc75509 100644 --- a/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml +++ b/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml @@ -1,17 +1,44 @@ name: Azure AD User Consent Blocked for Risky Application id: 06b8ec9a-d3b5-4882-8f16-04b4d10f5eab -version: 11 +version: 12 creation_date: '2023-11-16' -modification_date: '2026-05-13' +modification_date: '2026-09-24' author: Mauricio Velazco, Splunk status: production type: TTP -description: The following analytic detects instances where Azure AD has blocked a user's attempt to grant consent to a risky or potentially malicious application. This detection leverages Azure AD audit logs, focusing on user consent actions and system-driven blocks. Monitoring these blocked consent attempts is crucial as it highlights potential threats early on, indicating that a user might be targeted or that malicious applications are attempting to infiltrate the organization. If confirmed malicious, this activity suggests that Azure's security measures successfully prevented a harmful application from accessing organizational data, warranting immediate investigation to understand the context and take preventive measures. +description: |- + The following analytic detects instances where Azure AD has blocked a user's attempt to grant consent to a risky or potentially malicious application. + This detection leverages Azure AD audit logs, focusing on user consent actions and system-driven blocks. + Monitoring these blocked consent attempts is crucial as it highlights potential threats early on, indicating that a user might be targeted or that malicious applications are attempting to infiltrate the organization. + If confirmed malicious, this activity suggests that Azure's security measures successfully prevented a harmful application from accessing organizational data, warranting immediate investigation to understand the context and take preventive measures. data_source: - Azure Active Directory Consent to application -search: "`azure_monitor_aad` operationName=\"Consent to application\" properties.result=failure | rename properties.* as * | eval reason_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Reason\") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Reason\"), -1) | eval permissions_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Permissions\") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Permissions\"), -1) | search reason_index >= 0 | eval reason = mvindex('targetResources{}.modifiedProperties{}.newValue',reason_index) | eval permissions = mvindex('targetResources{}.modifiedProperties{}.newValue',permissions_index) | search reason = \"\\\"Risky application detected\\\"\" | rex field=permissions \"Scope: (? [ ^,]+)\" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product reason Scope signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_user_consent_blocked_for_risky_application_filter`" -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category. -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +search: |- + `azure_monitor_aad` + operationName="Consent to application" + properties.result=failure + + | rename properties.* as * + + | eval reason_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Reason") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Reason"), -1) + | eval permissions_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions"), -1) + | search reason_index >= 0 + | eval reason = mvindex('targetResources{}.modifiedProperties{}.newValue',reason_index) | eval permissions = mvindex('targetResources{}.modifiedProperties{}.newValue',permissions_index) + | search reason = "Risky application detected" + | rex field=permissions "Scope: (?[^,]+)" + | fillnull + + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest user src vendor_account vendor_product reason Scope signature + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `azure_ad_user_consent_blocked_for_risky_application_filter` +how_to_implement: |- + You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category. +known_false_positives: |- + No false positives have been identified at this time. references: - https://attack.mitre.org/techniques/T1528/ - https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/ From 21bcc53536a0e41f079e9cff70ab69eeaacf3c5b Mon Sep 17 00:00:00 2001 From: sbaker-gre Date: Tue, 29 Sep 2026 04:08:21 -0500 Subject: [PATCH 108/162] Windows Crowdstrike RTR Script Execution: match EDR sources without a parent command line (#4294) --------- Co-authored-by: Nasreddine Bencherchali --- .../endpoint/windows_crowdstrike_rtr_script_execution.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_crowdstrike_rtr_script_execution.yml b/detections/endpoint/windows_crowdstrike_rtr_script_execution.yml index 801437cc581..eeaa18f1349 100644 --- a/detections/endpoint/windows_crowdstrike_rtr_script_execution.yml +++ b/detections/endpoint/windows_crowdstrike_rtr_script_execution.yml @@ -1,8 +1,8 @@ name: Windows Crowdstrike RTR Script Execution id: be2bbfff-77c9-4d65-9b7c-97726051534a -version: 2 +version: 3 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-09-28' author: Raven Tait, Splunk status: production type: Anomaly @@ -20,7 +20,7 @@ search: |- from datamodel=Endpoint.Processes where Processes.parent_process_name="dllhost.exe" - Processes.parent_process="*/Processid:{BD07DDB9-1C61-4DCE-9202-A2BA1757CDB2}*" + Processes.parent_process IN ("*/Processid:{BD07DDB9-1C61-4DCE-9202-A2BA1757CDB2}*", "unknown") Processes.process_name="powershell.exe" Processes.process="* -Version 5.1 -s -NoLogo -NoProfile -EncodedCommand*" From 9aff0d8628193ee2a82c355d049dbf8f462deab0 Mon Sep 17 00:00:00 2001 From: sbaker-gre Date: Tue, 29 Sep 2026 05:08:06 -0500 Subject: [PATCH 109/162] O365 message trace detections: support o365:graph:messagetrace (Office 365 add-on 6.x) (#4286) Splunk Add-on for Microsoft Office 365 6.x collects message trace through Microsoft Graph and emits sourcetype o365:graph:messagetrace with camelCase fields (senderAddress, recipientAddress, messageId, status) instead of the PascalCase fields of the retired Reporting web service sourcetypes. - Add o365:graph:messagetrace to the o365_messagetrace macro. - Switch the four dependent detections from raw field names to the CIM fields the add-on aliases for both sourcetypes: status_code, recipient, src_user, message_id. Behaviour is unchanged on the legacy sourcetypes. - Replace the Organization field, which the Graph sourcetype does not carry, with a sender-domain vs recipient-domain comparison. - Update drilldowns to use recipient. Affected: O365 Email Password and Payroll Compromise Behavior, O365 Email Receive and Hard Delete Takeover Behavior, O365 Email Send and Hard Delete Exfiltration Behavior, O365 Email Send Attachments Excessive Volume. --------- Co-authored-by: Nasreddine Bencherchali --- ...ssword_and_payroll_compromise_behavior.yml | 29 +++++++++++----- ...eive_and_hard_delete_takeover_behavior.yml | 29 +++++++++++----- ..._and_hard_delete_exfiltration_behavior.yml | 34 +++++++++++++------ ...mail_send_attachments_excessive_volume.yml | 33 +++++++++++++----- macros/o365_messagetrace.yml | 6 ++-- 5 files changed, 93 insertions(+), 38 deletions(-) diff --git a/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml b/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml index e48b35f375f..9b4d1e6d12c 100644 --- a/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml +++ b/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml @@ -1,12 +1,14 @@ name: O365 Email Password and Payroll Compromise Behavior id: e36de71a-6bdc-4002-98ff-e3e51b0d8f96 -version: 7 +version: 8 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick status: production type: TTP -description: The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period. This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account. +description: |- + The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period. + This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account. data_source: - Office 365 Universal Audit Log - Office 365 Reporting Message Trace @@ -14,8 +16,8 @@ search: |- `o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") | eval mailtime = _time | bin _time span=4hr - | eval user = lower(RecipientAddress) - | eval InternetMessageId = lower(MessageId) + | eval user = lower(recipient) + | eval InternetMessageId = lower(message_id) | join InternetMessageId, user max=0 [ | search `o365_management_activity` Workload=Exchange Operation IN ("SoftDelete","HardDelete") @@ -32,8 +34,10 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_password_and_payroll_compromise_behavior_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. -known_false_positives: No false positives have been identified at this time. +how_to_implement: |- + You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. +known_false_positives: |- + No false positives have been identified at this time. references: - https://attack.mitre.org/techniques/T1114/ - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf @@ -48,7 +52,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" - name: Investigate Email for $user$ - search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*password*","*passcode*") RecipientAddress = "$user$"' + search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*password*","*passcode*") recipient = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ finding: @@ -86,3 +90,12 @@ tests: source: o365_messagetrace sourcetype: o365:reporting:messagetrace test_type: unit + - name: True Positive Test - Graph message trace + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log + source: o365 + sourcetype: o365:management:activity + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + source: o365_messagetrace + sourcetype: o365:graph:messagetrace + test_type: unit diff --git a/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml b/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml index 5362379aa31..51c0ec9f307 100644 --- a/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml +++ b/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml @@ -1,12 +1,14 @@ name: O365 Email Receive and Hard Delete Takeover Behavior id: b66aeaa4-586f-428b-8a2b-c4fd3039d8d3 -version: 6 +version: 7 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick status: production type: Anomaly -description: The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period. This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account. +description: |- + The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period. + This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account. data_source: - Office 365 Universal Audit Log - Office 365 Reporting Message Trace @@ -14,8 +16,8 @@ search: |- `o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") | eval mailtime = _time | bin _time span=4hr - | eval user = lower(RecipientAddress) - | eval InternetMessageId = lower(MessageId) + | eval user = lower(recipient) + | eval InternetMessageId = lower(message_id) | join InternetMessageId, user max=0 [ | search `o365_management_activity` Workload=Exchange Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions") @@ -31,8 +33,10 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_receive_and_hard_delete_takeover_behavior_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. -known_false_positives: Possible new user/account onboarding processes. +how_to_implement: |- + You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. +known_false_positives: |- + Possible new user/account onboarding processes. references: - https://attack.mitre.org/techniques/T1114/ - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf @@ -47,7 +51,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" - name: Investigate Email for $user$ - search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") AND RecipientAddress = "$user$"' + search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") AND recipient = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ intermediate_findings: @@ -87,3 +91,12 @@ tests: source: o365_messagetrace sourcetype: o365:reporting:messagetrace test_type: unit + - name: True Positive Test - Graph message trace + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log + source: o365 + sourcetype: o365:management:activity + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + source: o365_messagetrace + sourcetype: o365:graph:messagetrace + test_type: unit diff --git a/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml b/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml index 5fc9037fee1..174bf25eb1c 100644 --- a/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml +++ b/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml @@ -1,21 +1,24 @@ name: O365 Email Send and Hard Delete Exfiltration Behavior id: dd7798cf-c4f5-4114-ad0f-beacd9a33708 -version: 6 +version: 7 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick status: production type: Anomaly -description: The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of exfiltration activity. This behavior is often seen when threat actors want to reduce the probability of detection by the compromised account owner. +description: |- + The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour). + This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of exfiltration activity. + This behavior is often seen when threat actors want to reduce the probability of detection by the compromised account owner. data_source: - Office 365 Universal Audit Log - Office 365 Reporting Message Trace search: |- - `o365_messagetrace` Status=Delivered + `o365_messagetrace` status_code=Delivered | eval mailtime = _time | bin _time span=1hr - | eval user = lower(SenderAddress), recipient = lower(RecipientAddress) - | eval InternetMessageId = lower(MessageId) + | eval user = lower(src_user), recipient = lower(recipient) + | eval InternetMessageId = lower(message_id) | join InternetMessageId, user, max=0 [ | search `o365_management_activity` Workload=Exchange (Operation IN ("Send*")) OR (Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions")) @@ -26,14 +29,16 @@ search: |- | stats values(sender) as sender, values(ClientInfoString) as http_user_agent, values(InternetMessageId) as InternetMessageId, values(file_name) as file_name, sum(file_size) as file_size, values(sendtime) as firstTime, values(deltime) as lastTime values(Operation) as signature, dc(Operation) as opcount, count by _time,subject,user | where opcount > 1 AND firstTime < lastTime ] - | stats values(sender) as sender, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, sum(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime count by subject,user,recipient,Organization - | eval externalRecipient = if(match(lower(recipient),mvindex(split(lower(Organization),"."),0)),0,1) + | stats values(sender) as sender, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, sum(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime count by subject,user,recipient + | eval externalRecipient = if(mvindex(split(lower(recipient),"@"),1)==mvindex(split(lower(user),"@"),1),0,1) | where externalRecipient = 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_send_and_hard_delete_exfiltration_behavior_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. -known_false_positives: Users that habitually/proactively cleaning the recoverable items folder may trigger this alert. +how_to_implement: |- + You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. +known_false_positives: |- + Users that habitually/proactively cleaning the recoverable items folder may trigger this alert. references: - https://attack.mitre.org/techniques/T1114/ - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf @@ -90,3 +95,12 @@ tests: source: o365_messagetrace sourcetype: o365:reporting:messagetrace test_type: unit + - name: True Positive Test - Graph message trace + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log + source: o365 + sourcetype: o365:management:activity + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + source: o365_messagetrace + sourcetype: o365:graph:messagetrace + test_type: unit diff --git a/detections/cloud/o365_email_send_attachments_excessive_volume.yml b/detections/cloud/o365_email_send_attachments_excessive_volume.yml index 3842d035eed..1616e1a2701 100644 --- a/detections/cloud/o365_email_send_attachments_excessive_volume.yml +++ b/detections/cloud/o365_email_send_attachments_excessive_volume.yml @@ -1,20 +1,24 @@ name: O365 Email Send Attachments Excessive Volume id: 70a050a2-8537-488a-a628-b60a9558d96a -version: 6 +version: 7 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick status: production type: Anomaly -description: The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox. Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox. Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors. +description: |- + The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour). + This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox. + Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox. + Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors. data_source: - Office 365 Universal Audit Log search: |- - `o365_messagetrace` Status=Delivered + `o365_messagetrace` status_code=Delivered | eval mailtime = _time | bin _time span=1hr - | eval user = lower(SenderAddress), recipient = lower(RecipientAddress) - | eval InternetMessageId = lower(MessageId) + | eval user = lower(src_user), recipient = lower(recipient) + | eval InternetMessageId = lower(message_id) | join InternetMessageId, user, _time max=0 [ | search `o365_management_activity` Workload=Exchange Operation IN ("Send","SendAs","SendOnBehalf") @@ -27,14 +31,16 @@ search: |- | eval file_name = mvjoin(file_name,"||") ] | eval file_name = split(file_name,"||") - | stats values(sender) as sender, values(recipient) as recipient, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, max(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime max(count) as count by subject,user,Organization,InternetMessageId + | stats values(sender) as sender, values(recipient) as recipient, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, max(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime max(count) as count by subject,user,InternetMessageId | eval recipient = mvmap(recipient, if(match(mvindex(split(lower(recipient),"@"),1),mvindex(split(lower(user),"@"),1)), null(),recipient)) | search recipient = * | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_send_attachments_excessive_volume_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. -known_false_positives: Users or processes that are send a large number of attachments may trigger this alert, adjust thresholds accordingly. +how_to_implement: |- + You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. +known_false_positives: |- + Users or processes that are send a large number of attachments may trigger this alert, adjust thresholds accordingly. references: - https://attack.mitre.org/techniques/T1114/ - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf @@ -84,3 +90,12 @@ tests: source: o365_messagetrace sourcetype: o365:reporting:messagetrace test_type: unit + - name: True Positive Test - Graph message trace + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log + source: o365 + sourcetype: o365:management:activity + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + source: o365_messagetrace + sourcetype: o365:graph:messagetrace + test_type: unit diff --git a/macros/o365_messagetrace.yml b/macros/o365_messagetrace.yml index 390f0117419..2b530a58f26 100644 --- a/macros/o365_messagetrace.yml +++ b/macros/o365_messagetrace.yml @@ -1,8 +1,8 @@ name: o365_messagetrace id: 1ead5eb3-85e8-40fb-9eb4-6936843f08d6 -version: 1 +version: 2 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Splunk Threat Research Team description: Customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. -definition: sourcetype IN ("ms:o365:reporting:messagetrace","o365:reporting:messagetrace") +definition: sourcetype IN ("ms:o365:reporting:messagetrace","o365:reporting:messagetrace","o365:graph:messagetrace") From cc1890337230930fd32c40fff5125acb0ec5ecb8 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 29 Sep 2026 15:21:46 -0700 Subject: [PATCH 110/162] improve format for attack data links so (#4299) they are in line with all other attack data links --- ...o_nvm___osascript_network_connection_for_a_long_duration.yml | 2 +- .../endpoint/macos_osascript_executing_interactive_shell.yml | 2 +- .../macos_osascript_executing_javascript_code_with_objc.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml index 2b52bc33861..b30c5e3f415 100644 --- a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml +++ b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml @@ -98,7 +98,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1059.002/osascript_long_lived_connection_to_remote_host/osascript_long_lived_connection_to_remote_host.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript_long_lived_connection_to_remote_host/osascript_long_lived_connection_to_remote_host.log source: not_applicable sourcetype: cisco:nvm:flowdata:v2 test_type: unit diff --git a/detections/endpoint/macos_osascript_executing_interactive_shell.yml b/detections/endpoint/macos_osascript_executing_interactive_shell.yml index c308ce8fc1b..5c50548ce5e 100644 --- a/detections/endpoint/macos_osascript_executing_interactive_shell.yml +++ b/detections/endpoint/macos_osascript_executing_interactive_shell.yml @@ -80,7 +80,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1059.002/osascript_spawns_shell_process/osascript_spawns_shell_process.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript_spawns_shell_process/osascript_spawns_shell_process.log source: osquery sourcetype: osquery:results test_type: unit diff --git a/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml b/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml index 370282b1704..b0a26a48976 100644 --- a/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml +++ b/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml @@ -80,7 +80,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/refs/heads/master/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective_C/osascript_JavaScript_command_execution_Objective_C.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective_C/osascript_JavaScript_command_execution_Objective_C.log source: osquery sourcetype: osquery:results test_type: unit From 4a7da063357487c9a75f659640570c63e74e9e3e Mon Sep 17 00:00:00 2001 From: onurmerdogan Date: Wed, 30 Sep 2026 16:48:50 +0200 Subject: [PATCH 111/162] New Detection Coverage for ShieldCrash Exploit --- ...e_data_stream_created_over_local_share.yml | 6 +- ...der_intermediary_artifact_was_observed.yml | 77 +++++++++++++++++++ 2 files changed, 80 insertions(+), 3 deletions(-) create mode 100644 detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml diff --git a/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml b/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml index bd2877700bf..aea125442a2 100644 --- a/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml +++ b/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml @@ -1,8 +1,8 @@ name: Windows Alternate Data Stream Created Over Local Share id: e974a5c9-cbe9-4b4a-8fba-b55e7dbc8259 -version: 1 +version: 2 creation_date: '2026-08-19' -modification_date: '2026-08-19' +modification_date: '2026-09-30' author: Onur Mustafa Erdogan, Splunk status: production type: Anomaly @@ -17,7 +17,7 @@ data_source: search: |- `wineventlog_security` EventCode=5145 - IpAddress="127.0.0.1" + IpAddress IN ("127.0.0.1", "::1") ObjectType="File" | regex RelativeTargetName="(?i)\:\w+$" | fillnull diff --git a/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml b/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml new file mode 100644 index 00000000000..64c7d7d195c --- /dev/null +++ b/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml @@ -0,0 +1,77 @@ +name: Windows Defender Intermediary Artifact Was Observed +id: 5234fb35-da15-4e45-8e17-3b7ae0e0fc9e +version: 1 +creation_date: '2026-09-30' +modification_date: '2026-09-30' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects creation and removal of intermediary remediation artifacts of Windows Defender, during exploitation of ShieldCrash attacks. + Exploit abuses the race condition between file validation and its remediation performed by Windows Defender. In between these steps, ShieldCrash changes the + symbolic link to redirect the remediation process to a staging directory controlled by the attacker. This detection aims to detect creation of defender artifact, + its alternate data stream, and their subsequent removal. +data_source: + - Sysmon EventID 11 AND Sysmon EventID 15 AND Sysmon EventID 23 +search: |- + `sysmon` + EventID IN (11, 15, 23) + process_name IN ("system","msmpeng.exe") + user=SYSTEM + AND NOT TargetFilename IN ("C:\\Windows\\Temp\\*", "*:Zone.Identifier", "*:SmartScreen") + | stats values(EventID) as EventID dc(EventID) as dc_EventID values(TargetFilename) as TargetFilename + dc(TargetFilename) as dc_TargetFilename min(_time) as firstTime max(_time) as lastTime count + by dest process_id process_name user file_name file_path + | regex file_path!="(?i)\.\w{1,10}$" + | search dc_TargetFilename>1 dc_EventID>1 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_defender_intermediary_artifact_was_observed_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting file creation, file stream creation and file deletion events from your endpoints using Sysmon. + These logs must be processed using the latest Sysmon Technical Add-on (https://splunkbase.splunk.com/app/5709). Make sure to update Sysmon configuration to include + directories you would like to monitor for these kinds of events. +known_false_positives: |- + Remediation of various container files, such as archives, might also lead to creation various defender artifacts + SmartScreen interferes with the remediation process, potentially causing additional defender artifacts to be created. +references: + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.cyderes.com/howler-cell/shieldcrash-microsoft-zero-day?hs_amp=true + - https://socradar.io/blog/shieldcrash-poc-microsoft-defender-fix-bypass/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Intermediary artifacts [$TargetFilename$] were observed by [$process_name$] during Defender Remediation process on [$dest$] +threat_objects: + - field: TargetFilename + type: file_path +analytic_story: + - RoguePlanet + - Windows Privilege Escalation +asset_type: Endpoint +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/shieldcrash_windefender_artifacts/shieldcrash_windefender_artifacts.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit From 964fd332411bb16e2f62408796ef7ea0716cfe28 Mon Sep 17 00:00:00 2001 From: Raven Tait <93157481+RavenTait@users.noreply.github.com> Date: Thu, 1 Oct 2026 05:55:22 -0400 Subject: [PATCH 112/162] Add New Rule Covering ResetNightmare (#4289) --------- Co-authored-by: Nasreddine Bencherchali --- .../windows_ad_user_suspicious_upn_change.yml | 91 +++++++++++++++++++ ...ws_admin_password_changed_by_non_admin.yml | 32 +++++-- 2 files changed, 115 insertions(+), 8 deletions(-) create mode 100644 detections/endpoint/windows_ad_user_suspicious_upn_change.yml diff --git a/detections/endpoint/windows_ad_user_suspicious_upn_change.yml b/detections/endpoint/windows_ad_user_suspicious_upn_change.yml new file mode 100644 index 00000000000..aa955d2dd76 --- /dev/null +++ b/detections/endpoint/windows_ad_user_suspicious_upn_change.yml @@ -0,0 +1,91 @@ +name: Windows AD User Suspicious UPN Change +id: 81324b8b-46c0-4ca3-b9a1-d33638f21021 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects a user account modifying its own userPrincipalName (UPN) to match the sAMAccountName of another account via Windows Security Event 4738. + This is the setup step of the ResetNightmare attack (CVE-2026-27912), where an attacker with WriteProperty rights on their own UPN attribute spoofs their identity to a target account. + The KDC then resolves a ptype=10 (NT-ENTERPRISE) Kerberos pre-authentication request against the spoofed UPN, issuing a kadmin/changepw TGT that can be used to change the target account's password via kpasswd (port 464). + Event 4738 is generated when a user account attribute is changed. This analytic filters to events where the SubjectUserSid equals the TargetSid (self-modification), the new UPN value is not a standard UPN (no @ sign), and the value is not a Windows placeholder. + A non-UPN value set on one's own account is anomalous and has no legitimate administrative use case. +data_source: + - Windows Event Log Security 4738 +search: |- + `wineventlog_security` + EventCode=4738 + UserPrincipalName="*" + NOT UserPrincipalName IN ( + "-", + "", + "*@*", + "%%1793" + ) + NOT SubjectUserSid IN ( + "S-1-5-18", + "S-1-5-7" + ) + NOT SubjectUserName IN ( + "ANONYMOUS*", + "NT AUTHORITY*" + ) + + | where SubjectUserSid=TargetSid + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by dest SubjectUserName SubjectUserSid TargetUserName TargetSid UserPrincipalName + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_ad_user_suspicious_upn_change_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `User Account Management` within `Account Management` needs to be enabled. +known_false_positives: |- + Administrators or identity management tools may legitimately set a UPN that does not contain an @ sign during account provisioning or migration workflows. Investigate the SubjectUserName and context to confirm. +references: + - https://cravaterouge.com/articles/resetnightmare/ + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27912 + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738 +drilldown_searches: + - name: View the detection results for - "$SubjectUserName$" + search: '%original_detection_search% | search SubjectUserName = "$SubjectUserName$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$SubjectUserName$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$SubjectUserName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: User [$SubjectUserName$] set their UPN to [$UserPrincipalName$] on $dest$ + entity: + field: SubjectUserName + type: user + score: 50 +threat_objects: + - field: SubjectUserName + type: user +analytic_story: + - Active Directory Kerberos Attacks +asset_type: Endpoint +cve: + - CVE-2026-27912 +mitre_attack_id: + - T1078.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/resetnightmare/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml index 7bb99a45b9b..3c8a2b17db8 100644 --- a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml +++ b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml @@ -1,8 +1,8 @@ name: Windows Admin Password Changed by Non-Admin id: 6d4c4d88-cd60-43a1-8c70-c74a9614f724 -version: 1 +version: 2 creation_date: '2026-04-27' -modification_date: '2026-04-27' +modification_date: '2026-09-23' author: Raven Tait, Splunk status: production type: TTP @@ -13,15 +13,27 @@ data_source: search: |- `wineventlog_security` EventCode=4723 - | rex field=object_id "-(?\d+)$" + TargetSid IN ( + "*500*", + "*512*", + "*513*", + "*518*", + "*519*", + "*520*" + ) + + | rex field=TargetSid "-(?\d+)$" | rex field=SubjectUserSid "-(?\d+)$" - | where target_rid="500" OR tonumber(target_rid) IN (512,513,518,519,520) + + | where tonumber(target_rid)=500 OR tonumber(target_rid) IN (512,513,518,519,520) | where tonumber(subject_rid) >= 1000 - | where SubjectUserSid != object_id + | where subject_rid != target_rid + | stats count min(_time) as firstTime max(_time) as lastTime - by dest user object_id EventCode src_user - SubjectUserSid SubjectLogonId PrivilegeList + + by dest TargetSid EventCode SubjectUserSid src_user TargetUserName + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_admin_password_changed_by_non_admin_filter` @@ -41,17 +53,21 @@ drilldown_searches: name: View risk events for the last 7 days for - "$dest$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' finding: - title: Non-Administrator account $src_user$ changed password of Admin account $user$ on $dest$. + title: Non-Administrator account [$src_user$] changed the password of the Admin account [$user$] on $dest$. entity: field: dest type: system score: 50 +threat_objects: + - field: src_user + type: user analytic_story: - Windows Privilege Escalation - BlueHammer asset_type: Endpoint cve: - CVE-2026-33825 + - CVE-2026-27912 mitre_attack_id: - T1068 - T1543.003 From 466d5b3d88615763a22d48fac1505934e361ad43 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Thu, 1 Oct 2026 16:14:20 +0200 Subject: [PATCH 113/162] Update windows_defender_intermediary_artifact_was_observed.yml --- ...der_intermediary_artifact_was_observed.yml | 28 +++++++++++++++---- 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml b/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml index 64c7d7d195c..a5a3a0d4e98 100644 --- a/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml +++ b/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml @@ -16,14 +16,30 @@ data_source: search: |- `sysmon` EventID IN (11, 15, 23) - process_name IN ("system","msmpeng.exe") + process_name IN ( + "System", + "msmpeng.exe" + ) user=SYSTEM - AND NOT TargetFilename IN ("C:\\Windows\\Temp\\*", "*:Zone.Identifier", "*:SmartScreen") - | stats values(EventID) as EventID dc(EventID) as dc_EventID values(TargetFilename) as TargetFilename - dc(TargetFilename) as dc_TargetFilename min(_time) as firstTime max(_time) as lastTime count - by dest process_id process_name user file_name file_path - | regex file_path!="(?i)\.\w{1,10}$" + NOT TargetFilename IN ( + "C:\\Windows\\Temp\\*", + "*:Zone.Identifier", + "*:SmartScreen" + ) + + | regex TargetFilename!="(?i)\.\w{1,10}$" + + | stats count values(EventID) as EventID + values(TargetFilename) as TargetFilename + dc(EventID) as dc_EventID + dc(TargetFilename) as dc_TargetFilename + min(_time) as firstTime + max(_time) as lastTime + + by dest process_id process_name user + | search dc_TargetFilename>1 dc_EventID>1 + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_defender_intermediary_artifact_was_observed_filter` From 896f8d9e2fc034e0441e3c10093ad599a0e113e4 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 1 Oct 2026 07:17:01 -0700 Subject: [PATCH 114/162] Update data source TA and install.yml app versions (#4302) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/m365_copilot_graph_api.yml | 2 +- data_sources/ntlm_operational_8004.yml | 2 +- data_sources/ntlm_operational_8005.yml | 2 +- data_sources/ntlm_operational_8006.yml | 2 +- data_sources/o365.yml | 2 +- data_sources/o365_add_app_role_assignment_grant_to_user_.yml | 2 +- .../o365_add_app_role_assignment_to_service_principal_.yml | 2 +- data_sources/o365_add_mailboxpermission.yml | 2 +- data_sources/o365_add_member_to_role_.yml | 2 +- data_sources/o365_add_owner_to_application_.yml | 2 +- data_sources/o365_add_service_principal_.yml | 2 +- data_sources/o365_change_user_license_.yml | 2 +- data_sources/o365_consent_to_application_.yml | 2 +- data_sources/o365_disable_strong_authentication_.yml | 2 +- data_sources/o365_mailitemsaccessed.yml | 2 +- data_sources/o365_modifyfolderpermissions.yml | 2 +- data_sources/o365_set_company_information_.yml | 2 +- data_sources/o365_set_mailbox.yml | 2 +- data_sources/o365_update_application_.yml | 2 +- data_sources/o365_update_authorization_policy_.yml | 2 +- data_sources/o365_update_user_.yml | 2 +- data_sources/o365_userloggedin.yml | 2 +- data_sources/o365_userloginfailed.yml | 2 +- data_sources/office_365_reporting_message_trace.yml | 2 +- data_sources/office_365_universal_audit_log.yml | 2 +- data_sources/powershell_script_block_logging_4104.yml | 2 +- data_sources/windows_active_directory_admon.yml | 2 +- data_sources/windows_event_log_application_15457.yml | 2 +- data_sources/windows_event_log_application_17135.yml | 2 +- data_sources/windows_event_log_application_2282.yml | 2 +- data_sources/windows_event_log_application_3000.yml | 2 +- data_sources/windows_event_log_application_8128.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_400.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_854.yml | 2 +- data_sources/windows_event_log_appxdeployment_server_855.yml | 2 +- data_sources/windows_event_log_appxpackaging_171.yml | 2 +- data_sources/windows_event_log_capi2_70.yml | 2 +- data_sources/windows_event_log_capi2_81.yml | 2 +- .../windows_event_log_certificateservicesclient_1007.yml | 2 +- data_sources/windows_event_log_defender_1116.yml | 2 +- data_sources/windows_event_log_defender_1117.yml | 2 +- data_sources/windows_event_log_defender_1121.yml | 2 +- data_sources/windows_event_log_defender_1122.yml | 2 +- data_sources/windows_event_log_defender_1125.yml | 2 +- data_sources/windows_event_log_defender_1126.yml | 2 +- data_sources/windows_event_log_defender_1129.yml | 2 +- data_sources/windows_event_log_defender_1131.yml | 2 +- data_sources/windows_event_log_defender_1132.yml | 2 +- data_sources/windows_event_log_defender_1133.yml | 2 +- data_sources/windows_event_log_defender_1134.yml | 2 +- data_sources/windows_event_log_defender_5007.yml | 2 +- data_sources/windows_event_log_printservice_316.yml | 2 +- data_sources/windows_event_log_printservice_4909.yml | 2 +- data_sources/windows_event_log_printservice_808.yml | 2 +- data_sources/windows_event_log_remoteconnectionmanager_1149.yml | 2 +- data_sources/windows_event_log_security_1100.yml | 2 +- data_sources/windows_event_log_security_1102.yml | 2 +- data_sources/windows_event_log_security_4624.yml | 2 +- data_sources/windows_event_log_security_4625.yml | 2 +- data_sources/windows_event_log_security_4627.yml | 2 +- data_sources/windows_event_log_security_4648.yml | 2 +- data_sources/windows_event_log_security_4662.yml | 2 +- data_sources/windows_event_log_security_4663.yml | 2 +- data_sources/windows_event_log_security_4672.yml | 2 +- data_sources/windows_event_log_security_4688.yml | 2 +- data_sources/windows_event_log_security_4698.yml | 2 +- data_sources/windows_event_log_security_4699.yml | 2 +- data_sources/windows_event_log_security_4700.yml | 2 +- data_sources/windows_event_log_security_4702.yml | 2 +- data_sources/windows_event_log_security_4703.yml | 2 +- data_sources/windows_event_log_security_4719.yml | 2 +- data_sources/windows_event_log_security_4720.yml | 2 +- data_sources/windows_event_log_security_4723.yml | 2 +- data_sources/windows_event_log_security_4724.yml | 2 +- data_sources/windows_event_log_security_4725.yml | 2 +- data_sources/windows_event_log_security_4726.yml | 2 +- data_sources/windows_event_log_security_4727.yml | 2 +- data_sources/windows_event_log_security_4728.yml | 2 +- data_sources/windows_event_log_security_4730.yml | 2 +- data_sources/windows_event_log_security_4731.yml | 2 +- data_sources/windows_event_log_security_4732.yml | 2 +- data_sources/windows_event_log_security_4737.yml | 2 +- data_sources/windows_event_log_security_4738.yml | 2 +- data_sources/windows_event_log_security_4739.yml | 2 +- data_sources/windows_event_log_security_4740.yml | 2 +- data_sources/windows_event_log_security_4741.yml | 2 +- data_sources/windows_event_log_security_4742.yml | 2 +- data_sources/windows_event_log_security_4744.yml | 2 +- data_sources/windows_event_log_security_4749.yml | 2 +- data_sources/windows_event_log_security_4754.yml | 2 +- data_sources/windows_event_log_security_4756.yml | 2 +- data_sources/windows_event_log_security_4759.yml | 2 +- data_sources/windows_event_log_security_4768.yml | 2 +- data_sources/windows_event_log_security_4769.yml | 2 +- data_sources/windows_event_log_security_4771.yml | 2 +- data_sources/windows_event_log_security_4776.yml | 2 +- data_sources/windows_event_log_security_4781.yml | 2 +- data_sources/windows_event_log_security_4783.yml | 2 +- data_sources/windows_event_log_security_4790.yml | 2 +- data_sources/windows_event_log_security_4794.yml | 2 +- data_sources/windows_event_log_security_4798.yml | 2 +- data_sources/windows_event_log_security_4876.yml | 2 +- data_sources/windows_event_log_security_4886.yml | 2 +- data_sources/windows_event_log_security_4887.yml | 2 +- data_sources/windows_event_log_security_4946.yml | 2 +- data_sources/windows_event_log_security_4947.yml | 2 +- data_sources/windows_event_log_security_4948.yml | 2 +- data_sources/windows_event_log_security_5136.yml | 2 +- data_sources/windows_event_log_security_5137.yml | 2 +- data_sources/windows_event_log_security_5140.yml | 2 +- data_sources/windows_event_log_security_5141.yml | 2 +- data_sources/windows_event_log_security_5145.yml | 2 +- data_sources/windows_event_log_security_5441.yml | 2 +- data_sources/windows_event_log_security_5447.yml | 2 +- data_sources/windows_event_log_system_104.yml | 2 +- data_sources/windows_event_log_system_4720.yml | 2 +- data_sources/windows_event_log_system_4726.yml | 2 +- data_sources/windows_event_log_system_4728.yml | 2 +- data_sources/windows_event_log_system_7036.yml | 2 +- data_sources/windows_event_log_system_7040.yml | 2 +- data_sources/windows_event_log_system_7045.yml | 2 +- data_sources/windows_event_log_taskscheduler_200.yml | 2 +- data_sources/windows_event_log_taskscheduler_201.yml | 2 +- data_sources/windows_iis.yml | 2 +- data_sources/windows_iis_29.yml | 2 +- 125 files changed, 125 insertions(+), 125 deletions(-) diff --git a/data_sources/m365_copilot_graph_api.yml b/data_sources/m365_copilot_graph_api.yml index eef7d37443d..ab7410db47d 100644 --- a/data_sources/m365_copilot_graph_api.yml +++ b/data_sources/m365_copilot_graph_api.yml @@ -10,7 +10,7 @@ sourcetype: o365:graph:api supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - appDisplayName - appId diff --git a/data_sources/ntlm_operational_8004.yml b/data_sources/ntlm_operational_8004.yml index 749a2d3ae1c..4f9bbaca4e7 100644 --- a/data_sources/ntlm_operational_8004.yml +++ b/data_sources/ntlm_operational_8004.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8005.yml b/data_sources/ntlm_operational_8005.yml index 045f5a43f3a..b179ee9d966 100644 --- a/data_sources/ntlm_operational_8005.yml +++ b/data_sources/ntlm_operational_8005.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8006.yml b/data_sources/ntlm_operational_8006.yml index d7df32bf79e..ecf8af19a2c 100644 --- a/data_sources/ntlm_operational_8006.yml +++ b/data_sources/ntlm_operational_8006.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/o365.yml b/data_sources/o365.yml index 4184acc03ef..ca824bcbf38 100644 --- a/data_sources/o365.yml +++ b/data_sources/o365.yml @@ -17,4 +17,4 @@ separator: Operation supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 diff --git a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml index 1687c98ff8f..00bc4805b49 100644 --- a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml +++ b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment grant to user. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml index 925288235de..67062042d52 100644 --- a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml +++ b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_mailboxpermission.yml b/data_sources/o365_add_mailboxpermission.yml index 79d4333bbb7..9c2dd48871c 100644 --- a/data_sources/o365_add_mailboxpermission.yml +++ b/data_sources/o365_add_mailboxpermission.yml @@ -17,7 +17,7 @@ separator_value: Add-MailboxPermission supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - AccessRights diff --git a/data_sources/o365_add_member_to_role_.yml b/data_sources/o365_add_member_to_role_.yml index a69da205d94..bc771f78058 100644 --- a/data_sources/o365_add_member_to_role_.yml +++ b/data_sources/o365_add_member_to_role_.yml @@ -17,7 +17,7 @@ separator_value: Add member to role. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_owner_to_application_.yml b/data_sources/o365_add_owner_to_application_.yml index aa2db390305..a37f369403b 100644 --- a/data_sources/o365_add_owner_to_application_.yml +++ b/data_sources/o365_add_owner_to_application_.yml @@ -17,7 +17,7 @@ separator_value: Add owner to application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_service_principal_.yml b/data_sources/o365_add_service_principal_.yml index 3b4615afa78..37c92818d44 100644 --- a/data_sources/o365_add_service_principal_.yml +++ b/data_sources/o365_add_service_principal_.yml @@ -17,7 +17,7 @@ separator_value: Add service principal. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_change_user_license_.yml b/data_sources/o365_change_user_license_.yml index d6451bc0359..648a5cfcfc3 100644 --- a/data_sources/o365_change_user_license_.yml +++ b/data_sources/o365_change_user_license_.yml @@ -17,7 +17,7 @@ separator_value: Change user license. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_consent_to_application_.yml b/data_sources/o365_consent_to_application_.yml index f12ada70fda..5e89011933c 100644 --- a/data_sources/o365_consent_to_application_.yml +++ b/data_sources/o365_consent_to_application_.yml @@ -17,7 +17,7 @@ separator_value: Consent to application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_disable_strong_authentication_.yml b/data_sources/o365_disable_strong_authentication_.yml index 3e75abb3786..b18af0076e2 100644 --- a/data_sources/o365_disable_strong_authentication_.yml +++ b/data_sources/o365_disable_strong_authentication_.yml @@ -17,7 +17,7 @@ separator_value: Disable Strong Authentication. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_mailitemsaccessed.yml b/data_sources/o365_mailitemsaccessed.yml index 3860a0da92a..ba8649b87b8 100644 --- a/data_sources/o365_mailitemsaccessed.yml +++ b/data_sources/o365_mailitemsaccessed.yml @@ -17,7 +17,7 @@ separator_value: MailItemsAccessed supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - AppId diff --git a/data_sources/o365_modifyfolderpermissions.yml b/data_sources/o365_modifyfolderpermissions.yml index bf304721058..40683dcd19b 100644 --- a/data_sources/o365_modifyfolderpermissions.yml +++ b/data_sources/o365_modifyfolderpermissions.yml @@ -17,7 +17,7 @@ separator_value: ModifyFolderPermissions supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - AppId diff --git a/data_sources/o365_set_company_information_.yml b/data_sources/o365_set_company_information_.yml index e40e2d49171..f73672008ba 100644 --- a/data_sources/o365_set_company_information_.yml +++ b/data_sources/o365_set_company_information_.yml @@ -17,7 +17,7 @@ separator_value: Set Company Information. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_set_mailbox.yml b/data_sources/o365_set_mailbox.yml index 07dff022336..cbc4206d889 100644 --- a/data_sources/o365_set_mailbox.yml +++ b/data_sources/o365_set_mailbox.yml @@ -17,7 +17,7 @@ separator_value: Set-Mailbox supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - AppId diff --git a/data_sources/o365_update_application_.yml b/data_sources/o365_update_application_.yml index 48912324ff7..6efbb68a3b9 100644 --- a/data_sources/o365_update_application_.yml +++ b/data_sources/o365_update_application_.yml @@ -17,7 +17,7 @@ separator_value: Update application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_update_authorization_policy_.yml b/data_sources/o365_update_authorization_policy_.yml index 0feeb95bdf6..e835ce51ad1 100644 --- a/data_sources/o365_update_authorization_policy_.yml +++ b/data_sources/o365_update_authorization_policy_.yml @@ -17,7 +17,7 @@ separator_value: Update authorization policy. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_update_user_.yml b/data_sources/o365_update_user_.yml index 0b264ec1b2f..925465e2f7b 100644 --- a/data_sources/o365_update_user_.yml +++ b/data_sources/o365_update_user_.yml @@ -17,7 +17,7 @@ separator_value: Update user. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_userloggedin.yml b/data_sources/o365_userloggedin.yml index 0402ece5bf7..00c0f8fa062 100644 --- a/data_sources/o365_userloggedin.yml +++ b/data_sources/o365_userloggedin.yml @@ -17,7 +17,7 @@ separator_value: UserLoggedIn supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_userloginfailed.yml b/data_sources/o365_userloginfailed.yml index 61907c7546c..bdacceddf40 100644 --- a/data_sources/o365_userloginfailed.yml +++ b/data_sources/o365_userloginfailed.yml @@ -17,7 +17,7 @@ separator_value: UserLoginFailed supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/office_365_reporting_message_trace.yml b/data_sources/office_365_reporting_message_trace.yml index 1c2f9ffefc5..8cd1af8c3cf 100644 --- a/data_sources/office_365_reporting_message_trace.yml +++ b/data_sources/office_365_reporting_message_trace.yml @@ -11,7 +11,7 @@ separator: Organization supported_TA: - name: Splunk Microsoft Office 365 Add-on url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - FromIP - Index diff --git a/data_sources/office_365_universal_audit_log.yml b/data_sources/office_365_universal_audit_log.yml index c9273ae1194..1b72cc576d0 100644 --- a/data_sources/office_365_universal_audit_log.yml +++ b/data_sources/office_365_universal_audit_log.yml @@ -11,7 +11,7 @@ separator: Operation supported_TA: - name: Splunk Microsoft Office 365 Add-on url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time example_log: '' diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 6089a236b58..f5c6668fa1c 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -18,7 +18,7 @@ separator_value: '4104' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index b43f02de4b6..77746de129b 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -16,7 +16,7 @@ sourcetype: ActiveDirectory supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Guid diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index 953e724a1ec..5198777c72c 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_17135.yml b/data_sources/windows_event_log_application_17135.yml index dfbc3ae1ed9..6f026135e38 100644 --- a/data_sources/windows_event_log_application_17135.yml +++ b/data_sources/windows_event_log_application_17135.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index df3d27c6c72..b5c5f361151 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index 7f333a78f98..6e376dc0285 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -17,7 +17,7 @@ separator_value: '3000' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index e3841b7d777..0135033e88a 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index 6c924b1ebbb..d198bf8189d 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index f72140ae8d7..c6f21e79e37 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index 870de7ee17b..5cca95235e5 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index cf70c22f8c0..8b42fea335b 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_capi2_70.yml b/data_sources/windows_event_log_capi2_70.yml index 592e0b6ef3e..aac5be676cf 100644 --- a/data_sources/windows_event_log_capi2_70.yml +++ b/data_sources/windows_event_log_capi2_70.yml @@ -18,7 +18,7 @@ separator_value: '70' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_capi2_81.yml b/data_sources/windows_event_log_capi2_81.yml index 66ada131486..d0df9f5dce1 100644 --- a/data_sources/windows_event_log_capi2_81.yml +++ b/data_sources/windows_event_log_capi2_81.yml @@ -18,7 +18,7 @@ separator_value: '81' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_certificateservicesclient_1007.yml b/data_sources/windows_event_log_certificateservicesclient_1007.yml index 4c7a4f8b938..f0fc8598849 100644 --- a/data_sources/windows_event_log_certificateservicesclient_1007.yml +++ b/data_sources/windows_event_log_certificateservicesclient_1007.yml @@ -18,7 +18,7 @@ separator_value: '1007' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1116.yml b/data_sources/windows_event_log_defender_1116.yml index 9b02654eb11..8be3dfc440e 100644 --- a/data_sources/windows_event_log_defender_1116.yml +++ b/data_sources/windows_event_log_defender_1116.yml @@ -16,7 +16,7 @@ separator_value: '1116' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Action_ID diff --git a/data_sources/windows_event_log_defender_1117.yml b/data_sources/windows_event_log_defender_1117.yml index 4eee9d4d80b..b7ffdd9830c 100644 --- a/data_sources/windows_event_log_defender_1117.yml +++ b/data_sources/windows_event_log_defender_1117.yml @@ -16,7 +16,7 @@ separator_value: '1117' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Action_Name diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index e79d9912370..9c345f89e15 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -16,7 +16,7 @@ separator_value: '1121' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index ad28a09086f..2944fc6126d 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -16,7 +16,7 @@ separator_value: '1122' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index db460b697ee..18308e14775 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time example_log: 112204000x80000000000000003701Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009E6DB77E5-3DF2-4CF1-B95A-636979351E5B2023-11-26T23:43:08.709Z(unknown user)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1.401.1247.01.1.23100.2009ENT\ConsRC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index 2bbe2b2b19e..43fc8141873 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index ad851b6a940..4ba86029d75 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -16,7 +16,7 @@ separator_value: '1129' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index c014f6885a9..e38fadd8e0d 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index 88a8748b5b5..ef1a010606b 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 70dc254190b..90d22162d6c 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index f5889d38fd5..59d8d069840 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 10c8ddbedef..034cb376ca7 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -14,7 +14,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_printservice_316.yml b/data_sources/windows_event_log_printservice_316.yml index 2aa8588d750..65a5a4a1556 100644 --- a/data_sources/windows_event_log_printservice_316.yml +++ b/data_sources/windows_event_log_printservice_316.yml @@ -15,7 +15,7 @@ separator_value: '316' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_printservice_4909.yml b/data_sources/windows_event_log_printservice_4909.yml index 28d99290fb0..0088b7e89f0 100644 --- a/data_sources/windows_event_log_printservice_4909.yml +++ b/data_sources/windows_event_log_printservice_4909.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time example_log: '' diff --git a/data_sources/windows_event_log_printservice_808.yml b/data_sources/windows_event_log_printservice_808.yml index 38622b24f5c..bb4019035ad 100644 --- a/data_sources/windows_event_log_printservice_808.yml +++ b/data_sources/windows_event_log_printservice_808.yml @@ -16,7 +16,7 @@ separator_value: '808' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml index 060336e042f..79ab58fc3e5 100644 --- a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml +++ b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml @@ -16,7 +16,7 @@ separator_value: '1149' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 75f9683746d..5d3ccb17aba 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -15,7 +15,7 @@ separator_value: '1100' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index f59cb881fd4..21041873b42 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -16,7 +16,7 @@ separator_value: '1102' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index c48507cfc3a..d5dbfd0c909 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -16,7 +16,7 @@ separator_value: '4624' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index dad4989547c..6de42e817e9 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -15,7 +15,7 @@ separator_value: '4625' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4627.yml b/data_sources/windows_event_log_security_4627.yml index 89fba03f2cb..83f0397f05a 100644 --- a/data_sources/windows_event_log_security_4627.yml +++ b/data_sources/windows_event_log_security_4627.yml @@ -16,7 +16,7 @@ separator_value: '4627' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index b4667be60c9..1ac6a07c6e8 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -15,7 +15,7 @@ separator_value: '4648' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index fa95daaa50d..a6aad97997b 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -15,7 +15,7 @@ separator_value: '4662' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index 104eb80b58b..52f47aaccab 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -15,7 +15,7 @@ separator_value: '4663' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index 289d62a9024..f80791c7df1 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -15,7 +15,7 @@ separator_value: '4672' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index 989857e2787..80f51515f94 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -16,7 +16,7 @@ configuration: Enabling Windows event log process command line logging via group supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - Caller_Domain - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index a440f483f92..65e778bf224 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -15,7 +15,7 @@ separator_value: '4698' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index 54054afabba..0017cf0583a 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -15,7 +15,7 @@ separator_value: '4699' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index 3d13a756ee0..3403e64193c 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - EventID example_log: 4700 0 0 12804 0 0x8020000000000000 344861 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin LeastPrivilege CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index 4c180ca38a4..bddee9b6cee 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - EventID example_log: 4702 0 0 12804 0 0x8020000000000000 344863 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin HighestAvailable CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index ed09ed27bd6..310316fd12c 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -15,7 +15,7 @@ separator_value: '4703' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index 4a8dfb8ca50..bf7bc7d2aa4 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -15,7 +15,7 @@ separator_value: '4719' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 5e2bbda6ab1..1372f745737 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -14,7 +14,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index fd486f8f612..5f96b26f472 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -14,7 +14,7 @@ separator_value: '4723' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index a9cd94593d2..81c019c3b43 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -14,7 +14,7 @@ separator_value: '4724' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index 9524a3f72f0..ab583b54cfb 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -14,7 +14,7 @@ separator_value: '4725' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index 8136745ad82..93d2716a2e6 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -14,7 +14,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 24032e276be..05b8d2bd41f 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index ab74f07c8d2..482d06ddf78 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index d73d16002d6..f6cf01a48d7 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index fefeeec1255..7d1b7a78cd3 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index 3fdffb89a81..803b5e8cb49 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -14,7 +14,7 @@ separator_value: '4732' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index 881d7ccf056..6241a8694e8 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index 9c4df3de2d0..4e15e78539c 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -14,7 +14,7 @@ separator_value: '4738' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4739.yml b/data_sources/windows_event_log_security_4739.yml index 7784f95bb37..60ac157f3d5 100644 --- a/data_sources/windows_event_log_security_4739.yml +++ b/data_sources/windows_event_log_security_4739.yml @@ -15,7 +15,7 @@ separator_value: '4739' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4740.yml b/data_sources/windows_event_log_security_4740.yml index f085e94675e..b070516752b 100644 --- a/data_sources/windows_event_log_security_4740.yml +++ b/data_sources/windows_event_log_security_4740.yml @@ -14,7 +14,7 @@ separator_value: '4740' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - action diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index 1c4c800fe0c..113dfdb62a2 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -17,7 +17,7 @@ separator_value: '4741' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index 027458aca61..73a3e378cca 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index f02e15fa1a7..17716ec4550 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index dac0a891f9c..cab2404af92 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index 27c818f2890..81bd73fe377 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index f73f48479e1..a507ddf54d9 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index 8978d1ea3fb..44d305da80b 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 44102ebf15e..72a021b5ab1 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -17,7 +17,7 @@ separator_value: '4768' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index f29190cc072..85f20a46174 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -17,7 +17,7 @@ separator_value: '4769' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index bff553454a2..3a247d68691 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -17,7 +17,7 @@ separator_value: '4771' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index b01e5a06bbb..af76586dde8 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -17,7 +17,7 @@ separator_value: '4776' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index f8856f02cda..32ee3e86b67 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -17,7 +17,7 @@ separator_value: '4781' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index c21f93675c7..ed112d8efeb 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index da4093a413f..4636083cdf1 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index 75ffcb4b339..dbe5284202f 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -17,7 +17,7 @@ separator_value: supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index 50d72b8dc7f..f9c23c5c7c0 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index 8c021ffff6d..4a93ee7e359 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -17,7 +17,7 @@ separator_value: '4876' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index fc950fe6494..29fd942c970 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -17,7 +17,7 @@ separator_value: '4886' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index 88e0dff8539..d76820b4e04 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -17,7 +17,7 @@ separator_value: '4887' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index 361668dc89e..f247ab52d0e 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -12,7 +12,7 @@ separator_value: '4946' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index 892346a5984..6bf8d9f6319 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -12,7 +12,7 @@ separator_value: '4947' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index 3ed3918118c..34f0f502fc9 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -12,7 +12,7 @@ separator_value: '4948' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index fe9b0aa1ac9..987a9f95012 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -17,7 +17,7 @@ separator_value: '5136' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index 4ff1c91b19e..f52138e52a1 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -17,7 +17,7 @@ separator_value: '5137' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AppCorrelationID diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index 31c604a5035..f5aa6f25df6 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -17,7 +17,7 @@ separator_value: '5140' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index 03d0bbe1f66..a5104efd608 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -17,7 +17,7 @@ separator_value: '5141' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index bd20531413e..aa637f928a3 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -17,7 +17,7 @@ separator_value: '5145' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5441.yml b/data_sources/windows_event_log_security_5441.yml index e8a62868bd3..0406dee9ca1 100644 --- a/data_sources/windows_event_log_security_5441.yml +++ b/data_sources/windows_event_log_security_5441.yml @@ -17,7 +17,7 @@ configuration: Enable the Audit Filtering Platform Policy Change subcategory to supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_5447.yml b/data_sources/windows_event_log_security_5447.yml index 94e8f2a90cb..d1f16649a7f 100644 --- a/data_sources/windows_event_log_security_5447.yml +++ b/data_sources/windows_event_log_security_5447.yml @@ -17,7 +17,7 @@ configuration: Enable the Audit Filtering Platform Policy Change subcategory to supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Action diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index b7298c67134..2441f3fffbf 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_system_4720.yml b/data_sources/windows_event_log_system_4720.yml index 5b95d4b808e..f386952c7d1 100644 --- a/data_sources/windows_event_log_system_4720.yml +++ b/data_sources/windows_event_log_system_4720.yml @@ -17,7 +17,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4726.yml b/data_sources/windows_event_log_system_4726.yml index b5590d7546c..50059d6e568 100644 --- a/data_sources/windows_event_log_system_4726.yml +++ b/data_sources/windows_event_log_system_4726.yml @@ -17,7 +17,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4728.yml b/data_sources/windows_event_log_system_4728.yml index 2ca373f47e1..7a36f05d1d3 100644 --- a/data_sources/windows_event_log_system_4728.yml +++ b/data_sources/windows_event_log_system_4728.yml @@ -17,7 +17,7 @@ separator_value: '4728' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index 6cd9b92a19f..ef0de6543d2 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -17,7 +17,7 @@ separator_value: '7036' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index d43588fae6a..3e0518531c5 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -17,7 +17,7 @@ separator_value: '7040' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index 1aa7fef4267..eac759b2d86 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -17,7 +17,7 @@ separator_value: '7045' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccountName diff --git a/data_sources/windows_event_log_taskscheduler_200.yml b/data_sources/windows_event_log_taskscheduler_200.yml index 31739b254e3..81161d7f0d4 100644 --- a/data_sources/windows_event_log_taskscheduler_200.yml +++ b/data_sources/windows_event_log_taskscheduler_200.yml @@ -17,7 +17,7 @@ separator_value: '200' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActionName diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index 6809dbf363c..e429edceb16 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_iis.yml b/data_sources/windows_iis.yml index 521b00579bc..a2adad94a89 100644 --- a/data_sources/windows_iis.yml +++ b/data_sources/windows_iis.yml @@ -16,4 +16,4 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 diff --git a/data_sources/windows_iis_29.yml b/data_sources/windows_iis_29.yml index 27abf33af68..d846b317464 100644 --- a/data_sources/windows_iis_29.yml +++ b/data_sources/windows_iis_29.yml @@ -17,7 +17,7 @@ separator_value: '29' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ComputerName From c69f2137fae821fae7d712f14bdcddffd7b37e35 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 1 Oct 2026 17:31:50 +0200 Subject: [PATCH 115/162] add script and workflow for archived TAs (#4301) --- .github/workflows/archived-ta-tracker.yml | 32 +++ scripts/check_archived_tas.py | 245 ++++++++++++++++++++++ 2 files changed, 277 insertions(+) create mode 100644 .github/workflows/archived-ta-tracker.yml create mode 100644 scripts/check_archived_tas.py diff --git a/.github/workflows/archived-ta-tracker.yml b/.github/workflows/archived-ta-tracker.yml new file mode 100644 index 00000000000..25d202bf6a3 --- /dev/null +++ b/.github/workflows/archived-ta-tracker.yml @@ -0,0 +1,32 @@ +name: Archived TA tracker + +on: + workflow_dispatch: + schedule: + - cron: "17 7 * * *" + +permissions: + contents: read + issues: write + +jobs: + check-archived-tas: + runs-on: ubuntu-latest + steps: + - name: Check out repository + uses: actions/checkout@v7 + + - name: Set up Python + uses: actions/setup-python@v6 + with: + python-version: "3.12" + + - name: Install YAML parser + run: python -m pip install PyYAML + + - name: Create or update archived TA issues + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_REPOSITORY: ${{ github.repository }} + GITHUB_REF_NAME: ${{ github.ref_name }} + run: python scripts/check_archived_tas.py diff --git a/scripts/check_archived_tas.py b/scripts/check_archived_tas.py new file mode 100644 index 00000000000..020fa3f2d71 --- /dev/null +++ b/scripts/check_archived_tas.py @@ -0,0 +1,245 @@ +#!/usr/bin/env python3 +"""Create or refresh one GitHub issue for each archived TA in active use.""" + +from __future__ import annotations + +import json +import os +import re +import sys +import time +import urllib.error +import urllib.parse +import urllib.request +from pathlib import Path +from typing import Any + +import yaml + + +ROOT = Path(__file__).resolve().parents[1] +DATA_SOURCES_DIR = ROOT / "data_sources" +DETECTIONS_DIR = ROOT / "detections" +SPLUNKBASE_API = "https://splunkbase.splunk.com/api/v1/app" +APP_URL_PATTERN = re.compile( + r"https?://(?:www\.)?splunkbase\.splunk\.com/app/(\d+)(?:/|\b)", re.I +) +USER_AGENT = "splunk-threat-research-team/1.0" + + +def yaml_files(folder: Path): + yield from sorted(folder.rglob("*.yml")) + yield from sorted(folder.rglob("*.yaml")) + + +def load_yaml(path: Path) -> dict[str, Any] | None: + try: + value = yaml.safe_load(path.read_text(encoding="utf-8")) + except (OSError, yaml.YAMLError) as exc: + print(f"Warning: skipping {path.relative_to(ROOT)}: {exc}", file=sys.stderr) + return None + return value if isinstance(value, dict) else None + + +def discover_used_tas() -> dict[str, dict[str, Any]]: + """Return TAs grouped by app ID, including linked data sources/detections.""" + data_sources: dict[str, dict[str, Any]] = {} + for path in yaml_files(DATA_SOURCES_DIR): + obj = load_yaml(path) + if not obj or not isinstance(obj.get("name"), str): + continue + data_sources[obj["name"].strip().casefold()] = { + "name": obj["name"].strip(), + "path": path.relative_to(ROOT).as_posix(), + "supported_tas": obj.get("supported_TA") or [], + "detections": [], + } + + for path in yaml_files(DETECTIONS_DIR): + detection = load_yaml(path) + if not detection: + continue + references = detection.get("data_source") or [] + if isinstance(references, str): + references = [references] + if not isinstance(references, list): + continue + detection_name = str(detection.get("name") or path.stem) + detection_path = path.relative_to(ROOT).as_posix() + for reference in references: + if not isinstance(reference, str): + continue + source = data_sources.get(reference.strip().casefold()) + if source: + source["detections"].append({"name": detection_name, "path": detection_path}) + + tas: dict[str, dict[str, Any]] = {} + for source in data_sources.values(): + if not source["detections"]: + continue + for ta in source["supported_tas"]: + if not isinstance(ta, dict): + continue + url = str(ta.get("url") or "").strip() + match = APP_URL_PATTERN.search(url) + if not match: + continue + app_id = match.group(1) + name = str(ta.get("name") or f"Splunkbase app {app_id}").strip() + record = tas.setdefault( + app_id, + { + "app_id": app_id, + "name": name, + "url": f"https://splunkbase.splunk.com/app/{app_id}/", + "data_sources": {}, + }, + ) + if record["name"].startswith("Splunkbase app ") and name: + record["name"] = name + record["data_sources"][source["path"]] = source + return tas + + +def get_json(url: str) -> Any: + request = urllib.request.Request( + url, headers={"User-Agent": USER_AGENT, "Accept": "application/json"} + ) + with urllib.request.urlopen(request, timeout=30) as response: + return json.loads(response.read().decode("utf-8")) + + +def truthy(value: Any) -> bool: + if isinstance(value, str): + return value.strip().casefold() in {"true", "1", "yes", "archived"} + return value is True or value == 1 + + +def splunkbase_archived(app_id: str) -> tuple[bool, str]: + url = f"{SPLUNKBASE_API}/{app_id}/" + payload = get_json(url) + if not isinstance(payload, dict): + raise ValueError("unexpected Splunkbase response") + archived = truthy(payload.get("is_archived")) or truthy(payload.get("archive_status")) + api_name = str(payload.get("title") or payload.get("name") or "").strip() + return archived, api_name + + +def github_request(method: str, url: str, token: str, body: dict[str, Any] | None = None) -> Any: + headers = { + "User-Agent": USER_AGENT, + "Accept": "application/vnd.github+json", + "Authorization": f"Bearer {token}", + "X-GitHub-Api-Version": "2022-11-28", + } + data = json.dumps(body).encode("utf-8") if body is not None else None + request = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=30) as response: + raw = response.read() + return json.loads(raw.decode("utf-8")) if raw else None + + +def list_repo_issues(repo: str, token: str) -> list[dict[str, Any]]: + """Read open and closed issues so an old issue can be reopened in place.""" + issues: list[dict[str, Any]] = [] + page = 1 + while True: + query = urllib.parse.urlencode({"state": "all", "per_page": 100, "page": page}) + payload = github_request("GET", f"https://api.github.com/repos/{repo}/issues?{query}", token) + if not isinstance(payload, list): + raise ValueError("unexpected GitHub issues response") + issues.extend(item for item in payload if isinstance(item, dict) and "pull_request" not in item) + if len(payload) < 100: + return issues + page += 1 + + +def issue_body(ta: dict[str, Any], repo: str, branch: str) -> str: + lines = [ + f"", + f"**Splunkbase TA:** [{ta['name']}]({ta['url']})", + "", + "This archived Splunkbase TA is referenced by data source objects used by detections.", + "", + "### Data source objects and detections", + ] + for source in sorted(ta["data_sources"].values(), key=lambda item: item["name"].casefold()): + source_url = f"https://github.com/{repo}/blob/{branch}/{source['path']}" + lines.append(f"- [{source['name']}]({source_url})") + detection_items = sorted(source["detections"], key=lambda item: item["name"].casefold()) + for detection in detection_items: + detection_url = f"https://github.com/{repo}/blob/{branch}/{detection['path']}" + lines.append(f" - Detection: [{detection['name']}]({detection_url})") + lines.extend(["", "_This issue is maintained automatically by the archived TA daily workflow._"]) + return "\n".join(lines) + + +def find_existing_issue(ta: dict[str, Any], issues: list[dict[str, Any]]) -> dict[str, Any] | None: + marker = f"" + marked = [issue for issue in issues if marker in str(issue.get("body") or "")] + if marked: + return next((issue for issue in marked if issue.get("state") == "open"), marked[0]) + + # Adopt a manually created issue only when its exact title and Splunkbase + # URL both match. This avoids conflating two apps that happen to share a name. + expected_title = f"{ta['name']} is archived on Splunkbase" + for issue in issues: + if issue.get("title") == expected_title and ta["url"] in str(issue.get("body") or ""): + return issue + return None + + +def main() -> int: + repo = os.environ.get("GITHUB_REPOSITORY", "").strip() + token = os.environ.get("GITHUB_TOKEN", "").strip() + branch = os.environ.get("GITHUB_REF_NAME", "develop").strip() + if not repo or not token: + print("GITHUB_REPOSITORY and GITHUB_TOKEN are required.", file=sys.stderr) + return 2 + + used_tas = discover_used_tas() + print(f"Found {len(used_tas)} distinct TAs referenced by data sources used in detections.") + issues = list_repo_issues(repo, token) + api_root = f"https://api.github.com/repos/{repo}/issues" + archived_count = 0 + + for app_id, ta in sorted(used_tas.items(), key=lambda item: item[1]["name"].casefold()): + try: + archived, api_name = splunkbase_archived(app_id) + except (urllib.error.URLError, urllib.error.HTTPError, TimeoutError, ValueError, json.JSONDecodeError) as exc: + print(f"Warning: could not check Splunkbase app {app_id}: {exc}", file=sys.stderr) + continue + if not archived: + continue + archived_count += 1 + if api_name: + ta["name"] = api_name + + title = f"{ta['name']} is archived on Splunkbase" + body = issue_body(ta, repo, branch) + existing = find_existing_issue(ta, issues) + try: + if existing: + issue_number = existing["number"] + result = github_request( + "PATCH", + f"{api_root}/{issue_number}", + token, + {"title": title, "body": body, "state": "open"}, + ) + action = "Updated/reopened" + else: + result = github_request("POST", api_root, token, {"title": title, "body": body}) + action = "Created" + issues.append(result) + print(f"{action} issue #{result['number']}: {title}") + except (urllib.error.URLError, urllib.error.HTTPError, TimeoutError, KeyError, TypeError) as exc: + print(f"Error: could not save issue for app {app_id}: {exc}", file=sys.stderr) + time.sleep(0.15) + + print(f"Archived TAs currently in use: {archived_count}") + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) From cd8d8f8d98f109a151c14432c401ce7e9aa8ad7c Mon Sep 17 00:00:00 2001 From: kbouchard <47464052+kbouchardherjavecgroup@users.noreply.github.com> Date: Thu, 1 Oct 2026 08:50:57 -0700 Subject: [PATCH 116/162] added V4 of Generic Response plan (#4295) added V4 of Generic Response plan Co-authored-by: Nasreddine Bencherchali --- response_templates/GenericIncidentResponse_v4.json | 1 + 1 file changed, 1 insertion(+) create mode 100644 response_templates/GenericIncidentResponse_v4.json diff --git a/response_templates/GenericIncidentResponse_v4.json b/response_templates/GenericIncidentResponse_v4.json new file mode 100644 index 00000000000..b2368751a94 --- /dev/null +++ b/response_templates/GenericIncidentResponse_v4.json @@ -0,0 +1 @@ +{"id": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c", "create_time": 1788276134.3671353, "update_time": 1788280100.5796342, "name": "Generic Incident Response", "description": "Use%20this%20as%20a%20starting%20point.%20This%20will%20guide%20you%20to%20visualizations%20and%20dashboards%20within%20Splunk%20Enterprise%20Security%20that%20you%20would%20use%20to%20research%20and%20interrogate%20different%20data%20types%20like%20Authentication,%20Endpoint%20or%20Network.%20%20The%20Suggested%20Integrations(connectors)%20are%20just%20that,%20either%20built%20into%20Splunk%20SOAR%20or%20commonly%20used%20by%20customers.%20The%20Actions%20included%20will%20need%20to%20be%20reviewed,%20removed,%20validated,%20or%20added%20based%20on%20what%20tools%20your%20organizations%20use.%20%20Before%20implementing%20be%20sure%20to%20add%20roles%20and%20approvals%20to%20ensure%20proper%20review%20occurs%20in%20the%20incident%20response%20workflow%20", "template_status": "draft", "creator": "splunker", "updated_by": "splunker", "is_default": false, "version": 4, "phases": [{"id": "c8c1bb29-a14c-4230-ba02-283f98645b90", "create_time": 1788276680.0027182, "update_time": 1788280100.5278718, "name": "Initial%20Reporting%20and%20Awareness%20", "order": 1, "tasks": [{"id": "76fd8383-b2f7-47d8-b952-49a60105c23f", "create_time": 1764758755.9055116, "update_time": 1788280100.527043, "name": "Ensure%20Investigations%20are%20mirrored%20in%20the%20core%20enterprise%20tracking%20system.", "order": 1, "tag": "69c9baf1-bd12-4b09-b6b6-a77df9428682", "description": "Open%20Incident%20to%20track%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "3ff21177-da2b-4c47-acc7-b44d4dd0dc2a", "create_time": 1788276603.7561357, "update_time": 1788280100.5271513, "last_job_id": 0, "name": "create ticket - ServiceNow", "action": "2471", "description": "Create a new ticket/record", "type": "create ticket", "app_id": 147, "asset": 29, "parameters": [{"table": "", "fields": "", "vault_id": "", "description": "", "short_description": ""}]}, {"id": "71f70831-5652-41d8-a05e-6d4c7221b81d", "create_time": 1788276680.0023613, "update_time": 1788280100.5271919, "last_job_id": 0, "name": "create ticket - Salesforce", "action": "2933", "description": "Create a new Case", "type": "create ticket", "app_id": 144, "asset": 34, "parameters": [{"subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "45052d6d-ffd0-4491-9434-af7c69b6544d", "create_time": 1788276680.0023906, "update_time": 1788280100.5272317, "last_job_id": 0, "name": "create ticket - Jira", "action": "2285", "description": "Create a ticket (issue)", "type": "create ticket", "app_id": 80, "asset": 31, "parameters": [{"fields": "", "summary": "", "assignee": "", "priority": "", "vault_id": "", "issue_type": "", "description": "", "project_key": "", "assignee_account_id": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c62f8956-c622-4c11-a664-9d68661f2df1", "create_time": 1764758755.905616, "update_time": 1788280100.5275803, "name": "Alert%20Appropriate%20Parties%20that%20Incident%20Response%20Is%20Starting", "order": 2, "tag": "8ca56a2a-f0d7-43c1-96e3-06bac95deffe", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "b7f1588d-09e9-4fe8-b72a-27c599eb2a8d", "create_time": 1788277531.9986718, "update_time": 1788280100.527657, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "70c65ce6-06b9-4fbc-9f9b-362f2f4a4817", "create_time": 1788277531.9986978, "update_time": 1788280100.5276885, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "24d8b79b-e9a5-43a3-a971-fcbf1d4f02d7", "create_time": 1788277531.998722, "update_time": 1788280100.5277174, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4ff61fec-6cb7-4dd8-9b63-ca3ea2e1a18d", "create_time": 1788277531.9987452, "update_time": 1788280100.5277452, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "5b82f7e8-0e65-46e0-916c-d0c487e5b65a", "create_time": 1788277531.9987676, "update_time": 1788280100.5277727, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "8af7ff80-2510-4ec6-aa55-d88d3406b5f8", "create_time": 1788277531.9987895, "update_time": 1788280100.5278, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "816cf263-fcdd-45d6-8f5f-f4c5c3f638bd", "create_time": 1788276680.0036306, "update_time": 1788280100.528886, "name": "Analysis", "order": 2, "tasks": [{"id": "2444a355-821e-4485-86c5-03c836cba7c5", "create_time": 1764758755.9059348, "update_time": 1788280100.5279753, "name": "Research intelligence resources", "order": 1, "tag": "595d75bb-316e-4dec-bfc6-6729d3e7b280", "description": "Review%20Intelligence%20resources%20including%20Splunk%20Attack%20Analyzer%20and%20Cisco%20Talos%20in%20the%20Intelligence%20Tab%20of%20investigation%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Splunk%20Attack%20Analyzer%0A2.%20Cisco%20Talos%20Intelligence%0A3.%20VirusTotal%20v3%0A4.%20PhishTank%20(preconfigured)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0d079a95-c063-4b33-87ba-25fe661a9ece", "create_time": 1774295034.6502967, "update_time": 1788280100.5280461, "last_job_id": 0, "name": "detonate file - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8939", "description": "Submit File for Scanning", "type": "detonate file", "app_id": 283, "asset": 23, "parameters": [{"file": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "efe8365d-975e-4aa6-a26e-6eeca46a39e4", "create_time": 1774295034.650387, "update_time": 1788280100.5280788, "last_job_id": 0, "name": "detonate url - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8940", "description": "Submit New URL for Scanning", "type": "detonate url", "app_id": 283, "asset": 23, "parameters": [{"url": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "60f5815d-8d11-490d-870c-3e174acc2cdd", "create_time": 1774295034.650461, "update_time": 1788280100.5281093, "last_job_id": 0, "name": "get job summary - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8937", "description": "Get a job summary for a submitted job", "type": "get job summary", "app_id": 283, "asset": 23, "parameters": [{"job_id": "", "timeout": ""}]}, {"id": "592359f5-15f0-405f-bd1b-94feeef818a1", "create_time": 1774295034.6505318, "update_time": 1788280100.5281377, "last_job_id": 0, "name": "domain reputation - Cisco Talos Intelligence", "action": "7850", "description": "Query domain info", "type": "domain reputation", "app_id": 61, "asset": 11, "parameters": [{"domain": ""}]}, {"id": "28f35544-23b8-4302-89ff-6ca0004c1809", "create_time": 1774295034.6506045, "update_time": 1788280100.5281668, "last_job_id": 0, "name": "ip reputation - Cisco Talos Intelligence", "action": "7849", "description": "Query IP info", "type": "ip reputation", "app_id": 61, "asset": 11, "parameters": [{"ip": ""}]}, {"id": "e970c5c0-d3f1-4f83-9cc7-a640ac3573ba", "create_time": 1774295034.6506772, "update_time": 1788280100.5281966, "last_job_id": 0, "name": "url reputation - Cisco Talos Intelligence", "action": "7851", "description": "Query URL info", "type": "url reputation", "app_id": 61, "asset": 11, "parameters": [{"url": ""}]}, {"id": "4fdc630a-1b12-4391-b43d-cdd2e203cdb9", "create_time": 1774295034.6507487, "update_time": 1788280100.5282252, "last_job_id": 0, "name": "domain reputation - VirusTotal v3", "action": "8999", "description": "Queries VirusTotal for domain info", "type": "domain reputation", "app_id": 323, "asset": 28, "parameters": [{"domain": ""}]}, {"id": "4ad7addc-85f1-423f-bbb3-127b419e5e4f", "create_time": 1774295034.65084, "update_time": 1788280100.5282538, "last_job_id": 0, "name": "file reputation - VirusTotal v3", "action": "9000", "description": "Queries VirusTotal for file reputation info", "type": "file reputation", "app_id": 323, "asset": 28, "parameters": [{"hash": ""}]}, {"id": "eda133de-bca5-4dfc-adb7-80c32b26a9af", "create_time": 1774295034.6509123, "update_time": 1788280100.5282822, "last_job_id": 0, "name": "ip reputation - VirusTotal v3", "action": "9002", "description": "Queries VirusTotal for IP info", "type": "ip reputation", "app_id": 323, "asset": 28, "parameters": [{"ip": ""}]}, {"id": "61ad9c71-2ac1-4ca6-93a8-2b6fac2bc23e", "create_time": 1774295034.650983, "update_time": 1788280100.5283108, "last_job_id": 0, "name": "url reputation - VirusTotal v3", "action": "9003", "description": "Queries VirusTotal for URL info (run this action after running detonate url)", "type": "url reputation", "app_id": 323, "asset": 28, "parameters": [{"url": ""}]}, {"id": "4d492999-a2cf-4f01-90c8-3c02ffc1074f", "create_time": 1774295034.6510537, "update_time": 1788280100.5283384, "last_job_id": 0, "name": "detonate file - VirusTotal v3", "action": "9005", "description": "Upload a file to Virus Total and retrieve the analysis results", "type": "detonate file", "app_id": 323, "asset": 28, "parameters": [{"vault_id": "", "wait_time": ""}]}, {"id": "b469d96c-f7d1-458e-b12a-b2e6024ef6ba", "create_time": 1774295034.6511242, "update_time": 1788280100.5283694, "last_job_id": 0, "name": "detonate url - VirusTotal v3", "action": "9004", "description": "Load a URL to Virus Total and retrieve analysis results", "type": "detonate url", "app_id": 323, "asset": 28, "parameters": [{"url": "", "wait_time": ""}]}, {"id": "dce78a62-bcde-499a-94dd-95f738db943a", "create_time": 1774295034.651194, "update_time": 1788280100.528398, "last_job_id": 0, "name": "url reputation - PhishTank", "action": "8902", "description": "Queries PhishTank for URL's phishing reputation", "type": "url reputation", "app_id": 225, "asset": 3, "parameters": [{"url": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a947eacc-04e3-485e-bac4-6566e85df173", "create_time": 1764758755.9060266, "update_time": 1788280100.5284767, "name": "Research%20Network%20and%20Traffic%20logs%20", "order": 2, "tag": "7586c74e-6844-45bb-9535-4924752ff0de", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0A%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BWeb%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/web_center)%0A2.%20%5BTraffic%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_center)%0A3.%20%5BTraffic%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_search)%0A4.%20%5BTraffic%20Size%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_size_analysis)%0A5.%20%5BPort%20and%20Protocol%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/port_protocol_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "bfa0b1ad-7bb1-484d-bcfa-16df7989518c", "create_time": 1764758755.906122, "update_time": 1788280100.528601, "name": "Research%20Authentication%20Behavior", "order": 3, "tag": "5f7e4c57-343a-4a5c-8c90-643bdb578dbb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)%0A2.%20%5BAccess%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_center)%0A3.%20%5BAccount%20Management%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/account_management)%0A4.%20%5BAccess%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "0168209e-eb24-4a5a-b72a-7c074a96a19c", "create_time": 1764758755.906265, "update_time": 1788280100.5287104, "name": "Research%20OS%20%20and%20Endpoint%20Logs", "order": 4, "tag": "357d8065-7af2-4968-a52e-1daba8d36bcb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BEndpoint%20Changes%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/endpoint_changes)%0A2.%20%5BMalware%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_center)%0A3.%20%5BMalware%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_search)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a16d098a-10a7-4b53-a798-fd83c467ddb6", "create_time": 1764758755.9069023, "update_time": 1788280100.528816, "name": "Determine%20full%20impact", "order": 5, "tag": "2419ca1b-fa9e-4443-8334-4642877218c4", "description": "Determine%20and%20Document%20Initial%20Infection%20vectors,%20attack%20targets,%20attacker%20sources,%20infected%20devices,%20compromised%20users.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "1cfc9549-b74f-4dfd-b1c5-956b1587e546", "create_time": 1788276680.0043044, "update_time": 1788280100.530551, "name": "Containment", "order": 3, "tasks": [{"id": "91691144-6812-44e7-ae84-769b7c91778f", "create_time": 1764758755.9071276, "update_time": 1788280100.5289705, "name": "Alert%20Appropriate%20Parties%20of%20evidence%20found%20and%20recommended%20next%20actions", "order": 1, "tag": "fa5fbdd4-4224-460f-80b1-081083c3a8e5", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "79483e20-2181-4940-8225-94c2d222e631", "create_time": 1788278442.8867176, "update_time": 1788280100.5290368, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "29954e34-f374-48b8-ac1d-ed2d53750ff5", "create_time": 1788278442.886742, "update_time": 1788280100.5290687, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "5acb959b-9bf7-4213-9ca4-0237a9191d61", "create_time": 1788278442.8867648, "update_time": 1788280100.5290997, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "f0239d21-9be0-4768-9971-cb03a109fb8c", "create_time": 1788278442.8867874, "update_time": 1788280100.5291348, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "2a6dc7f4-2326-4ca4-b9c3-e824c14e735e", "create_time": 1788278442.8868096, "update_time": 1788280100.529166, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "ac4ad54a-6826-4758-bd4b-7ea9366d1811", "create_time": 1788278442.8868325, "update_time": 1788280100.5291967, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "884da2c4-4fb8-494f-bd5a-2c0eacb81646", "create_time": 1764758755.9072351, "update_time": 1788280100.5292842, "name": "Block%20Malicious%20URL%20and%20%20IPs", "order": 2, "tag": "f735a650-8d7e-42ee-95fa-ca8122e29df4", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20URLs%20or%20IPs%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Cisco%20Firepower%20%0A2.%20Cisco%20Secure%20Firewall%20%0A3.%20Palo%20Alto%20%0A4.%20Zscaler%20%0A5.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "8e293ed1-ff03-4401-a9a3-39e7b7eb2d8a", "create_time": 1788278624.1030524, "update_time": 1788280100.5293477, "last_job_id": 0, "name": "block ip - Cisco Firepower", "action": "2989", "description": "Blocks an IP network", "type": "block ip", "app_id": 35, "asset": 38, "parameters": [{"ip": ""}]}, {"id": "0a955b4b-e637-429c-ac6f-b8baed5cc5c9", "create_time": 1788278624.1030767, "update_time": 1788280100.5293787, "last_job_id": 0, "name": "delete network object - Cisco Secure Firewall", "action": "2995", "description": "Deletes a network object in FMC", "type": "delete network object", "app_id": 37, "asset": 39, "parameters": [{"type": "", "object_id": "", "domain_name": ""}]}, {"id": "805b7d47-1625-4a45-abe3-d187d94fbdae", "create_time": 1788278624.1030996, "update_time": 1788280100.5294104, "last_job_id": 0, "name": "block ip - Panorama", "action": "2395", "description": "Block an IP", "type": "block ip", "app_id": 119, "asset": 10, "parameters": [{"ip": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "should_add_tag": false, "is_source_address": false, "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "984a01e3-f98b-4500-8e1e-1308536615c3", "create_time": 1788278624.1031215, "update_time": 1788280100.5294404, "last_job_id": 0, "name": "block url - Panorama", "action": "2391", "description": "Block an URL", "type": "block url", "app_id": 119, "asset": 10, "parameters": [{"url": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "939506af-4344-4903-8716-2c98620b1108", "create_time": 1788278624.1031427, "update_time": 1788280100.529471, "last_job_id": 0, "name": "block ip - Zscaler", "action": "2798", "description": "Block an IP", "type": "block ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "7d44cabe-dc7f-4282-9c65-982acc17af71", "create_time": 1788278624.1031644, "update_time": 1788280100.5295005, "last_job_id": 0, "name": "block url - Zscaler", "action": "2799", "description": "Block a URL", "type": "block url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}, {"id": "4972f488-4a2a-43b3-9380-67eaf963f2a3", "create_time": 1788278624.1031861, "update_time": 1788280100.5295336, "last_job_id": 0, "name": "unallow ip - Zscaler", "action": "2804", "description": "Remove an IP address from the allowlist", "type": "unallow ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "5a94c3aa-4d81-4803-9bb0-c04abf4a66fd", "create_time": 1788278624.1032078, "update_time": 1788280100.5295634, "last_job_id": 0, "name": "unallow url - Zscaler", "action": "2805", "description": "Remove a URL from the allowed list", "type": "unallow url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5b6fd766-744a-4ada-9612-9934ff090668", "create_time": 1764758755.9073257, "update_time": 1788280100.5296493, "name": "Block%20Applications%20and%20Hashes", "order": 3, "tag": "de5b8d96-bc90-47e5-a707-4b4ce273b2f5", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20applications%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Palo%20Alto/Panorama%0A2.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "4aeae82c-9dd1-40c2-a202-8c1681107ad0", "create_time": 1788278773.9890056, "update_time": 1788280100.5297146, "last_job_id": 0, "name": "block application - Panorama", "action": "2393", "description": "Block an application", "type": "block application", "app_id": 119, "asset": 10, "parameters": [{"application": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "aab34ec2-4c29-454f-a4c6-977593bb4223", "create_time": 1788278773.9890535, "update_time": 1788280100.5297453, "last_job_id": 0, "name": "block hash - Carbon Black Response", "action": "2075", "description": "Add a hash to the Carbon Black Response blacklist", "type": "block hash", "app_id": 28, "asset": 12, "parameters": [{"hash": "", "comment": ""}]}, {"id": "efce157a-05de-44a0-9068-8a89c805cabb", "create_time": 1788278773.9890966, "update_time": 1788280100.5297751, "last_job_id": 0, "name": "terminate process - Carbon Black Response", "action": "2067", "description": "Kill running processes on a machine", "type": "terminate process", "app_id": 28, "asset": 12, "parameters": [{"pid": "", "sensor_id": "", "ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c21f1448-9c99-4d7b-818e-d803780529ad", "create_time": 1788279259.257031, "update_time": 1788280100.5298517, "name": "Quarantine%20compromised%20devices%20or%20endpoints", "order": 4, "tag": "de175899-36ac-48d6-9ca4-fa1f31c46019", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20quarantine%20any%20compromised%20devices.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Crowdstrike%0A2.%20Microsoft%20Defender%20for%20Endpoint%0A3.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "306acb45-61e8-4af7-8836-7f5b23e79f13", "create_time": 1788279409.7877266, "update_time": 1788280100.5299373, "last_job_id": 0, "name": "quarantine device - CrowdStrike OAuth API", "action": "2153", "description": "Block the device", "type": "quarantine device", "app_id": 48, "asset": 19, "parameters": [{"hostname": "", "device_id": ""}]}, {"id": "8e3459f3-a1d1-4230-8461-7ef56dc5a843", "create_time": 1788279409.7877512, "update_time": 1788280100.5299702, "last_job_id": 0, "name": "quarantine device - Windows Defender ATP", "action": "2698", "description": "Quarantine the device", "type": "quarantine device", "app_id": 101, "asset": 40, "parameters": [{"type": "", "comment": "", "timeout": "", "device_id": ""}]}, {"id": "889e7a1d-0df0-43d1-81b9-46ab7359ffba", "create_time": 1788279409.7877738, "update_time": 1788280100.5300007, "last_job_id": 0, "name": "quarantine file - Windows Defender ATP", "action": "2702", "description": "Quarantine a file", "type": "quarantine file", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": "", "file_hash": ""}]}, {"id": "7b3a2d28-4942-4598-bffc-7c1f4515ec72", "create_time": 1788279409.787797, "update_time": 1788280100.530035, "last_job_id": 0, "name": "restrict app execution - Windows Defender ATP", "action": "2715", "description": "Restrict execution of all applications on the device except a predefined set", "type": "restrict app execution", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": ""}]}, {"id": "5a8eb830-4b4a-411c-993c-fc5ac42da7ef", "create_time": 1788279409.7878232, "update_time": 1788280100.5300653, "last_job_id": 0, "name": "quarantine device - Carbon Black Response", "action": "2062", "description": "Quarantine the endpoint", "type": "quarantine device", "app_id": 28, "asset": 12, "parameters": [{"ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "e2eefabb-dd45-4647-a347-b8a66c3bd2ed", "create_time": 1788279702.6294243, "update_time": 1788280100.5301492, "name": "Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens", "order": 5, "tag": "8cd82a46-eb24-4bb7-8023-34d779e4c4d2", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A1.%20MS%20Graph%20For%20Active%20Directory%20%0A2.%20AD%20LDAP%20%0A3.%20Okta%20%0A4.%20AWS%20IAM%20%0A5.%20Azure%20AD%20Graph", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0b3091e6-c58b-495c-bf1e-92fda2468d00", "create_time": 1788279702.6294713, "update_time": 1788280100.5302153, "last_job_id": 0, "name": "disable account - AD LDAP", "action": "1930", "description": "Disables an Active Directory account", "type": "disable account", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "cb9c0ef7-748d-43ea-a0a0-1ba7dbe433cc", "create_time": 1788279702.629496, "update_time": 1788280100.5302463, "last_job_id": 0, "name": "reset password - AD LDAP", "action": "1932", "description": "Resets the password of a user, requiring the user to change password at next login", "type": "reset password", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "efcd23da-9a95-4a84-927c-5a80668bf16e", "create_time": 1788279702.629519, "update_time": 1788280100.5302763, "last_job_id": 0, "name": "disable user - Azure AD Graph", "action": "2019", "description": "Disable a user", "type": "disable user", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "73978225-62b4-49d4-b779-e38a85469279", "create_time": 1788279702.6295414, "update_time": 1788280100.5303059, "last_job_id": 0, "name": "reset password - Azure AD Graph", "action": "2016", "description": "Reset or set a user's password in an Azure AD environment", "type": "reset password", "app_id": 14, "asset": 21, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}, {"id": "89d063f3-11e3-49c7-957a-b07b8b9fb141", "create_time": 1788279702.629564, "update_time": 1788280100.5303347, "last_job_id": 0, "name": "disable tokens - Azure AD Graph", "action": "2017", "description": "Invalidate all active refresh tokens for a user in an Azure AD environment", "type": "disable tokens", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "0f2fe1cc-260d-4200-b13d-bcf6aa3ec877", "create_time": 1788279702.629587, "update_time": 1788280100.5303638, "last_job_id": 0, "name": "disable user - AWS IAM", "action": "3044", "description": "Disable login profile and access keys of a user", "type": "disable user", "app_id": 6, "asset": 42, "parameters": [{"username": "", "credentials": "", "disable_access_keys": false}]}, {"id": "e3f709da-f0a0-4140-b837-109df13fbb5e", "create_time": 1788279702.629611, "update_time": 1788280100.5303931, "last_job_id": 0, "name": "disable user - Okta", "action": "2367", "description": "Disables the specified user", "type": "disable user", "app_id": 118, "asset": 13, "parameters": [{"id": ""}]}, {"id": "fac660ff-6fa7-4952-8924-46e41746cfd8", "create_time": 1788279702.6296341, "update_time": 1788280100.5304255, "last_job_id": 0, "name": "disable user - MS Graph for Active Directory", "action": "3021", "description": "Disable a user", "type": "disable user", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "7fed8e92-ceb2-44fa-9711-5a23ed3342c2", "create_time": 1788279702.6296563, "update_time": 1788280100.5304606, "last_job_id": 0, "name": "disable tokens - MS Graph for Active Directory", "action": "3019", "description": "Invalidate all active refresh tokens for a user in a Microsoft AD environment", "type": "disable tokens", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "48c0cfa5-084a-447c-9f44-cd67be2c6ddd", "create_time": 1788279702.6296782, "update_time": 1788280100.53049, "last_job_id": 0, "name": "reset password - MS Graph for Active Directory", "action": "3018", "description": "Reset or set a user's password in a Microsoft AD environment", "type": "reset password", "app_id": 89, "asset": 41, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "50452b43-98af-43ab-bfb0-1e9f7368b2c9", "create_time": 1788276680.0046902, "update_time": 1788280100.5313852, "name": "Recovery", "order": 4, "tasks": [{"id": "91a74317-f931-4ced-b4aa-6cdf54433221", "create_time": 1764758755.9079046, "update_time": 1788280100.5306091, "name": "Verify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20monitor%20for%20signs%20of%20recurrence", "order": 1, "tag": "c3c83a87-0d75-4d0a-b4e7-9fef0d60e5f4", "description": "Define%20who%20owns%20recovery%20execution,%20who%20approves%20restoration,%20and%20what%20systems/users/services%20are%20in%20scope.%20%0AVerify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20and%20monitor%20signs%20of%20recurrence.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "91f6342d-a92b-4157-a124-5e87ab0c9827", "create_time": 1764758755.9080007, "update_time": 1788280100.5307238, "name": "Complete%20incident%20documentation%20and%20lessons%20learned%20before%20closure", "order": 2, "tag": "27d8d5a5-4c1b-470c-b995-c39275b61444", "description": "Root%20Cause%20Analysis.%20%20New%20Detections,%20Visualizations,%20responses%20or%20playbooks%20to%20help%20resolve%20in%20future.%20", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5840a534-399b-4ac1-b0bc-80927edf8f8b", "create_time": 1764758755.9080942, "update_time": 1788280100.5308282, "name": "Report%20incident%20response%20status", "order": 3, "tag": "085d0c66-3bb9-48c8-9403-0fc21217d77c", "description": "Alert%20appropriate%20parties%20that%20incident%20response%20is%20complete.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "2bcf6e5e-de9b-42bd-b24c-d4cdd423cb13", "create_time": 1788279986.6035137, "update_time": 1788280100.5308995, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "393db9ae-69e9-4172-8b08-a7e59cf20aa9", "create_time": 1788279986.6035569, "update_time": 1788280100.5309548, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "d80a5892-bc25-4b3a-be22-af3620e30994", "create_time": 1788279986.6036005, "update_time": 1788280100.530988, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4d83b65b-55b8-4d55-81a0-1e7ee2e25ade", "create_time": 1788279986.6036437, "update_time": 1788280100.5310204, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "db31bdad-1648-4426-bb85-2fed1912d79d", "create_time": 1788279986.6036847, "update_time": 1788280100.5310526, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "49790c40-0d53-4598-b162-25d69c9ce19b", "create_time": 1788279986.603725, "update_time": 1788280100.5310874, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a18d484f-0600-490d-9b4c-52851cd7b767", "create_time": 1788280100.5311828, "update_time": 1788280100.5311832, "name": "Update%20and%20close%20company-wide%20awareness%20tickets%20when%20appropriate.", "order": 4, "tag": "44b218d8-0a50-47f1-a5ed-20a5c73ff522", "description": "Update%20Incident%20to%20track%20notes%20from%20the%20investigaiton.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "cc88b369-e5e6-4d63-9d88-97d985edd8f8", "create_time": 1788280100.5312567, "update_time": 1788280100.5312572, "last_job_id": 0, "name": "update ticket - ServiceNow", "action": "2473", "description": "Update ticket/record information", "type": "update ticket", "app_id": 147, "asset": 29, "parameters": [{"id": "", "table": "", "fields": "", "vault_id": "", "is_sys_id": false}]}, {"id": "99b0e0e2-2efd-4f9f-b4f4-6e68501acb3a", "create_time": 1788280100.5312977, "update_time": 1788280100.5312986, "last_job_id": 0, "name": "update ticket - Salesforce", "action": "2937", "description": "Update a Case", "type": "update ticket", "app_id": 144, "asset": 34, "parameters": [{"id": "", "status": "", "subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "cc9e1aca-7be7-4b4c-a5ff-7c4929e8dd73", "create_time": 1788280100.531338, "update_time": 1788280100.5313385, "last_job_id": 0, "name": "update ticket - Jira", "action": "2287", "description": "Update ticket (issue)", "type": "update ticket", "app_id": 80, "asset": 31, "parameters": [{"id": "", "vault_id": "", "update_fields": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}], "origin": {"id": "67fc1f68-1928-4436-8525-2957aac3a534", "name": "Generic Incident Response", "version": 4}, "template_id": "69f3e851-6e19-4ecd-ae2b-7cd558d49133", "active": true, "used": false, "ai_generated": false, "source_attachment_id": null, "_user": "nobody", "_key": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c"} \ No newline at end of file From dd57ea01535eff5721a6a53192e1c0a17e37bdb0 Mon Sep 17 00:00:00 2001 From: kbouchard <47464052+kbouchardherjavecgroup@users.noreply.github.com> Date: Thu, 1 Oct 2026 12:14:27 -0700 Subject: [PATCH 117/162] Update GenericIncidentResponse_v4.json (#4308) updated from Draft to Published. --- response_templates/GenericIncidentResponse_v4.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/response_templates/GenericIncidentResponse_v4.json b/response_templates/GenericIncidentResponse_v4.json index b2368751a94..4d0deb91728 100644 --- a/response_templates/GenericIncidentResponse_v4.json +++ b/response_templates/GenericIncidentResponse_v4.json @@ -1 +1 @@ -{"id": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c", "create_time": 1788276134.3671353, "update_time": 1788280100.5796342, "name": "Generic Incident Response", "description": "Use%20this%20as%20a%20starting%20point.%20This%20will%20guide%20you%20to%20visualizations%20and%20dashboards%20within%20Splunk%20Enterprise%20Security%20that%20you%20would%20use%20to%20research%20and%20interrogate%20different%20data%20types%20like%20Authentication,%20Endpoint%20or%20Network.%20%20The%20Suggested%20Integrations(connectors)%20are%20just%20that,%20either%20built%20into%20Splunk%20SOAR%20or%20commonly%20used%20by%20customers.%20The%20Actions%20included%20will%20need%20to%20be%20reviewed,%20removed,%20validated,%20or%20added%20based%20on%20what%20tools%20your%20organizations%20use.%20%20Before%20implementing%20be%20sure%20to%20add%20roles%20and%20approvals%20to%20ensure%20proper%20review%20occurs%20in%20the%20incident%20response%20workflow%20", "template_status": "draft", "creator": "splunker", "updated_by": "splunker", "is_default": false, "version": 4, "phases": [{"id": "c8c1bb29-a14c-4230-ba02-283f98645b90", "create_time": 1788276680.0027182, "update_time": 1788280100.5278718, "name": "Initial%20Reporting%20and%20Awareness%20", "order": 1, "tasks": [{"id": "76fd8383-b2f7-47d8-b952-49a60105c23f", "create_time": 1764758755.9055116, "update_time": 1788280100.527043, "name": "Ensure%20Investigations%20are%20mirrored%20in%20the%20core%20enterprise%20tracking%20system.", "order": 1, "tag": "69c9baf1-bd12-4b09-b6b6-a77df9428682", "description": "Open%20Incident%20to%20track%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "3ff21177-da2b-4c47-acc7-b44d4dd0dc2a", "create_time": 1788276603.7561357, "update_time": 1788280100.5271513, "last_job_id": 0, "name": "create ticket - ServiceNow", "action": "2471", "description": "Create a new ticket/record", "type": "create ticket", "app_id": 147, "asset": 29, "parameters": [{"table": "", "fields": "", "vault_id": "", "description": "", "short_description": ""}]}, {"id": "71f70831-5652-41d8-a05e-6d4c7221b81d", "create_time": 1788276680.0023613, "update_time": 1788280100.5271919, "last_job_id": 0, "name": "create ticket - Salesforce", "action": "2933", "description": "Create a new Case", "type": "create ticket", "app_id": 144, "asset": 34, "parameters": [{"subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "45052d6d-ffd0-4491-9434-af7c69b6544d", "create_time": 1788276680.0023906, "update_time": 1788280100.5272317, "last_job_id": 0, "name": "create ticket - Jira", "action": "2285", "description": "Create a ticket (issue)", "type": "create ticket", "app_id": 80, "asset": 31, "parameters": [{"fields": "", "summary": "", "assignee": "", "priority": "", "vault_id": "", "issue_type": "", "description": "", "project_key": "", "assignee_account_id": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c62f8956-c622-4c11-a664-9d68661f2df1", "create_time": 1764758755.905616, "update_time": 1788280100.5275803, "name": "Alert%20Appropriate%20Parties%20that%20Incident%20Response%20Is%20Starting", "order": 2, "tag": "8ca56a2a-f0d7-43c1-96e3-06bac95deffe", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "b7f1588d-09e9-4fe8-b72a-27c599eb2a8d", "create_time": 1788277531.9986718, "update_time": 1788280100.527657, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "70c65ce6-06b9-4fbc-9f9b-362f2f4a4817", "create_time": 1788277531.9986978, "update_time": 1788280100.5276885, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "24d8b79b-e9a5-43a3-a971-fcbf1d4f02d7", "create_time": 1788277531.998722, "update_time": 1788280100.5277174, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4ff61fec-6cb7-4dd8-9b63-ca3ea2e1a18d", "create_time": 1788277531.9987452, "update_time": 1788280100.5277452, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "5b82f7e8-0e65-46e0-916c-d0c487e5b65a", "create_time": 1788277531.9987676, "update_time": 1788280100.5277727, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "8af7ff80-2510-4ec6-aa55-d88d3406b5f8", "create_time": 1788277531.9987895, "update_time": 1788280100.5278, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "816cf263-fcdd-45d6-8f5f-f4c5c3f638bd", "create_time": 1788276680.0036306, "update_time": 1788280100.528886, "name": "Analysis", "order": 2, "tasks": [{"id": "2444a355-821e-4485-86c5-03c836cba7c5", "create_time": 1764758755.9059348, "update_time": 1788280100.5279753, "name": "Research intelligence resources", "order": 1, "tag": "595d75bb-316e-4dec-bfc6-6729d3e7b280", "description": "Review%20Intelligence%20resources%20including%20Splunk%20Attack%20Analyzer%20and%20Cisco%20Talos%20in%20the%20Intelligence%20Tab%20of%20investigation%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Splunk%20Attack%20Analyzer%0A2.%20Cisco%20Talos%20Intelligence%0A3.%20VirusTotal%20v3%0A4.%20PhishTank%20(preconfigured)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0d079a95-c063-4b33-87ba-25fe661a9ece", "create_time": 1774295034.6502967, "update_time": 1788280100.5280461, "last_job_id": 0, "name": "detonate file - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8939", "description": "Submit File for Scanning", "type": "detonate file", "app_id": 283, "asset": 23, "parameters": [{"file": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "efe8365d-975e-4aa6-a26e-6eeca46a39e4", "create_time": 1774295034.650387, "update_time": 1788280100.5280788, "last_job_id": 0, "name": "detonate url - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8940", "description": "Submit New URL for Scanning", "type": "detonate url", "app_id": 283, "asset": 23, "parameters": [{"url": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "60f5815d-8d11-490d-870c-3e174acc2cdd", "create_time": 1774295034.650461, "update_time": 1788280100.5281093, "last_job_id": 0, "name": "get job summary - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8937", "description": "Get a job summary for a submitted job", "type": "get job summary", "app_id": 283, "asset": 23, "parameters": [{"job_id": "", "timeout": ""}]}, {"id": "592359f5-15f0-405f-bd1b-94feeef818a1", "create_time": 1774295034.6505318, "update_time": 1788280100.5281377, "last_job_id": 0, "name": "domain reputation - Cisco Talos Intelligence", "action": "7850", "description": "Query domain info", "type": "domain reputation", "app_id": 61, "asset": 11, "parameters": [{"domain": ""}]}, {"id": "28f35544-23b8-4302-89ff-6ca0004c1809", "create_time": 1774295034.6506045, "update_time": 1788280100.5281668, "last_job_id": 0, "name": "ip reputation - Cisco Talos Intelligence", "action": "7849", "description": "Query IP info", "type": "ip reputation", "app_id": 61, "asset": 11, "parameters": [{"ip": ""}]}, {"id": "e970c5c0-d3f1-4f83-9cc7-a640ac3573ba", "create_time": 1774295034.6506772, "update_time": 1788280100.5281966, "last_job_id": 0, "name": "url reputation - Cisco Talos Intelligence", "action": "7851", "description": "Query URL info", "type": "url reputation", "app_id": 61, "asset": 11, "parameters": [{"url": ""}]}, {"id": "4fdc630a-1b12-4391-b43d-cdd2e203cdb9", "create_time": 1774295034.6507487, "update_time": 1788280100.5282252, "last_job_id": 0, "name": "domain reputation - VirusTotal v3", "action": "8999", "description": "Queries VirusTotal for domain info", "type": "domain reputation", "app_id": 323, "asset": 28, "parameters": [{"domain": ""}]}, {"id": "4ad7addc-85f1-423f-bbb3-127b419e5e4f", "create_time": 1774295034.65084, "update_time": 1788280100.5282538, "last_job_id": 0, "name": "file reputation - VirusTotal v3", "action": "9000", "description": "Queries VirusTotal for file reputation info", "type": "file reputation", "app_id": 323, "asset": 28, "parameters": [{"hash": ""}]}, {"id": "eda133de-bca5-4dfc-adb7-80c32b26a9af", "create_time": 1774295034.6509123, "update_time": 1788280100.5282822, "last_job_id": 0, "name": "ip reputation - VirusTotal v3", "action": "9002", "description": "Queries VirusTotal for IP info", "type": "ip reputation", "app_id": 323, "asset": 28, "parameters": [{"ip": ""}]}, {"id": "61ad9c71-2ac1-4ca6-93a8-2b6fac2bc23e", "create_time": 1774295034.650983, "update_time": 1788280100.5283108, "last_job_id": 0, "name": "url reputation - VirusTotal v3", "action": "9003", "description": "Queries VirusTotal for URL info (run this action after running detonate url)", "type": "url reputation", "app_id": 323, "asset": 28, "parameters": [{"url": ""}]}, {"id": "4d492999-a2cf-4f01-90c8-3c02ffc1074f", "create_time": 1774295034.6510537, "update_time": 1788280100.5283384, "last_job_id": 0, "name": "detonate file - VirusTotal v3", "action": "9005", "description": "Upload a file to Virus Total and retrieve the analysis results", "type": "detonate file", "app_id": 323, "asset": 28, "parameters": [{"vault_id": "", "wait_time": ""}]}, {"id": "b469d96c-f7d1-458e-b12a-b2e6024ef6ba", "create_time": 1774295034.6511242, "update_time": 1788280100.5283694, "last_job_id": 0, "name": "detonate url - VirusTotal v3", "action": "9004", "description": "Load a URL to Virus Total and retrieve analysis results", "type": "detonate url", "app_id": 323, "asset": 28, "parameters": [{"url": "", "wait_time": ""}]}, {"id": "dce78a62-bcde-499a-94dd-95f738db943a", "create_time": 1774295034.651194, "update_time": 1788280100.528398, "last_job_id": 0, "name": "url reputation - PhishTank", "action": "8902", "description": "Queries PhishTank for URL's phishing reputation", "type": "url reputation", "app_id": 225, "asset": 3, "parameters": [{"url": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a947eacc-04e3-485e-bac4-6566e85df173", "create_time": 1764758755.9060266, "update_time": 1788280100.5284767, "name": "Research%20Network%20and%20Traffic%20logs%20", "order": 2, "tag": "7586c74e-6844-45bb-9535-4924752ff0de", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0A%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BWeb%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/web_center)%0A2.%20%5BTraffic%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_center)%0A3.%20%5BTraffic%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_search)%0A4.%20%5BTraffic%20Size%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_size_analysis)%0A5.%20%5BPort%20and%20Protocol%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/port_protocol_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "bfa0b1ad-7bb1-484d-bcfa-16df7989518c", "create_time": 1764758755.906122, "update_time": 1788280100.528601, "name": "Research%20Authentication%20Behavior", "order": 3, "tag": "5f7e4c57-343a-4a5c-8c90-643bdb578dbb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)%0A2.%20%5BAccess%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_center)%0A3.%20%5BAccount%20Management%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/account_management)%0A4.%20%5BAccess%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "0168209e-eb24-4a5a-b72a-7c074a96a19c", "create_time": 1764758755.906265, "update_time": 1788280100.5287104, "name": "Research%20OS%20%20and%20Endpoint%20Logs", "order": 4, "tag": "357d8065-7af2-4968-a52e-1daba8d36bcb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BEndpoint%20Changes%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/endpoint_changes)%0A2.%20%5BMalware%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_center)%0A3.%20%5BMalware%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_search)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a16d098a-10a7-4b53-a798-fd83c467ddb6", "create_time": 1764758755.9069023, "update_time": 1788280100.528816, "name": "Determine%20full%20impact", "order": 5, "tag": "2419ca1b-fa9e-4443-8334-4642877218c4", "description": "Determine%20and%20Document%20Initial%20Infection%20vectors,%20attack%20targets,%20attacker%20sources,%20infected%20devices,%20compromised%20users.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "1cfc9549-b74f-4dfd-b1c5-956b1587e546", "create_time": 1788276680.0043044, "update_time": 1788280100.530551, "name": "Containment", "order": 3, "tasks": [{"id": "91691144-6812-44e7-ae84-769b7c91778f", "create_time": 1764758755.9071276, "update_time": 1788280100.5289705, "name": "Alert%20Appropriate%20Parties%20of%20evidence%20found%20and%20recommended%20next%20actions", "order": 1, "tag": "fa5fbdd4-4224-460f-80b1-081083c3a8e5", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "79483e20-2181-4940-8225-94c2d222e631", "create_time": 1788278442.8867176, "update_time": 1788280100.5290368, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "29954e34-f374-48b8-ac1d-ed2d53750ff5", "create_time": 1788278442.886742, "update_time": 1788280100.5290687, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "5acb959b-9bf7-4213-9ca4-0237a9191d61", "create_time": 1788278442.8867648, "update_time": 1788280100.5290997, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "f0239d21-9be0-4768-9971-cb03a109fb8c", "create_time": 1788278442.8867874, "update_time": 1788280100.5291348, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "2a6dc7f4-2326-4ca4-b9c3-e824c14e735e", "create_time": 1788278442.8868096, "update_time": 1788280100.529166, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "ac4ad54a-6826-4758-bd4b-7ea9366d1811", "create_time": 1788278442.8868325, "update_time": 1788280100.5291967, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "884da2c4-4fb8-494f-bd5a-2c0eacb81646", "create_time": 1764758755.9072351, "update_time": 1788280100.5292842, "name": "Block%20Malicious%20URL%20and%20%20IPs", "order": 2, "tag": "f735a650-8d7e-42ee-95fa-ca8122e29df4", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20URLs%20or%20IPs%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Cisco%20Firepower%20%0A2.%20Cisco%20Secure%20Firewall%20%0A3.%20Palo%20Alto%20%0A4.%20Zscaler%20%0A5.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "8e293ed1-ff03-4401-a9a3-39e7b7eb2d8a", "create_time": 1788278624.1030524, "update_time": 1788280100.5293477, "last_job_id": 0, "name": "block ip - Cisco Firepower", "action": "2989", "description": "Blocks an IP network", "type": "block ip", "app_id": 35, "asset": 38, "parameters": [{"ip": ""}]}, {"id": "0a955b4b-e637-429c-ac6f-b8baed5cc5c9", "create_time": 1788278624.1030767, "update_time": 1788280100.5293787, "last_job_id": 0, "name": "delete network object - Cisco Secure Firewall", "action": "2995", "description": "Deletes a network object in FMC", "type": "delete network object", "app_id": 37, "asset": 39, "parameters": [{"type": "", "object_id": "", "domain_name": ""}]}, {"id": "805b7d47-1625-4a45-abe3-d187d94fbdae", "create_time": 1788278624.1030996, "update_time": 1788280100.5294104, "last_job_id": 0, "name": "block ip - Panorama", "action": "2395", "description": "Block an IP", "type": "block ip", "app_id": 119, "asset": 10, "parameters": [{"ip": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "should_add_tag": false, "is_source_address": false, "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "984a01e3-f98b-4500-8e1e-1308536615c3", "create_time": 1788278624.1031215, "update_time": 1788280100.5294404, "last_job_id": 0, "name": "block url - Panorama", "action": "2391", "description": "Block an URL", "type": "block url", "app_id": 119, "asset": 10, "parameters": [{"url": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "939506af-4344-4903-8716-2c98620b1108", "create_time": 1788278624.1031427, "update_time": 1788280100.529471, "last_job_id": 0, "name": "block ip - Zscaler", "action": "2798", "description": "Block an IP", "type": "block ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "7d44cabe-dc7f-4282-9c65-982acc17af71", "create_time": 1788278624.1031644, "update_time": 1788280100.5295005, "last_job_id": 0, "name": "block url - Zscaler", "action": "2799", "description": "Block a URL", "type": "block url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}, {"id": "4972f488-4a2a-43b3-9380-67eaf963f2a3", "create_time": 1788278624.1031861, "update_time": 1788280100.5295336, "last_job_id": 0, "name": "unallow ip - Zscaler", "action": "2804", "description": "Remove an IP address from the allowlist", "type": "unallow ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "5a94c3aa-4d81-4803-9bb0-c04abf4a66fd", "create_time": 1788278624.1032078, "update_time": 1788280100.5295634, "last_job_id": 0, "name": "unallow url - Zscaler", "action": "2805", "description": "Remove a URL from the allowed list", "type": "unallow url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5b6fd766-744a-4ada-9612-9934ff090668", "create_time": 1764758755.9073257, "update_time": 1788280100.5296493, "name": "Block%20Applications%20and%20Hashes", "order": 3, "tag": "de5b8d96-bc90-47e5-a707-4b4ce273b2f5", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20applications%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Palo%20Alto/Panorama%0A2.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "4aeae82c-9dd1-40c2-a202-8c1681107ad0", "create_time": 1788278773.9890056, "update_time": 1788280100.5297146, "last_job_id": 0, "name": "block application - Panorama", "action": "2393", "description": "Block an application", "type": "block application", "app_id": 119, "asset": 10, "parameters": [{"application": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "aab34ec2-4c29-454f-a4c6-977593bb4223", "create_time": 1788278773.9890535, "update_time": 1788280100.5297453, "last_job_id": 0, "name": "block hash - Carbon Black Response", "action": "2075", "description": "Add a hash to the Carbon Black Response blacklist", "type": "block hash", "app_id": 28, "asset": 12, "parameters": [{"hash": "", "comment": ""}]}, {"id": "efce157a-05de-44a0-9068-8a89c805cabb", "create_time": 1788278773.9890966, "update_time": 1788280100.5297751, "last_job_id": 0, "name": "terminate process - Carbon Black Response", "action": "2067", "description": "Kill running processes on a machine", "type": "terminate process", "app_id": 28, "asset": 12, "parameters": [{"pid": "", "sensor_id": "", "ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c21f1448-9c99-4d7b-818e-d803780529ad", "create_time": 1788279259.257031, "update_time": 1788280100.5298517, "name": "Quarantine%20compromised%20devices%20or%20endpoints", "order": 4, "tag": "de175899-36ac-48d6-9ca4-fa1f31c46019", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20quarantine%20any%20compromised%20devices.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Crowdstrike%0A2.%20Microsoft%20Defender%20for%20Endpoint%0A3.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "306acb45-61e8-4af7-8836-7f5b23e79f13", "create_time": 1788279409.7877266, "update_time": 1788280100.5299373, "last_job_id": 0, "name": "quarantine device - CrowdStrike OAuth API", "action": "2153", "description": "Block the device", "type": "quarantine device", "app_id": 48, "asset": 19, "parameters": [{"hostname": "", "device_id": ""}]}, {"id": "8e3459f3-a1d1-4230-8461-7ef56dc5a843", "create_time": 1788279409.7877512, "update_time": 1788280100.5299702, "last_job_id": 0, "name": "quarantine device - Windows Defender ATP", "action": "2698", "description": "Quarantine the device", "type": "quarantine device", "app_id": 101, "asset": 40, "parameters": [{"type": "", "comment": "", "timeout": "", "device_id": ""}]}, {"id": "889e7a1d-0df0-43d1-81b9-46ab7359ffba", "create_time": 1788279409.7877738, "update_time": 1788280100.5300007, "last_job_id": 0, "name": "quarantine file - Windows Defender ATP", "action": "2702", "description": "Quarantine a file", "type": "quarantine file", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": "", "file_hash": ""}]}, {"id": "7b3a2d28-4942-4598-bffc-7c1f4515ec72", "create_time": 1788279409.787797, "update_time": 1788280100.530035, "last_job_id": 0, "name": "restrict app execution - Windows Defender ATP", "action": "2715", "description": "Restrict execution of all applications on the device except a predefined set", "type": "restrict app execution", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": ""}]}, {"id": "5a8eb830-4b4a-411c-993c-fc5ac42da7ef", "create_time": 1788279409.7878232, "update_time": 1788280100.5300653, "last_job_id": 0, "name": "quarantine device - Carbon Black Response", "action": "2062", "description": "Quarantine the endpoint", "type": "quarantine device", "app_id": 28, "asset": 12, "parameters": [{"ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "e2eefabb-dd45-4647-a347-b8a66c3bd2ed", "create_time": 1788279702.6294243, "update_time": 1788280100.5301492, "name": "Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens", "order": 5, "tag": "8cd82a46-eb24-4bb7-8023-34d779e4c4d2", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A1.%20MS%20Graph%20For%20Active%20Directory%20%0A2.%20AD%20LDAP%20%0A3.%20Okta%20%0A4.%20AWS%20IAM%20%0A5.%20Azure%20AD%20Graph", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0b3091e6-c58b-495c-bf1e-92fda2468d00", "create_time": 1788279702.6294713, "update_time": 1788280100.5302153, "last_job_id": 0, "name": "disable account - AD LDAP", "action": "1930", "description": "Disables an Active Directory account", "type": "disable account", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "cb9c0ef7-748d-43ea-a0a0-1ba7dbe433cc", "create_time": 1788279702.629496, "update_time": 1788280100.5302463, "last_job_id": 0, "name": "reset password - AD LDAP", "action": "1932", "description": "Resets the password of a user, requiring the user to change password at next login", "type": "reset password", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "efcd23da-9a95-4a84-927c-5a80668bf16e", "create_time": 1788279702.629519, "update_time": 1788280100.5302763, "last_job_id": 0, "name": "disable user - Azure AD Graph", "action": "2019", "description": "Disable a user", "type": "disable user", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "73978225-62b4-49d4-b779-e38a85469279", "create_time": 1788279702.6295414, "update_time": 1788280100.5303059, "last_job_id": 0, "name": "reset password - Azure AD Graph", "action": "2016", "description": "Reset or set a user's password in an Azure AD environment", "type": "reset password", "app_id": 14, "asset": 21, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}, {"id": "89d063f3-11e3-49c7-957a-b07b8b9fb141", "create_time": 1788279702.629564, "update_time": 1788280100.5303347, "last_job_id": 0, "name": "disable tokens - Azure AD Graph", "action": "2017", "description": "Invalidate all active refresh tokens for a user in an Azure AD environment", "type": "disable tokens", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "0f2fe1cc-260d-4200-b13d-bcf6aa3ec877", "create_time": 1788279702.629587, "update_time": 1788280100.5303638, "last_job_id": 0, "name": "disable user - AWS IAM", "action": "3044", "description": "Disable login profile and access keys of a user", "type": "disable user", "app_id": 6, "asset": 42, "parameters": [{"username": "", "credentials": "", "disable_access_keys": false}]}, {"id": "e3f709da-f0a0-4140-b837-109df13fbb5e", "create_time": 1788279702.629611, "update_time": 1788280100.5303931, "last_job_id": 0, "name": "disable user - Okta", "action": "2367", "description": "Disables the specified user", "type": "disable user", "app_id": 118, "asset": 13, "parameters": [{"id": ""}]}, {"id": "fac660ff-6fa7-4952-8924-46e41746cfd8", "create_time": 1788279702.6296341, "update_time": 1788280100.5304255, "last_job_id": 0, "name": "disable user - MS Graph for Active Directory", "action": "3021", "description": "Disable a user", "type": "disable user", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "7fed8e92-ceb2-44fa-9711-5a23ed3342c2", "create_time": 1788279702.6296563, "update_time": 1788280100.5304606, "last_job_id": 0, "name": "disable tokens - MS Graph for Active Directory", "action": "3019", "description": "Invalidate all active refresh tokens for a user in a Microsoft AD environment", "type": "disable tokens", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "48c0cfa5-084a-447c-9f44-cd67be2c6ddd", "create_time": 1788279702.6296782, "update_time": 1788280100.53049, "last_job_id": 0, "name": "reset password - MS Graph for Active Directory", "action": "3018", "description": "Reset or set a user's password in a Microsoft AD environment", "type": "reset password", "app_id": 89, "asset": 41, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "50452b43-98af-43ab-bfb0-1e9f7368b2c9", "create_time": 1788276680.0046902, "update_time": 1788280100.5313852, "name": "Recovery", "order": 4, "tasks": [{"id": "91a74317-f931-4ced-b4aa-6cdf54433221", "create_time": 1764758755.9079046, "update_time": 1788280100.5306091, "name": "Verify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20monitor%20for%20signs%20of%20recurrence", "order": 1, "tag": "c3c83a87-0d75-4d0a-b4e7-9fef0d60e5f4", "description": "Define%20who%20owns%20recovery%20execution,%20who%20approves%20restoration,%20and%20what%20systems/users/services%20are%20in%20scope.%20%0AVerify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20and%20monitor%20signs%20of%20recurrence.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "91f6342d-a92b-4157-a124-5e87ab0c9827", "create_time": 1764758755.9080007, "update_time": 1788280100.5307238, "name": "Complete%20incident%20documentation%20and%20lessons%20learned%20before%20closure", "order": 2, "tag": "27d8d5a5-4c1b-470c-b995-c39275b61444", "description": "Root%20Cause%20Analysis.%20%20New%20Detections,%20Visualizations,%20responses%20or%20playbooks%20to%20help%20resolve%20in%20future.%20", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5840a534-399b-4ac1-b0bc-80927edf8f8b", "create_time": 1764758755.9080942, "update_time": 1788280100.5308282, "name": "Report%20incident%20response%20status", "order": 3, "tag": "085d0c66-3bb9-48c8-9403-0fc21217d77c", "description": "Alert%20appropriate%20parties%20that%20incident%20response%20is%20complete.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "2bcf6e5e-de9b-42bd-b24c-d4cdd423cb13", "create_time": 1788279986.6035137, "update_time": 1788280100.5308995, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "393db9ae-69e9-4172-8b08-a7e59cf20aa9", "create_time": 1788279986.6035569, "update_time": 1788280100.5309548, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "d80a5892-bc25-4b3a-be22-af3620e30994", "create_time": 1788279986.6036005, "update_time": 1788280100.530988, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4d83b65b-55b8-4d55-81a0-1e7ee2e25ade", "create_time": 1788279986.6036437, "update_time": 1788280100.5310204, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "db31bdad-1648-4426-bb85-2fed1912d79d", "create_time": 1788279986.6036847, "update_time": 1788280100.5310526, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "49790c40-0d53-4598-b162-25d69c9ce19b", "create_time": 1788279986.603725, "update_time": 1788280100.5310874, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a18d484f-0600-490d-9b4c-52851cd7b767", "create_time": 1788280100.5311828, "update_time": 1788280100.5311832, "name": "Update%20and%20close%20company-wide%20awareness%20tickets%20when%20appropriate.", "order": 4, "tag": "44b218d8-0a50-47f1-a5ed-20a5c73ff522", "description": "Update%20Incident%20to%20track%20notes%20from%20the%20investigaiton.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "cc88b369-e5e6-4d63-9d88-97d985edd8f8", "create_time": 1788280100.5312567, "update_time": 1788280100.5312572, "last_job_id": 0, "name": "update ticket - ServiceNow", "action": "2473", "description": "Update ticket/record information", "type": "update ticket", "app_id": 147, "asset": 29, "parameters": [{"id": "", "table": "", "fields": "", "vault_id": "", "is_sys_id": false}]}, {"id": "99b0e0e2-2efd-4f9f-b4f4-6e68501acb3a", "create_time": 1788280100.5312977, "update_time": 1788280100.5312986, "last_job_id": 0, "name": "update ticket - Salesforce", "action": "2937", "description": "Update a Case", "type": "update ticket", "app_id": 144, "asset": 34, "parameters": [{"id": "", "status": "", "subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "cc9e1aca-7be7-4b4c-a5ff-7c4929e8dd73", "create_time": 1788280100.531338, "update_time": 1788280100.5313385, "last_job_id": 0, "name": "update ticket - Jira", "action": "2287", "description": "Update ticket (issue)", "type": "update ticket", "app_id": 80, "asset": 31, "parameters": [{"id": "", "vault_id": "", "update_fields": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}], "origin": {"id": "67fc1f68-1928-4436-8525-2957aac3a534", "name": "Generic Incident Response", "version": 4}, "template_id": "69f3e851-6e19-4ecd-ae2b-7cd558d49133", "active": true, "used": false, "ai_generated": false, "source_attachment_id": null, "_user": "nobody", "_key": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c"} \ No newline at end of file +{"id": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c", "create_time": 1788276134.3671353, "update_time": 1788280100.5796342, "name": "Generic Incident Response", "description": "Use%20this%20as%20a%20starting%20point.%20This%20will%20guide%20you%20to%20visualizations%20and%20dashboards%20within%20Splunk%20Enterprise%20Security%20that%20you%20would%20use%20to%20research%20and%20interrogate%20different%20data%20types%20like%20Authentication,%20Endpoint%20or%20Network.%20%20The%20Suggested%20Integrations(connectors)%20are%20just%20that,%20either%20built%20into%20Splunk%20SOAR%20or%20commonly%20used%20by%20customers.%20The%20Actions%20included%20will%20need%20to%20be%20reviewed,%20removed,%20validated,%20or%20added%20based%20on%20what%20tools%20your%20organizations%20use.%20%20Before%20implementing%20be%20sure%20to%20add%20roles%20and%20approvals%20to%20ensure%20proper%20review%20occurs%20in%20the%20incident%20response%20workflow%20", "template_status": "published", "creator": "splunker", "updated_by": "splunker", "is_default": false, "version": 4, "phases": [{"id": "c8c1bb29-a14c-4230-ba02-283f98645b90", "create_time": 1788276680.0027182, "update_time": 1788280100.5278718, "name": "Initial%20Reporting%20and%20Awareness%20", "order": 1, "tasks": [{"id": "76fd8383-b2f7-47d8-b952-49a60105c23f", "create_time": 1764758755.9055116, "update_time": 1788280100.527043, "name": "Ensure%20Investigations%20are%20mirrored%20in%20the%20core%20enterprise%20tracking%20system.", "order": 1, "tag": "69c9baf1-bd12-4b09-b6b6-a77df9428682", "description": "Open%20Incident%20to%20track%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "3ff21177-da2b-4c47-acc7-b44d4dd0dc2a", "create_time": 1788276603.7561357, "update_time": 1788280100.5271513, "last_job_id": 0, "name": "create ticket - ServiceNow", "action": "2471", "description": "Create a new ticket/record", "type": "create ticket", "app_id": 147, "asset": 29, "parameters": [{"table": "", "fields": "", "vault_id": "", "description": "", "short_description": ""}]}, {"id": "71f70831-5652-41d8-a05e-6d4c7221b81d", "create_time": 1788276680.0023613, "update_time": 1788280100.5271919, "last_job_id": 0, "name": "create ticket - Salesforce", "action": "2933", "description": "Create a new Case", "type": "create ticket", "app_id": 144, "asset": 34, "parameters": [{"subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "45052d6d-ffd0-4491-9434-af7c69b6544d", "create_time": 1788276680.0023906, "update_time": 1788280100.5272317, "last_job_id": 0, "name": "create ticket - Jira", "action": "2285", "description": "Create a ticket (issue)", "type": "create ticket", "app_id": 80, "asset": 31, "parameters": [{"fields": "", "summary": "", "assignee": "", "priority": "", "vault_id": "", "issue_type": "", "description": "", "project_key": "", "assignee_account_id": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c62f8956-c622-4c11-a664-9d68661f2df1", "create_time": 1764758755.905616, "update_time": 1788280100.5275803, "name": "Alert%20Appropriate%20Parties%20that%20Incident%20Response%20Is%20Starting", "order": 2, "tag": "8ca56a2a-f0d7-43c1-96e3-06bac95deffe", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "b7f1588d-09e9-4fe8-b72a-27c599eb2a8d", "create_time": 1788277531.9986718, "update_time": 1788280100.527657, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "70c65ce6-06b9-4fbc-9f9b-362f2f4a4817", "create_time": 1788277531.9986978, "update_time": 1788280100.5276885, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "24d8b79b-e9a5-43a3-a971-fcbf1d4f02d7", "create_time": 1788277531.998722, "update_time": 1788280100.5277174, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4ff61fec-6cb7-4dd8-9b63-ca3ea2e1a18d", "create_time": 1788277531.9987452, "update_time": 1788280100.5277452, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "5b82f7e8-0e65-46e0-916c-d0c487e5b65a", "create_time": 1788277531.9987676, "update_time": 1788280100.5277727, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "8af7ff80-2510-4ec6-aa55-d88d3406b5f8", "create_time": 1788277531.9987895, "update_time": 1788280100.5278, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "816cf263-fcdd-45d6-8f5f-f4c5c3f638bd", "create_time": 1788276680.0036306, "update_time": 1788280100.528886, "name": "Analysis", "order": 2, "tasks": [{"id": "2444a355-821e-4485-86c5-03c836cba7c5", "create_time": 1764758755.9059348, "update_time": 1788280100.5279753, "name": "Research intelligence resources", "order": 1, "tag": "595d75bb-316e-4dec-bfc6-6729d3e7b280", "description": "Review%20Intelligence%20resources%20including%20Splunk%20Attack%20Analyzer%20and%20Cisco%20Talos%20in%20the%20Intelligence%20Tab%20of%20investigation%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Splunk%20Attack%20Analyzer%0A2.%20Cisco%20Talos%20Intelligence%0A3.%20VirusTotal%20v3%0A4.%20PhishTank%20(preconfigured)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0d079a95-c063-4b33-87ba-25fe661a9ece", "create_time": 1774295034.6502967, "update_time": 1788280100.5280461, "last_job_id": 0, "name": "detonate file - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8939", "description": "Submit File for Scanning", "type": "detonate file", "app_id": 283, "asset": 23, "parameters": [{"file": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "efe8365d-975e-4aa6-a26e-6eeca46a39e4", "create_time": 1774295034.650387, "update_time": 1788280100.5280788, "last_job_id": 0, "name": "detonate url - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8940", "description": "Submit New URL for Scanning", "type": "detonate url", "app_id": 283, "asset": 23, "parameters": [{"url": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "60f5815d-8d11-490d-870c-3e174acc2cdd", "create_time": 1774295034.650461, "update_time": 1788280100.5281093, "last_job_id": 0, "name": "get job summary - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8937", "description": "Get a job summary for a submitted job", "type": "get job summary", "app_id": 283, "asset": 23, "parameters": [{"job_id": "", "timeout": ""}]}, {"id": "592359f5-15f0-405f-bd1b-94feeef818a1", "create_time": 1774295034.6505318, "update_time": 1788280100.5281377, "last_job_id": 0, "name": "domain reputation - Cisco Talos Intelligence", "action": "7850", "description": "Query domain info", "type": "domain reputation", "app_id": 61, "asset": 11, "parameters": [{"domain": ""}]}, {"id": "28f35544-23b8-4302-89ff-6ca0004c1809", "create_time": 1774295034.6506045, "update_time": 1788280100.5281668, "last_job_id": 0, "name": "ip reputation - Cisco Talos Intelligence", "action": "7849", "description": "Query IP info", "type": "ip reputation", "app_id": 61, "asset": 11, "parameters": [{"ip": ""}]}, {"id": "e970c5c0-d3f1-4f83-9cc7-a640ac3573ba", "create_time": 1774295034.6506772, "update_time": 1788280100.5281966, "last_job_id": 0, "name": "url reputation - Cisco Talos Intelligence", "action": "7851", "description": "Query URL info", "type": "url reputation", "app_id": 61, "asset": 11, "parameters": [{"url": ""}]}, {"id": "4fdc630a-1b12-4391-b43d-cdd2e203cdb9", "create_time": 1774295034.6507487, "update_time": 1788280100.5282252, "last_job_id": 0, "name": "domain reputation - VirusTotal v3", "action": "8999", "description": "Queries VirusTotal for domain info", "type": "domain reputation", "app_id": 323, "asset": 28, "parameters": [{"domain": ""}]}, {"id": "4ad7addc-85f1-423f-bbb3-127b419e5e4f", "create_time": 1774295034.65084, "update_time": 1788280100.5282538, "last_job_id": 0, "name": "file reputation - VirusTotal v3", "action": "9000", "description": "Queries VirusTotal for file reputation info", "type": "file reputation", "app_id": 323, "asset": 28, "parameters": [{"hash": ""}]}, {"id": "eda133de-bca5-4dfc-adb7-80c32b26a9af", "create_time": 1774295034.6509123, "update_time": 1788280100.5282822, "last_job_id": 0, "name": "ip reputation - VirusTotal v3", "action": "9002", "description": "Queries VirusTotal for IP info", "type": "ip reputation", "app_id": 323, "asset": 28, "parameters": [{"ip": ""}]}, {"id": "61ad9c71-2ac1-4ca6-93a8-2b6fac2bc23e", "create_time": 1774295034.650983, "update_time": 1788280100.5283108, "last_job_id": 0, "name": "url reputation - VirusTotal v3", "action": "9003", "description": "Queries VirusTotal for URL info (run this action after running detonate url)", "type": "url reputation", "app_id": 323, "asset": 28, "parameters": [{"url": ""}]}, {"id": "4d492999-a2cf-4f01-90c8-3c02ffc1074f", "create_time": 1774295034.6510537, "update_time": 1788280100.5283384, "last_job_id": 0, "name": "detonate file - VirusTotal v3", "action": "9005", "description": "Upload a file to Virus Total and retrieve the analysis results", "type": "detonate file", "app_id": 323, "asset": 28, "parameters": [{"vault_id": "", "wait_time": ""}]}, {"id": "b469d96c-f7d1-458e-b12a-b2e6024ef6ba", "create_time": 1774295034.6511242, "update_time": 1788280100.5283694, "last_job_id": 0, "name": "detonate url - VirusTotal v3", "action": "9004", "description": "Load a URL to Virus Total and retrieve analysis results", "type": "detonate url", "app_id": 323, "asset": 28, "parameters": [{"url": "", "wait_time": ""}]}, {"id": "dce78a62-bcde-499a-94dd-95f738db943a", "create_time": 1774295034.651194, "update_time": 1788280100.528398, "last_job_id": 0, "name": "url reputation - PhishTank", "action": "8902", "description": "Queries PhishTank for URL's phishing reputation", "type": "url reputation", "app_id": 225, "asset": 3, "parameters": [{"url": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a947eacc-04e3-485e-bac4-6566e85df173", "create_time": 1764758755.9060266, "update_time": 1788280100.5284767, "name": "Research%20Network%20and%20Traffic%20logs%20", "order": 2, "tag": "7586c74e-6844-45bb-9535-4924752ff0de", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0A%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BWeb%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/web_center)%0A2.%20%5BTraffic%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_center)%0A3.%20%5BTraffic%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_search)%0A4.%20%5BTraffic%20Size%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_size_analysis)%0A5.%20%5BPort%20and%20Protocol%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/port_protocol_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "bfa0b1ad-7bb1-484d-bcfa-16df7989518c", "create_time": 1764758755.906122, "update_time": 1788280100.528601, "name": "Research%20Authentication%20Behavior", "order": 3, "tag": "5f7e4c57-343a-4a5c-8c90-643bdb578dbb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)%0A2.%20%5BAccess%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_center)%0A3.%20%5BAccount%20Management%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/account_management)%0A4.%20%5BAccess%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "0168209e-eb24-4a5a-b72a-7c074a96a19c", "create_time": 1764758755.906265, "update_time": 1788280100.5287104, "name": "Research%20OS%20%20and%20Endpoint%20Logs", "order": 4, "tag": "357d8065-7af2-4968-a52e-1daba8d36bcb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BEndpoint%20Changes%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/endpoint_changes)%0A2.%20%5BMalware%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_center)%0A3.%20%5BMalware%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_search)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a16d098a-10a7-4b53-a798-fd83c467ddb6", "create_time": 1764758755.9069023, "update_time": 1788280100.528816, "name": "Determine%20full%20impact", "order": 5, "tag": "2419ca1b-fa9e-4443-8334-4642877218c4", "description": "Determine%20and%20Document%20Initial%20Infection%20vectors,%20attack%20targets,%20attacker%20sources,%20infected%20devices,%20compromised%20users.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "1cfc9549-b74f-4dfd-b1c5-956b1587e546", "create_time": 1788276680.0043044, "update_time": 1788280100.530551, "name": "Containment", "order": 3, "tasks": [{"id": "91691144-6812-44e7-ae84-769b7c91778f", "create_time": 1764758755.9071276, "update_time": 1788280100.5289705, "name": "Alert%20Appropriate%20Parties%20of%20evidence%20found%20and%20recommended%20next%20actions", "order": 1, "tag": "fa5fbdd4-4224-460f-80b1-081083c3a8e5", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "79483e20-2181-4940-8225-94c2d222e631", "create_time": 1788278442.8867176, "update_time": 1788280100.5290368, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "29954e34-f374-48b8-ac1d-ed2d53750ff5", "create_time": 1788278442.886742, "update_time": 1788280100.5290687, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "5acb959b-9bf7-4213-9ca4-0237a9191d61", "create_time": 1788278442.8867648, "update_time": 1788280100.5290997, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "f0239d21-9be0-4768-9971-cb03a109fb8c", "create_time": 1788278442.8867874, "update_time": 1788280100.5291348, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "2a6dc7f4-2326-4ca4-b9c3-e824c14e735e", "create_time": 1788278442.8868096, "update_time": 1788280100.529166, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "ac4ad54a-6826-4758-bd4b-7ea9366d1811", "create_time": 1788278442.8868325, "update_time": 1788280100.5291967, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "884da2c4-4fb8-494f-bd5a-2c0eacb81646", "create_time": 1764758755.9072351, "update_time": 1788280100.5292842, "name": "Block%20Malicious%20URL%20and%20%20IPs", "order": 2, "tag": "f735a650-8d7e-42ee-95fa-ca8122e29df4", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20URLs%20or%20IPs%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Cisco%20Firepower%20%0A2.%20Cisco%20Secure%20Firewall%20%0A3.%20Palo%20Alto%20%0A4.%20Zscaler%20%0A5.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "8e293ed1-ff03-4401-a9a3-39e7b7eb2d8a", "create_time": 1788278624.1030524, "update_time": 1788280100.5293477, "last_job_id": 0, "name": "block ip - Cisco Firepower", "action": "2989", "description": "Blocks an IP network", "type": "block ip", "app_id": 35, "asset": 38, "parameters": [{"ip": ""}]}, {"id": "0a955b4b-e637-429c-ac6f-b8baed5cc5c9", "create_time": 1788278624.1030767, "update_time": 1788280100.5293787, "last_job_id": 0, "name": "delete network object - Cisco Secure Firewall", "action": "2995", "description": "Deletes a network object in FMC", "type": "delete network object", "app_id": 37, "asset": 39, "parameters": [{"type": "", "object_id": "", "domain_name": ""}]}, {"id": "805b7d47-1625-4a45-abe3-d187d94fbdae", "create_time": 1788278624.1030996, "update_time": 1788280100.5294104, "last_job_id": 0, "name": "block ip - Panorama", "action": "2395", "description": "Block an IP", "type": "block ip", "app_id": 119, "asset": 10, "parameters": [{"ip": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "should_add_tag": false, "is_source_address": false, "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "984a01e3-f98b-4500-8e1e-1308536615c3", "create_time": 1788278624.1031215, "update_time": 1788280100.5294404, "last_job_id": 0, "name": "block url - Panorama", "action": "2391", "description": "Block an URL", "type": "block url", "app_id": 119, "asset": 10, "parameters": [{"url": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "939506af-4344-4903-8716-2c98620b1108", "create_time": 1788278624.1031427, "update_time": 1788280100.529471, "last_job_id": 0, "name": "block ip - Zscaler", "action": "2798", "description": "Block an IP", "type": "block ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "7d44cabe-dc7f-4282-9c65-982acc17af71", "create_time": 1788278624.1031644, "update_time": 1788280100.5295005, "last_job_id": 0, "name": "block url - Zscaler", "action": "2799", "description": "Block a URL", "type": "block url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}, {"id": "4972f488-4a2a-43b3-9380-67eaf963f2a3", "create_time": 1788278624.1031861, "update_time": 1788280100.5295336, "last_job_id": 0, "name": "unallow ip - Zscaler", "action": "2804", "description": "Remove an IP address from the allowlist", "type": "unallow ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "5a94c3aa-4d81-4803-9bb0-c04abf4a66fd", "create_time": 1788278624.1032078, "update_time": 1788280100.5295634, "last_job_id": 0, "name": "unallow url - Zscaler", "action": "2805", "description": "Remove a URL from the allowed list", "type": "unallow url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5b6fd766-744a-4ada-9612-9934ff090668", "create_time": 1764758755.9073257, "update_time": 1788280100.5296493, "name": "Block%20Applications%20and%20Hashes", "order": 3, "tag": "de5b8d96-bc90-47e5-a707-4b4ce273b2f5", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20applications%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Palo%20Alto/Panorama%0A2.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "4aeae82c-9dd1-40c2-a202-8c1681107ad0", "create_time": 1788278773.9890056, "update_time": 1788280100.5297146, "last_job_id": 0, "name": "block application - Panorama", "action": "2393", "description": "Block an application", "type": "block application", "app_id": 119, "asset": 10, "parameters": [{"application": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "aab34ec2-4c29-454f-a4c6-977593bb4223", "create_time": 1788278773.9890535, "update_time": 1788280100.5297453, "last_job_id": 0, "name": "block hash - Carbon Black Response", "action": "2075", "description": "Add a hash to the Carbon Black Response blacklist", "type": "block hash", "app_id": 28, "asset": 12, "parameters": [{"hash": "", "comment": ""}]}, {"id": "efce157a-05de-44a0-9068-8a89c805cabb", "create_time": 1788278773.9890966, "update_time": 1788280100.5297751, "last_job_id": 0, "name": "terminate process - Carbon Black Response", "action": "2067", "description": "Kill running processes on a machine", "type": "terminate process", "app_id": 28, "asset": 12, "parameters": [{"pid": "", "sensor_id": "", "ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c21f1448-9c99-4d7b-818e-d803780529ad", "create_time": 1788279259.257031, "update_time": 1788280100.5298517, "name": "Quarantine%20compromised%20devices%20or%20endpoints", "order": 4, "tag": "de175899-36ac-48d6-9ca4-fa1f31c46019", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20quarantine%20any%20compromised%20devices.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Crowdstrike%0A2.%20Microsoft%20Defender%20for%20Endpoint%0A3.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "306acb45-61e8-4af7-8836-7f5b23e79f13", "create_time": 1788279409.7877266, "update_time": 1788280100.5299373, "last_job_id": 0, "name": "quarantine device - CrowdStrike OAuth API", "action": "2153", "description": "Block the device", "type": "quarantine device", "app_id": 48, "asset": 19, "parameters": [{"hostname": "", "device_id": ""}]}, {"id": "8e3459f3-a1d1-4230-8461-7ef56dc5a843", "create_time": 1788279409.7877512, "update_time": 1788280100.5299702, "last_job_id": 0, "name": "quarantine device - Windows Defender ATP", "action": "2698", "description": "Quarantine the device", "type": "quarantine device", "app_id": 101, "asset": 40, "parameters": [{"type": "", "comment": "", "timeout": "", "device_id": ""}]}, {"id": "889e7a1d-0df0-43d1-81b9-46ab7359ffba", "create_time": 1788279409.7877738, "update_time": 1788280100.5300007, "last_job_id": 0, "name": "quarantine file - Windows Defender ATP", "action": "2702", "description": "Quarantine a file", "type": "quarantine file", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": "", "file_hash": ""}]}, {"id": "7b3a2d28-4942-4598-bffc-7c1f4515ec72", "create_time": 1788279409.787797, "update_time": 1788280100.530035, "last_job_id": 0, "name": "restrict app execution - Windows Defender ATP", "action": "2715", "description": "Restrict execution of all applications on the device except a predefined set", "type": "restrict app execution", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": ""}]}, {"id": "5a8eb830-4b4a-411c-993c-fc5ac42da7ef", "create_time": 1788279409.7878232, "update_time": 1788280100.5300653, "last_job_id": 0, "name": "quarantine device - Carbon Black Response", "action": "2062", "description": "Quarantine the endpoint", "type": "quarantine device", "app_id": 28, "asset": 12, "parameters": [{"ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "e2eefabb-dd45-4647-a347-b8a66c3bd2ed", "create_time": 1788279702.6294243, "update_time": 1788280100.5301492, "name": "Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens", "order": 5, "tag": "8cd82a46-eb24-4bb7-8023-34d779e4c4d2", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A1.%20MS%20Graph%20For%20Active%20Directory%20%0A2.%20AD%20LDAP%20%0A3.%20Okta%20%0A4.%20AWS%20IAM%20%0A5.%20Azure%20AD%20Graph", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0b3091e6-c58b-495c-bf1e-92fda2468d00", "create_time": 1788279702.6294713, "update_time": 1788280100.5302153, "last_job_id": 0, "name": "disable account - AD LDAP", "action": "1930", "description": "Disables an Active Directory account", "type": "disable account", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "cb9c0ef7-748d-43ea-a0a0-1ba7dbe433cc", "create_time": 1788279702.629496, "update_time": 1788280100.5302463, "last_job_id": 0, "name": "reset password - AD LDAP", "action": "1932", "description": "Resets the password of a user, requiring the user to change password at next login", "type": "reset password", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "efcd23da-9a95-4a84-927c-5a80668bf16e", "create_time": 1788279702.629519, "update_time": 1788280100.5302763, "last_job_id": 0, "name": "disable user - Azure AD Graph", "action": "2019", "description": "Disable a user", "type": "disable user", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "73978225-62b4-49d4-b779-e38a85469279", "create_time": 1788279702.6295414, "update_time": 1788280100.5303059, "last_job_id": 0, "name": "reset password - Azure AD Graph", "action": "2016", "description": "Reset or set a user's password in an Azure AD environment", "type": "reset password", "app_id": 14, "asset": 21, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}, {"id": "89d063f3-11e3-49c7-957a-b07b8b9fb141", "create_time": 1788279702.629564, "update_time": 1788280100.5303347, "last_job_id": 0, "name": "disable tokens - Azure AD Graph", "action": "2017", "description": "Invalidate all active refresh tokens for a user in an Azure AD environment", "type": "disable tokens", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "0f2fe1cc-260d-4200-b13d-bcf6aa3ec877", "create_time": 1788279702.629587, "update_time": 1788280100.5303638, "last_job_id": 0, "name": "disable user - AWS IAM", "action": "3044", "description": "Disable login profile and access keys of a user", "type": "disable user", "app_id": 6, "asset": 42, "parameters": [{"username": "", "credentials": "", "disable_access_keys": false}]}, {"id": "e3f709da-f0a0-4140-b837-109df13fbb5e", "create_time": 1788279702.629611, "update_time": 1788280100.5303931, "last_job_id": 0, "name": "disable user - Okta", "action": "2367", "description": "Disables the specified user", "type": "disable user", "app_id": 118, "asset": 13, "parameters": [{"id": ""}]}, {"id": "fac660ff-6fa7-4952-8924-46e41746cfd8", "create_time": 1788279702.6296341, "update_time": 1788280100.5304255, "last_job_id": 0, "name": "disable user - MS Graph for Active Directory", "action": "3021", "description": "Disable a user", "type": "disable user", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "7fed8e92-ceb2-44fa-9711-5a23ed3342c2", "create_time": 1788279702.6296563, "update_time": 1788280100.5304606, "last_job_id": 0, "name": "disable tokens - MS Graph for Active Directory", "action": "3019", "description": "Invalidate all active refresh tokens for a user in a Microsoft AD environment", "type": "disable tokens", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "48c0cfa5-084a-447c-9f44-cd67be2c6ddd", "create_time": 1788279702.6296782, "update_time": 1788280100.53049, "last_job_id": 0, "name": "reset password - MS Graph for Active Directory", "action": "3018", "description": "Reset or set a user's password in a Microsoft AD environment", "type": "reset password", "app_id": 89, "asset": 41, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "50452b43-98af-43ab-bfb0-1e9f7368b2c9", "create_time": 1788276680.0046902, "update_time": 1788280100.5313852, "name": "Recovery", "order": 4, "tasks": [{"id": "91a74317-f931-4ced-b4aa-6cdf54433221", "create_time": 1764758755.9079046, "update_time": 1788280100.5306091, "name": "Verify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20monitor%20for%20signs%20of%20recurrence", "order": 1, "tag": "c3c83a87-0d75-4d0a-b4e7-9fef0d60e5f4", "description": "Define%20who%20owns%20recovery%20execution,%20who%20approves%20restoration,%20and%20what%20systems/users/services%20are%20in%20scope.%20%0AVerify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20and%20monitor%20signs%20of%20recurrence.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "91f6342d-a92b-4157-a124-5e87ab0c9827", "create_time": 1764758755.9080007, "update_time": 1788280100.5307238, "name": "Complete%20incident%20documentation%20and%20lessons%20learned%20before%20closure", "order": 2, "tag": "27d8d5a5-4c1b-470c-b995-c39275b61444", "description": "Root%20Cause%20Analysis.%20%20New%20Detections,%20Visualizations,%20responses%20or%20playbooks%20to%20help%20resolve%20in%20future.%20", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5840a534-399b-4ac1-b0bc-80927edf8f8b", "create_time": 1764758755.9080942, "update_time": 1788280100.5308282, "name": "Report%20incident%20response%20status", "order": 3, "tag": "085d0c66-3bb9-48c8-9403-0fc21217d77c", "description": "Alert%20appropriate%20parties%20that%20incident%20response%20is%20complete.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "2bcf6e5e-de9b-42bd-b24c-d4cdd423cb13", "create_time": 1788279986.6035137, "update_time": 1788280100.5308995, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "393db9ae-69e9-4172-8b08-a7e59cf20aa9", "create_time": 1788279986.6035569, "update_time": 1788280100.5309548, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "d80a5892-bc25-4b3a-be22-af3620e30994", "create_time": 1788279986.6036005, "update_time": 1788280100.530988, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4d83b65b-55b8-4d55-81a0-1e7ee2e25ade", "create_time": 1788279986.6036437, "update_time": 1788280100.5310204, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "db31bdad-1648-4426-bb85-2fed1912d79d", "create_time": 1788279986.6036847, "update_time": 1788280100.5310526, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "49790c40-0d53-4598-b162-25d69c9ce19b", "create_time": 1788279986.603725, "update_time": 1788280100.5310874, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a18d484f-0600-490d-9b4c-52851cd7b767", "create_time": 1788280100.5311828, "update_time": 1788280100.5311832, "name": "Update%20and%20close%20company-wide%20awareness%20tickets%20when%20appropriate.", "order": 4, "tag": "44b218d8-0a50-47f1-a5ed-20a5c73ff522", "description": "Update%20Incident%20to%20track%20notes%20from%20the%20investigaiton.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "cc88b369-e5e6-4d63-9d88-97d985edd8f8", "create_time": 1788280100.5312567, "update_time": 1788280100.5312572, "last_job_id": 0, "name": "update ticket - ServiceNow", "action": "2473", "description": "Update ticket/record information", "type": "update ticket", "app_id": 147, "asset": 29, "parameters": [{"id": "", "table": "", "fields": "", "vault_id": "", "is_sys_id": false}]}, {"id": "99b0e0e2-2efd-4f9f-b4f4-6e68501acb3a", "create_time": 1788280100.5312977, "update_time": 1788280100.5312986, "last_job_id": 0, "name": "update ticket - Salesforce", "action": "2937", "description": "Update a Case", "type": "update ticket", "app_id": 144, "asset": 34, "parameters": [{"id": "", "status": "", "subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "cc9e1aca-7be7-4b4c-a5ff-7c4929e8dd73", "create_time": 1788280100.531338, "update_time": 1788280100.5313385, "last_job_id": 0, "name": "update ticket - Jira", "action": "2287", "description": "Update ticket (issue)", "type": "update ticket", "app_id": 80, "asset": 31, "parameters": [{"id": "", "vault_id": "", "update_fields": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}], "origin": {"id": "67fc1f68-1928-4436-8525-2957aac3a534", "name": "Generic Incident Response", "version": 4}, "template_id": "69f3e851-6e19-4ecd-ae2b-7cd558d49133", "active": true, "used": false, "ai_generated": false, "source_attachment_id": null, "_user": "nobody", "_key": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c"} From 1d0d226f4c310b13cf3176c238755d54cb1a0dee Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 2 Oct 2026 02:43:32 -0700 Subject: [PATCH 118/162] Update data source TA and install.yml app versions (#4309) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/asl_aws_cloudtrail.yml | 2 +- data_sources/aws_bedrock_claude.yml | 2 +- data_sources/aws_cloudfront.yml | 2 +- data_sources/aws_cloudtrail.yml | 2 +- data_sources/aws_cloudtrail_assumerolewithsaml.yml | 2 +- data_sources/aws_cloudtrail_consolelogin.yml | 2 +- data_sources/aws_cloudtrail_copyobject.yml | 2 +- data_sources/aws_cloudtrail_createaccesskey.yml | 2 +- data_sources/aws_cloudtrail_createkey.yml | 2 +- data_sources/aws_cloudtrail_createloginprofile.yml | 2 +- data_sources/aws_cloudtrail_createnetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_createpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_createsnapshot.yml | 2 +- data_sources/aws_cloudtrail_createtask.yml | 2 +- data_sources/aws_cloudtrail_createvirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deactivatemfadevice.yml | 2 +- data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_deletealarms.yml | 2 +- data_sources/aws_cloudtrail_deletedetector.yml | 2 +- data_sources/aws_cloudtrail_deletegroup.yml | 2 +- data_sources/aws_cloudtrail_deleteguardrail.yml | 2 +- data_sources/aws_cloudtrail_deleteipset.yml | 2 +- data_sources/aws_cloudtrail_deleteknowledgebase.yml | 2 +- data_sources/aws_cloudtrail_deleteloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deleteloggroup.yml | 2 +- data_sources/aws_cloudtrail_deletelogstream.yml | 2 +- ...aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml | 2 +- data_sources/aws_cloudtrail_deletenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_deletepolicy.yml | 2 +- data_sources/aws_cloudtrail_deleterule.yml | 2 +- data_sources/aws_cloudtrail_deleterulegroup.yml | 2 +- data_sources/aws_cloudtrail_deletesnapshot.yml | 2 +- data_sources/aws_cloudtrail_deletetrail.yml | 2 +- data_sources/aws_cloudtrail_deletevirtualmfadevice.yml | 2 +- data_sources/aws_cloudtrail_deletewebacl.yml | 2 +- data_sources/aws_cloudtrail_describeeventaggregates.yml | 2 +- data_sources/aws_cloudtrail_describeimagescanfindings.yml | 2 +- data_sources/aws_cloudtrail_describesnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_getobject.yml | 2 +- data_sources/aws_cloudtrail_getpassworddata.yml | 2 +- data_sources/aws_cloudtrail_invokemodel.yml | 2 +- data_sources/aws_cloudtrail_jobcreated.yml | 2 +- data_sources/aws_cloudtrail_listfoundationmodels.yml | 2 +- data_sources/aws_cloudtrail_modifydbinstance.yml | 2 +- data_sources/aws_cloudtrail_modifyimageattribute.yml | 2 +- data_sources/aws_cloudtrail_modifysnapshotattribute.yml | 2 +- data_sources/aws_cloudtrail_putbucketacl.yml | 2 +- data_sources/aws_cloudtrail_putbucketlifecycle.yml | 2 +- data_sources/aws_cloudtrail_putbucketreplication.yml | 2 +- data_sources/aws_cloudtrail_putbucketversioning.yml | 2 +- data_sources/aws_cloudtrail_putimage.yml | 2 +- data_sources/aws_cloudtrail_putkeypolicy.yml | 2 +- data_sources/aws_cloudtrail_replacenetworkaclentry.yml | 2 +- data_sources/aws_cloudtrail_setdefaultpolicyversion.yml | 2 +- data_sources/aws_cloudtrail_stoplogging.yml | 2 +- data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml | 2 +- data_sources/aws_cloudtrail_updateloginprofile.yml | 2 +- data_sources/aws_cloudtrail_updatesamlprovider.yml | 2 +- data_sources/aws_cloudtrail_updatetrail.yml | 2 +- data_sources/aws_cloudwatchlogs_vpcflow.yml | 2 +- data_sources/aws_security_hub.yml | 2 +- install.yml | 2 +- 63 files changed, 63 insertions(+), 63 deletions(-) diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index 6fd1fe38ab6..177d51fa859 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -24,7 +24,7 @@ separator: api.operation supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 output_fields: - dest - user diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index 5ca8401b63d..801a3882ead 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -14,7 +14,7 @@ separator_value: ModelInvocationLog supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - accountId diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index f74d5622d50..e725a27c95d 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -17,7 +17,7 @@ sourcetype: aws:cloudfront:accesslogs supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index 771112afc14..9ce661d9697 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -11,4 +11,4 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 diff --git a/data_sources/aws_cloudtrail_assumerolewithsaml.yml b/data_sources/aws_cloudtrail_assumerolewithsaml.yml index a6cec23c064..87c2702b279 100644 --- a/data_sources/aws_cloudtrail_assumerolewithsaml.yml +++ b/data_sources/aws_cloudtrail_assumerolewithsaml.yml @@ -18,7 +18,7 @@ separator_value: AssumeRoleWithSAML supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index 2ff6e5b7143..1c5f94ecab4 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -18,7 +18,7 @@ separator_value: ConsoleLogin supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_copyobject.yml b/data_sources/aws_cloudtrail_copyobject.yml index 4a3d0da1704..042284fe756 100644 --- a/data_sources/aws_cloudtrail_copyobject.yml +++ b/data_sources/aws_cloudtrail_copyobject.yml @@ -17,7 +17,7 @@ separator_value: CopyObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index b0d5da0175d..90d25a6c4b4 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -17,7 +17,7 @@ separator_value: CreateAccessKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index d0438d39af5..66946e91610 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -17,7 +17,7 @@ separator_value: CreateKey supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createloginprofile.yml b/data_sources/aws_cloudtrail_createloginprofile.yml index 6a3bc6f3c0b..e9c79a8b1ae 100644 --- a/data_sources/aws_cloudtrail_createloginprofile.yml +++ b/data_sources/aws_cloudtrail_createloginprofile.yml @@ -17,7 +17,7 @@ separator_value: CreateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index c63acbb7eca..c1153a30680 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -17,7 +17,7 @@ separator_value: CreateNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index e66f77171f1..00c450ca5dc 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -17,7 +17,7 @@ separator_value: CreatePolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index c1b0c920e41..621812b8ec1 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -17,7 +17,7 @@ separator_value: CreateSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createtask.yml b/data_sources/aws_cloudtrail_createtask.yml index 5288b8cbd48..f84b2cf0026 100644 --- a/data_sources/aws_cloudtrail_createtask.yml +++ b/data_sources/aws_cloudtrail_createtask.yml @@ -17,7 +17,7 @@ separator_value: CreateTask supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml index 47342a57d8f..bcc8f0593cb 100644 --- a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml @@ -17,7 +17,7 @@ separator_value: CreateVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deactivatemfadevice.yml b/data_sources/aws_cloudtrail_deactivatemfadevice.yml index 9e8c0336a0c..9c87fc438ac 100644 --- a/data_sources/aws_cloudtrail_deactivatemfadevice.yml +++ b/data_sources/aws_cloudtrail_deactivatemfadevice.yml @@ -17,7 +17,7 @@ separator_value: DeactivateMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml index f328e4afb8e..4364c100004 100644 --- a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: DeleteAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletealarms.yml b/data_sources/aws_cloudtrail_deletealarms.yml index 81b65bfb0df..9aa28412573 100644 --- a/data_sources/aws_cloudtrail_deletealarms.yml +++ b/data_sources/aws_cloudtrail_deletealarms.yml @@ -17,7 +17,7 @@ separator_value: DeleteAlarms supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index 9dd19beb76e..39d29d1a6fc 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -17,7 +17,7 @@ separator_value: DeleteDetector supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index eaaed2c8444..d190093d91f 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteguardrail.yml b/data_sources/aws_cloudtrail_deleteguardrail.yml index bcf5a76f984..bcf4fd5f848 100644 --- a/data_sources/aws_cloudtrail_deleteguardrail.yml +++ b/data_sources/aws_cloudtrail_deleteguardrail.yml @@ -14,7 +14,7 @@ separator_value: DeleteGuardrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 8ca44cb9048..6cb149284f9 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -16,7 +16,7 @@ separator_value: DeleteIPSet supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deleteknowledgebase.yml b/data_sources/aws_cloudtrail_deleteknowledgebase.yml index 86bd7aab68c..0bacc4bbb41 100644 --- a/data_sources/aws_cloudtrail_deleteknowledgebase.yml +++ b/data_sources/aws_cloudtrail_deleteknowledgebase.yml @@ -14,7 +14,7 @@ separator_value: DeleteKnowledgeBase supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml index 206581102ad..d8aa0af29a5 100644 --- a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index 45377a711cc..32a576295d7 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogGroup supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index 9f3946121af..fb8e5147f61 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -17,7 +17,7 @@ separator_value: DeleteLogStream supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml index c7139fe37ee..6518df5b567 100644 --- a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml @@ -14,7 +14,7 @@ separator_value: DeleteModelInvocationLoggingConfiguration supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index c0350a47118..26b3ce7198e 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -16,7 +16,7 @@ separator_value: DeleteNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index 8b3f877fa33..f5c3a384fe7 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -15,7 +15,7 @@ separator_value: DeletePolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index eaf32e0d25f..95f67eb714a 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -17,7 +17,7 @@ separator_value: DeleteRule supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deleterulegroup.yml b/data_sources/aws_cloudtrail_deleterulegroup.yml index 9a977502fa5..888baf1d853 100644 --- a/data_sources/aws_cloudtrail_deleterulegroup.yml +++ b/data_sources/aws_cloudtrail_deleterulegroup.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time example_log: '' diff --git a/data_sources/aws_cloudtrail_deletesnapshot.yml b/data_sources/aws_cloudtrail_deletesnapshot.yml index 73fae76c7dc..e8eb028bb97 100644 --- a/data_sources/aws_cloudtrail_deletesnapshot.yml +++ b/data_sources/aws_cloudtrail_deletesnapshot.yml @@ -17,7 +17,7 @@ separator_value: DeleteSnapshot supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index 0ff1b8bf84d..2a0af889973 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -17,7 +17,7 @@ separator_value: DeleteTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml index 124ec4fdcdd..bd587aed866 100644 --- a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml @@ -15,7 +15,7 @@ separator_value: DeleteVirtualMFADevice supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index b970da776a4..3d389b31f62 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -15,7 +15,7 @@ separator_value: DeleteWebACL supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_describeeventaggregates.yml b/data_sources/aws_cloudtrail_describeeventaggregates.yml index 1cef1f3ceeb..5aa835619d9 100644 --- a/data_sources/aws_cloudtrail_describeeventaggregates.yml +++ b/data_sources/aws_cloudtrail_describeeventaggregates.yml @@ -15,7 +15,7 @@ separator_value: DescribeEventAggregates supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index 435cf6402eb..191afb2bcec 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -16,7 +16,7 @@ separator_value: DescribeImageScanFindings supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describesnapshotattribute.yml b/data_sources/aws_cloudtrail_describesnapshotattribute.yml index 2130bc1392f..e31315d18cd 100644 --- a/data_sources/aws_cloudtrail_describesnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_describesnapshotattribute.yml @@ -11,7 +11,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - action - app diff --git a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml index b66fcd5be46..27e9e0b3f16 100644 --- a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: GetAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_getobject.yml b/data_sources/aws_cloudtrail_getobject.yml index 954e0181fb0..160dfe1db5b 100644 --- a/data_sources/aws_cloudtrail_getobject.yml +++ b/data_sources/aws_cloudtrail_getobject.yml @@ -16,7 +16,7 @@ separator_value: GetObject supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index 7e6ef7089ff..4c419b3a636 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -15,7 +15,7 @@ separator_value: GetPasswordData supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_invokemodel.yml b/data_sources/aws_cloudtrail_invokemodel.yml index d2595753a7c..d2d1b63ce6f 100644 --- a/data_sources/aws_cloudtrail_invokemodel.yml +++ b/data_sources/aws_cloudtrail_invokemodel.yml @@ -14,7 +14,7 @@ separator_value: InvokeModel supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_jobcreated.yml b/data_sources/aws_cloudtrail_jobcreated.yml index d18e6de7ea7..c421ba7cb94 100644 --- a/data_sources/aws_cloudtrail_jobcreated.yml +++ b/data_sources/aws_cloudtrail_jobcreated.yml @@ -15,7 +15,7 @@ separator_value: JobCreated supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_listfoundationmodels.yml b/data_sources/aws_cloudtrail_listfoundationmodels.yml index 8fa39552820..f3898a66797 100644 --- a/data_sources/aws_cloudtrail_listfoundationmodels.yml +++ b/data_sources/aws_cloudtrail_listfoundationmodels.yml @@ -14,7 +14,7 @@ separator_value: ListFoundationModels supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index 82d2e091096..3613f843e82 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -16,7 +16,7 @@ separator_value: ModifyDBInstance supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index 5391f2dc6fd..4d47df2492d 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -15,7 +15,7 @@ separator_value: ModifyImageAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index 72d88079740..1027f7c5f23 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -14,7 +14,7 @@ separator_value: ModifySnapshotAttribute supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putbucketacl.yml b/data_sources/aws_cloudtrail_putbucketacl.yml index a2c348f7a8b..4877ea119c8 100644 --- a/data_sources/aws_cloudtrail_putbucketacl.yml +++ b/data_sources/aws_cloudtrail_putbucketacl.yml @@ -15,7 +15,7 @@ separator_value: PutBucketAcl supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index 5d3dd4b85aa..daa93d4c05c 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -15,7 +15,7 @@ separator_value: PutBucketLifecycle supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketreplication.yml b/data_sources/aws_cloudtrail_putbucketreplication.yml index 9eca3486105..452914db259 100644 --- a/data_sources/aws_cloudtrail_putbucketreplication.yml +++ b/data_sources/aws_cloudtrail_putbucketreplication.yml @@ -14,7 +14,7 @@ separator_value: PutBucketReplication supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketversioning.yml b/data_sources/aws_cloudtrail_putbucketversioning.yml index 8a52e1dd161..ebcd3e95b4f 100644 --- a/data_sources/aws_cloudtrail_putbucketversioning.yml +++ b/data_sources/aws_cloudtrail_putbucketversioning.yml @@ -14,7 +14,7 @@ separator_value: PutBucketVersioning supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index dae12350ea2..d95a8e337fc 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -15,7 +15,7 @@ separator_value: PutImage supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 3f1d2fd448e..57b95d703a1 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -13,7 +13,7 @@ separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 85693fd2c76..40e4c9ae5d8 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -15,7 +15,7 @@ separator_value: ReplaceNetworkAclEntry supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index 188e83923bc..83e554a5ca4 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -15,7 +15,7 @@ separator_value: SetDefaultPolicyVersion supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index c7bbbe699df..de9423c9c53 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -14,7 +14,7 @@ separator_value: StopLogging supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml index 559857b474c..106b623c2c5 100644 --- a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml @@ -15,7 +15,7 @@ separator_value: UpdateAccountPasswordPolicy supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index b9140c0c4b1..f62c9e64176 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -15,7 +15,7 @@ separator_value: UpdateLoginProfile supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatesamlprovider.yml b/data_sources/aws_cloudtrail_updatesamlprovider.yml index 613fcc77504..e8c6c5ae94b 100644 --- a/data_sources/aws_cloudtrail_updatesamlprovider.yml +++ b/data_sources/aws_cloudtrail_updatesamlprovider.yml @@ -16,7 +16,7 @@ separator_value: UpdateSAMLProvider supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index a5c3a3a362e..c609919c95d 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -15,7 +15,7 @@ separator_value: UpdateTrail supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - app diff --git a/data_sources/aws_cloudwatchlogs_vpcflow.yml b/data_sources/aws_cloudwatchlogs_vpcflow.yml index 62efe791219..b165f0ace89 100644 --- a/data_sources/aws_cloudwatchlogs_vpcflow.yml +++ b/data_sources/aws_cloudwatchlogs_vpcflow.yml @@ -12,7 +12,7 @@ source: aws_cloudwatchlogs_vpcflow sourcetype: aws:cloudwatchlogs:vpcflow supported_TA: - name: Splunk Add-on for AWS - version: 8.3.0 + version: 8.2.2 url: https://splunkbase.splunk.com/app/1876 fields: - _raw diff --git a/data_sources/aws_security_hub.yml b/data_sources/aws_security_hub.yml index e6f4e5bc3d6..64fc6abb3b9 100644 --- a/data_sources/aws_security_hub.yml +++ b/data_sources/aws_security_hub.yml @@ -15,7 +15,7 @@ sourcetype: aws:securityhub:finding supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.3.0 + version: 8.2.2 fields: - _time - AwsAccountId diff --git a/install.yml b/install.yml index f031247a96f..28ef2c76795 100644 --- a/install.yml +++ b/install.yml @@ -3,7 +3,7 @@ apps: hardcoded_path: dist/DA-ESS-ContentUpdate.tar.gz - appid: SplunkEnterpriseSecuritySuite url: https://splunkbase.splunk.com/app/263 - version: 8.7.0 + version: 8.7.1 - appid: Splunk_TA_microsoft-iis url: https://splunkbase.splunk.com/app/3185 version: 2.0.0 From f4866a01c182468c60ac9f3223fa594e0cc17a3e Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 2 Oct 2026 12:09:41 +0200 Subject: [PATCH 119/162] Bump contentctl.yml and build.yml to 6.8.0 (#4311) * Update build.yml * Update contentctl.yml --- build.yml | 2 +- contentctl.yml | 2 +- .../detections}/detect_f5_tmui_rce_cve_2020_5902.yml | 4 ++-- .../detections}/linux_adding_crontab_using_list_parameter.yml | 4 ++-- .../detections}/lolbas_with_network_traffic.yml | 4 ++-- 5 files changed, 8 insertions(+), 8 deletions(-) rename {detections/deprecated => removed/detections}/detect_f5_tmui_rce_cve_2020_5902.yml (97%) rename {detections/deprecated => removed/detections}/linux_adding_crontab_using_list_parameter.yml (98%) rename {detections/deprecated => removed/detections}/lolbas_with_network_traffic.yml (99%) diff --git a/build.yml b/build.yml index c3377966ae0..5a6a252bb08 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.7.0 +app_version: 6.8.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index 1ffa66afdee..e6c1aceb7cb 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.7.0 + version: 6.8.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU diff --git a/detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml b/removed/detections/detect_f5_tmui_rce_cve_2020_5902.yml similarity index 97% rename from detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml rename to removed/detections/detect_f5_tmui_rce_cve_2020_5902.yml index 657033ef5a0..0d8c5cdcc7c 100644 --- a/detections/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml +++ b/removed/detections/detect_f5_tmui_rce_cve_2020_5902.yml @@ -2,9 +2,9 @@ name: Detect F5 TMUI RCE CVE-2020-5902 id: 810e4dbc-d46e-11ea-87d0-0242ac130003 version: 10 creation_date: '2020-08-04' -modification_date: '2026-08-10' +modification_date: '2026-10-02' author: Shannon Davis, Splunk -status: deprecated +status: removed type: TTP description: The following analytic identifies remote code execution (RCE) attempts targeting F5 BIG-IP, BIG-IQ, and Traffix SDC devices, specifically exploiting CVE-2020-5902. It uses regex to detect patterns in syslog data that match known exploit strings such as "hsqldb;" and directory traversal sequences. This activity is significant because successful exploitation can allow attackers to execute arbitrary commands on the affected devices, leading to full system compromise. If confirmed malicious, this could result in unauthorized access, data exfiltration, or further lateral movement within the network. data_source: [] diff --git a/detections/deprecated/linux_adding_crontab_using_list_parameter.yml b/removed/detections/linux_adding_crontab_using_list_parameter.yml similarity index 98% rename from detections/deprecated/linux_adding_crontab_using_list_parameter.yml rename to removed/detections/linux_adding_crontab_using_list_parameter.yml index 6c550de21dd..c2f250d80ac 100644 --- a/detections/deprecated/linux_adding_crontab_using_list_parameter.yml +++ b/removed/detections/linux_adding_crontab_using_list_parameter.yml @@ -2,9 +2,9 @@ name: Linux Adding Crontab Using List Parameter id: 52f6d751-1fd4-4c74-a4c9-777ecfeb5c58 version: 12 creation_date: '2021-12-21' -modification_date: '2026-09-03' +modification_date: '2026-10-02' author: Teoderick Contreras, Bhavin Patel, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic detects suspicious modifications to cron jobs on Linux systems using the crontab command with list parameters. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it may indicate an attempt to establish persistence or execute malicious code on a schedule. If confirmed malicious, the impact could include unauthorized code execution, data destruction, or other damaging outcomes. Further investigation should analyze the added cron job, its associated command, and any related processes. data_source: diff --git a/detections/deprecated/lolbas_with_network_traffic.yml b/removed/detections/lolbas_with_network_traffic.yml similarity index 99% rename from detections/deprecated/lolbas_with_network_traffic.yml rename to removed/detections/lolbas_with_network_traffic.yml index 0910406a7c1..43a341fe4e6 100644 --- a/detections/deprecated/lolbas_with_network_traffic.yml +++ b/removed/detections/lolbas_with_network_traffic.yml @@ -2,9 +2,9 @@ name: LOLBAS With Network Traffic id: 2820f032-19eb-497e-8642-25b04a880359 version: 19 creation_date: '2023-02-02' -modification_date: '2026-08-24' +modification_date: '2026-10-02' author: Steven Dick -status: deprecated +status: removed type: TTP description: The following analytic identifies the use of Living Off the Land Binaries and Scripts (LOLBAS) with network traffic. It leverages data from the Network Traffic data model to detect when native Windows binaries, often abused by adversaries, initiate network connections. This activity is significant as LOLBAS are frequently used to download malicious payloads, enabling lateral movement, command-and-control, or data exfiltration. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to organizational security. data_source: From 3db0f548657e10f95191584270de291f55603463 Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Fri, 2 Oct 2026 12:11:32 +0200 Subject: [PATCH 120/162] Deprecate Child Processes of spoolsv.exe detection (#4310) --------- Co-authored-by: Nasreddine Bencherchali --- .../child_processes_of_spoolsv_exe.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) rename detections/{endpoint => deprecated}/child_processes_of_spoolsv_exe.yml (88%) diff --git a/detections/endpoint/child_processes_of_spoolsv_exe.yml b/detections/deprecated/child_processes_of_spoolsv_exe.yml similarity index 88% rename from detections/endpoint/child_processes_of_spoolsv_exe.yml rename to detections/deprecated/child_processes_of_spoolsv_exe.yml index 8dcc2901ae7..8caf4cabe3f 100644 --- a/detections/endpoint/child_processes_of_spoolsv_exe.yml +++ b/detections/deprecated/child_processes_of_spoolsv_exe.yml @@ -1,10 +1,10 @@ name: Child Processes of Spoolsv exe id: aa0c4aeb-5b18-41c4-8c07-f1442d7599df -version: 11 +version: 12 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Rico Valdez, Splunk -status: experimental +status: deprecated type: TTP description: The following analytic identifies child processes spawned by spoolsv.exe, the Print Spooler service in Windows, which typically runs with SYSTEM privileges. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. Monitoring this activity is crucial as it can indicate exploitation attempts, such as those associated with CVE-2018-8440, which can lead to privilege escalation. If confirmed malicious, attackers could gain SYSTEM-level access, allowing them to execute arbitrary code, escalate privileges, and potentially compromise the entire system. data_source: @@ -57,3 +57,9 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint +deprecation_info: + reason: |- + Deprecated because the broad parent-child logic generated substantial legitimate printer, driver, and print-management activity and did not directly detect the exploitation behavior associated with its CVE reference. + More specific Print Spooler behaviors are covered by existing production detections. + removed_in_version: 6.10.0 + replacement_content: [] From dffaa04fc298b7097e6af54660f8f8a4d5d752ab Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 5 Oct 2026 10:35:14 +0200 Subject: [PATCH 121/162] Update `how_to_implement` Section For NVM Content (#4281) --- ...er_spawned_unix_shell_with_external_connection.yml | 11 +++++------ ...cisco_nvm___curl_execution_with_insecure_flags.yml | 11 +++++------ ...___installation_of_typosquatted_python_package.yml | 11 +++++------ ..._or_mshta_network_execution_without_url_in_cli.yml | 11 +++++------ ...__non_network_binary_making_network_connection.yml | 11 +++++------ ...ascript_network_connection_for_a_long_duration.yml | 9 ++++----- ...o_nvm___outbound_connection_to_suspicious_port.yml | 11 +++++------ ...o_nvm___rclone_execution_with_network_activity.yml | 11 +++++------ ...dll32_abuse_of_mshtml_dll_for_payload_download.yml | 11 +++++------ ...cript_from_archive_triggering_network_activity.yml | 11 +++++------ ..._suspicious_download_from_file_sharing_website.yml | 11 +++++------ ..._suspicious_file_download_via_headless_browser.yml | 11 +++++------ ...s_network_connection_from_process_with_no_args.yml | 11 +++++------ ...picious_network_connection_initiated_via_msxsl.yml | 11 +++++------ ...us_network_connection_to_ip_lookup_service_api.yml | 11 +++++------ ...__webserver_download_from_file_sharing_website.yml | 11 +++++------ 16 files changed, 79 insertions(+), 95 deletions(-) diff --git a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml index 768ff926ec8..15f820549c0 100644 --- a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml +++ b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Browser Spawned Unix Shell with External Connection id: 6f2de8d1-9a2d-4c7a-9b8c-3b8a2f7d0e41 -version: 1 +version: 2 creation_date: '2026-09-02' -modification_date: '2026-09-02' +modification_date: '2026-09-22' author: Maria Jose Erquiaga, Splunk status: production type: Anomaly @@ -60,14 +60,13 @@ search: | | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_nvm___browser_spawned_unix_shell_with_external_connection_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Legitimate workflows may launch Unix command interpreters from browser contexts, including developer tooling, software installers, SSO helpers, browser extensions, and automation wrappers. Tuning may be required for approved applications, users, and destinations. references: diff --git a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml index 4f2287fd2b1..4291c2f1be9 100644 --- a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml +++ b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Curl Execution With Insecure Flags id: cc695238-3117-4e60-aa83-4beac2a42c69 -version: 8 +version: 9 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -45,14 +45,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___curl_execution_with_insecure_flags_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Usage of these flags to reach public IPs or uncommon destinations should be reviewed. Tuning may be required for domains with known certificate issues. diff --git a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml index 1230dc1fe34..e9d3748c202 100644 --- a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml +++ b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Installation of Typosquatted Python Package id: 5e3f6b44-42cb-4f8a-99f0-59e78a52ea1d -version: 5 +version: 6 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -43,14 +43,13 @@ search: | process_integrity_level process_path process_name process_arguments process_hash process_id additional_logged_in_users_list module_name_list module_hash_list | `cisco_nvm___installation_of_typosquatted_python_package_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). In addition to this, the search make use of the lookup "typo_squatted_python_packages". Which needs to be configured and tuned. known_false_positives: | False positives should be very minimal to non existent, as the names of the packages in the lookup are all extracted from previously malicious packages. diff --git a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml index 39f753ba7ed..e2b0c93aa31 100644 --- a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml +++ b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml @@ -1,8 +1,8 @@ name: Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI id: f2a9df84-9b01-4a21-9e3a-7aa1a217f69e -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -48,14 +48,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | False positives should be minimal as the presence of a network connection during such executions increases the likelihood of malicious behavior. references: diff --git a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml index 30d14780297..dc296fbfa2d 100644 --- a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml +++ b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Non-Network Binary Making Network Connection id: c6db35af-8a0e-4b61-88ed-738e66f15715 -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -46,14 +46,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___non_network_binary_making_network_connection_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Rare cases may exist where these binaries are used by plugins or third-party extensions to initiate outbound communication. However, such behavior is extremely uncommon and should be investigated for potential injection or abuse. diff --git a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml index b30c5e3f415..1d63ae1c37f 100644 --- a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml +++ b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Osascript Network Connection for a Long Duration id: 6bc88a9d-f7de-4257-b526-acf15bc5a517 -version: 1 +version: 2 creation_date: '2026-09-18' -modification_date: '2026-09-18' +modification_date: '2026-09-22' author: Radka Viskova, Splunk status: production type: Anomaly @@ -46,11 +46,10 @@ search: |- how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: |- Legitimate administrative scripting, automation, software deployment, or support workflows that use osascript for long-running network operations. references: diff --git a/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml b/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml index 012a98db4fd..4fbd80b96e0 100644 --- a/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml +++ b/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Outbound Connection to Suspicious Port id: fc32a8d5-bc79-4437-b48f-4646ab7bed9d -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -43,14 +43,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___outbound_connection_to_suspicious_port_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Some legitimate applications may use high or non-standard ports, such as alternate SSH daemons or development tools. However, many of these ports are commonly used by threat actors for reverse shells or C2 communications. diff --git a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml index d707ed47453..002d7f3c792 100644 --- a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml +++ b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Rclone Execution With Network Activity id: 719f8c78-b20d-4bb9-8c33-6d1a762e7a9a -version: 7 +version: 8 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -52,14 +52,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___rclone_execution_with_network_activity_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Rclone is used legitimately in some backup or other workflows. Tune this rule based on known-good operational usage or restrict by known user/service accounts an specific folders or remote names. references: diff --git a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml index 3b0f0d51b9b..c8caad0967d 100644 --- a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml +++ b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download id: 18f0d27d-569e-4bc4-96e1-09b214fa73c0 -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -39,14 +39,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | `rundll32.exe` using `mshtml.dll` is rare in legitimate environments. However, edge cases might exist. Tuning may be needed in environments with custom automation scripts. references: diff --git a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml index 0072fc506ec..d98e0f72d8d 100644 --- a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml +++ b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Susp Script From Archive Triggering Network Activity id: 8b07c2c9-0cde-4c44-9fa6-59dcf2b25777 -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -39,14 +39,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___susp_script_from_archive_triggering_network_activity_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Some software installers or automation scripts may extract and run scripts from archive files in temporary directories. However, it is uncommon for such scripts to initiate outbound network connections immediately upon extraction. diff --git a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml index 88bfa5cba70..2d0f030e056 100644 --- a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Suspicious Download From File Sharing Website id: 94ebc001-35e7-4ae8-9b0e-52766b2f99c7 -version: 7 +version: 8 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -54,14 +54,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___suspicious_download_from_file_sharing_website_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Some system administrators or development teams may use tools like curl or PowerShell to download files from public services for legitimate automation or scripting purposes. However, use of these binaries to contact domains commonly associated with file sharing or temporary hosting diff --git a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml index 7ea531ccb15..9e5dd3c33f8 100644 --- a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml +++ b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Suspicious File Download via Headless Browser id: cd0e816f-f67d-4dbe-a153-480b546e867e -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -74,14 +74,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___suspicious_file_download_via_headless_browser_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Some internal automation frameworks may invoke Chromium browsers in headless mode to programmatically access internal services or webpages. These tools may occasionally download legitimate resources as part of their normal behavior. diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml index 30cb586fc2a..f2e4760a56a 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Suspicious Network Connection From Process With No Args id: 54fa06c5-96a2-4406-a4a7-44d93ddbd173 -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -49,14 +49,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___suspicious_network_connection_from_process_with_no_args_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Some system binaries may execute without arguments in rare legitimate scenarios (e.g., certain service launches), and initiate a network connection to microsoft servers for telemetry or update purposes. Apply additional filters as needed. diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml index 8fe5860f2bc..e4cc59a7ea7 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Suspicious Network Connection Initiated via MsXsl id: 1cbcf75f-0e45-4f29-8c1b-7fcd7e55cc55 -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -43,14 +43,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___suspicious_network_connection_initiated_via_msxsl_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | False positives may occur in development or administrative environments where msxsl.exe is used for legitimate XML transformations. However, its use is uncommon in standard user activity diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml index 681ce03876d..c7c2ad43c3b 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Suspicious Network Connection to IP Lookup Service API id: 568cb83e-d79e-4a23-85ec-6e1f6c30cb2f -version: 8 +version: 9 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk, Janantha Marasinghe status: production type: Anomaly @@ -53,14 +53,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Internal scripts or agents performing network checks may query IP geolocation services. Tune by excluding known tools or adding internal allowlists for destination domains or process names and commandlines. diff --git a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml index bdcf425a928..f1360e9e908 100644 --- a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Webserver Download From File Sharing Website id: 1984f997-3b49-4d4b-a7e9-dc5dbf88370e -version: 7 +version: 8 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -46,14 +46,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___webserver_download_from_file_sharing_website_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | In rare cases, a web server may make outbound connections to pull content for legitimate purposes (e.g., downloading templates or updates from a trusted source). However, communication to anonymous file-sharing or temporary content domains is strongly suspicious. From 9c941e6ecc2806806dcb808d1d92885f230942df Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 5 Oct 2026 10:40:16 +0200 Subject: [PATCH 122/162] Add Missing `local=t` From Lookup Calls (#4282) --- .../azure_ad_privileged_role_assigned.yml | 6 +- ...ged_role_assigned_to_service_principal.yml | 6 +- .../cloud/circle_ci_disable_security_job.yml | 6 +- ...alls_from_previously_unseen_user_roles.yml | 6 +- ...ance_created_by_previously_unseen_user.yml | 6 +- ...ce_created_in_previously_unused_region.yml | 6 +- ...e_created_with_previously_unseen_image.yml | 6 +- ...d_with_previously_unseen_instance_type.yml | 6 +- ...nce_modified_by_previously_unseen_user.yml | 6 +- ...g_activity_from_previously_unseen_city.yml | 6 +- ...ctivity_from_previously_unseen_country.yml | 6 +- ...vity_from_previously_unseen_ip_address.yml | 6 +- ...activity_from_previously_unseen_region.yml | 6 +- .../cloud/kubernetes_nginx_ingress_lfi.yml | 6 +- .../o365_bec_email_hiding_rule_created.yml | 6 +- .../cloud/o365_privileged_role_assigned.yml | 6 +- ...ged_role_assigned_to_service_principal.yml | 6 +- .../endpoint/attacker_tools_on_endpoint.yml | 6 +- ...llation_of_typosquatted_python_package.yml | 2 +- ...outbound_connection_to_suspicious_port.yml | 2 +- .../endpoint/common_ransomware_extensions.yml | 9 +- ...tect_remote_access_software_usage_file.yml | 6 +- ..._remote_access_software_usage_fileinfo.yml | 6 +- ...t_remote_access_software_usage_process.yml | 6 +- ..._remote_access_software_usage_registry.yml | 6 +- .../first_time_seen_child_process_of_zoom.yml | 6 +- .../potential_password_in_username.yml | 6 +- ...rocesses_run_from_unexpected_locations.yml | 6 +- .../windows_ad_adminsdholder_acl_modified.yml | 6 +- ...ows_ad_dangerous_deny_acl_modification.yml | 6 +- ...ws_ad_dangerous_group_acl_modification.yml | 6 +- ...ows_ad_dangerous_user_acl_modification.yml | 6 +- ...ws_ad_dcshadow_privileges_acl_addition.yml | 18 +- ...omain_controller_audit_policy_disabled.yml | 6 +- ...ows_ad_domain_replication_acl_addition.yml | 14 +- .../windows_ad_domain_root_acl_deletion.yml | 6 +- ...indows_ad_domain_root_acl_modification.yml | 6 +- .../windows_ad_gpo_new_cse_addition.yml | 6 +- .../windows_ad_hidden_ou_creation.yml | 6 +- .../windows_ad_object_owner_updated.yml | 16 +- ...rivileged_account_sid_history_addition.yml | 6 +- ...ndows_ad_privileged_group_modification.yml | 6 +- .../windows_ad_self_dacl_assignment.yml | 18 +- .../windows_ai_platform_dns_query.yml | 6 +- .../windows_applocker_block_events.yml | 6 +- ...ege_escalation_via_unauthorized_bypass.yml | 6 +- ...ndows_attempt_to_stop_security_service.yml | 6 +- ...ial_access_from_browser_password_store.yml | 40 +- .../windows_defender_asr_audit_events.yml | 52 +- .../windows_defender_asr_block_events.yml | 56 +- ...ows_defender_asr_registry_modification.yml | 6 +- .../windows_defender_asr_rule_disabled.yml | 6 +- .../windows_defender_asr_rules_stacking.yml | 6 +- ...earch_order_hijacking_hunt_with_sysmon.yml | 6 +- ...s_domain_admin_impersonation_indicator.yml | 6 +- ...ows_dotnet_binary_in_non_standard_path.yml | 8 +- .../endpoint/windows_hosts_file_access.yml | 6 +- .../windows_identify_protocol_handlers.yml | 6 +- ...indows_important_audit_policy_disabled.yml | 6 +- ...indows_kerberos_local_successful_logon.yml | 6 +- .../windows_known_abused_dll_created.yml | 6 +- ...s_known_abused_dll_loaded_suspiciously.yml | 130 +- ...indows_lolbas_executed_as_renamed_file.yml | 6 +- ..._lolbas_executed_outside_expected_path.yml | 8 +- .../endpoint/windows_nirsoft_utilities.yml | 6 +- ...wershell_process_with_malicious_string.yml | 6 +- ...ell_script_block_with_malicious_string.yml | 6 +- .../endpoint/windows_pua_named_pipe.yml | 6 +- .../endpoint/windows_rmm_named_pipe.yml | 6 +- ...scheduled_task_with_suspicious_command.yml | 6 +- ...ws_scheduled_task_with_suspicious_name.yml | 6 +- ...e_created_with_suspicious_service_name.yml | 6 +- .../windows_suspicious_c2_named_pipe.yml | 6 +- .../windows_suspicious_named_pipe.yml | 6 +- .../windows_vulnerable_driver_installed.yml | 6 +- .../windows_vulnerable_driver_loaded.yml | 6 +- ...supply_chain_attack_network_indicators.yml | 6 +- ...e_firewall___binary_file_type_download.yml | 6 +- ...lacklisted_ssl_certificate_fingerprint.yml | 6 +- ...all___file_download_over_uncommon_port.yml | 6 +- ...___intrusion_events_by_threat_activity.yml | 8 +- ...ure_firewall___malware_file_downloaded.yml | 6 +- ...__remote_access_software_usage_traffic.yml | 6 +- ..._firewall___repeated_malware_downloads.yml | 6 +- ...connecting_to_dynamic_domain_providers.yml | 8 +- ...etect_remote_access_software_usage_dns.yml | 6 +- ...t_remote_access_software_usage_traffic.yml | 6 +- .../network/http_c2_framework_user_agent.yml | 6 +- .../network/http_malware_user_agent.yml | 6 +- detections/network/http_pua_user_agent.yml | 6 +- detections/network/http_rmm_user_agent.yml | 6 +- .../prohibited_network_traffic_allowed.yml | 6 +- ...etect_remote_access_software_usage_url.yml | 6 +- .../web/http_scripting_tool_user_agent.yml | 6 +- lookups/csv/hijacklibs_loaded.csv | 1736 ++++++++--------- macros/base64decode.yml | 6 +- ...emote_access_software_usage_exceptions.yml | 6 +- macros/suspicious_writes.yml | 6 +- 98 files changed, 1405 insertions(+), 1212 deletions(-) diff --git a/detections/cloud/azure_ad_privileged_role_assigned.yml b/detections/cloud/azure_ad_privileged_role_assigned.yml index d352b47e158..29ccd68bf85 100644 --- a/detections/cloud/azure_ad_privileged_role_assigned.yml +++ b/detections/cloud/azure_ad_privileged_role_assigned.yml @@ -1,8 +1,8 @@ name: Azure AD Privileged Role Assigned id: a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a -version: 16 +version: 17 creation_date: '2022-08-29' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP @@ -20,7 +20,7 @@ search: |- BY dest user src vendor_account vendor_product initiatedBy result role signature - | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description + | lookup local=t privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description | search isprvilegedadrole = True | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml index 7064e4b1e2c..9640b9bc5d6 100644 --- a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml +++ b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml @@ -1,8 +1,8 @@ name: Azure AD Privileged Role Assigned to Service Principal id: 5dfaa3d3-e2e4-4053-8252-16d9ee528c41 -version: 14 +version: 15 creation_date: '2023-04-28' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Mauricio Velazco, Splunk status: production type: TTP @@ -24,7 +24,7 @@ search: |- vendor_account vendor_product displayName initiatedBy result role signature - | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description + | lookup local=t privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description | search isprvilegedadrole = True | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/circle_ci_disable_security_job.yml b/detections/cloud/circle_ci_disable_security_job.yml index 86c52cf751c..22d5f050395 100644 --- a/detections/cloud/circle_ci_disable_security_job.yml +++ b/detections/cloud/circle_ci_disable_security_job.yml @@ -1,8 +1,8 @@ name: Circle CI Disable Security Job id: 4a2fdd41-c578-4cd4-9ef7-980e352517f2 -version: 10 +version: 11 creation_date: '2021-09-02' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Patrick Bareiss, Splunk status: production type: Anomaly @@ -15,7 +15,7 @@ search: |- | stats values(job_name) as job_names BY workflow_id workflow_name user commit_message url branch - | lookup mandatory_job_for_workflow workflow_name OUTPUTNEW job_name AS mandatory_job + | lookup local=t mandatory_job_for_workflow workflow_name OUTPUTNEW job_name AS mandatory_job | search mandatory_job=* | eval mandatory_job_executed=if(like(job_names, "%".mandatory_job."%"), 1, 0) | where mandatory_job_executed=0 diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index eacd8e6352b..ddd55187d0a 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -1,8 +1,8 @@ name: Cloud API Calls From Previously Unseen User Roles id: 2181ad1f-1e73-4d0c-9780-e8880482a08f -version: 11 +version: 12 creation_date: '2020-10-27' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Splunk status: production type: Anomaly @@ -16,7 +16,7 @@ search: |- All_Changes.status=success BY All_Changes.user, All_Changes.command All_Changes.object | `drop_dm_object_name("All_Changes")` - | lookup previously_seen_cloud_api_calls_per_user_role user as user, command as command OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_api_calls_per_user_role user as user, command as command OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUserApiCall=min(firstTimeSeen) diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index c6b2f67045d..223a8926b2e 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -1,8 +1,8 @@ name: Cloud Compute Instance Created By Previously Unseen User id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149 -version: 12 +version: 13 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Splunk status: production type: Anomaly @@ -14,7 +14,7 @@ search: |- WHERE All_Changes.action=created BY All_Changes.user All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` - | lookup previously_seen_cloud_compute_creations_by_user user as user OUTPUTNEW firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_compute_creations_by_user user as user OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUser=min(firstTimeSeen) diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml index 1e909aad75e..9d8da86c8ea 100644 --- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml +++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml @@ -1,8 +1,8 @@ name: Cloud Compute Instance Created In Previously Unused Region id: fa4089e2-50e3-40f7-8469-d2cc1564ca59 -version: 10 +version: 11 creation_date: '2020-11-30' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Splunk status: production type: Anomaly @@ -14,7 +14,7 @@ search: |- WHERE All_Changes.action=created BY All_Changes.vendor_region, All_Changes.user | `drop_dm_object_name("All_Changes")` - | lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index acb3a1e5c8e..98bcc0d7b31 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -1,8 +1,8 @@ name: Cloud Compute Instance Created With Previously Unseen Image id: bc24922d-987c-4645-b288-f8c73ec194c4 -version: 10 +version: 11 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Splunk status: production type: Anomaly @@ -16,7 +16,7 @@ search: |- | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" - | lookup previously_seen_cloud_compute_images image_id as image_id OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_compute_images image_id as image_id OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenImage=min(firstTimeSeen) diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index 3ff282b40bd..d6277404767 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -1,8 +1,8 @@ name: Cloud Compute Instance Created With Previously Unseen Instance Type id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda -version: 11 +version: 12 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Splunk status: production type: Anomaly @@ -26,7 +26,7 @@ search: |- | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where instance_type != "unknown" - | lookup previously_seen_cloud_compute_instance_types instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_compute_instance_types instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenInstanceType=min(firstTimeSeen) diff --git a/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml index 9a90486c1b6..2ff5d407c10 100644 --- a/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml @@ -1,8 +1,8 @@ name: Cloud Instance Modified By Previously Unseen User id: 7fb15084-b14e-405a-bd61-a6de15a40722 -version: 12 +version: 13 creation_date: '2020-11-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Splunk status: production type: Anomaly @@ -14,7 +14,7 @@ search: |- WHERE All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success BY All_Changes.user | `drop_dm_object_name("All_Changes")` - | lookup previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUser=min(firstTimeSeen) diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml index 19fb7fd7ce3..986561019d7 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml @@ -1,8 +1,8 @@ name: Cloud Provisioning Activity From Previously Unseen City id: e7ecc5e0-88df-48b9-91af-51104c68f02f -version: 9 +version: 10 creation_date: '2020-11-30' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Bhavin Patel, Splunk status: production type: Anomaly @@ -22,7 +22,7 @@ search: |- | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(City) - | lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenCity=min(firstTimeSeen) diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml index b88a2410262..a59431fb49a 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml @@ -1,8 +1,8 @@ name: Cloud Provisioning Activity From Previously Unseen Country id: 94994255-3acf-4213-9b3f-0494df03bb31 -version: 9 +version: 10 creation_date: '2020-12-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Bhavin Patel, Splunk status: production type: Anomaly @@ -22,7 +22,7 @@ search: |- | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) - | lookup previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenCountry=min(firstTimeSeen) diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml index c66d7cbe66a..94db84a678f 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml @@ -1,8 +1,8 @@ name: Cloud Provisioning Activity From Previously Unseen IP Address id: f86a8ec9-b042-45eb-92f4-e9ed1d781078 -version: 9 +version: 10 creation_date: '2020-11-30' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Splunk status: production type: Anomaly @@ -19,7 +19,7 @@ search: |- All_Changes.status=success BY All_Changes.src, All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` - | lookup previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml index 68b6adb810e..ecd39cf37de 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml @@ -1,8 +1,8 @@ name: Cloud Provisioning Activity From Previously Unseen Region id: 5aba1860-9617-4af9-b19d-aecac16fe4f2 -version: 9 +version: 10 creation_date: '2020-10-26' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Bhavin Patel, Splunk status: production type: Anomaly @@ -22,7 +22,7 @@ search: |- | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Region) - | lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) diff --git a/detections/cloud/kubernetes_nginx_ingress_lfi.yml b/detections/cloud/kubernetes_nginx_ingress_lfi.yml index 93c1f49678b..0cc3b3e3437 100644 --- a/detections/cloud/kubernetes_nginx_ingress_lfi.yml +++ b/detections/cloud/kubernetes_nginx_ingress_lfi.yml @@ -1,14 +1,14 @@ name: Kubernetes Nginx Ingress LFI id: 0f83244b-425b-4528-83db-7a88c5f66e48 -version: 11 +version: 12 creation_date: '2021-08-23' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Patrick Bareiss, Splunk status: production type: TTP description: The following analytic detects local file inclusion (LFI) attacks targeting Kubernetes Nginx ingress controllers. It leverages Kubernetes logs, parsing fields such as `request` and `status` to identify suspicious patterns indicative of LFI attempts. This activity is significant because LFI attacks can allow attackers to read sensitive files from the server, potentially exposing critical information. If confirmed malicious, this could lead to unauthorized access to sensitive data, further exploitation, and potential compromise of the Kubernetes environment. data_source: [] -search: '`kubernetes_container_controller` | rex field=_raw "^(?\S+)\s+-\s+-\s+\[(?[^\]]*)\]\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\"(?[^\"]*)\"\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\[(?[^\]]*)\]\s\[(?[^\]]*)\]\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)" | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | rex field=request "^(?\S+)\s(?\S+)\s" | eval phase="operate" | eval severity="high" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, url, http_method, host, http_user_agent, proxy, phase, severity, request | lookup local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT lfi_path | search lfi_path=yes | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter`' +search: '`kubernetes_container_controller` | rex field=_raw "^(?\S+)\s+-\s+-\s+\[(?[^\]]*)\]\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\"(?[^\"]*)\"\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\[(?[^\]]*)\]\s\[(?[^\]]*)\]\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)" | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | rex field=request "^(?\S+)\s(?\S+)\s" | eval phase="operate" | eval severity="high" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, url, http_method, host, http_user_agent, proxy, phase, severity, request | lookup local=t local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT lfi_path | search lfi_path=yes | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter`' how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/cloud/o365_bec_email_hiding_rule_created.yml b/detections/cloud/o365_bec_email_hiding_rule_created.yml index 7887386766b..de038e494d2 100644 --- a/detections/cloud/o365_bec_email_hiding_rule_created.yml +++ b/detections/cloud/o365_bec_email_hiding_rule_created.yml @@ -1,8 +1,8 @@ name: O365 BEC Email Hiding Rule Created id: 603ebac2-f157-4df7-a6ac-34e8d0350f86 -version: 8 +version: 9 creation_date: '2025-02-14' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: '0xC0FFEEEE, Github Community' status: production type: TTP @@ -13,7 +13,7 @@ search: |- | stats min(_time) as firstTime, max(_time) as lastTime, values(Operation) as Operation, latest(Name) as Name, latest(MarkAsRead) as MarkAsRead, latest(MoveToFolder) as MoveToFolder by object_id user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup ut_shannon_lookup word as Name + | lookup local=t ut_shannon_lookup word as Name | eval entropy_score=if(ut_shannon<=2, 1, 0) | eval len_score=if(len(Name)<=3, 1,0) | eval read_score=if(MarkAsRead="True", 1, 0) diff --git a/detections/cloud/o365_privileged_role_assigned.yml b/detections/cloud/o365_privileged_role_assigned.yml index 75a8eaf3254..f4680f055fe 100644 --- a/detections/cloud/o365_privileged_role_assigned.yml +++ b/detections/cloud/o365_privileged_role_assigned.yml @@ -1,15 +1,15 @@ name: O365 Privileged Role Assigned id: db435700-4ddc-4c23-892e-49e7525d7d39 -version: 11 +version: 12 creation_date: '2024-04-13' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP description: The following analytic identifies the assignment of sensitive and privileged Azure Active Directory roles to an Azure AD user. Adversaries and red teams alike may assign these roles to a compromised account to establish Persistence in an Azure AD environment. This detection leverages the O365 Universal Audit Log data source. data_source: - Office 365 Universal Audit Log -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature, vendor_account, vendor_product, dest | lookup privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category=\"User\" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_filter`" +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature, vendor_account, vendor_product, dest | lookup local=t privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category=\"User\" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Administrators will legitimately assign the privileged roles users as part of administrative tasks. Microsoft Privileged Identity Management (PIM) may cause false positives / less accurate alerting. references: diff --git a/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml b/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml index 3ccfbf7cbfd..ffeaa95712c 100644 --- a/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml +++ b/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml @@ -1,15 +1,15 @@ name: O365 Privileged Role Assigned To Service Principal id: 80f3fc1b-705f-4080-bf08-f61bf013b900 -version: 11 +version: 12 creation_date: '2024-04-13' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP description: The following analytic detects potential privilege escalation threats in Azure Active Directory (AD). This detection is important because it identifies instances where privileged roles that hold elevated permissions are assigned to service principals. This prevents unauthorized access or malicious activities, which occur when these non-human entities access Azure resources to exploit them. False positives might occur since administrators can legitimately assign privileged roles to service principals. This detection leverages the O365 Universal Audit Log data source. data_source: - Office 365 Universal Audit Log -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature,vendor_account, vendor_product, dest | lookup privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category!=\"User\" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_to_service_principal_filter`" +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature,vendor_account, vendor_product, dest | lookup local=t privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category!=\"User\" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_to_service_principal_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Administrators may legitimately assign the privileged roles to Service Principals as part of administrative tasks. Filter as needed. references: diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index 2f1379ec50a..57ab16b66d7 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -1,8 +1,8 @@ name: Attacker Tools On Endpoint id: a51bfe1a-94f0-48cc-b4e4-16a110145893 -version: 19 +version: 20 creation_date: '2021-07-12' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Bhavin Patel, Splunk, sventec, Github Community status: production type: TTP @@ -42,7 +42,7 @@ search: |- | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup attacker_tools attacker_tool_names AS process_name OUTPUT description + | lookup local=t attacker_tools attacker_tool_names AS process_name OUTPUT description | search description !=false | `attacker_tools_on_endpoint_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. diff --git a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml index e9d3748c202..7784dec31a4 100644 --- a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml +++ b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml @@ -21,7 +21,7 @@ search: | (process_arguments = "*poetry*" process_arguments = "*add*") ) | rex field=process_arguments "(?i)(?:pip|poetry)[^|]*?\s+(?:install|add)\s+(?P[^\s\"']+)$" - | lookup typo_squatted_python_packages + | lookup local=t typo_squatted_python_packages typosquatted_package_name as package_name OUTPUTNEW comment package_official_url | where isnotnull(comment) diff --git a/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml b/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml index 4fbd80b96e0..61d00ba1160 100644 --- a/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml +++ b/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml @@ -33,7 +33,7 @@ search: | values(aliul) as additional_logged_in_users_list values(dest_hostname) as dest_hostname by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport - | lookup suspicious_ports_list dest_port OUTPUTNEW comment as dest_port_metadata confidence as dest_confidence category as dest_port_category + | lookup local=t suspicious_ports_list dest_port OUTPUTNEW comment as dest_port_metadata confidence as dest_confidence category as dest_port_category | where isnotnull(dest_port_metadata) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 8f922873d49..7fb53d11a58 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -1,8 +1,8 @@ name: Common Ransomware Extensions id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec -version: 22 +version: 23 creation_date: '2019-10-16' -modification_date: '2026-07-02' +modification_date: '2026-09-22' author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk, Steven Dick status: production type: TTP @@ -56,7 +56,7 @@ search: | Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | rex field=file_name "(?(\.[^\.]+){1,2})$" - | lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Extensions Name + | lookup local=t update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Extensions Name | search Name !=False | stats min(firstTime) as firstTime max(lastTime) as lastTime @@ -105,6 +105,9 @@ intermediate_findings: type: system score: 50 message: The device $dest$ wrote $file_count$ files to $path_count$ path(s) with the $file_extension$ extension. This extension and behavior may indicate a $Name$ ransomware attack. +threat_objects: + - field: file_path + type: file_path analytic_story: - Rhysida Ransomware - Prestige Ransomware diff --git a/detections/endpoint/detect_remote_access_software_usage_file.yml b/detections/endpoint/detect_remote_access_software_usage_file.yml index 6c971f45ac7..0746d33835a 100644 --- a/detections/endpoint/detect_remote_access_software_usage_file.yml +++ b/detections/endpoint/detect_remote_access_software_usage_file.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage File id: 3bf5541a-6a45-4fdc-b01d-59b899fff961 -version: 16 +version: 17 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -40,7 +40,7 @@ search: | | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Filesystem)` - | lookup remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category + | lookup local=t remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_file_filter` diff --git a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml index 2c3579d0b6f..b7e8eb806bb 100644 --- a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml +++ b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage FileInfo id: ccad96d7-a48c-4f13-8b9c-9f6a31cba454 -version: 15 +version: 16 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -19,7 +19,7 @@ search: |- process_hash process_id process_integrity_level process_name process_path user user_id vendor_product - | lookup remote_access_software remote_utility_fileinfo AS Product OUTPUT isutility, description as signature, comment_reference as desc, category + | lookup local=t remote_access_software remote_utility_fileinfo AS Product OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_fileinfo_filter` diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml index 49afb5a4844..b80e1ec8b9d 100644 --- a/detections/endpoint/detect_remote_access_software_usage_process.yml +++ b/detections/endpoint/detect_remote_access_software_usage_process.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage Process id: ffd5e001-2e34-48f4-97a2-26dc4bb08178 -version: 17 +version: 18 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick, Sebastian Wurl, Splunk Community status: production type: Anomaly @@ -24,7 +24,7 @@ search: | | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` - | lookup remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category + | lookup local=t remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_process_filter` diff --git a/detections/endpoint/detect_remote_access_software_usage_registry.yml b/detections/endpoint/detect_remote_access_software_usage_registry.yml index 3d9d5dfbde7..f000f5d3d43 100644 --- a/detections/endpoint/detect_remote_access_software_usage_registry.yml +++ b/detections/endpoint/detect_remote_access_software_usage_registry.yml @@ -1,15 +1,15 @@ name: Detect Remote Access Software Usage Registry id: 33804986-25dd-43cf-bb6b-dc14956c7cbc -version: 13 +version: 14 creation_date: '2024-12-28' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly description: The following analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` latest(Registry.process_guid) as process_guid count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*" OR (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" AND Registry.registry_value_name="ImagePath")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rex field=registry_value_data "(\")?.+\\\(?[^\"=]+\.[^\" ]{1,5})(\")?" | rex field=registry_value_data "(?[^\.]+\.[^\" ]{1,5}$)" | eval file_name = coalesce(file_name_1,file_name_2) | lookup remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_registry_filter`' +search: '| tstats `security_content_summariesonly` latest(Registry.process_guid) as process_guid count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*" OR (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" AND Registry.registry_value_name="ImagePath")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rex field=registry_value_data "(\")?.+\\\(?[^\"=]+\.[^\" ]{1,5})(\")?" | rex field=registry_value_data "(?[^\.]+\.[^\" ]{1,5}$)" | eval file_name = coalesce(file_name_1,file_name_2) | lookup local=t remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_registry_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Registry` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content references: diff --git a/detections/endpoint/first_time_seen_child_process_of_zoom.yml b/detections/endpoint/first_time_seen_child_process_of_zoom.yml index 6f88871ef26..3c4b132b750 100644 --- a/detections/endpoint/first_time_seen_child_process_of_zoom.yml +++ b/detections/endpoint/first_time_seen_child_process_of_zoom.yml @@ -1,8 +1,8 @@ name: First Time Seen Child Process of Zoom id: e91bd102-d630-4e76-ab73-7e3ba22c5961 -version: 11 +version: 12 creation_date: '2020-05-28' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Splunk status: experimental type: Anomaly @@ -20,7 +20,7 @@ search: |- ) BY Processes.process_id Processes.dest | `drop_dm_object_name(Processes)` - | lookup zoom_first_time_child_process dest as dest process_name as process_name OUTPUT firstTimeSeen + | lookup local=t zoom_first_time_child_process dest as dest process_name as process_name OUTPUT firstTimeSeen | where isnull(firstTimeSeen) OR firstTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_window`") | `security_content_ctime(firstTime)` | `first_time_seen_child_process_of_zoom_filter` diff --git a/detections/endpoint/potential_password_in_username.yml b/detections/endpoint/potential_password_in_username.yml index e6fb5a7cbe4..06649111165 100644 --- a/detections/endpoint/potential_password_in_username.yml +++ b/detections/endpoint/potential_password_in_username.yml @@ -1,8 +1,8 @@ name: Potential password in username id: 5ced34b4-ab32-4bb0-8f22-3b8f186f0a38 -version: 8 +version: 9 creation_date: '2022-05-27' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Mikael Bjerkeland, Splunk status: production type: Hunting @@ -14,7 +14,7 @@ search: |- WHERE nodename=Authentication.Failed_Authentication BY "Authentication.user" | `drop_dm_object_name(Authentication)` - | lookup ut_shannon_lookup word AS user + | lookup local=t ut_shannon_lookup word AS user | where ut_shannon>3 AND len(user)>=8 AND mvcount(src) == 1 | sort count, - ut_shannon | eval incorrect_cred=user diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml index 4404c793fdb..34973c0d0a6 100644 --- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml +++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml @@ -1,8 +1,8 @@ name: System Processes Run From Unexpected Locations id: a34aae96-ccf8-4aef-952c-3ea21444444d -version: 17 +version: 18 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -35,7 +35,7 @@ search: | | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile + | lookup local=t update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true | `system_processes_run_from_unexpected_locations_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. diff --git a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml index 9d6cd43a91b..22272eb1e64 100644 --- a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml +++ b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml @@ -1,15 +1,15 @@ name: Windows AD AdminSDHolder ACL Modified id: 00d877c3-7b7b-443d-9562-6b231e2abab9 -version: 11 +version: 12 creation_date: '2022-11-15' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Mauricio Velazco, Dean Luxton, Splunk status: production type: TTP description: The following analytic detects modifications to the Access Control List (ACL) of the AdminSDHolder object in a Windows domain, specifically the addition of new rules. It leverages EventCode 5136 from the Security Event Log, focusing on changes to the nTSecurityDescriptor attribute. This activity is significant because the AdminSDHolder object secures privileged group members, and unauthorized changes can allow attackers to establish persistence and escalate privileges. If confirmed malicious, this could enable an attacker to control domain-level permissions, compromising the entire Active Directory environment. data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=container ObjectDN="CN=AdminSDHolder,CN=System*" | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUTNEW builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_adminsdholder_acl_modified_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=container ObjectDN="CN=AdminSDHolder,CN=System*" | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUTNEW builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_adminsdholder_acl_modified_filter`' how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. Additionally, a SACL needs to be created for the AdminSDHolder object in order to log modifications. known_false_positives: Adding new users or groups to the AdminSDHolder ACL is not usual. Filter as needed references: diff --git a/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml b/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml index 4c843d442b4..2ec0999809b 100644 --- a/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml +++ b/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml @@ -1,15 +1,15 @@ name: Windows AD Dangerous Deny ACL Modification id: 8e897153-2ebd-4cb2-85d3-09ad57db2fb7 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: This detection identifies an Active Directory access-control list (ACL) modification event, which applies permissions that deny the ability to enumerate permissions of the object. data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC) | `windows_ad_dangerous_deny_acl_modification_filter`' +search: '`wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC) | `windows_ad_dangerous_deny_acl_modification_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml b/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml index 496738c80c9..bb3d90f6285 100644 --- a/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml +++ b/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml @@ -1,15 +1,15 @@ name: Windows AD Dangerous Group ACL Modification id: 59b0fc85-7a0d-4585-97ec-06a382801990 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: 'This detection monitors the addition of the following ACLs to an Active Directory group object: "Full control", "All extended rights", "All validated writes", "Create all child objects", "Delete all child objects", "Delete subtree", "Delete", "Modify permissions", "Modify owner", and "Write all properties". Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert.' data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=group | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_group_acl_modification_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=group | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_group_acl_modification_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml b/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml index 953f11c0280..efaba46b0d9 100644 --- a/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml +++ b/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml @@ -1,15 +1,15 @@ name: Windows AD Dangerous User ACL Modification id: ec5b6790-595a-4fb8-ad43-56e5b55a9617 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: 'This detection monitors the addition of the following ACLs to an Active Directory user object: "Full control","All extended rights","All validated writes", "Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties". Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert.' data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=user | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_user_acl_modification_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=user | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_user_acl_modification_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml b/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml index 961b49dc716..6722e417c57 100644 --- a/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml +++ b/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml @@ -1,8 +1,8 @@ name: Windows AD DCShadow Privileges ACL Addition id: ae915743-1aa8-4a94-975c-8062ebc8b723 -version: 11 +version: 12 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -22,13 +22,13 @@ search: |- | search aceObjectGuid IN ("9923a32a-3607-11d2-b9be-0000f87a36b2","1131f6ab-9c07-11d1-f79f-00c04fc2dcd2","1131f6ac-9c07-11d1-f79f-00c04fc2dcd2") | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value - | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user - | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value + | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups + | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId BY ObjectClass ObjectDN src_user diff --git a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml index a9de68376c1..4ae8bbf8237 100644 --- a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml +++ b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml @@ -1,8 +1,8 @@ name: Windows AD Domain Controller Audit Policy Disabled id: fc3ccef1-60a4-4239-bd66-b279511b4d14 -version: 12 +version: 13 creation_date: '2023-01-25' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -15,7 +15,7 @@ search: |- | eval AuditPolicyChanges=coalesce(AuditPolicyChanges,Changes), SubcategoryGuid=coalesce(SubcategoryGuid,Subcategory_GUID) | stats min(_time) as _time values(host) as dest BY AuditPolicyChanges SubcategoryGuid - | lookup advanced_audit_policy_guids GUID as SubcategoryGuid OUTPUT Category SubCategory + | lookup local=t advanced_audit_policy_guids GUID as SubcategoryGuid OUTPUT Category SubCategory | `windows_ad_domain_controller_audit_policy_disabled_filter` how_to_implement: Ensure you are ingesting EventCode `4719` from your domain controllers, the category domain_controller exists in assets and identities, and that assets and identities is enabled. If A&I is not configured, you will need to manually filter the results within the base search. known_false_positives: No false positives have been identified at this time. diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml index fa3da3a0fa4..008078814aa 100644 --- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -1,8 +1,8 @@ name: Windows AD Domain Replication ACL Addition id: 8c372853-f459-4995-afdc-280c114d33ab -version: 14 +version: 15 creation_date: '2022-11-17' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -22,11 +22,11 @@ search: |- | search aceObjectGuid IN ("1131f6aa-9c07-11d1-f79f-00c04fc2dcd2","1131f6ad-9c07-11d1-f79f-00c04fc2dcd2","89e95b76-444d-4c62-991a-0facbeda640c") | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value - | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value - | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value + | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId BY ObjectClass ObjectDN src_user dest user diff --git a/detections/endpoint/windows_ad_domain_root_acl_deletion.yml b/detections/endpoint/windows_ad_domain_root_acl_deletion.yml index 3d8f5ea920b..f4c529ed511 100644 --- a/detections/endpoint/windows_ad_domain_root_acl_deletion.yml +++ b/detections/endpoint/windows_ad_domain_root_acl_deletion.yml @@ -1,15 +1,15 @@ name: Windows AD Domain Root ACL Deletion id: 3cb56e57-5642-4638-907f-8dfde9afb889 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: ACL deletion performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage. data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand old_values | where NOT old_values IN (new_values) | rex field=old_values "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(old_values) as old_values by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_deletion_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand old_values | where NOT old_values IN (new_values) | rex field=old_values "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(old_values) as old_values by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_deletion_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_domain_root_acl_modification.yml b/detections/endpoint/windows_ad_domain_root_acl_modification.yml index dd7f05a1ec1..e3e9320ce78 100644 --- a/detections/endpoint/windows_ad_domain_root_acl_modification.yml +++ b/detections/endpoint/windows_ad_domain_root_acl_modification.yml @@ -1,15 +1,15 @@ name: Windows AD Domain Root ACL Modification id: 4981e2db-1372-440d-816e-3e7e2ed74433 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: ACL modification performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage. data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",''access_rights_value''), aceType=ace_type_value, aceFlags=coalesce(ace_flag_value,"This object only"), aceControlAccessRights=ControlAccessRights, user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_modification_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",''access_rights_value''), aceType=ace_type_value, aceFlags=coalesce(ace_flag_value,"This object only"), aceControlAccessRights=ControlAccessRights, user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_modification_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_gpo_new_cse_addition.yml b/detections/endpoint/windows_ad_gpo_new_cse_addition.yml index ee01fe92ecd..7ee0d8c86b5 100644 --- a/detections/endpoint/windows_ad_gpo_new_cse_addition.yml +++ b/detections/endpoint/windows_ad_gpo_new_cse_addition.yml @@ -1,8 +1,8 @@ name: Windows AD GPO New CSE Addition id: 700c11d1-da09-47b2-81aa-358c143c7986 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -24,7 +24,7 @@ search: |- | \d]+\-[A-Z | \d]+\-[A-Z | \d]+\}") - | lookup msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType + | lookup local=t msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType | eval newPolicy=if(policyType like "%",policyType,new_values) | join ObjectDN [ | search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update diff --git a/detections/endpoint/windows_ad_hidden_ou_creation.yml b/detections/endpoint/windows_ad_hidden_ou_creation.yml index 753e9958033..f3b1f2b8cc0 100644 --- a/detections/endpoint/windows_ad_hidden_ou_creation.yml +++ b/detections/endpoint/windows_ad_hidden_ou_creation.yml @@ -1,15 +1,15 @@ name: Windows AD Hidden OU Creation id: 66b6ad5e-339a-40af-b721-dacefc7bdb75 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: This analytic is looking for when an ACL is applied to an OU which denies listing the objects residing in the OU. This activity combined with modifying the owner of the OU will hide AD objects even from domain administrators. data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=organizationalUnit | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("List contents","List objects",LC,LO) | `windows_ad_hidden_ou_creation_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=organizationalUnit | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("List contents","List objects",LC,LO) | `windows_ad_hidden_ou_creation_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_object_owner_updated.yml b/detections/endpoint/windows_ad_object_owner_updated.yml index b242e6adefb..d26cae513be 100644 --- a/detections/endpoint/windows_ad_object_owner_updated.yml +++ b/detections/endpoint/windows_ad_object_owner_updated.yml @@ -1,8 +1,8 @@ name: Windows AD Object Owner Updated id: 4af01f6b-d8d4-4f96-8635-758a01557130 -version: 12 +version: 13 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -17,12 +17,12 @@ search: |- | rex field=old_value "O:(?P.*?)G:" | rex field=new_value "O:(?P.*?)G:" | where old_owner!=new_owner ``` optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as new_owner OUTPUT downLevelDomainName as new_owner_user - | lookup admon_groups_def objectSid as new_owner OUTPUT cn as new_owner_group - | lookup identity_lookup_expanded objectSid as old_owner OUTPUT downLevelDomainName as old_owner_user - | lookup admon_groups_def objectSid as old_owner OUTPUT cn as old_owner_group ``` - | lookup builtin_groups_lookup builtin_group_string as new_owner_group OUTPUT builtin_group_name as new_owner_group_builtin_group - | lookup builtin_groups_lookup builtin_group_string as old_owner OUTPUT builtin_group_name as old_owner_group_builtin_group + | lookup local=t identity_lookup_expanded objectSid as new_owner OUTPUT downLevelDomainName as new_owner_user + | lookup local=t admon_groups_def objectSid as new_owner OUTPUT cn as new_owner_group + | lookup local=t identity_lookup_expanded objectSid as old_owner OUTPUT downLevelDomainName as old_owner_user + | lookup local=t admon_groups_def objectSid as old_owner OUTPUT cn as old_owner_group ``` + | lookup local=t builtin_groups_lookup builtin_group_string as new_owner_group OUTPUT builtin_group_name as new_owner_group_builtin_group + | lookup local=t builtin_groups_lookup builtin_group_string as old_owner OUTPUT builtin_group_name as old_owner_group_builtin_group | eval user=coalesce(new_owner_user, new_owner_group, new_owner_group_builtin_group, new_owner), previousOwner=coalesce(old_owner_user, old_owner_group, old_owner_group_builtin_group, old_owner) | stats values(previousOwner) as previousOwner values(user) as user values(SubjectLogonId) as SubjectLogonId BY _time ObjectClass ObjectDN diff --git a/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml b/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml index 49124a77138..4d065865c8f 100644 --- a/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml @@ -1,8 +1,8 @@ name: Windows AD Privileged Account SID History Addition id: 6b521149-b91c-43aa-ba97-c2cac59ec830 -version: 13 +version: 14 creation_date: '2023-04-11' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -16,7 +16,7 @@ search: |- NOT SidHistory IN ("%%1793", -) | rex field=SidHistory "(^%{|^)(?P.*?)(}$|$)" | eval category="privileged" - | lookup identity_lookup_expanded category, identity as SidHistory OUTPUT identity_tag as match + | lookup local=t identity_lookup_expanded category, identity as SidHistory OUTPUT identity_tag as match | where isnotnull(match) | rename TargetSid as userSid | table _time action status host user userSid SidHistory Logon_ID src_user dest diff --git a/detections/endpoint/windows_ad_privileged_group_modification.yml b/detections/endpoint/windows_ad_privileged_group_modification.yml index bcfe2f7cef9..0feccfdd2fb 100644 --- a/detections/endpoint/windows_ad_privileged_group_modification.yml +++ b/detections/endpoint/windows_ad_privileged_group_modification.yml @@ -1,8 +1,8 @@ name: Windows AD Privileged Group Modification id: 187bf937-c436-4c65-bbcb-7539ffe02da1 -version: 11 +version: 12 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -20,7 +20,7 @@ search: |- `wineventlog_security` EventCode IN (4728) | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc BY signature, Group_Name,src_user dest - | lookup admon_groups_def cn as Group_Name OUTPUT category + | lookup local=t admon_groups_def cn as Group_Name OUTPUT category | where category="privileged" | `windows_ad_privileged_group_modification_filter` how_to_implement: This analytic requires eventCode 4728 to be ingested along with the admon_groups_def lookup being configured to include a list of AD groups along with a category to identify privileged groups. See splunkbase app listed in the references for further details. diff --git a/detections/endpoint/windows_ad_self_dacl_assignment.yml b/detections/endpoint/windows_ad_self_dacl_assignment.yml index 086f99486a4..cc4b4578cdd 100644 --- a/detections/endpoint/windows_ad_self_dacl_assignment.yml +++ b/detections/endpoint/windows_ad_self_dacl_assignment.yml @@ -1,8 +1,8 @@ name: Windows AD Self DACL Assignment id: 16132445-da9f-4d03-ad44-56d717dcd67d -version: 12 +version: 13 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -36,17 +36,17 @@ search: | | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType - | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value - | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value - | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType + | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user - | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group + | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType = coalesce(ace_type_value, aceType), aceInheritance = coalesce(ace_flag_value, "This object only"), diff --git a/detections/endpoint/windows_ai_platform_dns_query.yml b/detections/endpoint/windows_ai_platform_dns_query.yml index 60a3555327e..64febb1b456 100644 --- a/detections/endpoint/windows_ai_platform_dns_query.yml +++ b/detections/endpoint/windows_ai_platform_dns_query.yml @@ -1,8 +1,8 @@ name: Windows AI Platform DNS Query id: 1ad89d24-c856-4a0e-8fdf-c20c7b9febe1 -version: 6 +version: 7 creation_date: '2025-08-28' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -12,7 +12,7 @@ data_source: - Sysmon EventID 22 search: | `sysmon` EventCode=22 QueryName IN ("router.huggingface.co", "api.openai.com") - | lookup update=true browser_app_list browser_process_name AS process_name OUTPUT isAllowed | search isAllowed!=true + | lookup local=t update=true browser_app_list browser_process_name AS process_name OUTPUT isAllowed | search isAllowed!=true | rename dvc as dest | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count dest process_exec process_guid process_name query query_count reply_code_id signature signature_id src user_id Image diff --git a/detections/endpoint/windows_applocker_block_events.yml b/detections/endpoint/windows_applocker_block_events.yml index 35ba239a3ba..e6acb3d585c 100644 --- a/detections/endpoint/windows_applocker_block_events.yml +++ b/detections/endpoint/windows_applocker_block_events.yml @@ -1,8 +1,8 @@ name: Windows AppLocker Block Events id: e369afe8-cd35-47a3-9c1e-d813efc1f7dd -version: 10 +version: 11 creation_date: '2024-04-17' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Anomaly @@ -16,7 +16,7 @@ search: |- BY dest, PolicyName, RuleId, user, TargetProcessId, FilePath, FullFilePath, EventCode - | lookup applockereventcodes EventCode OUTPUT Description + | lookup local=t applockereventcodes EventCode OUTPUT Description | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_applocker_block_events_filter` diff --git a/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml b/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml index 0af315282ff..15e389f0588 100644 --- a/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml +++ b/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml @@ -1,8 +1,8 @@ name: Windows AppLocker Privilege Escalation via Unauthorized Bypass id: bca48629-7fa2-40d3-9e5d-807564504e28 -version: 9 +version: 10 creation_date: '2024-04-17' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: TTP @@ -18,7 +18,7 @@ search: |- FullFilePath, EventCode | where attempt_count > 5 | sort - attempt_count - | lookup applockereventcodes EventCode OUTPUT Description + | lookup local=t applockereventcodes EventCode OUTPUT Description | `windows_applocker_privilege_escalation_via_unauthorized_bypass_filter` how_to_implement: The analytic is designed to be run against Windows AppLocker event logs collected from endpoints with AppLocker enabled. If using Microsoft Defender for Endpoint (MDE), modify the analytic to use EventTypes/ActionTypes that match the block events for AppLocker. The analytic requires the AppLocker event logs to be ingested into Splunk. known_false_positives: False positives are possible if legitimate users are attempting to bypass application restrictions. This could occur if a user is attempting to run an application that is not permitted by AppLocker. It is recommended to investigate the context of the bypass attempt to determine if it is malicious or not. Modify the threshold as needed to reduce false positives. diff --git a/detections/endpoint/windows_attempt_to_stop_security_service.yml b/detections/endpoint/windows_attempt_to_stop_security_service.yml index c5c5036f1fc..a0612d605f6 100644 --- a/detections/endpoint/windows_attempt_to_stop_security_service.yml +++ b/detections/endpoint/windows_attempt_to_stop_security_service.yml @@ -1,8 +1,8 @@ name: Windows Attempt To Stop Security Service id: 9ed27cea-4e27-4eff-b2c6-aac9e78a7517 -version: 11 +version: 12 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -29,7 +29,7 @@ search: |- | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup security_services_lookup service as process OUTPUTNEW category, description + | lookup local=t security_services_lookup service as process OUTPUTNEW category, description | search category=security | `windows_attempt_to_stop_security_service_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. diff --git a/detections/endpoint/windows_credential_access_from_browser_password_store.yml b/detections/endpoint/windows_credential_access_from_browser_password_store.yml index 53e4dea2ce8..694b94d3938 100644 --- a/detections/endpoint/windows_credential_access_from_browser_password_store.yml +++ b/detections/endpoint/windows_credential_access_from_browser_password_store.yml @@ -1,15 +1,42 @@ name: Windows Credential Access From Browser Password Store id: 72013a8e-5cea-408a-9d51-5585386b4d69 -version: 23 +version: 24 creation_date: '2024-03-20' -modification_date: '2026-06-25' +modification_date: '2026-09-22' author: Teoderick Contreras, Bhavin Patel Splunk status: production type: Anomaly -description: The following analytic identifies a possible non-common browser process accessing its browser user data profile. This tactic/technique has been observed in various Trojan Stealers, such as SnakeKeylogger, which attempt to gather sensitive browser information and credentials as part of their exfiltration strategy. Detecting this anomaly can serve as a valuable pivot for identifying processes that access lists of browser user data profiles unexpectedly. This detection uses a lookup file `browser_app_list` that maintains a list of well known browser applications and the browser paths that are allowed to access the browser user data profiles. +description: |- + The following analytic identifies a possible non-common browser process accessing its browser user data profile. + This tactic/technique has been observed in various Trojan Stealers, such as SnakeKeylogger, which attempt to gather sensitive browser information and credentials as part of their exfiltration strategy. + Detecting this anomaly can serve as a valuable pivot for identifying processes that access lists of browser user data profiles unexpectedly. + This detection uses a lookup file `browser_app_list` that maintains a list of well known browser applications and the browser paths that are allowed to access the browser user data profiles. data_source: - Windows Event Log Security 4663 -search: '`wineventlog_security` EventCode=4663 | stats count by _time object_file_path object_file_name dest process_name process_path process_id EventCode | lookup browser_app_list browser_object_path as object_file_path OUTPUT browser_process_name isAllowed | stats count min(_time) as firstTime max(_time) as lastTime values(object_file_name) values(object_file_path) values(browser_process_name) as browser_process_name by dest process_name process_path process_id EventCode isAllowed | rex field=process_name "(?[^\\\\]+)$" | eval isMalicious=if(match(browser_process_name, extracted_process_name), "0", "1") | where isMalicious=1 and isAllowed="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credential_access_from_browser_password_store_filter`' +search: |- + `wineventlog_security` + EventCode=4663 + + | stats count by _time object_file_path object_file_name + dest process_name + process_path process_id EventCode + + | lookup local=t browser_app_list browser_object_path as object_file_path OUTPUT browser_process_name isAllowed + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(object_file_name) + values(object_file_path) + values(browser_process_name) as browser_process_name + by dest process_name process_path process_id EventCode isAllowed + + | rex field=process_name "(?[^\\\\]+)$" + | eval isMalicious=if(match(browser_process_name, extracted_process_name), "0", "1") + | where isMalicious=1 and isAllowed="false" + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_credential_access_from_browser_password_store_filter` how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." This search may trigger on a browser application that is not included in the browser_app_list lookup file. known_false_positives: The lookup file `browser_app_list` may not contain all the browser applications that are allowed to access the browser user data profiles. Consider updating the lookup files to add allowed object paths for the browser applications that are not included in the lookup file. references: @@ -29,7 +56,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: A non-common browser process $process_name$ accessing browser user data folder on $dest$ + message: A non-common browser process [$process_name$] accessing browser user data folder on $dest$ +threat_objects: + - field: process_name + type: process_name analytic_story: - StealC Stealer - Salt Typhoon diff --git a/detections/endpoint/windows_defender_asr_audit_events.yml b/detections/endpoint/windows_defender_asr_audit_events.yml index f6983833e1e..ad273795234 100644 --- a/detections/endpoint/windows_defender_asr_audit_events.yml +++ b/detections/endpoint/windows_defender_asr_audit_events.yml @@ -1,33 +1,46 @@ name: Windows Defender ASR Audit Events id: 0e4d46b1-22bd-4f0e-8337-ca6f60ad4bea -version: 9 +version: 10 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Anomaly -description: This detection searches for Windows Defender ASR audit events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR audit events that are generated when a process or application attempts to perform an action that would be blocked by an ASR rule, but is allowed to proceed for auditing purposes. +description: |- + This detection searches for ASR audit events that are generated when a process or application attempts to perform an action that would be blocked by an ASR rule, but is allowed to proceed for auditing purposes. data_source: - Windows Event Log Defender 1122 - Windows Event Log Defender 1125 - - Windows Event Log Defender 1126 - Windows Event Log Defender 1132 - Windows Event Log Defender 1134 search: |- - `ms_defender` EventCode IN (1122, 1125, 1126, 1132, 1134) - | stats count min(_time) as firstTime max(_time) as lastTime - BY host, Process_Name, Target_Commandline, - Path, ID, EventCode - | lookup asr_rules ID OUTPUT ASR_Rule - | fillnull value=NULL - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | rename host as dest - | `windows_defender_asr_audit_events_filter` + `ms_defender` + EventCode IN ( + 1122, + 1125, + 1132, + 1134 + ) + | fillnull value=NULL + | stats count min(_time) as firstTime + max(_time) as lastTime + by host EventCode + Parent_Commandline Process_Name Target_Commandline + Path ID RuleType + + | lookup local=t asr_rules ID OUTPUT ASR_Rule + + | rename host as dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_defender_asr_audit_events_filter` how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. Note that Audit and block Event IDs have different fields, therefore the analytic will need to be modified for each type of event. -known_false_positives: False positives are expected from legitimate applications generating events that are similar to those generated by malicious activity. For example, Event ID 1122 is generated when a process attempts to load a DLL that is blocked by an ASR rule. This can be triggered by legitimate applications that attempt to load DLLs that are not blocked by ASR rules. This is audit only. +known_false_positives: |- + Some false positives are expected initially as the ASR rules are tuned and configured. references: - https://asrgen.streamlit.app/ + - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-overview drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -42,7 +55,14 @@ intermediate_findings: - field: dest type: system score: 20 - message: ASR audit event, $ASR_Rule$, was triggered on $dest$. + message: The ASR audit event [$ASR_Rule$] was triggered on [$dest$]. +threat_objects: + - field: Parent_Commandline + type: parent_process + - field: Target_Commandline + type: process + - field: Process_Name + type: file_path analytic_story: - Windows Attack Surface Reduction asset_type: Endpoint diff --git a/detections/endpoint/windows_defender_asr_block_events.yml b/detections/endpoint/windows_defender_asr_block_events.yml index 8a05832e331..6d02f418c06 100644 --- a/detections/endpoint/windows_defender_asr_block_events.yml +++ b/detections/endpoint/windows_defender_asr_block_events.yml @@ -1,12 +1,14 @@ name: Windows Defender ASR Block Events id: 026f5f4e-e99f-4155-9e63-911ba587300b -version: 10 +version: 11 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Anomaly -description: This detection searches for Windows Defender ASR block events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR block events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule. Typically, these will be enabled in block most after auditing and tuning the ASR rules themselves. Set to TTP once tuned. +description: |- + This detection searches for ASR block events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule. + Typically, these will be enabled in block most after auditing and tuning the ASR rules themselves. data_source: - Windows Event Log Defender 1121 - Windows Event Log Defender 1126 @@ -14,20 +16,35 @@ data_source: - Windows Event Log Defender 1131 - Windows Event Log Defender 1133 search: |- - `ms_defender` EventCode IN (1121, 1126, 1129, 1131, 1133) - | stats count min(_time) as firstTime max(_time) as lastTime - BY host, Path, Parent_Commandline, - Process_Name, ID, EventCode - | lookup asr_rules ID OUTPUT ASR_Rule - | fillnull value=NULL - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | rename host as dest - | `windows_defender_asr_block_events_filter` -how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. Note that Audit and block Event IDs have different fields, therefore the analytic will need to be modified for each type of event. -known_false_positives: False positives are expected from legitimate applications generating events that are similar to those generated by malicious activity. For example, Event ID 1122 is generated when a process attempts to load a DLL that is blocked by an ASR rule. This can be triggered by legitimate applications that attempt to load DLLs that are not blocked by ASR rules. This is block only. + `ms_defender` + EventCode IN ( + 1121, + 1126, + 1129, + 1131, + 1133 + ) + | fillnull value=NULL + | stats count min(_time) as firstTime + max(_time) as lastTime + by host EventCode + Parent_Commandline Process_Name Target_Commandline + Path ID RuleType + + | lookup local=t asr_rules ID OUTPUT ASR_Rule + + | rename host as dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_defender_asr_block_events_filter` +how_to_implement: |- + The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. Note that Audit and block Event IDs have different fields, therefore the analytic will need to be modified for each type of event. +known_false_positives: |- + Some false positives are expected initially as the ASR rules are tuned and configured. references: - https://asrgen.streamlit.app/ + - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-overview drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -42,7 +59,14 @@ intermediate_findings: - field: dest type: system score: 20 - message: ASR block event, $ASR_Rule$, was triggered on $dest$. + message: The ASR block event [$ASR_Rule$] was triggered on [$dest$]. +threat_objects: + - field: Parent_Commandline + type: parent_process + - field: Target_Commandline + type: process + - field: Process_Name + type: file_path analytic_story: - Windows Attack Surface Reduction asset_type: Endpoint diff --git a/detections/endpoint/windows_defender_asr_registry_modification.yml b/detections/endpoint/windows_defender_asr_registry_modification.yml index 627268ebe1b..06c4bbcb8bb 100644 --- a/detections/endpoint/windows_defender_asr_registry_modification.yml +++ b/detections/endpoint/windows_defender_asr_registry_modification.yml @@ -1,15 +1,15 @@ name: Windows Defender ASR Registry Modification id: 6a1b6cbe-6612-44c3-92b9-1a1bd77412eb -version: 8 +version: 9 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting description: The following analytic detects modifications to Windows Defender Attack Surface Reduction (ASR) registry settings. It leverages Windows Defender Operational logs, specifically EventCode 5007, to identify changes in ASR rules. This activity is significant because ASR rules are designed to block actions commonly used by malware to exploit systems. Unauthorized modifications to these settings could indicate an attempt to weaken system defenses. If confirmed malicious, this could allow an attacker to bypass security measures, leading to potential system compromise and data breaches. data_source: - Windows Event Log Defender 5007 -search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" | rex field=Old_Value "0x(?\\d+)$" | rex field=New_Value "Rules\\\\(?[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") | stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID | lookup asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)`| rename host as dest | `security_content_ctime(lastTime)` | `windows_defender_asr_registry_modification_filter`' +search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" | rex field=Old_Value "0x(?\\d+)$" | rex field=New_Value "Rules\\\\(?[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") | stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID | lookup local=t asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)`| rename host as dest | `security_content_ctime(lastTime)` | `windows_defender_asr_registry_modification_filter`' how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. known_false_positives: False positives are expected from legitimate applications generating events that are similar to those generated by malicious activity. For example, Event ID 5007 is generated when a process attempts to modify a registry key that is related to ASR rules. This can be triggered by legitimate applications that attempt to modify registry keys that are not blocked by ASR rules. references: diff --git a/detections/endpoint/windows_defender_asr_rule_disabled.yml b/detections/endpoint/windows_defender_asr_rule_disabled.yml index 29f4af1a665..eed3e8b8c5f 100644 --- a/detections/endpoint/windows_defender_asr_rule_disabled.yml +++ b/detections/endpoint/windows_defender_asr_rule_disabled.yml @@ -1,15 +1,15 @@ name: Windows Defender ASR Rule Disabled id: 429d611b-3183-49a7-b235-fc4203c4e1cb -version: 10 +version: 11 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: TTP description: The following analytic identifies when a Windows Defender ASR rule disabled events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR rule disabled events that are generated when an ASR rule is disabled. data_source: - Windows Event Log Defender 5007 -search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" | rex field=Old_Value "0x(?\\d+)$" | rex field=New_Value "Rules\\\\(?[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") | search New_Registry_Value="Disabled" | stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID | lookup asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| rename host as dest | `windows_defender_asr_rule_disabled_filter`' +search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" | rex field=Old_Value "0x(?\\d+)$" | rex field=New_Value "Rules\\\\(?[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") | search New_Registry_Value="Disabled" | stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID | lookup local=t asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| rename host as dest | `windows_defender_asr_rule_disabled_filter`' how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. known_false_positives: False positives may occur if applications are typically disabling ASR rules in the environment. Monitor for changes to ASR rules to determine if this is a false positive. references: diff --git a/detections/endpoint/windows_defender_asr_rules_stacking.yml b/detections/endpoint/windows_defender_asr_rules_stacking.yml index 780f6b19932..1f0d5b29282 100644 --- a/detections/endpoint/windows_defender_asr_rules_stacking.yml +++ b/detections/endpoint/windows_defender_asr_rules_stacking.yml @@ -1,8 +1,8 @@ name: Windows Defender ASR Rules Stacking id: 425a6657-c5e4-4cbb-909e-fc9e5d326f01 -version: 8 +version: 9 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting @@ -22,7 +22,7 @@ search: |- | stats count min(_time) as firstTime max(_time) as lastTime BY host Parent_Commandline, Process_Name, Path, ID, EventCode - | lookup asr_rules ID OUTPUT ASR_Rule + | lookup local=t asr_rules ID OUTPUT ASR_Rule | fillnull value=NULL | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml index ce9a6ee9814..f151287086b 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml @@ -1,15 +1,15 @@ name: Windows DLL Search Order Hijacking Hunt with Sysmon id: 79c7d1fc-64c7-91be-a616-ccda752efe81 -version: 12 +version: 13 creation_date: '2022-08-19' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting description: The following analytic identifies potential DLL search order hijacking or DLL sideloading by detecting known Windows libraries loaded from non-standard directories. It leverages Sysmon EventCode 7 to monitor DLL loads and cross-references them with a lookup of known hijackable libraries. This activity is significant as it may indicate an attempt to execute malicious code by exploiting DLL search order vulnerabilities. If confirmed malicious, this could allow attackers to gain code execution, escalate privileges, or maintain persistence within the environment. data_source: - Sysmon EventID 7 -search: '`sysmon` EventCode=7 NOT (process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*")) | lookup hijacklibs library AS loaded_file OUTPUT islibrary | search islibrary = True | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dll_search_order_hijacking_hunt_with_sysmon_filter`' +search: '`sysmon` EventCode=7 NOT (process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*")) | lookup local=t hijacklibs library AS loaded_file OUTPUT islibrary | search islibrary = True | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dll_search_order_hijacking_hunt_with_sysmon_filter`' how_to_implement: The search is written against the latest Sysmon TA 4.0 https://splunkbase.splunk.com/app/5709. For this specific event ID 7, the sysmon TA will extract the ImageLoaded name to the loaded_file field which is used in the search to compare against the hijacklibs lookup. known_false_positives: False positives will be present based on paths. Filter or add other paths to the exclusion as needed. Some applications may legitimately load libraries from non-standard paths. references: diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index bdd740f73b4..5c0981bdc1f 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -1,8 +1,8 @@ name: Windows Domain Admin Impersonation Indicator id: 10381f93-6d38-470a-9c30-d25478e3bd3f -version: 12 +version: 13 creation_date: '2023-10-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Mauricio Velazco, Splunk status: production type: TTP @@ -16,7 +16,7 @@ search: |- BY _time TargetUserName GroupMembership action app dest signature_id user vendor_product - | lookup domain_admins username as TargetUserName OUTPUT username + | lookup local=t domain_admins username as TargetUserName OUTPUT username | fillnull value=NotDA username | search username = "NotDA" | `windows_domain_admin_impersonation_indicator_filter` diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml index bf5c2622dda..eee16bce84a 100644 --- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml +++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml @@ -1,8 +1,8 @@ name: Windows DotNet Binary in Non Standard Path id: fddf3b56-7933-11ec-98a6-acde48001122 -version: 14 +version: 15 creation_date: '2022-01-20' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: TTP @@ -45,8 +45,8 @@ search: | | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup update=true is_net_windows_file filename as process_name OUTPUT netFile - | lookup update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile + | lookup local=t update=true is_net_windows_file filename as process_name OUTPUT netFile + | lookup local=t update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile | search netFile=true | `windows_dotnet_binary_in_non_standard_path_filter` how_to_implement: | diff --git a/detections/endpoint/windows_hosts_file_access.yml b/detections/endpoint/windows_hosts_file_access.yml index 04ee00db3d4..accdd50bec1 100644 --- a/detections/endpoint/windows_hosts_file_access.yml +++ b/detections/endpoint/windows_hosts_file_access.yml @@ -1,8 +1,8 @@ name: Windows Hosts File Access id: b34bcf35-5380-4b00-b208-5531303fb751 -version: 4 +version: 5 creation_date: '2026-03-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -29,7 +29,7 @@ search: | by _time object_file_path object_file_name dest process_name process_path process_id EventCode | eval process_path = lower(process_path) - | lookup browser_process_and_path browser_process_path as process_path OUTPUT is_valid_browser_path + | lookup local=t browser_process_and_path browser_process_path as process_path OUTPUT is_valid_browser_path | eval is_valid_browser_path=coalesce(is_valid_browser_path,"false") | where is_valid_browser_path = "false" | `security_content_ctime(firstTime)` diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml index a839ad24519..e6477a71bc9 100644 --- a/detections/endpoint/windows_identify_protocol_handlers.yml +++ b/detections/endpoint/windows_identify_protocol_handlers.yml @@ -1,8 +1,8 @@ name: Windows Identify Protocol Handlers id: bd5c311e-a6ea-48ae-a289-19a3398e3648 -version: 10 +version: 11 creation_date: '2022-07-12' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting @@ -23,7 +23,7 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` - | lookup windows_protocol_handlers handler AS process OUTPUT handler ishandler + | lookup local=t windows_protocol_handlers handler AS process OUTPUT handler ishandler | where ishandler="TRUE" | `windows_identify_protocol_handlers_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. diff --git a/detections/endpoint/windows_important_audit_policy_disabled.yml b/detections/endpoint/windows_important_audit_policy_disabled.yml index b9eb4aba48b..ad0f602c9e0 100644 --- a/detections/endpoint/windows_important_audit_policy_disabled.yml +++ b/detections/endpoint/windows_important_audit_policy_disabled.yml @@ -1,8 +1,8 @@ name: Windows Important Audit Policy Disabled id: 1bf500e5-1226-41d9-af5d-ed1f577929f2 -version: 8 +version: 9 creation_date: '2025-02-19' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -16,7 +16,7 @@ search: |- | rename ClientProcessId as process_id | stats min(_time) as _time values(host) as dest BY AuditPolicyChanges SubcategoryGuid, process_id - | lookup advanced_audit_policy_guids GUID as SubcategoryGuid OUTPUT Category SubCategory + | lookup local=t advanced_audit_policy_guids GUID as SubcategoryGuid OUTPUT Category SubCategory | `windows_important_audit_policy_disabled_filter` how_to_implement: To implement the following query, enable the audit policy sub category "Audit Audit Policy Change", and, ensure you are ingesting EventCode `4719` from your endpoints via the appropriate Splunk Add-on for Microsoft Windows. Update the macro definition with the an accurate list of Audit sub categories that you consider important for your environment. known_false_positives: No false positives have been identified at this time. diff --git a/detections/endpoint/windows_kerberos_local_successful_logon.yml b/detections/endpoint/windows_kerberos_local_successful_logon.yml index f056478f50a..af3fb835060 100644 --- a/detections/endpoint/windows_kerberos_local_successful_logon.yml +++ b/detections/endpoint/windows_kerberos_local_successful_logon.yml @@ -1,8 +1,8 @@ name: Windows Kerberos Local Successful Logon id: 8309c3a8-4d34-48ae-ad66-631658214653 -version: 15 +version: 16 creation_date: '2022-04-28' -modification_date: '2026-07-27' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: TTP @@ -31,7 +31,7 @@ search: |- src_port status subject user user_group vendor_product - | lookup update=true domain_controllers sAMAccountName as dest OUTPUT isDC + | lookup local=t update=true domain_controllers sAMAccountName as dest OUTPUT isDC | where isnull(isDC) | fields - isDC diff --git a/detections/endpoint/windows_known_abused_dll_created.yml b/detections/endpoint/windows_known_abused_dll_created.yml index 56dbfd3b2e1..e480094ba54 100644 --- a/detections/endpoint/windows_known_abused_dll_created.yml +++ b/detections/endpoint/windows_known_abused_dll_created.yml @@ -1,15 +1,15 @@ name: Windows Known Abused DLL Created id: ea91651a-772a-4b02-ac3d-985b364a5f07 -version: 11 +version: 12 creation_date: '2024-03-20' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly description: The following analytic identifies the creation of Dynamic Link Libraries (DLLs) with a known history of exploitation in atypical locations. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and filesystem events. This activity is significant as it may indicate DLL search order hijacking or sideloading, techniques used by attackers to execute arbitrary code, maintain persistence, or escalate privileges. If confirmed malicious, this activity could allow attackers to blend in with legitimate operations, posing a severe threat to system integrity and security. data_source: - Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\users\\*","*\\Windows\Temp\\*","*\\programdata\\*") Filesystem.file_name="*.dll" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | lookup hijacklibs_loaded library AS file_name OUTPUT islibrary, ttp, comment as desc | lookup hijacklibs_loaded library AS file_name excludes as file_path OUTPUT islibrary as excluded | search islibrary = TRUE AND excluded != TRUE | where isnotnull(file_name) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_known_abused_dll_created_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\users\\*","*\\Windows\Temp\\*","*\\programdata\\*") Filesystem.file_name="*.dll" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | lookup local=t hijacklibs_loaded library AS file_name OUTPUT islibrary, ttp, comment as desc | lookup local=t hijacklibs_loaded library AS file_name excludes as file_path OUTPUT islibrary as excluded | search islibrary = TRUE AND excluded != TRUE | where isnotnull(file_name) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_known_abused_dll_created_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` and `Filesystem` nodes of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: This analytic may flag instances where DLLs are loaded by user mode programs for entirely legitimate and benign purposes. It is important for users to be aware that false positives are not only possible but likely, and that careful tuning of this analytic is necessary to distinguish between malicious activity and normal, everyday operations of applications. This may involve adjusting thresholds, whitelisting known good software, or incorporating additional context from other security tools and logs to reduce the rate of false positives. references: diff --git a/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml b/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml index 22ae61333d5..cdede1c4363 100644 --- a/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml +++ b/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml @@ -1,17 +1,128 @@ name: Windows Known Abused DLL Loaded Suspiciously id: dd6d1f16-adc0-4e87-9c34-06189516b803 -version: 12 +version: 13 creation_date: '2024-04-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP -description: The following analytic detects when DLLs with known abuse history are loaded from an unusual location. This activity may represent an attacker performing a DLL search order or sideload hijacking technique. These techniques are used to gain persistence as well as elevate privileges on the target system. This detection relies on Sysmon EID7 and is compatible with all Officla Sysmon TA versions. +description: |- + The following analytic detects when DLLs with known abuse history are loaded from an unusual location. + This activity may represent an attacker performing a DLL search order or sideload hijacking technique. + These techniques are used to gain persistence as well as elevate privileges on the target system. data_source: - Sysmon EventID 7 -search: '`sysmon` ImageLoaded EventCode=7 NOT ImageLoaded IN ("*\\Program Files*","*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*") | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest process_exec process_guid process_hash process_id process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product loaded_file | rename Image as process | eval process_name = case(isnotnull(process),replace(process,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)","")), loaded_file_path = case(isnotnull(loaded_file), replace(loaded_file, "(:[\w\. ]+)", "")), loaded_file = case(isnotnull(loaded_file),replace(loaded_file,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)","")), user = case(NOT user IN ("-"), replace(user, "(.*)\\\(.+)$","\2")) | lookup hijacklibs_loaded library AS loaded_file OUTPUT islibrary comment as desc | lookup hijacklibs_loaded library AS loaded_file excludes as loaded_file_path OUTPUT islibrary as excluded | search islibrary = TRUE AND excluded = false | stats count min(_time) as firstTime max(_time) as lastTime by dest loaded_file loaded_file_path process process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_known_abused_dll_loaded_suspiciously_filter`' -how_to_implement: The following analytic requires Sysmon operational logs to be imported, with EID7 being mapped to the process_name field. Modify the sysmon macro as needed to match the sourcetype or add index. -known_false_positives: DLLs being loaded by user mode programs for legitimate reasons. +search: |- + `sysmon` + ImageLoaded + EventCode=7 + + NOT ImageLoaded IN ( + "C:\\$WINDOWS.~BT\\*", + "C:\\$WinREAgent\\*", + "C:\\Windows\\SoftwareDistribution\\*", + "C:\\Windows\\SyChpe32\\*", + "C:\\Windows\\System32\\*", + "C:\\Windows\\SystemTemp\\*", + "C:\\Windows\\SysWOW64\\*", + "C:\\Windows\\WinSxS\\*" + ) + + NOT ( + ImageLoaded="C:\\Windows\\Temp\\*" + Image IN ( + "C:\\Windows\\WinSxS\\arm64*", + "C:\\Windows\\UUS\\arm64\\*" + ) + Image IN ( + "*\\TiWorker.exe", + "*\\wuaucltcore.exe" + ) + ) + + NOT ( + ImageLoaded="C:\\Windows\\Microsoft.NET\\*" + ImageLoaded="*\\cscui.dll" + ) + + NOT ( + ImageLoaded="C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*" + ImageLoaded="*\\version.dll" + ) + + NOT ( + ImageLoaded="C:\\Program Files\\WindowsApps\\Microsoft.DirectXRuntime_*" + ImageLoaded="*\\d3dx9_43.dll" + ) + + NOT ImageLoaded="C:\\Windows\\ImmersiveControlPanel\\SystemSettings.dll" + + NOT ( + ImageLoaded="C:\\Program Files\\Microsoft\\Exchange Server\\*" + ImageLoaded="*\\mswb7.dll" + ) + + NOT ( + ImageLoaded="C:\\Program Files\\Arsenal-Image-Mounter-*" + ImageLoaded IN ( + "*\\mi.dll", + "*\\miutils.dll" + ) + ) + + NOT ( + Image="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" + ImageLoaded="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" + ) + + NOT ImageLoaded="C:\\Packages\\Plugins\\Microsoft.GuestConfiguration.ConfigurationforWindows\\*" + + NOT ( + Image IN ( + "C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs*", + "C:\\Windows\\System32\\backgroundTaskHost.exe" + ) + ImageLoaded="C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs*" + ) + + NOT ( + ImageLoaded="C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs\\*" + ImageLoaded="*\\wldp.dll" + ) + + NOT ( + Image IN ( + "C:\\Program Files\\CheckPoint\\*", + "C:\\Program Files (x86)\\CheckPoint\\*" + ) + Image="*\\SmartConsole.exe" + ImageLoaded IN ( + "C:\\Program Files\\CheckPoint\\*", + "C:\\Program Files (x86)\\CheckPoint\\*" + ) + ImageLoaded="*\\PolicyManager.dll" + ) + + | lookup local=t hijacklibs_loaded library AS loaded_file OUTPUT islibrary comment as reference + | lookup local=t hijacklibs_loaded library AS loaded_file excludes AS loaded_file_path OUTPUT islibrary AS excluded + | where islibrary="TRUE" AND excluded="false" + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by dest loaded_file loaded_file_path process_exec + process_guid process_hash process_id process_name + process_path service_dll_signature_exists + service_dll_signature_verified signature + signature_id user user_id reference vendor_product + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_known_abused_dll_loaded_suspiciously_filter` +how_to_implement: |- + The following analytic requires Sysmon operational logs to be ingested, with EventID 7 being mapped to the process_name field. Modify the sysmon macro as needed to match the sourcetype or add index. +known_false_positives: |- + False positives are expected from third party applications and other legitimate system processes located in Program Files and other similar locations. Filter as needed. references: - https://attack.mitre.org/techniques/T1574/002/ - https://hijacklibs.net/api/ @@ -27,11 +138,16 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: The module [$loaded_file$] was loaded from an unusual location. + title: The module [$loaded_file$] was loaded from an unusual location [$loaded_file_path$] on [$dest$]. Which may indicate a DLL search order or sideload hijacking technique. entity: field: dest type: system score: 50 +threat_objects: + - field: process_path + type: file_path + - field: loaded_file_path + type: file_path analytic_story: - SolarWinds WHD RCE Post Exploitation - Windows Defense Evasion Tactics diff --git a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml b/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml index de0367bd262..93cd636e66b 100644 --- a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml +++ b/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml @@ -1,8 +1,8 @@ name: Windows LOLBAS Executed As Renamed File id: fd496996-7d9e-4894-8d40-bb85b6192dc6 -version: 10 +version: 11 creation_date: '2024-05-03' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP @@ -11,7 +11,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` latest(Processes.parent_process) as parent_process, latest(Processes.process) as process, latest(Processes.process_guid) as process_guid count, min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes where NOT Processes.original_file_name IN("-","unknown") AND NOT Processes.process_path IN ("*\\Program Files*","*\\PROGRA~*","*\\Windows\\System32\\*","*\\Windows\\Syswow64\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product |`drop_dm_object_name(Processes)` | where NOT match(process_name, "(?i)".original_file_name) | lookup lolbas_file_path lolbas_file_name as original_file_name OUTPUT description as desc | search desc!="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_lolbas_executed_as_renamed_file_filter`' +search: '| tstats `security_content_summariesonly` latest(Processes.parent_process) as parent_process, latest(Processes.process) as process, latest(Processes.process_guid) as process_guid count, min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes where NOT Processes.original_file_name IN("-","unknown") AND NOT Processes.process_path IN ("*\\Program Files*","*\\PROGRA~*","*\\Windows\\System32\\*","*\\Windows\\Syswow64\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product |`drop_dm_object_name(Processes)` | where NOT match(process_name, "(?i)".original_file_name) | lookup local=t lolbas_file_path lolbas_file_name as original_file_name OUTPUT description as desc | search desc!="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_lolbas_executed_as_renamed_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: A certain amount of false positives are likely with this detection. MSI based installers often trigger for SETUPAPL.dll and vendors will often copy system exectables to a different path for application usage. references: diff --git a/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml b/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml index 6f917fe2492..24259e1e79e 100644 --- a/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml +++ b/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml @@ -1,8 +1,8 @@ name: Windows LOLBAS Executed Outside Expected Path id: 326fdf44-b90c-4d2e-adca-1fd140b10536 -version: 10 +version: 11 creation_date: '2024-05-03' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -36,8 +36,8 @@ search: | Processes.process_path Processes.user Processes.user_id Processes.vendor_product |`drop_dm_object_name(Processes)` - | lookup lolbas_file_path lolbas_file_name as process_name OUTPUT description as desc - | lookup lolbas_file_path lolbas_file_name as process_name lolbas_file_path as process_path OUTPUT description as is_lolbas_path + | lookup local=t lolbas_file_path lolbas_file_name as process_name OUTPUT description as desc + | lookup local=t lolbas_file_path lolbas_file_name as process_name lolbas_file_path as process_path OUTPUT description as is_lolbas_path | search desc!="false" AND is_lolbas_path="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index 5900bb891c8..41f70c18715 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -1,8 +1,8 @@ name: Windows NirSoft Utilities id: 5b2f4596-7d4c-11ec-88a7-acde48001122 -version: 10 +version: 11 creation_date: '2022-01-24' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting @@ -29,7 +29,7 @@ search: | | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile + | lookup local=t update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile | search nirsoftFile=true | `windows_nirsoft_utilities_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. diff --git a/detections/endpoint/windows_powershell_process_with_malicious_string.yml b/detections/endpoint/windows_powershell_process_with_malicious_string.yml index b9e7b2e5fa3..3093678429b 100644 --- a/detections/endpoint/windows_powershell_process_with_malicious_string.yml +++ b/detections/endpoint/windows_powershell_process_with_malicious_string.yml @@ -1,8 +1,8 @@ name: Windows PowerShell Process With Malicious String id: 5df35d50-e1a3-4a52-a337-92e69d9b1b8a -version: 9 +version: 10 creation_date: '2025-01-13' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP @@ -24,7 +24,7 @@ search: |- | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup malicious_powershell_strings command as process + | lookup local=t malicious_powershell_strings command as process | where isnotnull(match) | `windows_powershell_process_with_malicious_string_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. diff --git a/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml b/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml index bda2aaccd74..8556e4f6761 100644 --- a/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml +++ b/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml @@ -1,15 +1,15 @@ name: Windows PowerShell Script Block With Malicious String id: 0f09cedd-10f1-4b9f-bdea-7a8b06ea575d -version: 7 +version: 8 creation_date: '2025-01-13' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP description: The following analytic detects the execution of multiple offensive toolkits and commands by leveraging PowerShell Script Block Logging (EventCode=4104). This method captures and logs the full command sent to PowerShell, allowing for the identification of suspicious activities including several well-known tools used for credential theft, lateral movement, and persistence. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the environment. data_source: - Powershell Script Block Logging 4104 -search: '`powershell` ScriptBlockText=* EventCode=4104 | stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command values(Guid) as Guid values(Opcode) as Opcode values(Name) as Name values(Path) as Path values(ProcessID) as ProcessID values(ScriptBlockId) as ScriptBlockId values(ScriptBlockText) as ScriptBlockText by dest signature signature_id user_id vendor_product | eval command = mvjoin(command,"\n") | lookup malicious_powershell_strings command | where isnotnull(match) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_script_block_with_malicious_string_filter`' +search: '`powershell` ScriptBlockText=* EventCode=4104 | stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command values(Guid) as Guid values(Opcode) as Opcode values(Name) as Name values(Path) as Path values(ProcessID) as ProcessID values(ScriptBlockId) as ScriptBlockId values(ScriptBlockText) as ScriptBlockText by dest signature signature_id user_id vendor_product | eval command = mvjoin(command,"\n") | lookup local=t malicious_powershell_strings command | where isnotnull(match) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_script_block_with_malicious_string_filter`' how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. known_false_positives: No false positives have been identified at this time. commands with overlap. references: diff --git a/detections/endpoint/windows_pua_named_pipe.yml b/detections/endpoint/windows_pua_named_pipe.yml index bbcf80eff0a..68a592e092c 100644 --- a/detections/endpoint/windows_pua_named_pipe.yml +++ b/detections/endpoint/windows_pua_named_pipe.yml @@ -1,8 +1,8 @@ name: Windows PUA Named Pipe id: 95b11d20-e2c6-46a5-b526-8629f5f0860a -version: 5 +version: 6 creation_date: '2025-12-08' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: Anomaly @@ -38,7 +38,7 @@ search: | count by dest dvc process_exec process_guid process_id process_path signature signature_id vendor_product pipe_name user_id Image process_name - | lookup pua_named_pipes pua_pipe_name AS pipe_name OUTPUT tool, description + | lookup local=t pua_named_pipes pua_pipe_name AS pipe_name OUTPUT tool, description | where isnotnull(tool) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_rmm_named_pipe.yml b/detections/endpoint/windows_rmm_named_pipe.yml index 9e40b67134e..fdb9a4bf18e 100644 --- a/detections/endpoint/windows_rmm_named_pipe.yml +++ b/detections/endpoint/windows_rmm_named_pipe.yml @@ -1,8 +1,8 @@ name: Windows RMM Named Pipe id: c07c7138-edf5-4a16-8b24-3842599235bf -version: 5 +version: 6 creation_date: '2025-12-08' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: Anomaly @@ -37,7 +37,7 @@ search: | count by dest dvc process_exec process_guid process_id process_path signature signature_id vendor_product pipe_name user_id Image process_name - | lookup suspicious_rmm_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, description + | lookup local=t suspicious_rmm_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, description | where isnotnull(tool) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml index 8b118547037..876973cadb7 100644 --- a/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml @@ -1,8 +1,8 @@ name: Windows Scheduled Task with Suspicious Command id: 1f44c126-c26a-4dd3-83bb-0f9a0f03ecc3 -version: 9 +version: 10 creation_date: '2025-02-07' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP @@ -11,7 +11,7 @@ data_source: - Windows Event Log Security 4698 - Windows Event Log Security 4700 - Windows Event Log Security 4702 -search: "`wineventlog_security` EventCode IN (4698,4700,4702)\n| eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent)\n| xmlkv TaskContent\n| stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, TaskName, Command, Enabled, Hidden, EventCode\n| lookup windows_suspicious_tasks task_command as Command \n| where tool == \"shell command use\" OR tool == \"suspicious paths\"\n| eval command=TaskName, process=Command+if(isnotnull(Arguments),\" \".Arguments,\"\"), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode \n| `security_content_ctime(firstTime)` \n| `security_content_ctime(lastTime)`\n| `windows_scheduled_task_with_suspicious_command_filter` " +search: "`wineventlog_security` EventCode IN (4698,4700,4702)\n| eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent)\n| xmlkv TaskContent\n| stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, TaskName, Command, Enabled, Hidden, EventCode\n| lookup local=t windows_suspicious_tasks task_command as Command \n| where tool == \"shell command use\" OR tool == \"suspicious paths\"\n| eval command=TaskName, process=Command+if(isnotnull(Arguments),\" \".Arguments,\"\"), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode \n| `security_content_ctime(firstTime)` \n| `security_content_ctime(lastTime)`\n| `windows_scheduled_task_with_suspicious_command_filter` " how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. Windows Defender, Google Chrome, and MS Edge updates may trigger this detection. references: diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml index 872660b4e0d..e4e43f175d1 100644 --- a/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml @@ -1,8 +1,8 @@ name: Windows Scheduled Task with Suspicious Name id: 9e9ab4e3-c9d0-4967-a197-6d755e8a7e6e -version: 9 +version: 10 creation_date: '2025-02-07' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP @@ -16,7 +16,7 @@ search: |- | eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent) | xmlkv TaskContent | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, TaskName, Command, Enabled, Hidden,Caller_User_Name, EventCode - | lookup windows_suspicious_tasks task_name as TaskName + | lookup local=t windows_suspicious_tasks task_name as TaskName | where isnotnull(tool_type) | eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer | `security_content_ctime(firstTime)` diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_name.yml b/detections/endpoint/windows_service_created_with_suspicious_service_name.yml index feff939ffab..99789981a91 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_name.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_name.yml @@ -1,8 +1,8 @@ name: Windows Service Created with Suspicious Service Name id: 35eb6d19-a497-400c-93c5-645562804b11 -version: 9 +version: 10 creation_date: '2025-02-07' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -14,7 +14,7 @@ search: |- | stats values(ImagePath) as process, count, min(_time) as firstTime, max(_time) as lastTime values(EventCode) as signature by Computer, ServiceName, StartType, ServiceType, UserID | eval process_name = replace(mvindex(split(process,"\\"),-1), "\"", "") | rename Computer as dest, ServiceName as object_name, ServiceType as object_type, UserID as user_id - | lookup windows_suspicious_services service_name as object_name + | lookup local=t windows_suspicious_services service_name as object_name | where isnotnull(tool_name) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_suspicious_c2_named_pipe.yml b/detections/endpoint/windows_suspicious_c2_named_pipe.yml index 270a890fcb7..1654dfc0f83 100644 --- a/detections/endpoint/windows_suspicious_c2_named_pipe.yml +++ b/detections/endpoint/windows_suspicious_c2_named_pipe.yml @@ -1,8 +1,8 @@ name: Windows Suspicious C2 Named Pipe id: 90599d85-dc2a-4d4c-8c59-9485c3665828 -version: 6 +version: 7 creation_date: '2025-12-08' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: TTP @@ -37,7 +37,7 @@ search: | count by dest dvc process_exec process_guid process_id process_path signature signature_id vendor_product pipe_name user_id Image process_name - | lookup suspicious_c2_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, description + | lookup local=t suspicious_c2_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, description | where isnotnull(tool) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_suspicious_named_pipe.yml b/detections/endpoint/windows_suspicious_named_pipe.yml index c77859e3b85..38cc4205615 100644 --- a/detections/endpoint/windows_suspicious_named_pipe.yml +++ b/detections/endpoint/windows_suspicious_named_pipe.yml @@ -1,8 +1,8 @@ name: Windows Suspicious Named Pipe id: 3a76d52f-a007-4a65-a37d-f313c2c83f31 -version: 5 +version: 6 creation_date: '2025-12-08' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: TTP @@ -38,7 +38,7 @@ search: | count by dest dvc process_exec process_guid process_id process_path pipe_name user_id process_name signature signature_id vendor_product - | lookup suspicious_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, type, description + | lookup local=t suspicious_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, type, description | where isnotnull(tool) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_vulnerable_driver_installed.yml b/detections/endpoint/windows_vulnerable_driver_installed.yml index 4884e5dd26e..6f5d12c6d4d 100644 --- a/detections/endpoint/windows_vulnerable_driver_installed.yml +++ b/detections/endpoint/windows_vulnerable_driver_installed.yml @@ -1,8 +1,8 @@ name: Windows Vulnerable Driver Installed id: 1dda7586-57be-4a1b-8de1-a9ad802b9a7f -version: 11 +version: 12 creation_date: '2020-01-19' -modification_date: '2026-09-08' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -12,7 +12,7 @@ data_source: search: |- `wineventlog_system` EventCode=7045 ServiceType="kernel mode driver" | table _time dest EventCode ImagePath ServiceName ServiceType - | lookup loldrivers driver_name AS ImagePath OUTPUT is_driver driver_description + | lookup local=t loldrivers driver_name AS ImagePath OUTPUT is_driver driver_description | search is_driver = TRUE | `windows_vulnerable_driver_installed_filter` how_to_implement: Ensure the Splunk is collecting XmlWinEventLog:System events and the EventCode 7045 is being ingested. diff --git a/detections/endpoint/windows_vulnerable_driver_loaded.yml b/detections/endpoint/windows_vulnerable_driver_loaded.yml index 8f9d32b5501..26fcf996f6b 100644 --- a/detections/endpoint/windows_vulnerable_driver_loaded.yml +++ b/detections/endpoint/windows_vulnerable_driver_loaded.yml @@ -1,8 +1,8 @@ name: Windows Vulnerable Driver Loaded id: a2b1f1ef-221f-4187-b2a4-d4b08ec745f4 -version: 10 +version: 11 creation_date: '2022-12-31' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting @@ -15,7 +15,7 @@ search: |- BY ImageLoaded dest dvc process_hash process_path signature signature_id user_id vendor_product - | lookup loldrivers driver_name AS ImageLoaded OUTPUT is_driver driver_description + | lookup local=t loldrivers driver_name AS ImageLoaded OUTPUT is_driver driver_description | search is_driver = TRUE | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/network/3cx_supply_chain_attack_network_indicators.yml b/detections/network/3cx_supply_chain_attack_network_indicators.yml index 6c02019581c..946c2451347 100644 --- a/detections/network/3cx_supply_chain_attack_network_indicators.yml +++ b/detections/network/3cx_supply_chain_attack_network_indicators.yml @@ -1,8 +1,8 @@ name: 3CX Supply Chain Attack Network Indicators id: 791b727c-deec-4fbe-a732-756131b3c5a1 -version: 11 +version: 12 creation_date: '2023-04-11' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: TTP @@ -22,7 +22,7 @@ search: | | `drop_dm_object_name(DNS)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup 3cx_ioc_domains domain as query OUTPUT Description isIOC + | lookup local=t 3cx_ioc_domains domain as query OUTPUT Description isIOC | search isIOC=true | `3cx_supply_chain_attack_network_indicators_filter` how_to_implement: To successfully implement this search you need to be ingesting information into the `Network Resolution` datamodel in the `DNS` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA''s are installed. diff --git a/detections/network/cisco_secure_firewall___binary_file_type_download.yml b/detections/network/cisco_secure_firewall___binary_file_type_download.yml index 52fa1549919..1eb6a299ddb 100644 --- a/detections/network/cisco_secure_firewall___binary_file_type_download.yml +++ b/detections/network/cisco_secure_firewall___binary_file_type_download.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Binary File Type Download id: 24b2c2e3-2ff7-4a23-b814-87f8a62028cd -version: 8 +version: 9 creation_date: '2025-04-09' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -16,7 +16,7 @@ data_source: search: | `cisco_secure_firewall` EventType=FileEvent FileDirection="Download" FileType IN ("ISHIELD_MSI", "BINHEX", "BINARY_DATA", "ELF", "MACHO", "JARPACK", "TORRENT", "AUTORUN", "EICAR", "LNK", "SCR", "UNIX_SCRIPT") - | lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description + | lookup local=t cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description | stats count min(_time) as firstTime max(_time) as lastTime values(uri) as uri values(ClientApplication) as ClientApplication diff --git a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml index 7103a3112fe..68cbf8d2749 100644 --- a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml +++ b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint id: c43f7b49-2dab-4e76-892e-7f971c2f20f1 -version: 7 +version: 8 creation_date: '2025-04-03' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -12,7 +12,7 @@ data_source: - Cisco Secure Firewall Threat Defense Connection Event search: | `cisco_secure_firewall` EventType=* SSL_CertFingerprint=* - | lookup sslbl_ssl_certificate_blacklist SHA1 as SSL_CertFingerprint OUTPUT Listingdate, Listingreason + | lookup local=t sslbl_ssl_certificate_blacklist SHA1 as SSL_CertFingerprint OUTPUT Listingdate, Listingreason | where isnotnull(Listingreason) | stats min(_time) as firstTime max(_time) as lastTime values(dest) as dest diff --git a/detections/network/cisco_secure_firewall___file_download_over_uncommon_port.yml b/detections/network/cisco_secure_firewall___file_download_over_uncommon_port.yml index 301f42145e7..a6b4cb4e230 100644 --- a/detections/network/cisco_secure_firewall___file_download_over_uncommon_port.yml +++ b/detections/network/cisco_secure_firewall___file_download_over_uncommon_port.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - File Download Over Uncommon Port id: f26445a8-a6a2-4855-bec0-0c39e52e5b8f -version: 8 +version: 9 creation_date: '2025-04-09' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -12,7 +12,7 @@ data_source: - Cisco Secure Firewall Threat Defense File Event search: | `cisco_secure_firewall` EventType=FileEvent FileDirection="Download" NOT dest_port IN (80, 443) - | lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description + | lookup local=t cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description | stats count min(_time) as firstTime max(_time) as lastTime values(file_name) as file_name values(uri) as uri diff --git a/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml b/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml index 871d3190a60..518f8f97ff4 100644 --- a/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml +++ b/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Intrusion Events by Threat Activity id: b71e57e8-c571-4ff1-ae13-bc4384a9e891 -version: 10 +version: 11 creation_date: '2025-05-12' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Bhavin Patel, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -40,11 +40,11 @@ data_source: search: | `cisco_secure_firewall` EventType=IntrusionEvent | stats count AS total_alerts, dc(signature_id) AS sig_count, values(SnortRuleGroups) AS snort_rule_groups, values(connection_id) AS connection_id, values(rule) AS rule, values(dest_port) AS dest_port, values(transport) AS transport, values(app) AS app, values(signature) AS signature, values(src) AS src BY _time dest signature_id - | lookup cisco_snort_ids_to_threat_mapping signature_id OUTPUT threat, category, message + | lookup local=t cisco_snort_ids_to_threat_mapping signature_id OUTPUT threat, category, message | where isnotnull(threat) | bin _time span=1d | stats count AS Total_Alerts, dc(signature_id) AS sig_count, values(signature_id) AS signature_id, values(category) AS category, values(message) AS message, values(snort_rule_groups) AS snort_rule_groups, values(connection_id) AS connection_id, values(rule) AS rule, values(dest_port) AS dest_port, values(transport) AS transport, values(app) AS app, values(signature) AS signature, values(src) AS src BY _time dest threat - | lookup threat_snort_count threat OUTPUT description, distinct_count_snort_ids + | lookup local=t threat_snort_count threat OUTPUT description, distinct_count_snort_ids | table _time, dest, src, threat, category, message, description, signature_id, signature, snort_rule_groups, sig_count, distinct_count_snort_ids, connection_id, rule, dest_port, transport, app | where sig_count >= distinct_count_snort_ids | `cisco_secure_firewall___intrusion_events_by_threat_activity_filter` diff --git a/detections/network/cisco_secure_firewall___malware_file_downloaded.yml b/detections/network/cisco_secure_firewall___malware_file_downloaded.yml index c4280c02106..b32cf7b6ae5 100644 --- a/detections/network/cisco_secure_firewall___malware_file_downloaded.yml +++ b/detections/network/cisco_secure_firewall___malware_file_downloaded.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Malware File Downloaded id: 3cc93f52-5aa6-4b7f-83b9-3430b1436813 -version: 8 +version: 9 creation_date: '2025-04-09' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -12,7 +12,7 @@ data_source: - Cisco Secure Firewall Threat Defense File Event search: | `cisco_secure_firewall` EventType=FileEvent SHA_Disposition="Malware" FileDirection="Download" - | lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description + | lookup local=t cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description | stats count min(_time) as firstTime max(_time) as lastTime values(uri) as uri values(ClientApplication) as ClientApplication diff --git a/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml b/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml index 64793a40b67..8b32c0275e8 100644 --- a/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml +++ b/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Remote Access Software Usage Traffic id: ac54d39e-a75d-4f42-971d-006db3a0423a -version: 9 +version: 10 creation_date: '2025-05-28' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -26,7 +26,7 @@ search: | count by src ClientApplication action | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools appName AS ClientApplication OUTPUT category, appDescription as Description + | lookup local=t cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools appName AS ClientApplication OUTPUT category, appDescription as Description | search category IN ("remote administration", "remote desktop control") | `remote_access_software_usage_exceptions` | `cisco_secure_firewall___remote_access_software_usage_traffic_filter` diff --git a/detections/network/cisco_secure_firewall___repeated_malware_downloads.yml b/detections/network/cisco_secure_firewall___repeated_malware_downloads.yml index 12bf62ba6f7..972b7aeb41c 100644 --- a/detections/network/cisco_secure_firewall___repeated_malware_downloads.yml +++ b/detections/network/cisco_secure_firewall___repeated_malware_downloads.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Repeated Malware Downloads id: aeff2bb5-3483-48d4-9be8-c8976194be1e -version: 10 +version: 11 creation_date: '2025-04-09' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -12,7 +12,7 @@ data_source: - Cisco Secure Firewall Threat Defense File Event search: | `cisco_secure_firewall` EventType=FileEvent SHA_Disposition="Malware" FileDirection="Download" - | lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description + | lookup local=t cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description | bin _time span=5m | stats count min(_time) as firstTime max(_time) as lastTime values(uri) as uri diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml index 6d14e36bc2c..c3a4f069d99 100644 --- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml +++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml @@ -1,8 +1,8 @@ name: Detect hosts connecting to dynamic domain providers id: a1e761ac-1344-4dbd-88b2-3f34c912d359 -version: 13 +version: 14 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Bhavin Patel, Splunk status: production type: TTP @@ -18,8 +18,8 @@ search: | DNS.reply_code_id DNS.src DNS.vendor_product | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` - | lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default - | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local + | lookup local=t update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default + | lookup local=t update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local | eval isDynDNS = coalesce(isDynDNS_local,isDynDNS_default) |fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True | `detect_hosts_connecting_to_dynamic_domain_providers_filter` diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml index 1171d0c58f2..dc927f67a6f 100644 --- a/detections/network/detect_remote_access_software_usage_dns.yml +++ b/detections/network/detect_remote_access_software_usage_dns.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage DNS id: a16b797d-e309-41bd-8ba0-5067dae2e4be -version: 14 +version: 15 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -22,7 +22,7 @@ search: | | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup remote_access_software remote_domain AS query OUTPUT isutility, description as signature, + | lookup local=t remote_access_software remote_domain AS query OUTPUT isutility, description as signature, comment_reference as desc, category | eval dest = query | search isutility = True diff --git a/detections/network/detect_remote_access_software_usage_traffic.yml b/detections/network/detect_remote_access_software_usage_traffic.yml index 17fe2236b8d..f0883920752 100644 --- a/detections/network/detect_remote_access_software_usage_traffic.yml +++ b/detections/network/detect_remote_access_software_usage_traffic.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage Traffic id: 885ea672-07ee-475a-879e-60d28aa5dd42 -version: 16 +version: 17 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -30,7 +30,7 @@ search: | | `drop_dm_object_name("All_Traffic")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup remote_access_software remote_appid AS app OUTPUT isutility, description as signature, comment_reference as desc, category + | lookup local=t remote_access_software remote_appid AS app OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_traffic_filter` diff --git a/detections/network/http_c2_framework_user_agent.yml b/detections/network/http_c2_framework_user_agent.yml index a442d265c5b..db8c77cf01a 100644 --- a/detections/network/http_c2_framework_user_agent.yml +++ b/detections/network/http_c2_framework_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP C2 Framework User Agent id: 229dc225-6abe-4d28-89fd-edf874086162 -version: 5 +version: 6 creation_date: '2026-01-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Ravent Tait, Splunk status: production type: TTP @@ -15,7 +15,7 @@ search: |- BY Web.http_user_agent Web.http_method, Web.url, Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` - | lookup suspicious_c2_user_agents c2_user_agent AS http_user_agent OUTPUT tool, description + | lookup local=t suspicious_c2_user_agents c2_user_agent AS http_user_agent OUTPUT tool, description | where isnotnull(tool) | stats count min(firstTime) as first_seen max(lastTime) as last_seen BY tool url http_user_agent diff --git a/detections/network/http_malware_user_agent.yml b/detections/network/http_malware_user_agent.yml index df79a6ba052..5490fc528f5 100644 --- a/detections/network/http_malware_user_agent.yml +++ b/detections/network/http_malware_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP Malware User Agent id: 8c4866e4-f488-4253-8537-7dc4f954c292 -version: 5 +version: 6 creation_date: '2026-01-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: TTP @@ -15,7 +15,7 @@ search: |- BY Web.http_user_agent Web.http_method, Web.url, Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` - | lookup malware_user_agents malware_user_agent AS http_user_agent OUTPUT malware + | lookup local=t malware_user_agents malware_user_agent AS http_user_agent OUTPUT malware | where isnotnull(malware) | stats count min(firstTime) as first_seen max(lastTime) as last_seen BY malware url http_user_agent diff --git a/detections/network/http_pua_user_agent.yml b/detections/network/http_pua_user_agent.yml index a20df5452a6..b05dd3386e3 100644 --- a/detections/network/http_pua_user_agent.yml +++ b/detections/network/http_pua_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP PUA User Agent id: 21af5447-734f-4549-956b-7a255cb2b032 -version: 5 +version: 6 creation_date: '2026-01-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: Anomaly @@ -15,7 +15,7 @@ search: |- BY Web.http_user_agent Web.http_method, Web.url, Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` - | lookup pua_user_agents pua_user_agent AS http_user_agent OUTPUT tool + | lookup local=t pua_user_agents pua_user_agent AS http_user_agent OUTPUT tool | where isnotnull(tool) | stats count min(firstTime) as first_seen max(lastTime) as last_seen BY tool url http_user_agent diff --git a/detections/network/http_rmm_user_agent.yml b/detections/network/http_rmm_user_agent.yml index dde34ab9e5d..1ad50d30cb3 100644 --- a/detections/network/http_rmm_user_agent.yml +++ b/detections/network/http_rmm_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP RMM User Agent id: 61884b02-0dcf-44c5-9094-db33bac09fa6 -version: 5 +version: 6 creation_date: '2026-01-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: Anomaly @@ -15,7 +15,7 @@ search: |- BY Web.http_user_agent Web.http_method, Web.url, Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` - | lookup rmm_user_agents rmm_user_agent AS http_user_agent OUTPUT tool + | lookup local=t rmm_user_agents rmm_user_agent AS http_user_agent OUTPUT tool | where isnotnull(tool) | stats count min(firstTime) as first_seen max(lastTime) as last_seen BY tool url http_user_agent diff --git a/detections/network/prohibited_network_traffic_allowed.yml b/detections/network/prohibited_network_traffic_allowed.yml index 2235c3e236d..d305d4f139f 100644 --- a/detections/network/prohibited_network_traffic_allowed.yml +++ b/detections/network/prohibited_network_traffic_allowed.yml @@ -1,8 +1,8 @@ name: Prohibited Network Traffic Allowed id: ce5a0962-849f-4720-a678-753fe6674479 -version: 15 +version: 16 creation_date: '2020-04-29' -modification_date: '2026-09-08' +modification_date: '2026-09-22' author: Rico Valdez, Splunk status: production type: Anomaly @@ -36,7 +36,7 @@ search: |- All_Traffic.dest_port All_Traffic.dvc All_Traffic.transport All_Traffic.vendor_product - | lookup update=true interesting_ports_lookup dest_port as All_Traffic.dest_port transport as All_Traffic.transport OUTPUT app is_prohibited note + | lookup local=t update=true interesting_ports_lookup dest_port as All_Traffic.dest_port transport as All_Traffic.transport OUTPUT app is_prohibited note | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml index 1a8700de2a4..228dd2e6a28 100644 --- a/detections/web/detect_remote_access_software_usage_url.yml +++ b/detections/web/detect_remote_access_software_usage_url.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage URL id: 9296f515-073c-43a5-88ec-eda5a4626654 -version: 16 +version: 17 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -35,7 +35,7 @@ search: | | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("Web")` - | lookup remote_access_software remote_domain AS url_domain OUTPUT isutility, description as signature, comment_reference + | lookup local=t remote_access_software remote_domain AS url_domain OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = True | `remote_access_software_usage_exceptions` diff --git a/detections/web/http_scripting_tool_user_agent.yml b/detections/web/http_scripting_tool_user_agent.yml index 629822d8ddf..2a3328ef834 100644 --- a/detections/web/http_scripting_tool_user_agent.yml +++ b/detections/web/http_scripting_tool_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP Scripting Tool User Agent id: 04430b4e-5ca8-4e88-98b5-d6bcf54f8393 -version: 6 +version: 7 creation_date: '2025-10-21' -modification_date: '2026-06-15' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: Anomaly @@ -22,7 +22,7 @@ search: |- | `security_content_ctime(lastTime)` | `drop_dm_object_name(Web)` | eval http_user_agent = lower(http_user_agent) - | lookup scripting_tools_user_agents tool_user_agent AS http_user_agent OUTPUT tool + | lookup local=t scripting_tools_user_agents tool_user_agent AS http_user_agent OUTPUT tool | where isnotnull(tool) | stats count min(firstTime) as first_seen diff --git a/lookups/csv/hijacklibs_loaded.csv b/lookups/csv/hijacklibs_loaded.csv index d3523b22ad7..3a14253534b 100644 --- a/lookups/csv/hijacklibs_loaded.csv +++ b/lookups/csv/hijacklibs_loaded.csv @@ -1,887 +1,887 @@ islibrary,library,excludes,ttp,comment -TRUE,aclui.dll,*\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ -TRUE,aclui.dll,*\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ -TRUE,acrodistdll.dll,*\Program Files\Adobe\Acrobat *,T1574.002,https://go.recordedfuture.com/hubfs/reports/cta-2022-1223.pdf +TRUE,aclui.dll,*:\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ +TRUE,aclui.dll,*:\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ +TRUE,acrodistdll.dll,*:\Program Files\Adobe\Acrobat *,T1574.002,https://go.recordedfuture.com/hubfs/reports/cta-2022-1223.pdf TRUE,acrodistdll.dll,*\Acrobat\acrodistdll*,T1574.002,https://go.recordedfuture.com/hubfs/reports/cta-2022-1223.pdf -TRUE,activeds.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,activeds.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,adsldpc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,adsldpc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,aepic.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,aepic.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,apphelp.dll,*\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,apphelp.dll,*\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,applicationframe.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,applicationframe.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,appvpolicy.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,appwiz.cpl,*\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ -TRUE,appwiz.cpl,*\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ -TRUE,appxalluserstore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,appxalluserstore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,appxdeploymentclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,appxdeploymentclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,archiveint.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,archiveint.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ashldres.dll,*\Program Files\McAfee.com\VSO*,T1574.002,https://www.sophos.com/en-us/medialibrary/PDFs/technical%20papers/sophos-rotten-tomato-campaign.pdf -TRUE,atl.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,atl.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,atltracetoolui.dll,*\Program Files\Microsoft Visual Studio 11.0\Common7\Tools*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,audioses.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,audioses.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,auditpolcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,auditpolcore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,authfwcfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,authfwcfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,authz.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,authz.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,avrt.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,avrt.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,activeds.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,activeds.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,adsldpc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,adsldpc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,aepic.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,aepic.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,apphelp.dll,*:\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,apphelp.dll,*:\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,applicationframe.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,applicationframe.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,appvpolicy.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,appwiz.cpl,*:\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ +TRUE,appwiz.cpl,*:\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ +TRUE,appxalluserstore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,appxalluserstore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,appxdeploymentclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,appxdeploymentclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,archiveint.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,archiveint.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ashldres.dll,*:\Program Files\McAfee.com\VSO*,T1574.002,https://www.sophos.com/en-us/medialibrary/PDFs/technical%20papers/sophos-rotten-tomato-campaign.pdf +TRUE,atl.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,atl.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,atltracetoolui.dll,*:\Program Files\Microsoft Visual Studio 11.0\Common7\Tools*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,audioses.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,audioses.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,auditpolcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,auditpolcore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,authfwcfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,authfwcfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,authz.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,authz.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,avrt.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,avrt.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows TRUE,basicnetutils.dll,*\Appdata\local\Temp\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ -TRUE,basicnetutils.dll,*\Program Files\BAIDU\BAIDUPINYIN\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ -TRUE,batmeter.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,batmeter.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,bcd.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcd.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcp47langs.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcp47langs.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcp47mrm.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcp47mrm.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcrypt.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,bcrypt.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,bderepair.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bootmenuux.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bootux.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,cabinet.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cabinet.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cabview.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,cabview.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,certcli.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,certcli.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,certenroll.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,certenroll.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cfgmgr32.dll,*\Windows\System32\*,T1574.002, -TRUE,cfgmgr32.dll,*\Windows\SysWOW64\*,T1574.002, +TRUE,basicnetutils.dll,*:\Program Files\BAIDU\BAIDUPINYIN\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ +TRUE,batmeter.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,batmeter.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,bcd.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcd.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcp47langs.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcp47langs.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcp47mrm.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcp47mrm.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcrypt.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,bcrypt.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,bderepair.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bootmenuux.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bootux.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,cabinet.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cabinet.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cabview.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,cabview.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,certcli.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,certcli.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,certenroll.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,certenroll.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cfgmgr32.dll,*:\Windows\System32\*,T1574.002, +TRUE,cfgmgr32.dll,*:\Windows\SysWOW64\*,T1574.002, TRUE,chrome_frame_helper.dll,*\Appdata\local\Google\Chrome\Application*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ -TRUE,chrome_frame_helper.dll,*\Program Files\Google\Chrome\Application*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ +TRUE,chrome_frame_helper.dll,*:\Program Files\Google\Chrome\Application*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ TRUE,ciscosparklauncher.dll,*\Appdata\local\CiscoSparkLauncher*,T1574.002,https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ TRUE,ciscosparklauncher.dll,*\AppData\Local\Programs\Cisco Spark\*,T1574.002,https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ -TRUE,classicexplorer32.dll,*\Program Files\Classic Shell*,T1574.002,https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets -TRUE,classicexplorer32.dll,*\Program Files\Open-Shell*,T1574.002,https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets -TRUE,cldapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cldapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,clipc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,clipc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,clusapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,clusapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cmpbk32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cmpbk32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cmutil.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,cmutil.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,coloradapterclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,coloradapterclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,colorui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,colorui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,comdlg32.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,comdlg32.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,commfunc.dll,*\Program Files\Lenovo\Communications Utility*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ -TRUE,configmanager2.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,connect.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,connect.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,coredplus.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,coremessaging.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,coremessaging.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,coreuicomponents.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,coreuicomponents.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,credui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,credui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptbase.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptbase.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptdll.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptdll.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptsp.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,cryptsp.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,cryptui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptxml.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptxml.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cscapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cscapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cscobj.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,cscobj.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,cscui.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,cscui.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,d2d1.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d2d1.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10_1.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10_1.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10_1core.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10_1core.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10core.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10core.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10warp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10warp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d11.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d11.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d12.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d12.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d9.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d9.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\windows kits\10\bin\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\windows kits\10\bin\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\windows kits\10\redist\d3d\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\windows kits\10\redist\d3d\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\wireshark*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\cisco systems\cisco jabber*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\microsoft\edge\application\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\Google\Chrome\Application\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,classicexplorer32.dll,*:\Program Files\Classic Shell*,T1574.002,https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets +TRUE,classicexplorer32.dll,*:\Program Files\Open-Shell*,T1574.002,https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets +TRUE,cldapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cldapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,clipc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,clipc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,clusapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,clusapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cmpbk32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cmpbk32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cmutil.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,cmutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,coloradapterclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,coloradapterclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,colorui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,colorui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,comdlg32.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,comdlg32.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,commfunc.dll,*:\Program Files\Lenovo\Communications Utility*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ +TRUE,configmanager2.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,connect.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,connect.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,coredplus.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,coremessaging.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,coremessaging.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,coreuicomponents.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,coreuicomponents.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,credui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,credui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptbase.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptbase.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptdll.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptdll.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptsp.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,cryptsp.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,cryptui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptxml.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptxml.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cscapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cscapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cscobj.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,cscobj.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,cscui.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,cscui.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,d2d1.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d2d1.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10_1.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10_1.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10_1core.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10_1core.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10core.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10core.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10warp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10warp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d11.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d11.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d12.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d12.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d9.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d9.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\windows kits\10\bin\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\windows kits\10\bin\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\windows kits\10\redist\d3d\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\windows kits\10\redist\d3d\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\wireshark*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\cisco systems\cisco jabber*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\microsoft\edge\application\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\Google\Chrome\Application\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows TRUE,d3dcompiler_47.dll,*\Appdata\local\microsoft\teams\stage*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows TRUE,d3dcompiler_47.dll,*\Microsoft\Teams\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dx9_43.dll,*\Windows\System32\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ -TRUE,d3dx9_43.dll,*\Windows\SysWOW64\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ -TRUE,dataexchange.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,dataexchange.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,davclnt.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,davclnt.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\arm*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\arm\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\arm64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\arm64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\x64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\x86\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\microsoft office\root\office*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgeng.dll,*\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 -TRUE,dbgeng.dll,*\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 -TRUE,dbgeng.dll,*\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 -TRUE,dbgeng.dll,*\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\arm*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\arm\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\arm64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\arm64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\x64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\x86\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\cisco systems\cisco jabber*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\microsoft office\root\office*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\microsoft office\root\vfs\programfilesx86\microsoft analysis services\as oledb\140*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgmodel.dll,*\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,dbgmodel.dll,*\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,dbgmodel.dll,*\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,dcntel.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dcomp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dcomp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,defragproxy.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,defragproxy.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,desktopshellext.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,desktopshellext.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,deviceassociation.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,deviceassociation.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devicecredential.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devicecredential.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devicepairing.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,devicepairing.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,devobj.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devobj.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devrtl.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devrtl.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcmonitor.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcmonitor.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcsvc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcsvc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcsvc6.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcsvc6.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,directmanipulation.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,directmanipulation.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,dismapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dismapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dismcore.dll,*\Windows\System32\dism*,T1574.001,https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/ -TRUE,dismcore.dll,*\Windows\SysWOW64\dism*,T1574.001,https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/ -TRUE,dmcfgutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmcfgutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmcmnutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmcmnutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmcommandlineutils.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dmcommandlineutils.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dmenrollengine.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmenrollengine.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmenterprisediagnostics.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmiso8601utils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmiso8601utils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmoleaututils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmoleaututils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmprocessxmlfiltered.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmprocessxmlfiltered.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmpushproxy.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmpushproxy.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmxmlhelputils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmxmlhelputils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dnsapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dnsapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dot3api.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dot3api.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dot3cfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dot3cfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dpx.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dpx.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,drprov.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,drprov.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,drvstore.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,drvstore.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dsclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsparse.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsparse.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsprop.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dsprop.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dsreg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsreg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsrole.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsrole.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dui70.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dui70.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,duser.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,duser.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dusmapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dusmapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dwmapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dwmapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dwmcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dwrite.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dwrite.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dxcore.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dxcore.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dxgi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dxgi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dxva2.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dxva2.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dynamoapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,eappcfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,eappcfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,eappprxy.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,eappprxy.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,edgeiso.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,edgeiso.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,edputil.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,edputil.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,efsadu.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,efsadu.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,efsutil.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,efsutil.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,esent.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,esent.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,execmodelproxy.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,execmodelproxy.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,explorerframe.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,explorerframe.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,facesdk.dll,*\Program Files\luxand\facesdk\bin\win64*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,fastprox.dll,*\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,fastprox.dll,*\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,faultrep.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,faultrep.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fddevquery.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,fddevquery.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,feclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,feclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fhcfg.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,fhcfg.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,fhsvcctl.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,firewallapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,firewallapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,flightsettings.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,flightsettings.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,fltlib.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fltlib.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,formdll.dll,*\Program Files\Common Files\Microsoft Shared\NoteSync Forms*,T1574.002,https://any.run/report/d9c7f6d4ec08d961c20dac1b6422b3fbec5c6a8d9dc67d1f604835b36c5f224e/ae068531-92db-497d-b0cb-c0b1af5476f1 -TRUE,framedynos.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,framedynos.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,fveapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fveapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fveskybackup.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,fvewiz.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,fwbase.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwbase.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwcfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwcfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwpolicyiomgr.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwpolicyiomgr.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwpuclnt.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwpuclnt.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fxsapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fxsapi.dll,*\Windows\System32\driverstore\filerepository\prnms002.inf_*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fxsapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fxsst.dll,*\Windows\System32\*,T1574.001,https://www.fireeye.com/blog/threat-research/2011/06/fxsst.html/ -TRUE,fxstiff.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fxstiff.dll,*\Windows\System32\driverstore\filerepository\prnms002.inf_*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,getuname.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,getuname.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,gflagsui.dll,*\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,glib-2.0.dll,*\Program Files\VMware\VMware Tools*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ -TRUE,glib-2.0.dll,*\Program Files\VMware\VMware Workstation*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ -TRUE,glib-2.0.dll,*\Program Files\VMware\VMware Player*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ -TRUE,gpapi.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,gpapi.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,hha.dll,*\Windows\System32\*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ -TRUE,hha.dll,*\Windows\SysWOW64\*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ -TRUE,hha.dll,*\Program Files\HTML Help Workshop*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ -TRUE,hid.dll,*\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,hid.dll,*\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,hnetmon.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,hnetmon.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,hpcustpartui.dll,*\Program Files\HP*,T1574.002,https://www.trellix.com/en-us/about/newsroom/stories/research/operation-harvest-a-deep-dive-into-a-long-term-campaign.html -TRUE,hpqhvsei.dll,*\Program Files\HP*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,httpapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,httpapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,icmp.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,icmp.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,idstore.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,idstore.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ieadvpack.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ieadvpack.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iedkcs32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iedkcs32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iernonce.dll,*\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ -TRUE,iernonce.dll,*\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ -TRUE,iertutil.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iertutil.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ifmon.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ifmon.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ifsutil.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,ifsutil.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,inproclogger.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iphlpapi.dll,*\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iphlpapi.dll,*\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iri.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iri.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iscsidsc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iscsidsc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iscsiexe.dll,*\Windows\System32\*,T1574.001,https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC -TRUE,iscsiexe.dll,*\Windows\SysWOW64\*,T1574.001,https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC -TRUE,iscsium.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iscsium.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,isv.exe_rsaenh.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,isv.exe_rsaenh.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,iumbase.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iumsdk.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,iviewers.dll,*\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,iviewers.dll,*\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,iviewers.dll,*\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,iviewers.dll,*\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,joinutil.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,joinutil.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,kdstub.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ksuser.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ksuser.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ktmw32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ktmw32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ldvpocx.ocx,*\Program Files\Symantec_Client_Security\Symantec AntiVirus*,T1574.002,https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox -TRUE,ldvpocx.ocx,*\Program Files\Symantec AntiVirus*,T1574.002,https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox +TRUE,d3dx9_43.dll,*:\Windows\System32\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ +TRUE,d3dx9_43.dll,*:\Windows\SysWOW64\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ +TRUE,dataexchange.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,dataexchange.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,davclnt.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,davclnt.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\arm*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\arm\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\arm64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\arm64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\x64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\x86\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\microsoft office\root\office*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgeng.dll,*:\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 +TRUE,dbgeng.dll,*:\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 +TRUE,dbgeng.dll,*:\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 +TRUE,dbgeng.dll,*:\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\arm*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\arm\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\arm64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\arm64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\x64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\x86\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\cisco systems\cisco jabber*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\microsoft office\root\office*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\microsoft office\root\vfs\programfilesx86\microsoft analysis services\as oledb\140*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgmodel.dll,*:\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,dbgmodel.dll,*:\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,dbgmodel.dll,*:\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,dcntel.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dcomp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dcomp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,defragproxy.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,defragproxy.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,desktopshellext.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,desktopshellext.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,deviceassociation.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,deviceassociation.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devicecredential.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devicecredential.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devicepairing.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,devicepairing.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,devobj.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devobj.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devrtl.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devrtl.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcmonitor.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcmonitor.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcsvc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcsvc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcsvc6.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcsvc6.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,directmanipulation.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,directmanipulation.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,dismapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dismapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dismcore.dll,*:\Windows\System32\dism*,T1574.001,https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/ +TRUE,dismcore.dll,*:\Windows\SysWOW64\dism*,T1574.001,https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/ +TRUE,dmcfgutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmcfgutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmcmnutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmcmnutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmcommandlineutils.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dmcommandlineutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dmenrollengine.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmenrollengine.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmenterprisediagnostics.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmiso8601utils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmiso8601utils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmoleaututils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmoleaututils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmprocessxmlfiltered.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmprocessxmlfiltered.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmpushproxy.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmpushproxy.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmxmlhelputils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmxmlhelputils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dnsapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dnsapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dot3api.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dot3api.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dot3cfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dot3cfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dpx.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dpx.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,drprov.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,drprov.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,drvstore.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,drvstore.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dsclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsparse.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsparse.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsprop.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dsprop.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dsreg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsreg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsrole.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsrole.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dui70.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dui70.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,duser.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,duser.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dusmapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dusmapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dwmapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dwmapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dwmcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dwrite.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dwrite.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dxcore.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dxcore.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dxgi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dxgi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dxva2.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dxva2.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dynamoapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,eappcfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,eappcfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,eappprxy.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,eappprxy.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,edgeiso.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,edgeiso.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,edputil.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,edputil.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,efsadu.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,efsadu.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,efsutil.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,efsutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,esent.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,esent.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,execmodelproxy.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,execmodelproxy.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,explorerframe.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,explorerframe.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,facesdk.dll,*:\Program Files\luxand\facesdk\bin\win64*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,fastprox.dll,*:\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,fastprox.dll,*:\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,faultrep.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,faultrep.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fddevquery.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,fddevquery.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,feclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,feclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fhcfg.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,fhcfg.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,fhsvcctl.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,firewallapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,firewallapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,flightsettings.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,flightsettings.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,fltlib.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fltlib.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,formdll.dll,*:\Program Files\Common Files\Microsoft Shared\NoteSync Forms*,T1574.002,https://any.run/report/d9c7f6d4ec08d961c20dac1b6422b3fbec5c6a8d9dc67d1f604835b36c5f224e/ae068531-92db-497d-b0cb-c0b1af5476f1 +TRUE,framedynos.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,framedynos.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,fveapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fveapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fveskybackup.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,fvewiz.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,fwbase.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwbase.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwcfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwcfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwpolicyiomgr.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwpolicyiomgr.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwpuclnt.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwpuclnt.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fxsapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fxsapi.dll,*:\Windows\System32\driverstore\filerepository\prnms002.inf_*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fxsapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fxsst.dll,*:\Windows\System32\*,T1574.001,https://www.fireeye.com/blog/threat-research/2011/06/fxsst.html/ +TRUE,fxstiff.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fxstiff.dll,*:\Windows\System32\driverstore\filerepository\prnms002.inf_*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,getuname.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,getuname.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,gflagsui.dll,*:\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,glib-2.0.dll,*:\Program Files\VMware\VMware Tools*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ +TRUE,glib-2.0.dll,*:\Program Files\VMware\VMware Workstation*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ +TRUE,glib-2.0.dll,*:\Program Files\VMware\VMware Player*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ +TRUE,gpapi.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,gpapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,hha.dll,*:\Windows\System32\*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ +TRUE,hha.dll,*:\Windows\SysWOW64\*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ +TRUE,hha.dll,*:\Program Files\HTML Help Workshop*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ +TRUE,hid.dll,*:\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,hid.dll,*:\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,hnetmon.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,hnetmon.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,hpcustpartui.dll,*:\Program Files\HP*,T1574.002,https://www.trellix.com/en-us/about/newsroom/stories/research/operation-harvest-a-deep-dive-into-a-long-term-campaign.html +TRUE,hpqhvsei.dll,*:\Program Files\HP*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,httpapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,httpapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,icmp.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,icmp.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,idstore.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,idstore.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ieadvpack.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ieadvpack.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iedkcs32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iedkcs32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iernonce.dll,*:\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ +TRUE,iernonce.dll,*:\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ +TRUE,iertutil.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iertutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ifmon.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ifmon.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ifsutil.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,ifsutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,inproclogger.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iphlpapi.dll,*:\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iphlpapi.dll,*:\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iri.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iri.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iscsidsc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iscsidsc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iscsiexe.dll,*:\Windows\System32\*,T1574.001,https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC +TRUE,iscsiexe.dll,*:\Windows\SysWOW64\*,T1574.001,https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC +TRUE,iscsium.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iscsium.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,isv.exe_rsaenh.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,isv.exe_rsaenh.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,iumbase.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iumsdk.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,iviewers.dll,*:\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,iviewers.dll,*:\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,iviewers.dll,*:\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,iviewers.dll,*:\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,joinutil.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,joinutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,kdstub.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ksuser.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ksuser.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ktmw32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ktmw32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ldvpocx.ocx,*:\Program Files\Symantec_Client_Security\Symantec AntiVirus*,T1574.002,https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox +TRUE,ldvpocx.ocx,*:\Program Files\Symantec AntiVirus*,T1574.002,https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox TRUE,libcares-2.dll,*\git\mingw64\*,T1574.002,https://www.trellix.com/en-au/blogs/research/hiding-in-plain-sight-multi-actor-ahost-exe-attacks/ -TRUE,libvlc.dll,*\Program Files\VideoLAN\VLC*,T1574.002,https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ -TRUE,licensemanagerapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,licensemanagerapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,licensingdiagspp.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,licensingdiagspp.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,linkinfo.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,linkinfo.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,lmiguardiandll.dll,*\Program Files\LogMeIn*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 -TRUE,lmiguardiandll.dll,*\Program Files\LogMeIn\x86*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 -TRUE,lmiguardiandll.dll,*\Program Files\LogMeIn\x64*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 -TRUE,loadperf.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,loadperf.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,lockdown.dll,*\Program Files\McAfee\VirusScan Enterprise*,T1574.002,https://twitter.com/thepacketrat/status/1520878930449817600 -TRUE,lockhostingframework.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,log.dll,*\Program Files\Bitdefender Antivirus Free*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,logoncli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,logoncli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,logoncontroller.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,logoncontroller.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,lpksetupproxyserv.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,lpksetupproxyserv.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,lrwizdll.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,magnification.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,magnification.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,maintenanceui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mapistub.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mapistub.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mbaexmlparser.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,mdmdiagnostics.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mfc42u.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,mfc42u.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,mfcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mfcore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mfplat.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mfplat.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,midimap.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,midimap.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mintdh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,miutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,miutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mlang.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mlang.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mmdevapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mmdevapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mobilenetworking.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mobilenetworking.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mozglue.dll,*\Program Files\SeaMonkey*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,mozglue.dll,*\Program Files\Mozilla Firefox*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,mozglue.dll,*\Program Files\Mozilla Thunderbird*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,libvlc.dll,*:\Program Files\VideoLAN\VLC*,T1574.002,https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ +TRUE,licensemanagerapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,licensemanagerapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,licensingdiagspp.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,licensingdiagspp.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,linkinfo.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,linkinfo.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,lmiguardiandll.dll,*:\Program Files\LogMeIn*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 +TRUE,lmiguardiandll.dll,*:\Program Files\LogMeIn\x86*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 +TRUE,lmiguardiandll.dll,*:\Program Files\LogMeIn\x64*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 +TRUE,loadperf.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,loadperf.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,lockdown.dll,*:\Program Files\McAfee\VirusScan Enterprise*,T1574.002,https://twitter.com/thepacketrat/status/1520878930449817600 +TRUE,lockhostingframework.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,log.dll,*:\Program Files\Bitdefender Antivirus Free*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,logoncli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,logoncli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,logoncontroller.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,logoncontroller.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,lpksetupproxyserv.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,lpksetupproxyserv.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,lrwizdll.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,magnification.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,magnification.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,maintenanceui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mapistub.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mapistub.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mbaexmlparser.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,mdmdiagnostics.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mfc42u.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,mfc42u.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,mfcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mfcore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mfplat.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mfplat.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,midimap.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,midimap.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mintdh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,miutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,miutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mlang.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mlang.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mmdevapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mmdevapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mobilenetworking.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mobilenetworking.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mozglue.dll,*:\Program Files\SeaMonkey*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,mozglue.dll,*:\Program Files\Mozilla Firefox*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,mozglue.dll,*:\Program Files\Mozilla Thunderbird*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 TRUE,mozglue.dll,*\AppData\Local\Mozilla Firefox\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,mpclient.dll,*\Program Files\Windows Defender*,T1574.002,https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/ +TRUE,mpclient.dll,*:\Program Files\Windows Defender*,T1574.002,https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/ TRUE,mpclient.dll,*\ProgramData\Microsoft\Windows Defender\Platform\*,T1574.002,https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/ -TRUE,mpr.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mpr.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mprapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mprapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mpsvc.dll,*\Program Files\Windows Defender\*,T1574.002,https://www.mcafee.com/blogs/other-blogs/mcafee-labs/revil-ransomware-uses-dll-sideloading/ +TRUE,mpr.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mpr.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mprapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mprapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mpsvc.dll,*:\Program Files\Windows Defender\*,T1574.002,https://www.mcafee.com/blogs/other-blogs/mcafee-labs/revil-ransomware-uses-dll-sideloading/ TRUE,mpsvc.dll,*\ProgramData\Microsoft\Windows Defender\Platform\*,T1574.002,https://www.mcafee.com/blogs/other-blogs/mcafee-labs/revil-ransomware-uses-dll-sideloading/ -TRUE,mrmcorer.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mrmcorer.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msacm32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msacm32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mscms.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mscms.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mscoree.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mscoree.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mscorsvc.dll,*\Windows\Microsoft.NET\Framework\v*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,mscorsvc.dll,*\Windows\Microsoft.NET\Framework64\v*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,msctf.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,msctf.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,msctfmonitor.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msctfmonitor.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msdrm.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msdrm.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msdtctm.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msftedit.dll,*\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ -TRUE,msftedit.dll,*\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ -TRUE,msi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msiso.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,msiso.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,msutb.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msutb.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msvcp110_win.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,msvcp110_win.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,msvcr100.dll,*\Windows\System32\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,msvcr100.dll,*\Windows\SysWOW64\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,mswb7.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mswb7.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mswsock.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mswsock.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,msxml3.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,msxml3.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mtxclu.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mtxclu.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,napinsp.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,napinsp.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ncrypt.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ncrypt.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ndfapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ndfapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netapi32.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netapi32.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netid.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netid.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netiohlp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netiohlp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netjoin.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netjoin.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netplwiz.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netplwiz.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netprofm.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,netprofm.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,netprovfw.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netprovfw.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netsetupapi.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,netsetupapi.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,netshell.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netshell.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nettrace.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,networkexplorer.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,networkexplorer.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,newdev.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,newdev.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ninput.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ninput.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nlaapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nlaapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nlansp_c.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,nlansp_c.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,npmproxy.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,npmproxy.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,nshhttp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nshhttp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nshipsec.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nshipsec.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nshwfp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nshwfp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ntdsapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ntdsapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ntlanman.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ntlanman.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ntlmshared.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ntlmshared.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ntmarta.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ntmarta.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ntshrui.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ntshrui.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,nvsmartmax.dll,*\Program Files\NVIDIA Corporation\Display*,T1574.002,https://www.cybereason.com/blog/research/deadringer-exposing-chinese-threat-actors-targeting-major-telcos -TRUE,oleacc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,oleacc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,omadmapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,omadmapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,onex.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,onex.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,opcservices.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,opcservices.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,mrmcorer.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mrmcorer.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msacm32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msacm32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mscms.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mscms.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mscoree.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mscoree.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mscorsvc.dll,*:\Windows\Microsoft.NET\Framework\v*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,mscorsvc.dll,*:\Windows\Microsoft.NET\Framework64\v*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,msctf.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,msctf.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,msctfmonitor.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msctfmonitor.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msdrm.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msdrm.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msdtctm.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msftedit.dll,*:\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ +TRUE,msftedit.dll,*:\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ +TRUE,msi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msiso.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,msiso.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,msutb.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msutb.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msvcp110_win.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,msvcp110_win.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,msvcr100.dll,*:\Windows\System32\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,msvcr100.dll,*:\Windows\SysWOW64\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,mswb7.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mswb7.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mswsock.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mswsock.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,msxml3.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,msxml3.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mtxclu.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mtxclu.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,napinsp.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,napinsp.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ncrypt.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ncrypt.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ndfapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ndfapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netapi32.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netapi32.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netid.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netid.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netiohlp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netiohlp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netjoin.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netjoin.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netplwiz.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netplwiz.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netprofm.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,netprofm.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,netprovfw.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netprovfw.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netsetupapi.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,netsetupapi.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,netshell.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netshell.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nettrace.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,networkexplorer.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,networkexplorer.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,newdev.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,newdev.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ninput.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ninput.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nlaapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nlaapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nlansp_c.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,nlansp_c.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,npmproxy.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,npmproxy.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,nshhttp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nshhttp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nshipsec.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nshipsec.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nshwfp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nshwfp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ntdsapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ntdsapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ntlanman.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ntlanman.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ntlmshared.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ntlmshared.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ntmarta.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ntmarta.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ntshrui.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ntshrui.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,nvsmartmax.dll,*:\Program Files\NVIDIA Corporation\Display*,T1574.002,https://www.cybereason.com/blog/research/deadringer-exposing-chinese-threat-actors-targeting-major-telcos +TRUE,oleacc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,oleacc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,omadmapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,omadmapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,onex.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,onex.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,opcservices.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,opcservices.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ TRUE,opera_elf.dll,*\Appdata\local\programs\opera\*,T1574.002,https://twitter.com/ShitSecure/status/1566127363389329412 -TRUE,osbaseln.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,osbaseln.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,osksupport.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,osuninst.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,osuninst.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,outllib.dll,*\Program Files\Microsoft Office\OFFICE*,T1574.002,https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6 -TRUE,outllib.dll,*\Program Files\Microsoft Office\Root\OFFICE*,T1574.002,https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6 -TRUE,p2p.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,p2p.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,p2pnetsh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,p2pnetsh.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,p9np.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,p9np.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,pcaui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,pcaui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,pdh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,pdh.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,peerdistsh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,peerdistsh.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,pkeyhelper.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,pla.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,pla.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,playsndsrv.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,playsndsrv.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,pnrpnsp.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,pnrpnsp.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,policymanager.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,policymanager.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,polstore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,polstore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,powrprof.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,powrprof.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,printui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,printui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,prntvpt.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,prntvpt.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,profapi.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,profapi.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,propsys.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,propsys.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,proximitycommon.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,proximitycommon.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,proximityservicepal.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,prvdmofcomp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,prvdmofcomp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,puiapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,puiapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,python39.dll,*\Program Files\Python39*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,osbaseln.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,osbaseln.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,osksupport.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,osuninst.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,osuninst.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,outllib.dll,*:\Program Files\Microsoft Office\OFFICE*,T1574.002,https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6 +TRUE,outllib.dll,*:\Program Files\Microsoft Office\Root\OFFICE*,T1574.002,https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6 +TRUE,p2p.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,p2p.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,p2pnetsh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,p2pnetsh.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,p9np.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,p9np.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,pcaui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,pcaui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,pdh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,pdh.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,peerdistsh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,peerdistsh.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,pkeyhelper.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,pla.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,pla.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,playsndsrv.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,playsndsrv.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,pnrpnsp.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,pnrpnsp.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,policymanager.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,policymanager.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,polstore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,polstore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,powrprof.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,powrprof.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,printui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,printui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,prntvpt.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,prntvpt.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,profapi.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,profapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,propsys.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,propsys.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,proximitycommon.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,proximitycommon.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,proximityservicepal.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,prvdmofcomp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,prvdmofcomp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,puiapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,puiapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,python39.dll,*:\Program Files\Python39*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 TRUE,python39.dll,*\Appdata\local\Temp\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,python39.dll,*\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\VC\SecurityIssueAnalysis\python*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,python39.dll,*:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\VC\SecurityIssueAnalysis\python*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 TRUE,python39.dll,*\Users\anaconda3*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,qrt.dll,*\Program Files\F-Secure\Anti-Virus*,T1574.002,https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/ -TRUE,radcui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,radcui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasapi32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasapi32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasdlg.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,rasdlg.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,rasgcw.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,rasgcw.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,rasman.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasman.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasmontr.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasmontr.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rastls.dll,*\Program Files\Symantec\Network Connected Devices Auto Setup*,T1574.002,https://st.drweb.com/static/new-www/news/2020/october/Study_of_the_ShadowPad_APT_backdoor_and_its_relation_to_PlugX_en.pdf -TRUE,rcdll.dll,*\Program Files\Windows Kits\10\bin\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,reagent.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,reagent.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,regapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,regapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,reseteng.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,resetengine.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,resutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,resutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rjvplatform.dll,*\Windows\System32\SystemResetPlatform*,T1574.002,https://twitter.com/0gtweet/status/1666716511988330499 -TRUE,rjvplatform.dll,*\Windows\SysWOW64\SystemResetPlatform*,T1574.002,https://twitter.com/0gtweet/status/1666716511988330499 -TRUE,rmclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rmclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rpcnsh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rpcnsh.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rsaenh.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,rsaenh.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,rtutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rtutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rtworkq.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rtworkq.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,qrt.dll,*:\Program Files\F-Secure\Anti-Virus*,T1574.002,https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/ +TRUE,radcui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,radcui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasapi32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasapi32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasdlg.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,rasdlg.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,rasgcw.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,rasgcw.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,rasman.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasman.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasmontr.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasmontr.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rastls.dll,*:\Program Files\Symantec\Network Connected Devices Auto Setup*,T1574.002,https://st.drweb.com/static/new-www/news/2020/october/Study_of_the_ShadowPad_APT_backdoor_and_its_relation_to_PlugX_en.pdf +TRUE,rcdll.dll,*:\Program Files\Windows Kits\10\bin\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,reagent.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,reagent.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,regapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,regapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,reseteng.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,resetengine.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,resutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,resutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rjvplatform.dll,*:\Windows\System32\SystemResetPlatform*,T1574.002,https://twitter.com/0gtweet/status/1666716511988330499 +TRUE,rjvplatform.dll,*:\Windows\SysWOW64\SystemResetPlatform*,T1574.002,https://twitter.com/0gtweet/status/1666716511988330499 +TRUE,rmclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rmclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rpcnsh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rpcnsh.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rsaenh.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,rsaenh.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,rtutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rtutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rtworkq.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rtworkq.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows TRUE,rzlog4cpp_logger.dll,*\Appdata\local\razer\InGameEngine\cache\RzFpsApplet*,T1574.002,https://www.mandiant.com/resources/blog/china-nexus-espionage-southeast-asia -TRUE,safestore32.dll,*\Program Files\Sophos\Sophos Anti-Virus*,T1574.002,https://symantec.broadcom.com/hubfs/Attacks-Against-Government-Sector.pdf -TRUE,samcli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,samcli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,samlib.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,samlib.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sapi_onecore.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,sapi_onecore.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,sas.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sas.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,scansetting.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,scansetting.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,scecli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,scecli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,schedcli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,schedcli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,secur32.dll,*\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,secur32.dll,*\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,security.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,security.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,sensapi.dll,*\Windows\System32\*,T1574.002,https://twitter.com/AndrewOliveau/status/1682185200862625792 -TRUE,sensapi.dll,*\Windows\SysWOW64\*,T1574.002,https://twitter.com/AndrewOliveau/status/1682185200862625792 -TRUE,shell32.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,shell32.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,shfolder.dll,*\Windows\System32\*,T1574.002,https://twitter.com/dissectmalware/status/978017957480628226 -TRUE,shfolder.dll,*\Windows\SysWOW64\*,T1574.002,https://twitter.com/dissectmalware/status/978017957480628226 -TRUE,siteadv.dll,*\Program Files\SiteAdvisor\*,T1574.002,https://www.nortonlifelock.com/sites/default/files/2021-10/OPERATION%20EXORCIST%20White%20Paper.pdf -TRUE,slc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,slc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,smadhook32c.dll,*\Program Files\Smadav*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,snmpapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,snmpapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,spectrumsyncclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,spp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,spp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sppc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sppc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sppcext.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,sppcext.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,srclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srmtrace.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,srmtrace.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,srpapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srpapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srvcli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srvcli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ssp.exe_rsaenh.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ssp.exe_rsaenh.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ssp_isv.exe_rsaenh.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ssp_isv.exe_rsaenh.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,sspicli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sspicli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ssshim.dll,*\Windows\System32\*,T1574.002,https://twitter.com/0gtweet/status/1363107343018385410 -TRUE,ssshim.dll,*\Windows\SysWOW64\*,T1574.002,https://twitter.com/0gtweet/status/1363107343018385410 -TRUE,staterepository.core.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,staterepository.core.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,structuredquery.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,structuredquery.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,sxshared.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sxshared.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,symsrv.dll,*\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,systemsettingsthresholdadminflowui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tapi32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tapi32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tbs.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tbs.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tdh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tdh.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,textshaping.dll,*\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,textshaping.dll,*\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,timesync.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tmdbglog.dll,*\Program Files\Trend Micro\Titanium*,T1574.002,https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-tools-and-connections/ -TRUE,tosbtkbd.dll,*\Program Files\Toshiba\Bluetooth Toshiba Stack*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,tpmcoreprovisioning.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,tpmcoreprovisioning.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,tquery.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tquery.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tsworkspace.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tsworkspace.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ttdrecord.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ttdrecord.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,twext.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,twext.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,twinapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,twinapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,twinui.appcore.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,twinui.appcore.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,uianimation.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,uianimation.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,uiautomationcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uiautomationcore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uireng.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uireng.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uiribbon.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,uiribbon.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,umpdc.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,umpdc.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,unattend.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,safestore32.dll,*:\Program Files\Sophos\Sophos Anti-Virus*,T1574.002,https://symantec.broadcom.com/hubfs/Attacks-Against-Government-Sector.pdf +TRUE,samcli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,samcli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,samlib.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,samlib.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sapi_onecore.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,sapi_onecore.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,sas.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sas.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,scansetting.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,scansetting.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,scecli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,scecli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,schedcli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,schedcli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,secur32.dll,*:\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,secur32.dll,*:\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,security.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,security.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,sensapi.dll,*:\Windows\System32\*,T1574.002,https://twitter.com/AndrewOliveau/status/1682185200862625792 +TRUE,sensapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://twitter.com/AndrewOliveau/status/1682185200862625792 +TRUE,shell32.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,shell32.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,shfolder.dll,*:\Windows\System32\*,T1574.002,https://twitter.com/dissectmalware/status/978017957480628226 +TRUE,shfolder.dll,*:\Windows\SysWOW64\*,T1574.002,https://twitter.com/dissectmalware/status/978017957480628226 +TRUE,siteadv.dll,*:\Program Files\SiteAdvisor\*,T1574.002,https://www.nortonlifelock.com/sites/default/files/2021-10/OPERATION%20EXORCIST%20White%20Paper.pdf +TRUE,slc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,slc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,smadhook32c.dll,*:\Program Files\Smadav*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,snmpapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,snmpapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,spectrumsyncclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,spp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,spp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sppc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sppc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sppcext.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,sppcext.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,srclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srmtrace.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,srmtrace.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,srpapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srpapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srvcli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srvcli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ssp.exe_rsaenh.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ssp.exe_rsaenh.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ssp_isv.exe_rsaenh.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ssp_isv.exe_rsaenh.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,sspicli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sspicli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ssshim.dll,*:\Windows\System32\*,T1574.002,https://twitter.com/0gtweet/status/1363107343018385410 +TRUE,ssshim.dll,*:\Windows\SysWOW64\*,T1574.002,https://twitter.com/0gtweet/status/1363107343018385410 +TRUE,staterepository.core.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,staterepository.core.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,structuredquery.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,structuredquery.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,sxshared.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sxshared.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,symsrv.dll,*:\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,systemsettingsthresholdadminflowui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tapi32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tapi32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tbs.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tbs.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tdh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tdh.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,textshaping.dll,*:\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,textshaping.dll,*:\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,timesync.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tmdbglog.dll,*:\Program Files\Trend Micro\Titanium*,T1574.002,https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-tools-and-connections/ +TRUE,tosbtkbd.dll,*:\Program Files\Toshiba\Bluetooth Toshiba Stack*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,tpmcoreprovisioning.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,tpmcoreprovisioning.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,tquery.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tquery.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tsworkspace.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tsworkspace.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ttdrecord.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ttdrecord.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,twext.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,twext.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,twinapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,twinapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,twinui.appcore.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,twinui.appcore.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,uianimation.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,uianimation.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,uiautomationcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uiautomationcore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uireng.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uireng.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uiribbon.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,uiribbon.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,umpdc.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,umpdc.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,unattend.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ TRUE,unityplayer.dll,*\Appdata\local\Temp\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ -TRUE,updatepolicy.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,updatepolicy.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,upshared.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,urlmon.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,urlmon.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,userenv.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,userenv.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,utildll.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,utildll.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uxinit.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uxinit.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uxtheme.dll,*\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uxtheme.dll,*\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vaultcli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vaultcli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vdsutil.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,vdsutil.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,vender.dll,*\Program Files\ASUS\GPU TweakII*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,vender.dll,*\Program Files\ASUS\VGA COM\*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,version.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,version.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,vftrace.dll,*\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true -TRUE,vftrace.dll,*\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x64*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true -TRUE,vftrace.dll,*\Program Files\CyberArk\Endpoint Privilege Manager\Agent*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true -TRUE,virtdisk.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,virtdisk.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,updatepolicy.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,updatepolicy.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,upshared.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,urlmon.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,urlmon.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,userenv.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,userenv.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,utildll.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,utildll.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uxinit.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uxinit.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uxtheme.dll,*:\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uxtheme.dll,*:\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vaultcli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vaultcli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vdsutil.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,vdsutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,vender.dll,*:\Program Files\ASUS\GPU TweakII*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,vender.dll,*:\Program Files\ASUS\VGA COM\*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,version.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,version.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,vftrace.dll,*:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true +TRUE,vftrace.dll,*:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x64*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true +TRUE,vftrace.dll,*:\Program Files\CyberArk\Endpoint Privilege Manager\Agent*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true +TRUE,virtdisk.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,virtdisk.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows TRUE,vivaldi_elf.dll,*\Appdata\local\Vivaldi\Application*,T1574.002,https://securityintelligence.com/posts/vizom-malware-targets-brazilian-bank-customers-remote-overlay/ TRUE,vivaldi_elf.dll,*\Appdata\local\Vivaldi\Application\*,T1574.002,https://securityintelligence.com/posts/vizom-malware-targets-brazilian-bank-customers-remote-overlay/ -TRUE,vntfxf32.dll,*\Program Files\Venta\VentaFax & Voice*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,vsodscpl.dll,*\Program Files\McAfee\VirusScan Enterprise*,T1574.002,https://eiploader.wordpress.com/2011/03/28/digitally-signed-malware-without-stealing-certificates/ -TRUE,vssapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vssapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vsstrace.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vsstrace.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wbemprox.dll,*\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wbemprox.dll,*\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wbemsvc.dll,*\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wbemsvc.dll,*\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wcmapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wcmapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wcnnetsh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wdi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wdi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wdscore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wdscore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,webservices.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,webservices.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wecapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wecapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wer.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wer.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wevtapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wevtapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,whhelper.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,whhelper.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wimgapi.dll,*\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ -TRUE,wimgapi.dll,*\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ -TRUE,wimgapi.dll,*\Program Files\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\arm64\DISM*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ -TRUE,winbio.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winbio.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winbrand.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winbrand.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windows.storage.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windows.storage.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windows.storage.search.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windows.storage.search.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windows.ui.immersive.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,windows.ui.immersive.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,windowscodecs.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windowscodecs.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windowscodecsext.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windowscodecsext.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windowsperformancerecordercontrol.dll,*\Program Files\windows kits\10\windows performance toolkit*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windowsperformancerecordercontrol.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windowsperformancerecordercontrol.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windowsperformancerecorderui.dll,*\Program Files\Windows Kits\10\Windows Performance Toolkit*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,windowsudk.shellcommon.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windowsudk.shellcommon.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,winhttp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winhttp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wininet.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wininet.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winipsec.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winipsec.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winmde.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winmm.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winmm.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winnsi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winnsi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winrnr.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,winrnr.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,winscard.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winscard.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winsqlite3.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winsqlite3.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winsta.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winsta.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winsync.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winsync.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winutils.dll,*\Program Files\Palo Alto Networks\Traps*,T1574.002,https://research.checkpoint.com/2023/rorschach-a-new-sophisticated-and-fast-ransomware/ -TRUE,wkscli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wkscli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wlanapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wlanapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wlancfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wlancfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wldp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wldp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wlidprov.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wlidprov.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wmiclnt.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wmiclnt.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wmidcom.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wmidcom.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wmiutils.dll,*\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wmiutils.dll,*\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wmpdui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wmsgapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wmsgapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wofutil.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wofutil.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wpdshext.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wpdshext.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wsc.dll,*\Program Files\AVAST Software\Avast*,T1574.001,https://github.com/netero1010/Vulnerability-Disclosure/tree/main/CVE-2022-AVAST2 -TRUE,wscapi.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,wscapi.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,wsdapi.dll,*\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,wsdapi.dll,*\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,wshbth.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wshbth.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wshelper.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wshelper.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wsmsvc.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,wsmsvc.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,wtsapi32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wtsapi32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wwancfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wwancfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wwapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wwapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,xmllite.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,xmllite.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,xolehlp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,xolehlp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,xpsservices.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,xpsservices.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,xwizards.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,xwizards.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,xwtpw32.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,xwtpw32.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,vntfxf32.dll,*:\Program Files\Venta\VentaFax & Voice*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,vsodscpl.dll,*:\Program Files\McAfee\VirusScan Enterprise*,T1574.002,https://eiploader.wordpress.com/2011/03/28/digitally-signed-malware-without-stealing-certificates/ +TRUE,vssapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vssapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vsstrace.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vsstrace.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wbemprox.dll,*:\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wbemprox.dll,*:\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wbemsvc.dll,*:\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wbemsvc.dll,*:\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wcmapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wcmapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wcnnetsh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wdi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wdi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wdscore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wdscore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,webservices.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,webservices.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wecapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wecapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wer.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wer.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wevtapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wevtapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,whhelper.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,whhelper.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wimgapi.dll,*:\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ +TRUE,wimgapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ +TRUE,wimgapi.dll,*:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\arm64\DISM*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ +TRUE,winbio.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winbio.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winbrand.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winbrand.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windows.storage.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windows.storage.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windows.storage.search.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windows.storage.search.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windows.ui.immersive.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,windows.ui.immersive.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,windowscodecs.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windowscodecs.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windowscodecsext.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windowscodecsext.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windowsperformancerecordercontrol.dll,*:\Program Files\windows kits\10\windows performance toolkit*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windowsperformancerecordercontrol.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windowsperformancerecordercontrol.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windowsperformancerecorderui.dll,*:\Program Files\Windows Kits\10\Windows Performance Toolkit*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,windowsudk.shellcommon.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windowsudk.shellcommon.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,winhttp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winhttp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wininet.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wininet.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winipsec.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winipsec.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winmde.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winmm.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winmm.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winnsi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winnsi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winrnr.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,winrnr.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,winscard.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winscard.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winsqlite3.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winsqlite3.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winsta.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winsta.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winsync.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winsync.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winutils.dll,*:\Program Files\Palo Alto Networks\Traps*,T1574.002,https://research.checkpoint.com/2023/rorschach-a-new-sophisticated-and-fast-ransomware/ +TRUE,wkscli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wkscli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wlanapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wlanapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wlancfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wlancfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wldp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wldp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wlidprov.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wlidprov.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wmiclnt.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wmiclnt.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wmidcom.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wmidcom.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wmiutils.dll,*:\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wmiutils.dll,*:\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wmpdui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wmsgapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wmsgapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wofutil.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wofutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wpdshext.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wpdshext.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wsc.dll,*:\Program Files\AVAST Software\Avast*,T1574.001,https://github.com/netero1010/Vulnerability-Disclosure/tree/main/CVE-2022-AVAST2 +TRUE,wscapi.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,wscapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,wsdapi.dll,*:\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,wsdapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,wshbth.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wshbth.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wshelper.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wshelper.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wsmsvc.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,wsmsvc.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,wtsapi32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wtsapi32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wwancfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wwancfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wwapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wwapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,xmllite.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,xmllite.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,xolehlp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,xolehlp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,xpsservices.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,xpsservices.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,xwizards.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,xwizards.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,xwtpw32.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,xwtpw32.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables diff --git a/macros/base64decode.yml b/macros/base64decode.yml index 99fe5b4f96b..75877181140 100644 --- a/macros/base64decode.yml +++ b/macros/base64decode.yml @@ -1,10 +1,10 @@ name: base64decode id: fc2a1c3c-3251-418d-b411-7e62303e2cb3 -version: 1 +version: 2 creation_date: '2024-01-10' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Splunk Threat Research Team description: Content based conversion of UTF8/UTF16 based base64 encoding. Not a full implementation, but good enough for context without additional app installation. -definition: 'eval b64x_split=split($b64in$,"") | lookup char_conversion_matrix base64char as b64x_split OUTPUT base64bin as b64x_bin | eval b64x_join=mvjoin(b64x_bin,"") | rex field=b64x_join "(?.{8})" max_match=0 | lookup char_conversion_matrix bin as b64x_by8 output ascii as b64x_out | eval $b64in$_decode=mvjoin(b64x_out,"") | fields - b64x_* | eval $b64in$_decode = replace(replace($b64in$_decode,":NUL:",""),":SPACE:"," ") | rex field=$b64in$_decode mode=sed "s/\x00//g"' +definition: 'eval b64x_split=split($b64in$,"") | lookup local=t char_conversion_matrix base64char as b64x_split OUTPUT base64bin as b64x_bin | eval b64x_join=mvjoin(b64x_bin,"") | rex field=b64x_join "(?.{8})" max_match=0 | lookup local=t char_conversion_matrix bin as b64x_by8 output ascii as b64x_out | eval $b64in$_decode=mvjoin(b64x_out,"") | fields - b64x_* | eval $b64in$_decode = replace(replace($b64in$_decode,":NUL:",""),":SPACE:"," ") | rex field=$b64in$_decode mode=sed "s/\x00//g"' arguments: - b64in diff --git a/macros/remote_access_software_usage_exceptions.yml b/macros/remote_access_software_usage_exceptions.yml index 882b3c7b887..adeff11e2b3 100644 --- a/macros/remote_access_software_usage_exceptions.yml +++ b/macros/remote_access_software_usage_exceptions.yml @@ -1,8 +1,8 @@ name: remote_access_software_usage_exceptions id: 4b0c9d7e-6fe2-404d-87b0-80e11c9a11f1 -version: 1 +version: 2 creation_date: '2024-07-09' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Splunk Threat Research Team description: Macro used with remote access monitoring content to define exception lookup and usage. Returns filtered results based on contents of remote_access_software_usage_exception.csv -definition: 'eval exception_asset = CASE(isnotnull(src),src,isnotnull(dest),dest) | lookup update=true asset_lookup_by_str asset as exception_asset OUTPUTNEW asset as asset_temp_field | eval asset_temp_field = CASE(isnull(asset_temp_field),exception_asset,true(),asset_temp_field ) | lookup remote_access_software_exceptions asset as asset_temp_field software as signature OUTPUT exception as rmm_exception, exception_date as rmm_exception_date, exception_ttl_days as rmm_exception_ttl_days, comment as rmm_exception_comment | eval rmm_exception = mvdedup(mvfilter(NOT match(rmm_exception,"false"))), rmm_exception_date = mvdedup(mvfilter(NOT match(rmm_exception_date,"false"))), rmm_exception_ttl_days = mvdedup(mvfilter(NOT match(rmm_exception_ttl_days,"false"))), rmm_exception_comment = mvdedup(mvfilter(NOT match(rmm_exception_comment,"false"))), rmm_exception_end_date = relative_time(strptime(rmm_exception_date, "%Y-%m-%d"), "+"+rmm_exception_ttl_days+"d"), rmm_exception_end = CASE((now() >= rmm_exception_end_date),"TRUE",(now() < rmm_exception_end_date),"FALSE",(match(rmm_exception,"(?i)true") AND isnull(rmm_exception_ttl_days)),"UNLIMITED") | search NOT (rmm_exception = TRUE AND rmm_exception_end IN ("FALSE","UNLIMITED")) | fields - asset_temp_field,exception_asset' +definition: 'eval exception_asset = CASE(isnotnull(src),src,isnotnull(dest),dest) | lookup local=t update=true asset_lookup_by_str asset as exception_asset OUTPUTNEW asset as asset_temp_field | eval asset_temp_field = CASE(isnull(asset_temp_field),exception_asset,true(),asset_temp_field ) | lookup local=t remote_access_software_exceptions asset as asset_temp_field software as signature OUTPUT exception as rmm_exception, exception_date as rmm_exception_date, exception_ttl_days as rmm_exception_ttl_days, comment as rmm_exception_comment | eval rmm_exception = mvdedup(mvfilter(NOT match(rmm_exception,"false"))), rmm_exception_date = mvdedup(mvfilter(NOT match(rmm_exception_date,"false"))), rmm_exception_ttl_days = mvdedup(mvfilter(NOT match(rmm_exception_ttl_days,"false"))), rmm_exception_comment = mvdedup(mvfilter(NOT match(rmm_exception_comment,"false"))), rmm_exception_end_date = relative_time(strptime(rmm_exception_date, "%Y-%m-%d"), "+"+rmm_exception_ttl_days+"d"), rmm_exception_end = CASE((now() >= rmm_exception_end_date),"TRUE",(now() < rmm_exception_end_date),"FALSE",(match(rmm_exception,"(?i)true") AND isnull(rmm_exception_ttl_days)),"UNLIMITED") | search NOT (rmm_exception = TRUE AND rmm_exception_end IN ("FALSE","UNLIMITED")) | fields - asset_temp_field,exception_asset' diff --git a/macros/suspicious_writes.yml b/macros/suspicious_writes.yml index 40c6421b8dc..a86d06c69cb 100644 --- a/macros/suspicious_writes.yml +++ b/macros/suspicious_writes.yml @@ -1,8 +1,8 @@ name: suspicious_writes id: 6983de37-2a08-4c42-80a2-fe404edd19b4 -version: 1 +version: 2 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Splunk Threat Research Team description: This macro limites the output to file names that have been marked as suspicious -definition: lookup suspicious_writes_lookup file as file_name OUTPUT note as "Reference" | search "Reference" != False +definition: lookup local=t suspicious_writes_lookup file as file_name OUTPUT note as "Reference" | search "Reference" != False From 69bbd304ceec456a5dfecaab602e1bc4002afb1b Mon Sep 17 00:00:00 2001 From: Raven Tait <93157481+RavenTait@users.noreply.github.com> Date: Mon, 5 Oct 2026 05:59:11 -0400 Subject: [PATCH 123/162] Kerberloss Detections (#4296) --------- Co-authored-by: Nasreddine Bencherchali Co-authored-by: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> --- ..._computer_spn_modified_by_user_account.yml | 96 ++++++++++++++++ ...ows_ad_spn_unicode_collision_injection.yml | 104 ++++++++++++++++++ 2 files changed, 200 insertions(+) create mode 100644 detections/endpoint/windows_ad_computer_spn_modified_by_user_account.yml create mode 100644 detections/endpoint/windows_ad_spn_unicode_collision_injection.yml diff --git a/detections/endpoint/windows_ad_computer_spn_modified_by_user_account.yml b/detections/endpoint/windows_ad_computer_spn_modified_by_user_account.yml new file mode 100644 index 00000000000..a2fef1d15e8 --- /dev/null +++ b/detections/endpoint/windows_ad_computer_spn_modified_by_user_account.yml @@ -0,0 +1,96 @@ +name: Windows AD Computer SPN Modified By User Account +id: dbe30a35-b56d-4a7a-82c4-2433da06b342 +version: 1 +creation_date: '2026-09-25' +modification_date: '2026-09-25' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects a user account (non-machine account) adding or removing a servicePrincipalName (SPN) on a computer object in Active Directory, via Windows Security Event 5136. + In normal AD operations, SPN values on computer objects are managed exclusively by the computer account itself (during domain join or name change), by Domain Controllers during replication, or by the SYSTEM/NETWORK SERVICE context — all of which appear as accounts ending in the dollar sign ($) convention. + A named user account writing to the servicePrincipalName attribute of a computer object is anomalous and may indicate an attacker with delegated WriteProperty rights over computer accounts performing SPN manipulation. +data_source: + - Windows Event Log Security 5136 +search: |- + `wineventlog_security` + EventCode=5136 + AttributeLDAPDisplayName=servicePrincipalName + ObjectClass=computer + NOT SubjectUserName="*$" + NOT SubjectUserSid IN ( + "S-1-5-18", + "S-1-5-19", + "S-1-5-20" + ) + NOT SubjectUserName IN ( + "*ANONYMOUS*", + "*NT AUTHORITY*", + "*SYSTEM" + ) + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(AttributeValue) as spn_values + values(OperationType) as operation_types + by Computer SubjectUserName SubjectDomainName SubjectUserSid ObjectDN + + | eval operation_types=mvmap(operation_types, case(operation_types="%%14675", "Deleted", operation_types="%%14674", "Added", true(), operation_types)) + + | rename Computer as dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_ad_computer_spn_modified_by_user_account_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Domain Controller Security event logs. Enable the Advanced Security Audit policy `DS Access > Audit Directory Service Changes` for Success events. A WriteProperty audit SACL must also be configured on the computer object class (or CN=Computers container with inheritance) to generate Event 5136 when servicePrincipalName is modified. +known_false_positives: |- + Administrators using tools such as setspn.exe, ADSI Edit, or PowerShell AD modules to manually manage SPNs on computer objects will trigger this detection. + Service account provisioning workflows and some third-party identity management platforms may also legitimately modify computer SPNs. + Review the SubjectUserName, ObjectDN, and spn_values fields to determine if the change is expected. + Consider adding known administrative accounts to the filter macro. +references: + - https://www.semperis.com/blog/identity-crisis-novel-vulnerabilities-leading-to-kerberos-downgrade-dos-and-full-domain-takeover/ + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25177 + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136 +drilldown_searches: + - name: View the detection results for - "$SubjectUserName$" + search: '%original_detection_search% | search SubjectUserName = "$SubjectUserName$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$SubjectUserName$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$SubjectUserName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: SubjectUserName + type: user + score: 20 + message: User [$SubjectUserName$] modified SPNs on computer object [$ObjectDN$] on $dest$ +threat_objects: + - field: SubjectUserName + type: user +analytic_story: + - Active Directory Kerberos Attacks + - Compromised User Account + - Sneaky Active Directory Persistence Tricks +asset_type: Endpoint +cve: + - CVE-2026-25177 +mitre_attack_id: + - T1562.010 + - T1558.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.010/kerberloss/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml b/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml new file mode 100644 index 00000000000..bc34b8c4816 --- /dev/null +++ b/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml @@ -0,0 +1,104 @@ +name: Windows AD SPN Unicode Collision Injection +id: d2d2c043-57a6-4aca-be43-ebb402dbb9e5 +version: 1 +creation_date: '2026-09-25' +modification_date: '2026-09-25' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects the addition of a servicePrincipalName (SPN) containing invisible Unicode characters to an Active Directory computer object via Windows Security Event 5136. + This is the key indicator of the KerberLoss attack (CVE-2026-25177), where an attacker with write access to a machine account's SPN attribute injects a collision SPN that contains a Zero Width or other invisible Unicode character (e.g. U+200C Zero Width Non-Joiner). + LDAP's string preparation rules (RFC 4518) cause these characters to be ignored during uniqueness checking, allowing the write to succeed even when an identical SPN already exists on another machine account. + The Kerberos KDC, however, does not apply the same normalisation — it finds two accounts with matching SPNs and returns KDC_ERR_S_PRINCIPAL_UNKNOWN, causing a Kerberos denial-of-service or forcing clients to fall back to NTLM downgrade. +data_source: + - Windows Event Log Security 5136 +search: |- + `wineventlog_security` + EventCode=5136 + AttributeValue=* + AttributeLDAPDisplayName=servicePrincipalName + OperationType IN ( + "%%14674", + "%%14675" + ) + + | regex AttributeValue="[\x{034F}\x{200B}-\x{200F}\x{00AD}\x{1806}\x{FEFF}\x{FFFC}\x{2060}\x{206A}-\x{206F}\x{180B}-\x{180D}\x{FE00}-\x{FE0F}]" + + | eval matched_invisible_chars=mvappend( + if(match(AttributeValue, "\x{034F}"), "U+034F (Combining Grapheme Joiner)", null()), + if(match(AttributeValue, "\x{200B}"), "U+200B (Zero Width Space)", null()), + if(match(AttributeValue, "\x{200C}"), "U+200C (Zero Width Non-Joiner)", null()), + if(match(AttributeValue, "\x{200D}"), "U+200D (Zero Width Joiner)", null()), + if(match(AttributeValue, "\x{200E}"), "U+200E (Left-to-Right Mark)", null()), + if(match(AttributeValue, "\x{200F}"), "U+200F (Right-to-Left Mark)", null()), + if(match(AttributeValue, "\x{00AD}"), "U+00AD (Soft Hyphen)", null()), + if(match(AttributeValue, "\x{1806}"), "U+1806 (Mongolian Todo Soft Hyphen)", null()), + if(match(AttributeValue, "\x{FEFF}"), "U+FEFF (Zero Width No-Break Space)", null()), + if(match(AttributeValue, "\x{FFFC}"), "U+FFFC (Object Replacement Character)", null()), + if(match(AttributeValue, "\x{2060}"), "U+2060 (Word Joiner)", null()), + if(match(AttributeValue, "[\x{206A}-\x{206F}]"), "U+206A-206F (Deprecated Format Characters)", null()), + if(match(AttributeValue, "[\x{180B}-\x{180D}]"), "U+180B-180D (Variation Selectors)", null()), + if(match(AttributeValue, "[\x{FE00}-\x{FE0F}]"), "U+FE00-FE0F (Variation Selectors)", null())) + + | where isnotnull(matched_invisible_chars) + | rename Computer as dest + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(matched_invisible_chars) as matched_invisible_chars + by dest SubjectUserName SubjectDomainName ObjectDN ObjectClass AttributeValue + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_ad_spn_unicode_collision_injection_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Domain Controller Security event logs. Enable the Advanced Security Audit policy `DS Access > Audit Directory Service Changes` for Success events. Additionally, a WriteProperty audit SACL must be configured on the computer object class (or the CN=Computers container with inheritance) to generate Event 5136 when servicePrincipalName is modified. +known_false_positives: |- + Legitimate use of invisible Unicode characters in SPN values is not expected. This detection should have a very low false positive rate. + Provisioning tools or scripts that incorrectly encode SPN strings from certain character sets may trigger this. + Verify the SubjectUserName and ObjectDN to confirm intent. +references: + - https://www.semperis.com/blog/identity-crisis-novel-vulnerabilities-leading-to-kerberos-downgrade-dos-and-full-domain-takeover/ + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25177 + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136 +drilldown_searches: + - name: View the detection results for - "$SubjectUserName$" + search: '%original_detection_search% | search SubjectUserName = "$SubjectUserName$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$SubjectUserName$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$SubjectUserName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: User [$SubjectUserName$] injected an invisible-Unicode SPN [$matched_invisible_chars$] onto [$ObjectDN$] on $dest$ + entity: + field: SubjectUserName + type: user + score: 50 +threat_objects: + - field: AttributeValue + type: user +analytic_story: + - Active Directory Kerberos Attacks + - Compromised User Account + - Sneaky Active Directory Persistence Tricks +asset_type: Endpoint +cve: + - CVE-2026-25177 +mitre_attack_id: + - T1562.010 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.010/kerberloss/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit From fb58f09f959af48f795a7532739fe268ed367392 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 5 Oct 2026 14:14:20 +0200 Subject: [PATCH 124/162] update wmi filters analytics --- .../windows_event_log_wmi_activity_5861.yml | 61 +++++++++++++ ...ect_wmi_event_subscription_persistence.yml | 11 ++- .../wmi_temporary_event_subscription.yml | 12 ++- .../wmi_permanent_event_subscription.yml | 87 ++++++++++++++----- ..._permanent_event_subscription___sysmon.yml | 30 +++---- 5 files changed, 153 insertions(+), 48 deletions(-) create mode 100644 data_sources/windows_event_log_wmi_activity_5861.yml rename detections/{endpoint => deprecated}/detect_wmi_event_subscription_persistence.yml (89%) rename detections/{endpoint => deprecated}/wmi_temporary_event_subscription.yml (82%) diff --git a/data_sources/windows_event_log_wmi_activity_5861.yml b/data_sources/windows_event_log_wmi_activity_5861.yml new file mode 100644 index 00000000000..ab1747e3518 --- /dev/null +++ b/data_sources/windows_event_log_wmi_activity_5861.yml @@ -0,0 +1,61 @@ +name: Windows Event Log WMI Activity 5861 +id: dad572ee-2271-4a1c-b118-ae6c5494a7c1 +version: 1 +creation_date: '2026-10-05' +modification_date: '2026-10-05' +author: Nasreddine Bencherchali, Splunk +description: Logs the creation of a permanent WMI event subscription when an event filter is bound to an event consumer, including consumer and filter details. +mitre_components: + - WMI Creation + - Application Log Content + - OS API Execution +source: XmlWinEventLog:Microsoft-Windows-WMI-Activity/Operational +sourcetype: XmlWinEventLog +separator: EventID +separator_value: '5861' +supported_TA: [] +fields: + - _time + - Channel + - Computer + - EventCode + - System_Props_Xml + - UserData_Xml + - EventID + - EventRecordID + - Guid + - Keywords + - Level + - Opcode + - ProcessID + - SystemTime + - Task + - TaskCategory + - ThreadID + - UserID + - Version + - source + - sourcetype + - user_id + - vendor_product +output_fields: + - dest +example_log: |- + 586100000x400000000000000024669Microsoft-Windows-WMI-Activity/OperationalEC2AMAZ-1QDNI6F//./root/subscriptionAtomicRedTeam_filterCommandLineEventConsumer="AtomicRedTeam_consumer"Binding EventFilter: + instance of __EventFilter + { + CreatorSID = {1, 5, 0, 0, 0, 0, 0, 5, 21, 0, 0, 0, 95, 211, 181, 28, 123, 4, 131, 205, 168, 40, 205, 106, 244, 1, 0, 0}; + EventNamespace = "root\\subscription"; + Name = "AtomicRedTeam_filter"; + Query = "SELECT * FROM __InstanceCreationEvent Within 3 Where TargetInstance Isa \"Win32_Process\" And Targetinstance.Name = \"notepad.exe\" "; + QueryLanguage = "WQL"; + }; + Perm. Consumer: + instance of CommandLineEventConsumer + { + CommandLineTemplate = "cmd.exe"; + CreatorSID = {1, 5, 0, 0, 0, 0, 0, 5, 21, 0, 0, 0, 95, 211, 181, 28, 123, 4, 131, 205, 168, 40, 205, 106, 244, 1, 0, 0}; + Name = "AtomicRedTeam_consumer"; + RunInteractively = FALSE; + }; + diff --git a/detections/endpoint/detect_wmi_event_subscription_persistence.yml b/detections/deprecated/detect_wmi_event_subscription_persistence.yml similarity index 89% rename from detections/endpoint/detect_wmi_event_subscription_persistence.yml rename to detections/deprecated/detect_wmi_event_subscription_persistence.yml index 779f9b78bba..2d746625cbf 100644 --- a/detections/endpoint/detect_wmi_event_subscription_persistence.yml +++ b/detections/deprecated/detect_wmi_event_subscription_persistence.yml @@ -1,10 +1,10 @@ name: Detect WMI Event Subscription Persistence id: 01d9a0c2-cece-11eb-ab46-acde48001122 -version: 12 +version: 13 creation_date: '2021-06-16' -modification_date: '2026-05-13' +modification_date: '2026-10-05' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP description: The following analytic identifies the creation of WMI Event Subscriptions, which can be used to establish persistence or perform privilege escalation. It detects EventID 19 (EventFilter creation), EventID 20 (EventConsumer creation), and EventID 21 (FilterToConsumerBinding creation) from Sysmon logs. This activity is significant because WMI Event Subscriptions can execute code with elevated SYSTEM privileges, making it a powerful persistence mechanism. If confirmed malicious, an attacker could maintain long-term access, escalate privileges, and execute arbitrary code, posing a severe threat to the environment. data_source: @@ -60,3 +60,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: This rule uses only Sysmon EventID 20, which records creation of a WMI event consumer but does not confirm that a filter is bound to it. The Sysmon permanent subscription detection covers the binding with EventID 21. + removed_in_version: 6.10.0 + replacement_content: + - WMI Permanent Event Subscription - Sysmon diff --git a/detections/endpoint/wmi_temporary_event_subscription.yml b/detections/deprecated/wmi_temporary_event_subscription.yml similarity index 82% rename from detections/endpoint/wmi_temporary_event_subscription.yml rename to detections/deprecated/wmi_temporary_event_subscription.yml index b08200b0fc1..abe30ff2973 100644 --- a/detections/endpoint/wmi_temporary_event_subscription.yml +++ b/detections/deprecated/wmi_temporary_event_subscription.yml @@ -1,10 +1,10 @@ name: WMI Temporary Event Subscription id: 38cbd42c-1098-41bb-99cf-9d6d2b296d83 -version: 10 +version: 11 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-05' author: Rico Valdez, Splunk -status: experimental +status: deprecated type: TTP description: The following analytic detects the creation of WMI temporary event subscriptions. It leverages Windows Event Logs, specifically EventCode 5860, to identify these activities. This detection is significant because attackers often use WMI to execute commands, gather information, or maintain persistence within a compromised system. If confirmed malicious, this activity could allow an attacker to execute arbitrary code, escalate privileges, or persist in the environment. Analysts should review the specific WMI queries and assess their intent, considering potential false positives from legitimate administrative tasks. data_source: [] @@ -43,3 +43,9 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint +deprecation_info: + reason: |- + This rule is deprecated in its current form because EventID 5860 identifies temporary subscriptions rather than permanent persistence, and the broad match with exact query-string exceptions does not reliably distinguish malicious use from legitimate software. + Temporary WMI activity may warrant a separate behavior-focused detection. + removed_in_version: 6.10.0 + replacement_content: [] diff --git a/detections/endpoint/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml index 12a5ee8fb33..90cdca1ae46 100644 --- a/detections/endpoint/wmi_permanent_event_subscription.yml +++ b/detections/endpoint/wmi_permanent_event_subscription.yml @@ -1,43 +1,86 @@ name: WMI Permanent Event Subscription id: 71bfdb13-f200-4c6c-b2c9-a2e07adf437d -version: 10 +version: 15 creation_date: '2020-04-29' -modification_date: '2026-05-13' -author: Rico Valdez, Splunk -status: experimental -type: TTP -description: The following analytic detects the creation of permanent event subscriptions using Windows Management Instrumentation (WMI). It leverages Sysmon EventID 5 data to identify instances where the event consumers are not the expected "NTEventLogEventConsumer." This activity is significant because it suggests an attacker is attempting to achieve persistence by running malicious scripts or binaries in response to specific system events. If confirmed malicious, this could lead to severe impacts such as data theft, ransomware deployment, or other damaging outcomes. Investigate the associated scripts or binaries to identify the source of the attack. -data_source: [] +modification_date: '2026-10-05' +author: Rico Valdez, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: |- + Detects WMI permanent event subscriptions from Windows WMI-Activity EventID 5861. +data_source: + - Windows Event Log WMI Activity 5861 search: |- `wmi` EventCode=5861 - Binding - | rex field=Message "Consumer =\s+(?[^;|^$]+)" - | search consumer!="NTEventLogEventConsumer=\"SCM Event Log Consumer\"" + | spath input=_raw output=possible_cause path=Event.UserData.Operation_ESStoConsumerBinding.PossibleCause + | spath input=_raw output=consumer_xml path=Event.UserData.Operation_ESStoConsumerBinding.CONSUMER + | eval possible_cause=coalesce(possible_cause, Message) + | rex field=Message "(?i)Consumer\s*=\s*(?[^;\r\n]+)" + | eval consumer=coalesce(consumer_xml, consumer_message) + | where isnull(consumer) OR consumer!="NTEventLogEventConsumer=\"SCM Event Log Consumer\"" + | rex field=possible_cause "(?ms)instance of __EventFilter\s+\{(?.*?)\};\s*Perm\. Consumer:" + | rex field=event_filter "(?m)^\s*Name\s*=\s*\"(?[^\"]*)\"\s*;" + | rex field=event_filter "(?m)^\s*Query\s*=\s*\"(?.*?)\"\s*;" + | rex field=event_filter "(?m)^\s*EventNamespace\s*=\s*\"(?[^\"]*)\"\s*;" + | rex field=event_filter "(?m)^\s*QueryLanguage\s*=\s*\"(?[^\"]*)\"\s*;" + | rex field=possible_cause "(?s)Perm\. Consumer:\s+instance of (?[A-Za-z0-9_]+)\s+\{(?.*?)\};\s*\Z" + | rex field=consumer_properties "(?m)^\s*Name\s*=\s*\"(?[^\"]*)\"\s*;" + | rex field=consumer_properties "(?m)^\s*CommandLineTemplate\s*=\s*\"(?.*?)\"\s*;" + | rex field=consumer_properties "(?m)^\s*RunInteractively\s*=\s*(?[^;]+)\s*;" + | rex field=consumer_properties "(?m)^\s*ScriptingEngine\s*=\s*\"(?[^\"]*)\"\s*;" + | rex field=consumer_properties "(?ms)^\s*ScriptText\s*=\s*\"(?.*?)\"\s*;\s*$" + | where consumer_type IN ("CommandLineEventConsumer", "ActiveScriptEventConsumer") + | eval command=coalesce(command_line_template, script_text) + | fillnull value=NULL | stats count min(_time) as firstTime max(_time) as lastTime - by ComputerName, consumer, Message + values(consumer) as consumer + values(consumer_type) as consumer_type + values(consumer_name) as consumer_name + values(command_line_template) as command_line_template + values(run_interactively) as run_interactively + values(scripting_engine) as scripting_engine + values(script_text) as script_text + values(command) as command + by Computer, filter_name, filter_query, filter_event_namespace, filter_query_language | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | rename ComputerName as dest + | rename Computer as dest | `wmi_permanent_event_subscription_filter` -how_to_implement: To successfully implement this search, you must be ingesting the Windows WMI activity logs. This can be done by adding a stanza to inputs.conf on the system generating logs with a title of [WinEventLog://Microsoft-Windows-WMI-Activity/Operational]. -known_false_positives: Although unlikely, administrators may use event subscriptions for legitimate purposes. -references: [] -finding: - title: WMI Permanent Event Subscription detected on $dest$ - entity: - field: dest - type: system - score: 50 +how_to_implement: |- + Ingest Microsoft-Windows-WMI-Activity/Operational events and ensure EventCode, Computer, and the raw XML event are available. + The search uses spath to extract the binding details, then regex to parse the embedded __EventFilter and the supported CommandLineEventConsumer and ActiveScriptEventConsumer properties. For non-XML rendered events, Message is used as a fallback for the consumer details. +known_false_positives: |- + Administrators and software may use permanent WMI event subscriptions. Review the consumer, filter query, and creator context; tune known authorized subscriptions with the detection filter macro. +references: + - https://learn.microsoft.com/en-us/windows/win32/wmisdk/binding-an-event-filter-with-a-logical-consumer + - https://learn.microsoft.com/en-us/windows/win32/wmisdk/commandlineeventconsumer + - https://learn.microsoft.com/en-us/windows/win32/wmisdk/activescripteventconsumer +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: WMI event filter [$filter_name$] in [$filter_event_namespace$] watches [$filter_query$] and is bound to [$consumer_type$] [$consumer_name$] on [$dest$], which can execute [$command$]. +threat_objects: + - field: command + type: command analytic_story: - Suspicious WMI Use asset_type: Endpoint mitre_attack_id: - - T1047 + - T1546.003 product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud category: endpoint security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team_wmi_subscription/wmi.log + source: XmlWinEventLog:Microsoft-Windows-WMI-Activity/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index f876f349a24..5408d149b80 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -1,28 +1,24 @@ name: WMI Permanent Event Subscription - Sysmon id: ad05aae6-3b2a-4f73-af97-57bd26cee3b9 -version: 12 +version: 14 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-05' author: Rico Valdez, Michael Haag, Splunk status: production -type: TTP -description: The following analytic identifies the creation of WMI permanent event subscriptions, which can be used to establish persistence or perform privilege escalation. It leverages Sysmon data, specifically EventCodes 19, 20, and 21, to detect the creation of WMI EventFilters, EventConsumers, and FilterToConsumerBindings. This activity is significant as it may indicate an attacker setting up mechanisms to execute code with elevated SYSTEM privileges when specific events occur. If confirmed malicious, this could allow the attacker to maintain persistence, escalate privileges, and execute arbitrary code, posing a severe threat to the environment. +type: Anomaly +description: |- + Detects creation of a WMI permanent event subscription using Sysmon EventID 21. The event identifies the consumer and filter that were bound, showing what will run and which event condition triggers it. data_source: - Sysmon EventID 21 search: |- - `sysmon` EventCode=21 + `sysmon` EventCode=21 Operation=Created | stats count min(_time) as firstTime max(_time) as lastTime - BY dest dvc object - object_attrs object_category object_path - signature signature_id src - status user user_id - vendor_product Consumer ConsumerNoQuotes - Filter FilterNoQuotes + BY dest user Consumer Filter | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmi_permanent_event_subscription___sysmon_filter` -how_to_implement: To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity (eventID= 19, 20, 21). In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields. -known_false_positives: Although unlikely, administrators may use event subscriptions for legitimate purposes. +how_to_implement: Collect Sysmon WMI events and parse EventID 21, including the Operation, destination, user, Consumer, and Filter fields. Sysmon EventID 21 is emitted when a consumer is bound to a filter. +known_false_positives: Administrators and software may create authorized WMI subscriptions. Review the consumer and filter paths, then tune known authorized subscriptions with the detection filter macro. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ @@ -37,18 +33,12 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: WMI Permanent Event Subscription detected on $dest$ by $user$ - entity: - field: user - type: user - score: 50 intermediate_findings: entities: - field: dest type: system score: 50 - message: WMI Permanent Event Subscription detected on $dest$ by $user$ + message: A WMI consumer-to-filter binding was on [$dest$] by [$user$] consumer - [$Consumer$] was bound to filter [$Filter$]. analytic_story: - Suspicious WMI Use asset_type: Endpoint From d032dd9e71ed9e3a4888e9e31a85aa00341e1f82 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 5 Oct 2026 14:17:14 +0200 Subject: [PATCH 125/162] Update wmi_permanent_event_subscription___sysmon.yml --- ..._permanent_event_subscription___sysmon.yml | 23 ++++++++++++------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index 5408d149b80..9a6f4e32e12 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -7,18 +7,25 @@ author: Rico Valdez, Michael Haag, Splunk status: production type: Anomaly description: |- - Detects creation of a WMI permanent event subscription using Sysmon EventID 21. The event identifies the consumer and filter that were bound, showing what will run and which event condition triggers it. + Detects the creation of a WMI permanent event subscription using Sysmon EventID 21. data_source: - Sysmon EventID 21 search: |- - `sysmon` EventCode=21 Operation=Created - | stats count min(_time) as firstTime max(_time) as lastTime + `sysmon` + EventCode=21 + Operation=Created + + | stats count min(_time) as firstTime + max(_time) as lastTime BY dest user Consumer Filter - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `wmi_permanent_event_subscription___sysmon_filter` -how_to_implement: Collect Sysmon WMI events and parse EventID 21, including the Operation, destination, user, Consumer, and Filter fields. Sysmon EventID 21 is emitted when a consumer is bound to a filter. -known_false_positives: Administrators and software may create authorized WMI subscriptions. Review the consumer and filter paths, then tune known authorized subscriptions with the detection filter macro. + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `wmi_permanent_event_subscription___sysmon_filter` +how_to_implement: |- + To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity (eventID= 19, 20, 21). In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields. +known_false_positives: |- + Administrators and software may create authorized WMI subscriptions. Review the consumer and filter paths, then tune known authorized subscriptions with the detection filter macro. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ From 152e2f57cd28a9792d4329e3f7de3775656665dc Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Mon, 5 Oct 2026 14:20:42 +0200 Subject: [PATCH 126/162] New Approach on Handling Renamed Binaries (#4283) --------- Co-authored-by: Nasreddine Bencherchali --- .../detect_html_help_renamed.yml | 11 +- .../detect_mshta_renamed.yml | 11 +- .../detect_renamed_7_zip.yml | 11 +- .../detect_renamed_psexec.yml | 11 +- .../detect_renamed_rclone.yml | 11 +- .../detect_renamed_winrar.yml | 11 +- ...ous_microsoft_workflow_compiler_rename.yml | 11 +- .../suspicious_msbuild_rename.yml | 11 +- ...indows_lolbas_executed_as_renamed_file.yml | 9 +- .../windows_regsvr32_renamed_binary.yml | 11 +- .../windows_renamed_powershell_execution.yml | 11 +- ...named_command_interpreter_was_executed.yml | 109 +++++++++++++ ...ows_renamed_lolbas_binary_was_executed.yml | 114 ++++++++++++++ ...opular_3rd_party_software_was_executed.yml | 107 +++++++++++++ ...ows_renamed_python_binary_was_executed.yml | 91 +++++++++++ lookups/csv/renamed_lolbas_binaries.csv | 147 ++++++++++++++++++ lookups/csv/renamed_lolbas_binaries.yml | 14 ++ .../renamed_popular_3rd_party_binaries.csv | 43 +++++ .../renamed_popular_3rd_party_binaries.yml | 14 ++ ...d_windows_command_interpreter_binaries.csv | 14 ++ ...d_windows_command_interpreter_binaries.yml | 14 ++ 21 files changed, 754 insertions(+), 32 deletions(-) rename detections/{endpoint => deprecated}/detect_html_help_renamed.yml (89%) rename detections/{endpoint => deprecated}/detect_mshta_renamed.yml (88%) rename detections/{endpoint => deprecated}/detect_renamed_7_zip.yml (88%) rename detections/{endpoint => deprecated}/detect_renamed_psexec.yml (89%) rename detections/{endpoint => deprecated}/detect_renamed_rclone.yml (88%) rename detections/{endpoint => deprecated}/detect_renamed_winrar.yml (87%) rename detections/{endpoint => deprecated}/suspicious_microsoft_workflow_compiler_rename.yml (89%) rename detections/{endpoint => deprecated}/suspicious_msbuild_rename.yml (89%) rename detections/{endpoint => deprecated}/windows_lolbas_executed_as_renamed_file.yml (95%) rename detections/{endpoint => deprecated}/windows_regsvr32_renamed_binary.yml (90%) rename detections/{endpoint => deprecated}/windows_renamed_powershell_execution.yml (91%) create mode 100644 detections/endpoint/windows_renamed_command_interpreter_was_executed.yml create mode 100644 detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml create mode 100644 detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml create mode 100644 detections/endpoint/windows_renamed_python_binary_was_executed.yml create mode 100644 lookups/csv/renamed_lolbas_binaries.csv create mode 100644 lookups/csv/renamed_lolbas_binaries.yml create mode 100644 lookups/csv/renamed_popular_3rd_party_binaries.csv create mode 100644 lookups/csv/renamed_popular_3rd_party_binaries.yml create mode 100644 lookups/csv/renamed_windows_command_interpreter_binaries.csv create mode 100644 lookups/csv/renamed_windows_command_interpreter_binaries.yml diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/deprecated/detect_html_help_renamed.yml similarity index 89% rename from detections/endpoint/detect_html_help_renamed.yml rename to detections/deprecated/detect_html_help_renamed.yml index e9d228305a9..6a71fb80287 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/deprecated/detect_html_help_renamed.yml @@ -1,10 +1,10 @@ name: Detect HTML Help Renamed id: 62fed254-513b-460e-953d-79771493a9f3 -version: 14 +version: 15 creation_date: '2021-02-11' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects instances where hh.exe (HTML Help) has been renamed and is executing a Compiled HTML Help (CHM) file. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because attackers can use renamed hh.exe to execute malicious scripts embedded in CHM files, potentially leading to code execution. If confirmed malicious, this technique could allow attackers to run arbitrary scripts, escalate privileges, or persist within the environment, posing a significant security risk. data_source: @@ -53,3 +53,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/deprecated/detect_mshta_renamed.yml similarity index 88% rename from detections/endpoint/detect_mshta_renamed.yml rename to detections/deprecated/detect_mshta_renamed.yml index e04f4d7434c..a18668a17fe 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/deprecated/detect_mshta_renamed.yml @@ -1,10 +1,10 @@ name: Detect mshta renamed id: 8f45fcf0-5b68-11eb-ae93-0242ac130002 -version: 13 +version: 14 creation_date: '2021-01-15' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic identifies instances where mshta.exe has been renamed and executed. It leverages Endpoint Detection and Response (EDR) data, specifically focusing on the original file name field to detect discrepancies. This activity is significant because renaming mshta.exe is a common tactic used by attackers to evade detection and execute malicious scripts. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network. data_source: @@ -52,3 +52,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/deprecated/detect_renamed_7_zip.yml similarity index 88% rename from detections/endpoint/detect_renamed_7_zip.yml rename to detections/deprecated/detect_renamed_7_zip.yml index 667a8ad2f50..fea1e5e5ce5 100644 --- a/detections/endpoint/detect_renamed_7_zip.yml +++ b/detections/deprecated/detect_renamed_7_zip.yml @@ -1,10 +1,10 @@ name: Detect Renamed 7-Zip id: 4057291a-b8cf-11eb-95fe-acde48001122 -version: 12 +version: 13 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects the usage of a renamed 7-Zip executable using Sysmon data. It leverages the OriginalFileName field to identify instances where the 7-Zip process has been renamed. This activity is significant as attackers often rename legitimate tools to evade detection while staging or exfiltrating data. If confirmed malicious, this behavior could indicate data exfiltration attempts or other unauthorized data manipulation, potentially leading to significant data breaches or loss of sensitive information. Analysts should validate the legitimacy of the 7-Zip executable and investigate parallel processes for further suspicious activities. data_source: @@ -52,3 +52,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed Popular 3rd Party Software was Executed diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/deprecated/detect_renamed_psexec.yml similarity index 89% rename from detections/endpoint/detect_renamed_psexec.yml rename to detections/deprecated/detect_renamed_psexec.yml index 2e56a883799..52e1bdf8899 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/deprecated/detect_renamed_psexec.yml @@ -1,10 +1,10 @@ name: Detect Renamed PSExec id: 683e6196-b8e8-11eb-9a79-acde48001122 -version: 17 +version: 18 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk, Alex Oberkircher, Github Community -status: production +status: deprecated type: Hunting description: The following analytic identifies instances where `PsExec.exe` has been renamed and executed on an endpoint. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because renaming `PsExec.exe` is a common tactic to evade detection. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to unauthorized access, lateral movement, or further compromise of the network. data_source: @@ -67,3 +67,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all command interpreter binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed Command Interpreter was Executed diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/deprecated/detect_renamed_rclone.yml similarity index 88% rename from detections/endpoint/detect_renamed_rclone.yml rename to detections/deprecated/detect_renamed_rclone.yml index d7bbfa5d717..7e9bccd3330 100644 --- a/detections/endpoint/detect_renamed_rclone.yml +++ b/detections/deprecated/detect_renamed_rclone.yml @@ -1,10 +1,10 @@ name: Detect Renamed RClone id: 6dca1124-b3ec-11eb-9328-acde48001122 -version: 12 +version: 13 creation_date: '2021-05-13' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects the execution of a renamed `rclone.exe` process, which is commonly used for data exfiltration to remote destinations. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and original file names that do not match. This activity is significant because ransomware groups often use RClone to exfiltrate sensitive data. If confirmed malicious, this behavior could indicate an ongoing data exfiltration attempt, potentially leading to significant data loss and further compromise of the affected systems. data_source: @@ -56,3 +56,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed Popular 3rd Party Software was Executed diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/deprecated/detect_renamed_winrar.yml similarity index 87% rename from detections/endpoint/detect_renamed_winrar.yml rename to detections/deprecated/detect_renamed_winrar.yml index 5779de2a81b..215d1d0a53e 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/deprecated/detect_renamed_winrar.yml @@ -1,10 +1,10 @@ name: Detect Renamed WinRAR id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122 -version: 16 +version: 17 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic identifies instances where `WinRAR.exe` has been renamed and executed. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names within the Endpoint data model. This activity is significant because renaming executables is a common tactic used by attackers to evade detection. If confirmed malicious, this could indicate an attempt to bypass security controls, potentially leading to unauthorized data extraction or further system compromise. data_source: @@ -52,3 +52,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed Popular 3rd Party Software was Executed diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/deprecated/suspicious_microsoft_workflow_compiler_rename.yml similarity index 89% rename from detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml rename to detections/deprecated/suspicious_microsoft_workflow_compiler_rename.yml index 21f34aefa8a..ec137b5b28c 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml +++ b/detections/deprecated/suspicious_microsoft_workflow_compiler_rename.yml @@ -1,10 +1,10 @@ name: Suspicious microsoft workflow compiler rename id: f0db4464-55d9-11eb-ae93-0242ac130002 -version: 14 +version: 15 creation_date: '2021-01-19' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects the renaming of microsoft.workflow.compiler.exe, a rarely used executable typically located in C:\Windows\Microsoft.NET\Framework64\v4.0.30319. This detection leverages Endpoint Detection and Response (EDR) data, focusing on process names and original file names. This activity is significant because renaming this executable can indicate an attempt to evade security controls. If confirmed malicious, an attacker could use this renamed executable to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment. data_source: @@ -56,3 +56,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/deprecated/suspicious_msbuild_rename.yml similarity index 89% rename from detections/endpoint/suspicious_msbuild_rename.yml rename to detections/deprecated/suspicious_msbuild_rename.yml index 7a4091f3103..4fb2bbb641e 100644 --- a/detections/endpoint/suspicious_msbuild_rename.yml +++ b/detections/deprecated/suspicious_msbuild_rename.yml @@ -1,10 +1,10 @@ name: Suspicious MSBuild Rename id: 4006adac-5937-11eb-ae93-0242ac130002 -version: 14 +version: 15 creation_date: '2021-01-15' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects the execution of renamed instances of msbuild.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names within the Endpoint data model. This activity is significant because msbuild.exe is a legitimate tool often abused by attackers to execute malicious code while evading detection. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network. data_source: @@ -58,3 +58,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml b/detections/deprecated/windows_lolbas_executed_as_renamed_file.yml similarity index 95% rename from detections/endpoint/windows_lolbas_executed_as_renamed_file.yml rename to detections/deprecated/windows_lolbas_executed_as_renamed_file.yml index 93cd636e66b..94d1538a1af 100644 --- a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml +++ b/detections/deprecated/windows_lolbas_executed_as_renamed_file.yml @@ -2,9 +2,9 @@ name: Windows LOLBAS Executed As Renamed File id: fd496996-7d9e-4894-8d40-bb85b6192dc6 version: 11 creation_date: '2024-05-03' -modification_date: '2026-09-22' +modification_date: '2026-09-23' author: Steven Dick -status: production +status: deprecated type: TTP description: The following analytic identifies a LOLBAS process being executed where it's process name does not match it's original file name attribute. Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. data_source: @@ -63,3 +63,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to renaming of its newer version. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/windows_regsvr32_renamed_binary.yml b/detections/deprecated/windows_regsvr32_renamed_binary.yml similarity index 90% rename from detections/endpoint/windows_regsvr32_renamed_binary.yml rename to detections/deprecated/windows_regsvr32_renamed_binary.yml index 883a47c7e4b..4d6940c412e 100644 --- a/detections/endpoint/windows_regsvr32_renamed_binary.yml +++ b/detections/deprecated/windows_regsvr32_renamed_binary.yml @@ -1,10 +1,10 @@ name: Windows Regsvr32 Renamed Binary id: 7349a9e9-3cf6-4171-bb0c-75607a8dcd1a -version: 13 +version: 14 creation_date: '2022-10-27' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP description: The following analytic identifies instances where the regsvr32.exe binary has been renamed and executed. This detection leverages Endpoint Detection and Response (EDR) data, specifically focusing on the original filename metadata. Renaming regsvr32.exe is significant as it can be an evasion technique used by attackers to bypass security controls. If confirmed malicious, this activity could allow an attacker to execute arbitrary DLLs, potentially leading to code execution, privilege escalation, or persistence within the environment. data_source: @@ -65,3 +65,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/windows_renamed_powershell_execution.yml b/detections/deprecated/windows_renamed_powershell_execution.yml similarity index 91% rename from detections/endpoint/windows_renamed_powershell_execution.yml rename to detections/deprecated/windows_renamed_powershell_execution.yml index bade4e80afd..dbb8ef8e183 100644 --- a/detections/endpoint/windows_renamed_powershell_execution.yml +++ b/detections/deprecated/windows_renamed_powershell_execution.yml @@ -1,10 +1,10 @@ name: Windows Renamed Powershell Execution id: c08014de-cc5a-42de-9775-76ecd5b37bbd -version: 8 +version: 9 creation_date: '2022-10-27' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Teoderick Contreras, Nasreddine Bencherchali, Splunk -status: production +status: deprecated type: TTP description: The following analytic identifies instances where the PowerShell executable has been renamed and executed under an alternate filename. This behavior is commonly associated with attempts to evade security controls or bypass logging mechanisms that monitor standard PowerShell usage. While rare in legitimate environments, renamed PowerShell binaries are frequently observed in malicious campaigns leveraging Living-off-the-Land Binaries (LOLBins) and fileless malware techniques. This detection flags executions of PowerShell where the process name does not match the default powershell.exe or pwsh.exe, especially when invoked from unusual paths or accompanied by suspicious command-line arguments. data_source: @@ -49,3 +49,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all command interpreter binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed Command Interpreter was Executed diff --git a/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml new file mode 100644 index 00000000000..3e97a3ea439 --- /dev/null +++ b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml @@ -0,0 +1,109 @@ +name: Windows Renamed Command Interpreter was Executed +id: 6f4611be-076e-4fa8-bc78-466588a71442 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies a Windows command interpreter process being executed where it's process name does not match it's original file name attribute. + Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code. +data_source: + - Sysmon EventID 1 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) AS firstTime + max(_time) AS lastTime + + FROM datamodel=Endpoint.Processes WHERE + + NOT Processes.original_file_name IN ("-","unknown") + [ + | inputlookup renamed_windows_command_interpreter_binaries + | rename original_file_name as Processes.original_file_name + | table Processes.original_file_name + ] + NOT [ + | inputlookup renamed_windows_command_interpreter_binaries + | rename original_file_name as Processes.process_name + | table Processes.process_name + ] + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | eval original_file_name=lower(original_file_name) + + | where NOT match(process_name, "(?i)^".replace(original_file_name,"(?i).exe","")) + | where NOT match(process_name, "(?i)".original_file_name) + + | lookup local=t renamed_windows_command_interpreter_binaries original_file_name OUTPUT description + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_renamed_command_interpreter_was_executed_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents + are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement + this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, + you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk + Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node + of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and + speed up the data modeling process. +known_false_positives: |- + 3rd party software binaries sharing the same name as Windows command interpreter binaries may trigger false positives. +references: + - https://attack.mitre.org/techniques/T1036/ + - https://attack.mitre.org/techniques/T1036/003/ + - https://attack.mitre.org/techniques/T1059/ + - https://redcanary.com/threat-detection-report/techniques/rename-system-utilities/ +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Command Interpreter [$original_file_name$] was renamed as [$process_path$] and later executed on [$dest$] +threat_objects: + - field: process_path + type: file_path +analytic_story: + - Living Off The Land + - Masquerading - Rename System Utilities + - Suspicious Command-Line Executions + - Windows Defense Evasion Tactics + - Water Gamayun +asset_type: Endpoint +mitre_attack_id: + - T1036.003 + - T1059 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/renamed_command_interpreter/renamed_command_interpreter.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml new file mode 100644 index 00000000000..f0842c81eb4 --- /dev/null +++ b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml @@ -0,0 +1,114 @@ +name: Windows Renamed LOLBAS Binary was Executed +id: 10c3850e-810d-41b4-a197-2f14d7883579 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Steven Dick, Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies a LOLBAS process being executed where it's process name does not match it's original file name attribute. + Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code. + The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. +data_source: + - Sysmon EventID 1 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) AS firstTime + max(_time) AS lastTime + + FROM datamodel=Endpoint.Processes WHERE + + NOT Processes.original_file_name IN ("-","unknown") + [ + | inputlookup renamed_lolbas_binaries + | rename original_file_name as Processes.original_file_name + | table Processes.original_file_name + ] + NOT [ + | inputlookup renamed_lolbas_binaries + | rename original_file_name as Processes.process_name + | table Processes.process_name + ] + NOT process_name IN ( + "excelcnv.exe", + "installutil64.exe", + "protoc~1.exe", + "regwrite.exe", + "vzshadow.exe" + ) + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | eval original_file_name=lower(original_file_name) + + | where NOT match(process_name, "(?i)^".replace(original_file_name,"(?i).exe","")) + | where NOT match(process_name, "(?i)".original_file_name) + + | lookup local=t renamed_lolbas_binaries original_file_name OUTPUT description + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_renamed_lolbas_binary_was_executed_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents + are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement + this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, + you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk + Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node + of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and + speed up the data modeling process. +known_false_positives: |- + 3rd party software binaries sharing the same name as LOLBAS utilities may trigger false positives. +references: + - https://attack.mitre.org/techniques/T1036/ + - https://attack.mitre.org/techniques/T1036/003/ + - https://redcanary.com/threat-detection-report/techniques/rename-system-utilities/ +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: LOLBAS utility [$original_file_name$] was renamed as [$process_path$] and later executed on [$dest$] +threat_objects: + - field: process_path + type: file_path +analytic_story: + - Living Off The Land + - Masquerading - Rename System Utilities + - Windows Defense Evasion Tactics + - Water Gamayun +asset_type: Endpoint +mitre_attack_id: + - T1036.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/renamed_lolbas_binary/renamed_lolbas_binary.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml new file mode 100644 index 00000000000..374458d818c --- /dev/null +++ b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml @@ -0,0 +1,107 @@ +name: Windows Renamed Popular 3rd Party Software was Executed +id: cf6713c7-ac6b-4963-83a6-39f24ed10aa8 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies a popular 3rd party software process being executed where it's process name does not match it's original file name attribute. + Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code. +data_source: + - Sysmon EventID 1 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) AS firstTime + max(_time) AS lastTime + + FROM datamodel=Endpoint.Processes WHERE + + NOT Processes.original_file_name IN ("-","unknown") + [ + | inputlookup renamed_popular_3rd_party_binaries + | rename original_file_name as Processes.original_file_name + | table Processes.original_file_name + ] + NOT [ + | inputlookup renamed_popular_3rd_party_binaries + | rename original_file_name as Processes.process_name + | table Processes.process_name + ] + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | eval original_file_name=lower(original_file_name) + + | where NOT match(process_name, "(?i)^".replace(original_file_name,"(?i).exe","")) + | where NOT match(process_name, "(?i)".original_file_name) + + | lookup local=t renamed_popular_3rd_party_binaries original_file_name OUTPUT description + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_renamed_popular_3rd_party_software_was_executed_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents + are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement + this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, + you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk + Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node + of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and + speed up the data modeling process. +known_false_positives: |- + 3rd party software binaries might have overlapping executable names. +references: + - https://attack.mitre.org/techniques/T1036/ + - https://attack.mitre.org/techniques/T1036/003/ + - https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/ + - https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/ +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Windows 3rd Party software [$original_file_name$] was renamed as [$process_path$] and later executed on [$dest$] +threat_objects: + - field: process_path + type: file_path +analytic_story: + - Living Off The Land + - Masquerading - Rename System Utilities + - Windows Defense Evasion Tactics + - Water Gamayun +asset_type: Endpoint +mitre_attack_id: + - T1036.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/renamed_3rd_party_software/renamed_3rd_party_software.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_renamed_python_binary_was_executed.yml b/detections/endpoint/windows_renamed_python_binary_was_executed.yml new file mode 100644 index 00000000000..4f0731c4512 --- /dev/null +++ b/detections/endpoint/windows_renamed_python_binary_was_executed.yml @@ -0,0 +1,91 @@ +name: Windows Renamed Python Binary was Executed +id: 6735153f-2da0-4eba-a428-288898613837 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies a Python process being executed where it's process name does not match + it's original file name attribute. Processes that have been renamed and executed may be an indicator that + an adversary is attempting to evade defenses or execute malicious code. +data_source: + - Sysmon EventID 1 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime + FROM datamodel=Endpoint.Processes + WHERE + Processes.original_file_name IN ( + "py*", + "python*", + "ipyw*" + ) + NOT Processes.original_file_name IN ("-","unknown") + NOT Processes.process_name IN ("dwagent.exe", "WinUtils.exe") + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | eval original_file_name=lower(original_file_name) + | regex original_file_name="(?i)^(?:py|pyw|python|pythonw|python32|python64|pythonw32|pythonw64|ipyw32|ipyw64|python3|pythonw3|python3\.\w+|pythonw3\.\w+)\.exe$" + | regex process_name!="(?i)^(?:py|pyw|pip|pip3|python|pythonw|python32|python64|pythonw32|pythonw64|ipyw32|ipyw64|python3|pythonw3|python3\.\w+|pythonw3\.\w+|pip3\.\w+|idle3\.\w+)\.exe$" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_renamed_python_binary_was_executed_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents + are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement + this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, + you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk + Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node + of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and + speed up the data modeling process. +known_false_positives: Various Python implementations might have a different executable name, which could trigger false positives. +references: + - https://attack.mitre.org/techniques/T1036/ + - https://attack.mitre.org/techniques/T1036/003/ + - https://attack.mitre.org/techniques/T1059/006/ + - https://www.microsoft.com/en-us/security/blog/2026/02/05/clickfix-variant-crashfix-deploying-python-rat-trojan/ +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Python binary [$original_file_name$] was renamed as [$process_path$] and later executed on [$dest$] +threat_objects: + - field: process_name + type: process_name +analytic_story: + - Living Off The Land + - Masquerading - Rename System Utilities + - Windows Defense Evasion Tactics + - Water Gamayun +asset_type: Endpoint +mitre_attack_id: + - T1036.003 + - T1059.006 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/renamed_python_binary/renamed_python_binary.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/lookups/csv/renamed_lolbas_binaries.csv b/lookups/csv/renamed_lolbas_binaries.csv new file mode 100644 index 00000000000..ba83e577f1f --- /dev/null +++ b/lookups/csv/renamed_lolbas_binaries.csv @@ -0,0 +1,147 @@ +original_file_name,description +acccheckconsole.exe,Verifies UI accessibility requirements +addinutil.exe,.NET Tool used for updating cache files for Microsoft Office Add-Ins. +adplus.exe,Debugging tool included with Windows Debugging Tools +agentexecutor.exe,Intune Management Extension included on Intune Managed Devices +appcert.exe,Windows App Certification Kit command-line tool. +appinstaller.exe,Tool used for installation of AppX/MSIX applications on Windows 10 +appvlp.exe,Application Virtualization Utility Included with Microsoft Office 2016 +aspnet_compiler.exe,ASP.NET Compilation Tool +at.exe,Schedule periodic tasks +atbroker.exe,Helper binary for Assistive Technology (AT) +bitsadmin.exe,Used for managing background intelligent transfer +cdb.exe,Debugging tool included with Windows Debugging Tools. +certoc.exe,Used for installing certificates +certreq.exe,Used for requesting and managing certificates +certutil.exe,Windows binary used for handling certificates +cmdkey.exe,"creates, lists, and deletes stored user names and passwords or credentials." +cmdl32.exe,Microsoft Connection Manager Auto-Download +cmstp.exe,Installs or removes a Connection Manager service profile. +colorcpl.exe,Binary that handles color management +conhost.exe,Console Window host +control.exe,Console Window host +csc.exe,Binary file used by .NET to compile C# code +cscript.exe,Binary used to execute scripts in Windows +csi.exe,Command line interface included with Visual Studio. +curl.exe,Used for transferring data to or from a server; bundled with Windows 10 1803+ and can be used to download or upload files (not in repo lookup - added manually) +customshellhost.exe,A host process that is used by custom shells when using Windows in Kiosk mode. +datasvcutil.exe,DataSvcUtil.exe is a command-line tool provided by WCF Data Services that consumes an Open Data Protocol (OData) feed and generates the client data service classes that are needed to access a data service from a .NET Framework client application. +desktopimgdownldr.exe,Windows binary used to configure lockscreen/desktop image +devicecredentialdeployment.exe,Device Credential Deployment +devinit.exe,Visual Studio 2019 tool +devtoolslauncher.exe,Binary will execute specified binary. Part of VS/VScode installation. +dfsvc.exe,ClickOnce engine in Windows used by .NET +diantz.exe,Binary that package existing files into a cabinet (.cab) file +diskshadow.exe,Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS). +dnscmd.exe,A command-line interface for managing DNS servers +dotnet.exe,dotnet.exe comes with .NET Framework +dsdbutil.exe,Dsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line utility to export Active Directory. +dumpminitool.exe,Dump tool part Visual Studio 2022 +dxcap.exe,DirectX diagnostics/debugger included with Visual Studio. +esentutl.exe,Binary for working with Microsoft Joint Engine Technology (JET) database +eventvwr.exe,Displays Windows Event Logs in a GUI window. +excel.exe,Microsoft Office binary +expand.exe,Binary that expands one or more compressed files +extexport.exe,Load a DLL located in the C:\test folder with a specific name. +extrac32.exe,"Extract to ADS, copy or overwrite a file with Extrac32.exe" +findstr.exe,"Write to ADS, discover, or download files with Findstr.exe" +finger.exe,Displays information about a user or users on a specified remote computer that is running the Finger service or daemon +fltmc.exe,Filter Manager Control Program used by Windows +forfiles.exe,Selects and executes a command on a file or set of files. This command is useful for batch processing. +fsi.exe,64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK. +fsianycpu.exe,32/64-bit FSharp (F#) Interpreter included with Visual Studio. +fsutil.exe,File System Utility +ftp.exe,A binary designed for connecting to FTP servers +gfxdownloadwrapper.exe,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path." +gpscript.exe,Used by group policy to process scripts +hh.exe,Binary used for processing chm files in Windows +ie4uinit.exe,Executes commands from a specially prepared ie4uinit.inf file. +iediagcmd.exe,Diagnostics Utility for Internet Explorer +ieexec.exe,The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL. +ilasm.exe,used for compile c# code into dll or exe. +imewdbld.exe,Microsoft IME Open Extended Dictionary Module +infdefaultinstall.exe,Binary used to perform installation based on content inside inf files +installutil.exe,The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies +jsc.exe,Binary file used by .NET to compile javascript code to .exe or .dll format +ldifde.exe,"Creates, modifies, and deletes LDAP directory objects." +makecab.exe,Binary to package existing files into a cabinet (.cab) file +manage-bde.wsf,Script for managing BitLocker +mavinject.exe,Used by App-v in Windows +mftrace.exe,Trace log generation tool for Media Foundation Tools. +microsoft.nodejstools.pressanykey.exe,Part of the NodeJS Visual Studio tools. +microsoft.workflow.compiler.exe,A utility included with .NET that is capable of compiling and executing C# or VB.net code. +mmc.exe,Load snap-ins to locally and remotely manage Windows systems +msaccess.exe,Microsoft Office binary +msbuild.exe,Used to compile and execute code +msconfig.exe,"MSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup process to help the user determine the cause of a problem with Windows" +msdeploy.exe,Microsoft tool used to deploy Web Applications. +msdt.exe,Microsoft diagnostics tool +mshta.exe,Used by Windows to execute html applications. (.hta) +msiexec.exe,Used by Windows to execute msi files +msohtmed.exe,Microsoft Office binary +mspub.exe,Microsoft Office binary +netsh.exe,Netsh is a Windows tool used to manipulate network interface settings. +ntdsutil.exe,Command line utility used to export Active Directory. +odbcconf.exe,Used in Windows for managing ODBC connections +offlinescannershell.exe,Windows Defender Offline Shell +pcalua.exe,Program Compatibility Assistant +pcwrun.exe,Program Compatibility Wizard +pktmon.exe,Capture Network Packets on the windows 10 with October 2018 Update or later. +pnputil.exe,Used for installing drivers +powerpnt.exe,Microsoft Office binary +presentationhost.exe,File is used for executing Browser applications +print.exe,Used by Windows to send files to the printer +printbrm.exe,Printer Migration Command-Line Tool +protocolhandler.exe,Microsoft Office binary +provlaunch.exe,Launcher process +psr.exe,"Windows Problem Steps Recorder, used to record screen and clicks." +rasautou.exe,Windows Remote Access Dialer +rdrleakdiag.exe,Microsoft Windows resource leak diagnostic tool +reg.exe,Used to manipulate the registry +regasm.exe,Part of .NET +regedit.exe,Used by Windows to manipulate registry +regini.exe,Used to manipulate the registry +register-cimprovider.exe,Used to register new wmi providers +regsvcs.exe,Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies +regsvr32.exe,Used by Windows to register dlls +replace.exe,Used to replace file with another file +rpcping.exe,Used to verify rpc connection +rundll32.exe,Used by Windows to execute dll files +runexehelper.exe,Launcher process +runonce.exe,Executes a Run Once Task that has been configured in the registry +sc.exe,Used by Windows to manage services +schtasks.exe,Schedule periodic tasks +scriptrunner.exe,Execute binary through proxy binary to evade defensive counter measures +setres.exe,Configures display settings +settingsynchost.exe,Host Process for Setting Synchronization +sqldumper.exe,Debugging utility included with Microsoft SQL. +sqlps.exe,"Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons." +sqltoolsps.exe,Tool included with Microsoft SQL that loads SQL Server cmdlts. A replacement for sqlps.exe. Successor to sqlps.exe in SQL Server 2016+. +stordiag.exe,Storage diagnostic tool +syncappvpublishingserver.exe,Used by App-v to get App-v server lists +tar.exe,Used by Windows to extract and create archives. +testwindowremoteagent.exe,TestWindowRemoteAgent.exe is the command-line tool to establish RPC +ttdinject.exe,Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe) +tttracer.exe,Used by Windows 1809 and newer to Debug Time Travel +unregmp2.exe,Microsoft Windows Media Player Setup Utility +vbc.exe,Binary file used for compile vbs code +verclsid.exe,Used to verify a COM object before it is instantiated by Windows Explorer +visualuiaverifynative.exe,A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls. +vsdiagnostics.exe,Command-line tool used for performing diagnostics. +vshadow.exe,VShadow is a command-line tool that can be used to create and manage volume shadow copies. +vsiisexelauncher.exe,Binary will execute specified binary. Part of VS/VScode installation. +vsjitdebugger.exe,Just-In-Time (JIT) debugger included with Visual Studio +vsls-agent.exe,Agent for Visual Studio Live Share (Code Collaboration) +vstest.console.exe,VSTest.Console.exe is the command-line tool to run tests +wab.exe,Windows address book manager +wbadmin.exe,Windows Backup Administration utility +wfc.exe,The Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK). +winproj.exe,Microsoft Project Executable +winword.exe,Microsoft Office binary +wlrmdr.exe,Windows Logon Reminder executable +wmic.exe,The WMI command-line (WMIC) utility provides a command-line interface for WMI +workfolders.exe,Work Folders +wscript.exe,Used by Windows to execute scripts +wsreset.exe,Used to reset Windows Store settings according to its manifest file +wuauclt.exe,Windows Update Client +xwizard.exe,Execute custom class that has been added to the registry or download a file with Xwizard.exe diff --git a/lookups/csv/renamed_lolbas_binaries.yml b/lookups/csv/renamed_lolbas_binaries.yml new file mode 100644 index 00000000000..e76d3c31694 --- /dev/null +++ b/lookups/csv/renamed_lolbas_binaries.yml @@ -0,0 +1,14 @@ +name: renamed_lolbas_binaries +id: 8fcee872-392f-41ab-95fb-a50f8557b03e +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Splunk Threat Research Team +lookup_type: csv +description: A list of LOLBAS binaries and detailed information regarding their usage +default_match: 'false' +match_type: + - WILDCARD(original_file_name) +min_matches: 1 +max_matches: 1 +case_sensitive_match: false diff --git a/lookups/csv/renamed_popular_3rd_party_binaries.csv b/lookups/csv/renamed_popular_3rd_party_binaries.csv new file mode 100644 index 00000000000..d2a52926d0d --- /dev/null +++ b/lookups/csv/renamed_popular_3rd_party_binaries.csv @@ -0,0 +1,43 @@ +original_file_name,description +7z.exe,7-Zip +7zg.exe,7-Zip +7zfm.exe,7-Zip +7za.exe,7-Zip +winrar*.exe,WinRAR +rar.exe,WinRAR +unrar.exe,WinRAR +peazip.exe,PeaZip +anydesk.exe,AnyDesk +teamviewer*.exe,TeamViewer +tv_w32.exe,TeamViewer +tv_x64.exe,TeamViewer +screenconnect*.exe,ConnectWise ScreenConnect +ateraagent.exe,Atera +srserver.exe,Splashtop +splashtopstreamer.exe,Splashtop +lmiguardiansvc.exe,LogMeIn +logmein.exe,LogMeIn +basupsrvc.exe,N-able Take Control +tcclient.exe,N-able Take Control +action1_agent.exe,Action1 +rutserv.exe,Remote Utilities +rfusclient.exe,Remote Utilities +advanced_ip_scanner*.exe,Advanced IP Scanner +advanced_port_scanner*.exe,Advanced Port Scanner +netscan.exe,SoftPerfect Network Scanner +ipscan.exe,Angry IP Scanner +adfind*.exe,AdFind +processhacker.exe,Process Hacker +systeminformer.exe,System Informer +winscp*.exe,WinSCP +rclone.exe,Rclone +plink.exe,PuTTY +putty*.exe,PuTTY +mobaxterm.exe,MobaXterm +ngrok.exe,Ngrok +cloudflared.exe,Cloudflared +chisel.exe,Chisel +webbrowserpassview.exe,NirSoft WebBrowserPassView +mailpv.exe,NirSoft Mail PassView +autoit3.exe,AutoIt +aut2exe.exe,AutoIt diff --git a/lookups/csv/renamed_popular_3rd_party_binaries.yml b/lookups/csv/renamed_popular_3rd_party_binaries.yml new file mode 100644 index 00000000000..0c684fe5e13 --- /dev/null +++ b/lookups/csv/renamed_popular_3rd_party_binaries.yml @@ -0,0 +1,14 @@ +name: renamed_popular_3rd_party_binaries +id: 83a56371-0a0f-4486-be21-8dc1d4d25e97 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Splunk Threat Research Team +lookup_type: csv +description: A list of popular 3rd party Windows binaries and their software names +default_match: 'false' +match_type: + - WILDCARD(original_file_name) +min_matches: 1 +max_matches: 1 +case_sensitive_match: false diff --git a/lookups/csv/renamed_windows_command_interpreter_binaries.csv b/lookups/csv/renamed_windows_command_interpreter_binaries.csv new file mode 100644 index 00000000000..8809169991f --- /dev/null +++ b/lookups/csv/renamed_windows_command_interpreter_binaries.csv @@ -0,0 +1,14 @@ +original_file_name,description +bash.exe,"Bourne Again Shell interpreter; ships with WSL/Git for Windows/Cygwin and executes shell scripts and commands." +cmd.exe,"The native Windows command-line interpreter used to execute batch scripts and commands." +powershell.exe,"Windows PowerShell (v5.1 and earlier) command-line shell and scripting engine, heavily used for administration and living-off-the-land attacks." +powershell_ise.exe,"PowerShell Integrated Scripting Environment; GUI host for writing and running PowerShell scripts." +psexec*.c,"Sysinternals tool for executing processes on remote systems; frequently abused for lateral movement." +psexec*.exe,"Sysinternals tool for executing processes on remote systems; frequently abused for lateral movement." +psexec64.exe,"64-bit build of the Sysinternals PsExec remote execution tool." +pwsh.exe,"PowerShell (Core) 6+ cross-platform command-line shell and scripting engine, successor to powershell.exe." +pwsh.dll,"PowerShell (Core) 6+ cross-platform command-line shell and scripting engine, successor to powershell.exe." +sh.exe,"POSIX-compatible shell interpreter, typically bundled with Git for Windows/WSL/Cygwin, used to run shell scripts." +windowsterminal.exe,"Modern Windows Terminal application host that runs command-line shells (cmd, PowerShell, WSL) in tabs." +wsl.exe,"Windows Subsystem for Linux launcher; runs a Linux distribution/shell and executes Linux binaries or scripts on Windows." +wt.exe,"Windows Terminal executable, invoked via the wt command; launches and hosts terminal shell sessions." diff --git a/lookups/csv/renamed_windows_command_interpreter_binaries.yml b/lookups/csv/renamed_windows_command_interpreter_binaries.yml new file mode 100644 index 00000000000..0e364ef511c --- /dev/null +++ b/lookups/csv/renamed_windows_command_interpreter_binaries.yml @@ -0,0 +1,14 @@ +name: renamed_windows_command_interpreter_binaries +id: 2517d9fc-a1ee-4303-9a5b-15eaee7f418b +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Splunk Threat Research Team +lookup_type: csv +description: A list of Windows command interpreter binaries and detailed information regarding their usage +default_match: 'false' +match_type: + - WILDCARD(original_file_name) +min_matches: 1 +max_matches: 1 +case_sensitive_match: false From 3115df76912b73f367d295247e4c8dc21f46dcba Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 5 Oct 2026 14:23:50 +0200 Subject: [PATCH 127/162] version update --- detections/endpoint/wmi_permanent_event_subscription.yml | 2 +- .../endpoint/wmi_permanent_event_subscription___sysmon.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml index 90cdca1ae46..0455b9c92de 100644 --- a/detections/endpoint/wmi_permanent_event_subscription.yml +++ b/detections/endpoint/wmi_permanent_event_subscription.yml @@ -1,6 +1,6 @@ name: WMI Permanent Event Subscription id: 71bfdb13-f200-4c6c-b2c9-a2e07adf437d -version: 15 +version: 11 creation_date: '2020-04-29' modification_date: '2026-10-05' author: Rico Valdez, Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index 9a6f4e32e12..9b6796c2b90 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -1,6 +1,6 @@ name: WMI Permanent Event Subscription - Sysmon id: ad05aae6-3b2a-4f73-af97-57bd26cee3b9 -version: 14 +version: 13 creation_date: '2020-04-29' modification_date: '2026-10-05' author: Rico Valdez, Michael Haag, Splunk From ec66842b10a7486f7c1488ff35bdcb9f1613b68e Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 5 Oct 2026 14:47:45 +0200 Subject: [PATCH 128/162] Update wmi_permanent_event_subscription___sysmon.yml --- .../wmi_permanent_event_subscription___sysmon.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index 9b6796c2b90..605bf5d24e8 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -7,13 +7,17 @@ author: Rico Valdez, Michael Haag, Splunk status: production type: Anomaly description: |- - Detects the creation of a WMI permanent event subscription using Sysmon EventID 21. + Detects the creation, modification or deletion of a WMI permanent event subscription using Sysmon EventID 21. data_source: - Sysmon EventID 21 search: |- `sysmon` EventCode=21 - Operation=Created + Operation IN ( + Created, + Deleted, + Modified + ) | stats count min(_time) as firstTime max(_time) as lastTime From 2e906db303c44feed2f00040a80a8e43e2ef3def Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 5 Oct 2026 15:52:28 +0200 Subject: [PATCH 129/162] Update detections/endpoint/wmi_permanent_event_subscription.yml Co-authored-by: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> --- detections/endpoint/wmi_permanent_event_subscription.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml index 0455b9c92de..367735a71ca 100644 --- a/detections/endpoint/wmi_permanent_event_subscription.yml +++ b/detections/endpoint/wmi_permanent_event_subscription.yml @@ -7,7 +7,7 @@ author: Rico Valdez, Nasreddine Bencherchali, Splunk status: production type: Anomaly description: |- - Detects WMI permanent event subscriptions from Windows WMI-Activity EventID 5861. + Detects permanent WMI event subscriptions that are containing `CommandLineEventConsumer` or `ActiveScriptEventConsumer`. Due to their command execution capabilties, given WMI consumers are often leveraged by adversaries for both execution and persistence purposes. data_source: - Windows Event Log WMI Activity 5861 search: |- From 0443d7b68535009c433b6534437d3c89b726f2da Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 5 Oct 2026 19:09:52 +0200 Subject: [PATCH 130/162] Apply codex reviews (#4317) --- .github/workflows/archived-ta-tracker.yml | 2 +- .../endpoint/windows_admin_password_changed_by_non_admin.yml | 2 +- .../endpoint/windows_renamed_lolbas_binary_was_executed.yml | 2 +- scripts/check_archived_tas.py | 2 ++ 4 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/archived-ta-tracker.yml b/.github/workflows/archived-ta-tracker.yml index 25d202bf6a3..0f45898107d 100644 --- a/.github/workflows/archived-ta-tracker.yml +++ b/.github/workflows/archived-ta-tracker.yml @@ -22,7 +22,7 @@ jobs: python-version: "3.12" - name: Install YAML parser - run: python -m pip install PyYAML + run: python -m pip install PyYAML==6.0.3 - name: Create or update archived TA issues env: diff --git a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml index 3c8a2b17db8..1d6ad8ec27f 100644 --- a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml +++ b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml @@ -53,7 +53,7 @@ drilldown_searches: name: View risk events for the last 7 days for - "$dest$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' finding: - title: Non-Administrator account [$src_user$] changed the password of the Admin account [$user$] on $dest$. + title: Non-Administrator account [$src_user$] changed the password of the Admin account [$TargetUserName$] on $dest$. entity: field: dest type: system diff --git a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml index f0842c81eb4..2569bb59957 100644 --- a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml +++ b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml @@ -31,7 +31,7 @@ search: |- | rename original_file_name as Processes.process_name | table Processes.process_name ] - NOT process_name IN ( + NOT Processes.process_name IN ( "excelcnv.exe", "installutil64.exe", "protoc~1.exe", diff --git a/scripts/check_archived_tas.py b/scripts/check_archived_tas.py index 020fa3f2d71..a3b433e0703 100644 --- a/scripts/check_archived_tas.py +++ b/scripts/check_archived_tas.py @@ -56,6 +56,8 @@ def discover_used_tas() -> dict[str, dict[str, Any]]: } for path in yaml_files(DETECTIONS_DIR): + if (DETECTIONS_DIR / "deprecated") in path.parents: + continue detection = load_yaml(path) if not detection: continue From ce03ed3086dc4249ffe060a23802853da4a13c2c Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Tue, 6 Oct 2026 12:00:23 +0200 Subject: [PATCH 131/162] More Codex Fixes (#4318) --- ...azure_ad_user_consent_blocked_for_risky_application.yml | 2 +- .../windows_renamed_command_interpreter_was_executed.yml | 7 +++---- .../windows_renamed_lolbas_binary_was_executed.yml | 7 +++---- ...ows_renamed_popular_3rd_party_software_was_executed.yml | 7 +++---- 4 files changed, 10 insertions(+), 13 deletions(-) diff --git a/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml b/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml index 9fc6cc75509..34fb99e3aed 100644 --- a/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml +++ b/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml @@ -24,7 +24,7 @@ search: |- | eval permissions_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions"), -1) | search reason_index >= 0 | eval reason = mvindex('targetResources{}.modifiedProperties{}.newValue',reason_index) | eval permissions = mvindex('targetResources{}.modifiedProperties{}.newValue',permissions_index) - | search reason = "Risky application detected" + | search reason = "\"Risky application detected\"" | rex field=permissions "Scope: (?[^,]+)" | fillnull diff --git a/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml index 3e97a3ea439..bf7c9666d54 100644 --- a/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml +++ b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml @@ -41,10 +41,9 @@ search: |- | `drop_dm_object_name(Processes)` - | eval original_file_name=lower(original_file_name) - - | where NOT match(process_name, "(?i)^".replace(original_file_name,"(?i).exe","")) - | where NOT match(process_name, "(?i)".original_file_name) + | eval process_name_norm=replace(lower(process_name), "\.exe$", ""), + original_file_name_norm=replace(lower(original_file_name), "\.exe$", "") + | where process_name_norm != original_file_name_norm | lookup local=t renamed_windows_command_interpreter_binaries original_file_name OUTPUT description diff --git a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml index 2569bb59957..2d13725422b 100644 --- a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml +++ b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml @@ -49,10 +49,9 @@ search: |- | `drop_dm_object_name(Processes)` - | eval original_file_name=lower(original_file_name) - - | where NOT match(process_name, "(?i)^".replace(original_file_name,"(?i).exe","")) - | where NOT match(process_name, "(?i)".original_file_name) + | eval process_name_norm=replace(lower(process_name), "\.exe$", ""), + original_file_name_norm=replace(lower(original_file_name), "\.exe$", "") + | where process_name_norm != original_file_name_norm | lookup local=t renamed_lolbas_binaries original_file_name OUTPUT description diff --git a/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml index 374458d818c..5de6fed7b94 100644 --- a/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml +++ b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml @@ -41,10 +41,9 @@ search: |- | `drop_dm_object_name(Processes)` - | eval original_file_name=lower(original_file_name) - - | where NOT match(process_name, "(?i)^".replace(original_file_name,"(?i).exe","")) - | where NOT match(process_name, "(?i)".original_file_name) + | eval process_name_norm=replace(lower(process_name), "\.exe$", ""), + original_file_name_norm=replace(lower(original_file_name), "\.exe$", "") + | where process_name_norm != original_file_name_norm | lookup local=t renamed_popular_3rd_party_binaries original_file_name OUTPUT description From 2dc3668424cad95cc86da387a44e466ff181c190 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Tue, 6 Oct 2026 13:21:31 +0200 Subject: [PATCH 132/162] Extra Logic Fixes From Codex (#4319) --- ...ows_ad_spn_unicode_collision_injection.yml | 2 +- ...named_command_interpreter_was_executed.yml | 6 ---- ...ows_renamed_lolbas_binary_was_executed.yml | 7 +--- ...opular_3rd_party_software_was_executed.yml | 6 ---- ...ows_renamed_python_binary_was_executed.yml | 34 +++++++++++++------ 5 files changed, 25 insertions(+), 30 deletions(-) diff --git a/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml b/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml index bc34b8c4816..95de6c73ae6 100644 --- a/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml +++ b/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml @@ -7,7 +7,7 @@ author: Raven Tait, Splunk status: production type: TTP description: |- - The following analytic detects the addition of a servicePrincipalName (SPN) containing invisible Unicode characters to an Active Directory computer object via Windows Security Event 5136. + The following analytic detects the addition or modification of a servicePrincipalName (SPN) containing invisible Unicode characters to an Active Directory computer object via Windows Security Event 5136. This is the key indicator of the KerberLoss attack (CVE-2026-25177), where an attacker with write access to a machine account's SPN attribute injects a collision SPN that contains a Zero Width or other invisible Unicode character (e.g. U+200C Zero Width Non-Joiner). LDAP's string preparation rules (RFC 4518) cause these characters to be ignored during uniqueness checking, allowing the write to succeed even when an identical SPN already exists on another machine account. The Kerberos KDC, however, does not apply the same normalisation — it finds two accounts with matching SPNs and returns KDC_ERR_S_PRINCIPAL_UNKNOWN, causing a Kerberos denial-of-service or forcing clients to fall back to NTLM downgrade. diff --git a/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml index bf7c9666d54..1a57af52043 100644 --- a/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml +++ b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml @@ -19,17 +19,11 @@ search: |- FROM datamodel=Endpoint.Processes WHERE - NOT Processes.original_file_name IN ("-","unknown") [ | inputlookup renamed_windows_command_interpreter_binaries | rename original_file_name as Processes.original_file_name | table Processes.original_file_name ] - NOT [ - | inputlookup renamed_windows_command_interpreter_binaries - | rename original_file_name as Processes.process_name - | table Processes.process_name - ] by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id diff --git a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml index 2d13725422b..2a8a53caf77 100644 --- a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml +++ b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml @@ -20,17 +20,12 @@ search: |- FROM datamodel=Endpoint.Processes WHERE - NOT Processes.original_file_name IN ("-","unknown") [ | inputlookup renamed_lolbas_binaries | rename original_file_name as Processes.original_file_name | table Processes.original_file_name ] - NOT [ - | inputlookup renamed_lolbas_binaries - | rename original_file_name as Processes.process_name - | table Processes.process_name - ] + NOT Processes.process_name IN ( "excelcnv.exe", "installutil64.exe", diff --git a/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml index 5de6fed7b94..640c8aa4ae3 100644 --- a/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml +++ b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml @@ -19,17 +19,11 @@ search: |- FROM datamodel=Endpoint.Processes WHERE - NOT Processes.original_file_name IN ("-","unknown") [ | inputlookup renamed_popular_3rd_party_binaries | rename original_file_name as Processes.original_file_name | table Processes.original_file_name ] - NOT [ - | inputlookup renamed_popular_3rd_party_binaries - | rename original_file_name as Processes.process_name - | table Processes.process_name - ] by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id diff --git a/detections/endpoint/windows_renamed_python_binary_was_executed.yml b/detections/endpoint/windows_renamed_python_binary_was_executed.yml index 4f0731c4512..e1b2655e8e2 100644 --- a/detections/endpoint/windows_renamed_python_binary_was_executed.yml +++ b/detections/endpoint/windows_renamed_python_binary_was_executed.yml @@ -14,24 +14,36 @@ data_source: - Sysmon EventID 1 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime - FROM datamodel=Endpoint.Processes - WHERE - Processes.original_file_name IN ( + | tstats `security_content_summariesonly` + count min(_time) AS firstTime + max(_time) AS lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.original_file_name IN ( "py*", "python*", "ipyw*" - ) - NOT Processes.original_file_name IN ("-","unknown") - NOT Processes.process_name IN ("dwagent.exe", "WinUtils.exe") - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec - Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id - Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + ) + + NOT Processes.process_name IN ("dwagent.exe", "WinUtils.exe") + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | eval original_file_name=lower(original_file_name) + | regex original_file_name="(?i)^(?:py|pyw|python|pythonw|python32|python64|pythonw32|pythonw64|ipyw32|ipyw64|python3|pythonw3|python3\.\w+|pythonw3\.\w+)\.exe$" + | regex process_name!="(?i)^(?:py|pyw|pip|pip3|python|pythonw|python32|python64|pythonw32|pythonw64|ipyw32|ipyw64|python3|pythonw3|python3\.\w+|pythonw3\.\w+|pip3\.\w+|idle3\.\w+)\.exe$" + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_renamed_python_binary_was_executed_filter` From c324183503fe293aee96b0e3bd96a4230a92795a Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 6 Oct 2026 20:58:11 -0500 Subject: [PATCH 133/162] Decrement version on detection that should not have been bumped because no stanza fields were changed, this detection should not have been bumped. --- ...vm___browser_spawned_unix_shell_with_external_connection.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml index 15f820549c0..72bbe5d0998 100644 --- a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml +++ b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Browser Spawned Unix Shell with External Connection id: 6f2de8d1-9a2d-4c7a-9b8c-3b8a2f7d0e41 -version: 2 +version: 1 creation_date: '2026-09-02' modification_date: '2026-09-22' author: Maria Jose Erquiaga, Splunk From d339507b4cf7dbd290df265549c9c835f2124ec2 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 6 Oct 2026 21:33:32 -0500 Subject: [PATCH 134/162] another detection that was bumped accidentally --- .../endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml index 4291c2f1be9..62be4e512f7 100644 --- a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml +++ b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Curl Execution With Insecure Flags id: cc695238-3117-4e60-aa83-4beac2a42c69 -version: 9 +version: 8 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk From 52449e2a8a9f3743e82ea02c3860d962d02010a5 Mon Sep 17 00:00:00 2001 From: Eric McGinnis Date: Tue, 6 Oct 2026 21:54:32 -0500 Subject: [PATCH 135/162] Push changed to a bunch of files that should not have been bumped --- ...m___mshtml_or_mshta_network_execution_without_url_in_cli.yml | 2 +- ...cisco_nvm___non_network_binary_making_network_connection.yml | 2 +- ...o_nvm___osascript_network_connection_for_a_long_duration.yml | 2 +- .../cisco_nvm___rclone_execution_with_network_activity.yml | 2 +- ..._nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml | 2 +- ...m___susp_script_from_archive_triggering_network_activity.yml | 2 +- ...isco_nvm___suspicious_download_from_file_sharing_website.yml | 2 +- ...isco_nvm___suspicious_file_download_via_headless_browser.yml | 2 +- ..._suspicious_network_connection_from_process_with_no_args.yml | 2 +- ..._nvm___suspicious_network_connection_initiated_via_msxsl.yml | 2 +- ...__suspicious_network_connection_to_ip_lookup_service_api.yml | 2 +- ...cisco_nvm___webserver_download_from_file_sharing_website.yml | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml index e2b0c93aa31..ff2f2a11089 100644 --- a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml +++ b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml @@ -1,6 +1,6 @@ name: Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI id: f2a9df84-9b01-4a21-9e3a-7aa1a217f69e -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml index dc296fbfa2d..5d9707b4712 100644 --- a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml +++ b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Non-Network Binary Making Network Connection id: c6db35af-8a0e-4b61-88ed-738e66f15715 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml index 1d63ae1c37f..f9a7a87931a 100644 --- a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml +++ b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Osascript Network Connection for a Long Duration id: 6bc88a9d-f7de-4257-b526-acf15bc5a517 -version: 2 +version: 1 creation_date: '2026-09-18' modification_date: '2026-09-22' author: Radka Viskova, Splunk diff --git a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml index 002d7f3c792..f08391700bf 100644 --- a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml +++ b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Rclone Execution With Network Activity id: 719f8c78-b20d-4bb9-8c33-6d1a762e7a9a -version: 8 +version: 7 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml index c8caad0967d..b64b3f4cbee 100644 --- a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml +++ b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download id: 18f0d27d-569e-4bc4-96e1-09b214fa73c0 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml index d98e0f72d8d..fe101b8b271 100644 --- a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml +++ b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Susp Script From Archive Triggering Network Activity id: 8b07c2c9-0cde-4c44-9fa6-59dcf2b25777 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml index 2d0f030e056..790d763268a 100644 --- a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious Download From File Sharing Website id: 94ebc001-35e7-4ae8-9b0e-52766b2f99c7 -version: 8 +version: 7 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml index 9e5dd3c33f8..868531d2817 100644 --- a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml +++ b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious File Download via Headless Browser id: cd0e816f-f67d-4dbe-a153-480b546e867e -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml index f2e4760a56a..c3ab060c003 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious Network Connection From Process With No Args id: 54fa06c5-96a2-4406-a4a7-44d93ddbd173 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml index e4cc59a7ea7..7a99176ded8 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious Network Connection Initiated via MsXsl id: 1cbcf75f-0e45-4f29-8c1b-7fcd7e55cc55 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml index c7c2ad43c3b..6586f1d026e 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious Network Connection to IP Lookup Service API id: 568cb83e-d79e-4a23-85ec-6e1f6c30cb2f -version: 9 +version: 8 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk, Janantha Marasinghe diff --git a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml index f1360e9e908..e79046f8d0f 100644 --- a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Webserver Download From File Sharing Website id: 1984f997-3b49-4d4b-a7e9-dc5dbf88370e -version: 8 +version: 7 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk From 5298bf68951862aac12f5a07770c63f8f2ecd4d5 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Wed, 7 Oct 2026 19:56:44 +0200 Subject: [PATCH 136/162] Bump contentctl.yml and build.yml to 6.9.0 (#4326) --- build.yml | 2 +- contentctl.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build.yml b/build.yml index 5a6a252bb08..90e9100bc51 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.8.0 +app_version: 6.9.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index e6c1aceb7cb..2669049f6c6 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.8.0 + version: 6.9.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU From 670987f506c251a267de6f4127fe8044359ebc18 Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Wed, 7 Oct 2026 15:07:34 -0400 Subject: [PATCH 137/162] M365 Copilot detection test description update and promote to production (#4325) --- .../application/m365_copilot_agentic_jailbreak_attack.yml | 6 +++--- .../m365_copilot_impersonation_jailbreak_attack.yml | 6 +++--- ...m365_copilot_information_extraction_jailbreak_attack.yml | 6 +++--- detections/application/m365_copilot_jailbreak_attempts.yml | 6 +++--- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/detections/application/m365_copilot_agentic_jailbreak_attack.yml b/detections/application/m365_copilot_agentic_jailbreak_attack.yml index e73d2df500c..ba76b389cfb 100644 --- a/detections/application/m365_copilot_agentic_jailbreak_attack.yml +++ b/detections/application/m365_copilot_agentic_jailbreak_attack.yml @@ -1,10 +1,10 @@ name: M365 Copilot Agentic Jailbreak Attack id: e5c7b380-19da-42e9-9e53-0af4cd27aee3 -version: 5 +version: 6 creation_date: '2025-10-13' modification_date: '2026-05-13' author: Rod Soto -status: experimental +status: production type: Anomaly description: Detects agentic AI jailbreak attempts that try to establish persistent control over M365 Copilot through rule injection, universal triggers, response automation, system overrides, and persona establishment techniques. The detection analyzes the PromptText field for keywords like "from now on," "always respond," "ignore previous," "new rule," "override," and role-playing commands (e.g., "act as," "you are now") that attempt to inject persistent instructions. The search computes risk by counting distinct jailbreak indicators per user session, flagging coordinated manipulation attempts. data_source: @@ -62,4 +62,4 @@ tests: sourcetype: csv source: csv test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + description: Automated testing is experimental because contentctl-ng replays this CSV fixture through HEC raw, which does not extract the Subject_Title and Sender fields required by this detection in the current test configuration. The same fixture yields matching results when ingested through native CSV file/oneshot input. Retain the experimental test until CI reproduces that field extraction. See TR-4611. diff --git a/detections/application/m365_copilot_impersonation_jailbreak_attack.yml b/detections/application/m365_copilot_impersonation_jailbreak_attack.yml index cba621255af..4659c8a4b80 100644 --- a/detections/application/m365_copilot_impersonation_jailbreak_attack.yml +++ b/detections/application/m365_copilot_impersonation_jailbreak_attack.yml @@ -1,10 +1,10 @@ name: M365 Copilot Impersonation Jailbreak Attack id: cc26aba8-7f4a-4078-b91a-052d6a53cb13 -version: 6 +version: 7 creation_date: '2025-10-13' modification_date: '2026-06-04' author: Rod Soto -status: experimental +status: production type: TTP description: Detects M365 Copilot impersonation and roleplay jailbreak attempts where users try to manipulate the AI into adopting alternate personas, behaving as unrestricted entities, or impersonating malicious AI systems to bypass safety controls. The detection searches exported eDiscovery prompt logs for roleplay keywords like "pretend you are," "act as," "you are now," "amoral," and "roleplay as" in the Subject_Title field. Prompts are categorized into specific impersonation types (AI_Impersonation, Malicious_AI_Persona, Unrestricted_AI_Persona, etc.) to identify attempts to override the AI's safety guardrails through persona injection attacks. data_source: @@ -54,4 +54,4 @@ tests: sourcetype: csv source: csv test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + description: Automated testing is experimental because contentctl-ng replays this CSV fixture through HEC raw, which does not extract the Subject_Title and Sender fields required by this detection in the current test configuration. The same fixture yields matching results when ingested through native CSV file/oneshot input. Retain the experimental test until CI reproduces that field extraction. See TR-4611. diff --git a/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml b/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml index 9edff8c36cc..b856ed88224 100644 --- a/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml +++ b/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml @@ -1,10 +1,10 @@ name: M365 Copilot Information Extraction Jailbreak Attack id: c0ee37bb-ed43-4632-8e38-060fba80b0b2 -version: 5 +version: 6 creation_date: '2025-10-13' modification_date: '2026-05-13' author: Rod Soto -status: experimental +status: production type: TTP description: Detects M365 Copilot information extraction jailbreak attacks that attempt to obtain sensitive, classified, or comprehensive data through various social engineering techniques including fictional entity impersonation, bulk data requests, and privacy bypass attempts. The detection searches exported eDiscovery prompt logs for extraction keywords like "transcendent," "tell me everything," "confidential," "dump," "extract," "reveal," and "bypass" in the Subject_Title field, categorizing each attempt by extraction type and assigning severity levels (CRITICAL for classified/proprietary data, HIGH for bulk extraction or privacy bypass). Prompts are further analyzed for compound risk patterns such as "Confidential+Extraction" or "Bulk_Request+Bypass," filtering out low-severity cases to surface the most dangerous attempts to exfiltrate sensitive organizational information through AI manipulation. data_source: @@ -93,4 +93,4 @@ tests: sourcetype: csv source: csv test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + description: Automated testing is experimental because contentctl-ng replays this CSV fixture through HEC raw, which does not extract the Subject_Title and Sender fields required by this detection in the current test configuration. The same fixture yields matching results when ingested through native CSV file/oneshot input. Retain the experimental test until CI reproduces that field extraction. See TR-4611. diff --git a/detections/application/m365_copilot_jailbreak_attempts.yml b/detections/application/m365_copilot_jailbreak_attempts.yml index 28c8410f745..ca4445a5654 100644 --- a/detections/application/m365_copilot_jailbreak_attempts.yml +++ b/detections/application/m365_copilot_jailbreak_attempts.yml @@ -1,10 +1,10 @@ name: M365 Copilot Jailbreak Attempts id: b05a4f25-e07d-436f-ab03-f954afa922c0 -version: 6 +version: 7 creation_date: '2025-10-13' modification_date: '2026-05-13' author: Rod Soto -status: experimental +status: production type: Anomaly description: Detects M365 Copilot jailbreak attempts through prompt injection techniques including rule manipulation, system bypass commands, and AI impersonation requests that attempt to circumvent built-in safety controls. The detection searches exported eDiscovery prompt logs for jailbreak keywords like "pretend you are," "act as," "rules=," "ignore," "bypass," and "override" in the Subject_Title field, assigning severity scores based on the manipulation type (score of 4 for amoral impersonation or explicit rule injection, score of 3 for entity roleplay or bypass commands). Prompts with a jailbreak score of 2 or higher are flagged, prioritizing the most severe attempts to override AI safety mechanisms through direct instruction injection or unauthorized persona adoption. data_source: @@ -67,4 +67,4 @@ tests: sourcetype: csv source: csv test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + description: Automated testing is experimental because contentctl-ng replays this CSV fixture through HEC raw, which does not extract the Subject_Title and Sender fields required by this detection in the current test configuration. The same fixture yields matching results when ingested through native CSV file/oneshot input. Retain the experimental test until CI reproduces that field extraction. See TR-4611. From 87428989de7b9f645bbae05783c6fb05500d9c3e Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 8 Oct 2026 12:13:04 +0200 Subject: [PATCH 138/162] Automated NIST AI RMF detection map update 35 (#4327) --------- Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> --- .github/workflows/update_nist_ai_rmf_detection_map.yml | 2 +- lookups/csv/detection_subcategory_map.csv | 8 ++++---- lookups/csv/detection_subcategory_map.yml | 6 +++--- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/update_nist_ai_rmf_detection_map.yml b/.github/workflows/update_nist_ai_rmf_detection_map.yml index 7d832fed6e8..1d362f48781 100644 --- a/.github/workflows/update_nist_ai_rmf_detection_map.yml +++ b/.github/workflows/update_nist_ai_rmf_detection_map.yml @@ -43,7 +43,7 @@ jobs: commit-message: Update NIST AI RMF detection map branch: auto-nist-ai-rmf-detection-map-${{ github.run_number }} base: develop - title: Automated NIST AI RMF detection map update ${{ github.run_number }} + title: Automated NIST AI RMF lookup table update body: | This PR updates the generated NIST AI RMF detection-to-subcategory lookup. diff --git a/lookups/csv/detection_subcategory_map.csv b/lookups/csv/detection_subcategory_map.csv index 391d63fab3e..5a4b9383433 100644 --- a/lookups/csv/detection_subcategory_map.csv +++ b/lookups/csv/detection_subcategory_map.csv @@ -14,10 +14,10 @@ M365 Copilot,M365 Copilot Graph API,M365 Copilot Application Usage Pattern Anoma M365 Copilot,M365 Copilot Graph API,M365 Copilot Failed Authentication Patterns,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal M365 Copilot,M365 Copilot Graph API,M365 Copilot Non Compliant Devices Accessing M365 Copilot,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,GOVERN,Govern 1.6,high,generated_rule,AI system or access inventory signal M365 Copilot,M365 Copilot Graph API,M365 Copilot Session Origin Anomalies,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal -M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Agentic Jailbreak Attack,experimental,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal -M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Impersonation Jailbreak Attack,experimental,TTP,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal -M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Information Extraction Jailbreak Attack,experimental,TTP,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7|Measure 2.10,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal; Sensitive information or data-protection signal -M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Jailbreak Attempts,experimental,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Agentic Jailbreak Attack,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Impersonation Jailbreak Attack,production,TTP,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Information Extraction Jailbreak Attack,production,TTP,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7|Measure 2.10,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal; Sensitive information or data-protection signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Jailbreak Attempts,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal MCP,MCP Server,MCP Filesystem Server Suspicious Extension Write,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal MCP,MCP Server,MCP Github Suspicious Operation,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal MCP,MCP Server,MCP Postgres Suspicious Query,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal diff --git a/lookups/csv/detection_subcategory_map.yml b/lookups/csv/detection_subcategory_map.yml index b98d706b65d..01c7b156b9d 100644 --- a/lookups/csv/detection_subcategory_map.yml +++ b/lookups/csv/detection_subcategory_map.yml @@ -1,8 +1,8 @@ name: detection_subcategory_map id: 41c7e6c8-b835-4dd8-b7ed-b1f5d8476e84 -version: 2 +version: 3 creation_date: '2026-09-02' -modification_date: '2026-09-02' +modification_date: '2026-10-08' author: Nasreddine Bencherchali, Rod Soto, Splunk Threat Research Team lookup_type: csv -description: Generated mapping of AI-related ESCU detections to NIST AI RMF subcategory IDs for dashboard coverage reporting. Regenerate with scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py when AI data sources or detections change. +description: Generated mapping of AI-related ESCU detections to NIST AI RMF subcategory IDs for dashboard coverage reporting. From 2e47a6e36398c4c9e5f6b5d936cf89602cbd9bd1 Mon Sep 17 00:00:00 2001 From: p4t12ick Date: Thu, 8 Oct 2026 15:08:28 +0200 Subject: [PATCH 139/162] Bug Fix for Issue #4293 (#4324) --------- Co-authored-by: Nasreddine Bencherchali --- ...etect_new_open_s3_buckets_over_aws_cli.yml | 95 +++++++++++++++---- 1 file changed, 77 insertions(+), 18 deletions(-) diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index 55cad130737..6f54d9dce32 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -1,29 +1,85 @@ name: Detect New Open S3 Buckets over AWS CLI id: 39c61d09-8b30-4154-922b-2d0a694ecc22 -version: 10 +version: 11 creation_date: '2021-01-12' modification_date: '2026-05-13' -author: Patrick Bareiss, Splunk +author: Patrick Bareiss, Splunk, vshcherbakov status: production type: TTP -description: The following analytic detects the creation of open/public S3 buckets via the AWS CLI. It leverages AWS CloudTrail logs to identify events where a user has set bucket permissions to allow access to "AuthenticatedUsers" or "AllUsers." This activity is significant because open S3 buckets can expose sensitive data to unauthorized users, leading to data breaches. If confirmed malicious, an attacker could gain unauthorized access to potentially sensitive information stored in the S3 bucket, posing a significant security risk. +description: |- + The following analytic detects the creation of open/public S3 buckets via the AWS CLI. + It leverages AWS CloudTrail logs to identify events where a user has set bucket permissions to allow access to "AuthenticatedUsers" or "AllUsers." This activity is significant because open S3 buckets can expose sensitive data to unauthorized users, leading to data breaches. + If confirmed malicious, an attacker could gain unauthorized access to potentially sensitive information stored in the S3 bucket, posing a significant security risk. data_source: - AWS CloudTrail search: |- - `cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") - | rename requestParameters.bucketName AS bucketName - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY userIdentity.userName userIdentity.principalId userAgent - bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp - requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control - | rename userIdentity.userName as user - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `detect_new_open_s3_buckets_over_aws_cli_filter` -how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. -known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. -references: [] + `cloudtrail` + eventSource="s3.amazonaws.com" + eventName="PutBucketAcl" + errorCode=success + userAgent IN ("[aws-cli*", "aws-cli*") + + | rename requestParameters.bucketName AS bucketName + requestParameters.accessControlList.x-amz-grant-read AS grantRead + requestParameters.accessControlList.x-amz-grant-read-acp AS grantReadAcp + requestParameters.accessControlList.x-amz-grant-write AS grantWrite + requestParameters.accessControlList.x-amz-grant-write-acp AS grantWriteAcp + requestParameters.accessControlList.x-amz-grant-full-control AS grantFullControl + requestParameters.x-amz-acl AS cannedAcl, + userIdentity.principalId AS principalId + userIdentity.userName AS userName + userIdentity.arn AS userArn + + | eval grantRead=coalesce(grantRead,"-"), + grantReadAcp=coalesce(grantReadAcp,"-"), + grantWrite=coalesce(grantWrite,"-"), + grantWriteAcp=coalesce(grantWriteAcp,"-"), + grantFullControl=coalesce(grantFullControl,"-"), + cannedAcl=coalesce(cannedAcl,"-"), + user=coalesce(userName,userArn) + + | eval publicGrant = if( + match(grantRead, "(?i)AllUsers|AuthenticatedUsers") + OR + match(grantReadAcp, "(?i)AllUsers|AuthenticatedUsers") + OR + match(grantWrite, "(?i)AllUsers|AuthenticatedUsers") + OR + match(grantWriteAcp, "(?i)AllUsers|AuthenticatedUsers") + OR + match(grantFullControl, "(?i)AllUsers|AuthenticatedUsers"), + 1, + 0 + ) + + | eval publicCanned = if(cannedAcl IN ("public-read", "public-read-write", "authenticated-read"), 1, 0) + + | where publicGrant=1 OR publicCanned=1 + + | eval exposure=case(cannedAcl=="public-read-write","public-write", match(grantWrite."".grantWriteAcp."".grantFullControl,"(?i)AllUsers"),"public-write", cannedAcl=="public-read" OR match(grantRead,"(?i)AllUsers"),"public-read", cannedAcl=="authenticated-read" OR match(grantRead,"(?i)AuthenticatedUsers"),"authenticated-read", true(),"custom-grant") + + | stats count + min(_time) AS firstTime + max(_time) AS lastTime + values(cannedAcl) AS cannedAcl + values(grantRead) AS grantRead + values(grantReadAcp) AS grantReadAcp + values(grantWrite) AS grantWrite + values(grantWriteAcp) AS grantWriteAcp + values(grantFullControl) AS grantFullControl + values(eventName) AS eventName + + BY user principalId userAgent bucketName exposure + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `detect_new_open_s3_buckets_over_aws_cli_filter` +how_to_implement: |- + The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. +known_false_positives: |- + It is possible that an AWS admin has legitimately created a public bucket for a specific purpose. AWS strongly advises against granting full control to the "All Users" group. Investigate and apply the necessary filters as needed. +references: + - https://docs.aws.amazon.com/cli/latest/reference/s3api/create-bucket.html drilldown_searches: - name: View the detection results for - "$user$" search: '%original_detection_search% | search user = "$user$"' @@ -34,11 +90,14 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: User $user$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$ + title: User [$user$] has created an open/public S3 Bucket [$bucketName$] using AWS CLI with the following permissions - [$grantRead$] [$grantReadAcp$] [$grantWrite$] [$grantWriteAcp$] [$grantFullControl$] [$cannedAcl$] entity: field: user type: user score: 50 +threat_objects: + - field: bucketName + type: bucket_name analytic_story: - Suspicious AWS S3 Activities asset_type: S3 Bucket From dd8c9a3cb77fbe2179e6bcac08e1303dc61733ec Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 9 Oct 2026 11:40:48 +0200 Subject: [PATCH 140/162] Remove `CrowdStrike ProcessRollup2` Reference from Content Using `parent_process` (#4316) --- detections/endpoint/jscript_execution_using_cscript_app.yml | 5 ++--- detections/endpoint/ping_sleep_batch_command.yml | 5 ++--- .../endpoint/possible_lateral_movement_powershell_spawn.yml | 5 ++--- .../endpoint/svchost_lolbas_execution_process_spawn.yml | 5 ++--- .../endpoint/vbscript_execution_using_wscript_app.yml | 5 ++--- .../windows_command_shell_dcrat_forkbomb_payload.yml | 5 ++--- ...ws_for_loop_usage_within_cmd_exe_to_execute_commands.yml | 5 ++--- .../windows_indirect_command_execution_via_forfiles.yml | 5 ++--- .../windows_indirect_command_execution_via_pcalua.yml | 5 ++--- ...indows_proxy_execution_of__net_utilities_via_scripts.yml | 6 ++---- .../windows_scheduled_task_service_spawned_shell.yml | 5 ++--- detections/endpoint/windows_ssh_proxy_command.yml | 5 ++--- .../windows_suspicious_react_or_next_js_child_process.yml | 5 ++--- detections/endpoint/windows_time_based_evasion.yml | 5 ++--- 14 files changed, 28 insertions(+), 43 deletions(-) diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml index 4082fc5412e..198f9016e62 100644 --- a/detections/endpoint/jscript_execution_using_cscript_app.yml +++ b/detections/endpoint/jscript_execution_using_cscript_app.yml @@ -1,8 +1,8 @@ name: Jscript Execution Using Cscript App id: 002f1e24-146e-11ec-a470-acde48001122 -version: 14 +version: 15 creation_date: '2021-09-14' -modification_date: '2026-08-31' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -13,7 +13,6 @@ description: |- If confirmed malicious, this activity could allow attackers to execute arbitrary scripts, leading to code execution, data exfiltration, or further system compromise. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml index b34b2835a41..2283e1a9af9 100644 --- a/detections/endpoint/ping_sleep_batch_command.yml +++ b/detections/endpoint/ping_sleep_batch_command.yml @@ -1,8 +1,8 @@ name: Ping Sleep Batch Command id: ce058d6c-79f2-11ec-b476-acde48001122 -version: 17 +version: 18 creation_date: '2022-01-20' -modification_date: '2026-08-11' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,7 +14,6 @@ description: |- Because ping is commonly used for legitimate network troubleshooting, findings should be reviewed in the context of the complete command line, parent process, user, and commands executed before or after the delay. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml index 8fe0edf7a66..6b73129ed47 100644 --- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml +++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml @@ -1,8 +1,8 @@ name: Possible Lateral Movement PowerShell Spawn id: cb909b3e-512b-11ec-aa31-3e22fbd008af -version: 17 +version: 18 creation_date: '2021-11-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Mauricio Velazco, Michael Haag, Splunk status: production type: Anomaly @@ -13,7 +13,6 @@ description: | If confirmed malicious, this behavior could allow attackers to execute code remotely, escalate privileges, or persist within the environment. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml index 2d1937a88b6..d0ab2e98694 100644 --- a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml @@ -1,8 +1,8 @@ name: Svchost LOLBAS Execution Process Spawn id: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af -version: 15 +version: 16 creation_date: '2021-11-23' -modification_date: '2026-07-27' +modification_date: '2026-10-09' author: Mauricio Velazco, Splunk status: production type: TTP @@ -11,7 +11,6 @@ description: |- If confirmed malicious, this behavior could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment, posing a significant security risk. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml index 7ae808c2c9e..628db714370 100644 --- a/detections/endpoint/vbscript_execution_using_wscript_app.yml +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -1,15 +1,14 @@ name: Vbscript Execution Using Wscript App id: 35159940-228f-11ec-8a49-acde48001122 -version: 13 +version: 14 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects the execution of VBScript using the wscript.exe application. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This activity is significant because wscript.exe is typically not used to execute VBScript, which is usually associated with cscript.exe. This deviation can indicate an attempt to evade traditional process monitoring and antivirus defenses. If confirmed malicious, this technique could allow attackers to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE ( diff --git a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml index 8ad38fc09d8..f9e7d6f0afa 100644 --- a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml +++ b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml @@ -1,15 +1,14 @@ name: Windows Command Shell DCRat ForkBomb Payload id: 2bb1a362-7aa8-444a-92ed-1987e8da83e1 -version: 14 +version: 15 creation_date: '2022-07-28' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects the execution of a DCRat "forkbomb" payload, which spawns multiple cmd.exe processes that launch notepad.exe instances in quick succession. This detection leverages Endpoint Detection and Response (EDR) data, focusing on the rapid creation of cmd.exe and notepad.exe processes within a 30-second window. This activity is significant as it indicates a potential DCRat infection, a known Remote Access Trojan (RAT) with destructive capabilities. If confirmed malicious, this behavior could lead to system instability, resource exhaustion, and potential disruption of services. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` values(Processes.user) as user values(Processes.action) as action values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product dc(Processes.parent_process_id) as parent_process_id_count dc(Processes.process_id) as process_id_count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.parent_process_name= "cmd.exe" (Processes.process_name = "notepad.exe" diff --git a/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml b/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml index a4e9eadf4ae..f3dc13d6c8c 100644 --- a/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml +++ b/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml @@ -1,8 +1,8 @@ name: Windows For Loop Usage Within Cmd.exe To Execute Commands id: a4ce9079-fc8f-4749-982a-13197c8cf977 -version: 1 +version: 2 creation_date: '2026-09-16' -modification_date: '2026-09-16' +modification_date: '2026-10-09' author: Onur Mustafa Erdogan, Splunk status: production type: Anomaly @@ -11,7 +11,6 @@ description: |- Adversaries and malicious scripts leverage this pattern to programmatically process command output for discovery, data extraction, or execution purposes while evading simpler detection logic. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml index 2a70eea3f67..de6a411fc9d 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml @@ -1,15 +1,14 @@ name: Windows Indirect Command Execution Via forfiles id: 1fdf31c9-ff4d-4c48-b799-0e8666e08787 -version: 11 +version: 12 creation_date: '2022-03-04' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Eric McGinnis, Splunk status: production type: TTP description: The following analytic detects the execution of programs initiated by forfiles.exe. This command is typically used to run commands on multiple files, often within batch scripts. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where forfiles.exe is the parent process. This activity is significant because forfiles.exe can be exploited to bypass command line execution protections, making it a potential vector for malicious activity. If confirmed malicious, this could allow attackers to execute arbitrary commands, potentially leading to unauthorized access or further system compromise. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.parent_process="*forfiles* /c *" diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml index f5060aafe37..296099e1af8 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml @@ -1,15 +1,14 @@ name: Windows Indirect Command Execution Via pcalua id: 3428ac18-a410-4823-816c-ce697d26f7a8 -version: 11 +version: 12 creation_date: '2022-03-04' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Eric McGinnis, Splunk status: production type: TTP description: The following analytic detects programs initiated by pcalua.exe, the Microsoft Windows Program Compatibility Assistant. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process information. While pcalua.exe can start legitimate programs, it is significant because attackers may use it to bypass command line execution protections. If confirmed malicious, this activity could allow attackers to execute arbitrary commands, potentially leading to unauthorized actions, privilege escalation, or persistence within the environment. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.parent_process="*pcalua* -a*" diff --git a/detections/endpoint/windows_proxy_execution_of__net_utilities_via_scripts.yml b/detections/endpoint/windows_proxy_execution_of__net_utilities_via_scripts.yml index 96aadbd7434..c8fcafe4e29 100644 --- a/detections/endpoint/windows_proxy_execution_of__net_utilities_via_scripts.yml +++ b/detections/endpoint/windows_proxy_execution_of__net_utilities_via_scripts.yml @@ -1,8 +1,8 @@ name: Windows Proxy Execution of .NET Utilities via Scripts id: eb59cf01-1874-4d16-b7e4-54a6eb9b3118 -version: 2 +version: 3 creation_date: '2026-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -11,8 +11,6 @@ description: |- That pattern is consistent with adversaries using trusted .NET binaries as a proxy to run code while hiding execution behind script parents in low-trust folders, behavior associated with techniques such as signed binary proxy execution. data_source: - Sysmon EventID 1 - - Windows Event Log Security 4688 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml index 3694b15b214..2da9f7d1039 100644 --- a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml +++ b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml @@ -1,8 +1,8 @@ name: Windows Scheduled Task Service Spawned Shell id: d8120352-3b62-4e3c-8cb6-7b47584dd5e8 -version: 12 +version: 13 creation_date: '2023-07-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Steven Dick status: production type: TTP @@ -13,7 +13,6 @@ description: | If confirmed malicious, this could allow attackers to execute arbitrary code, maintain persistence, or escalate privileges within the environment. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/windows_ssh_proxy_command.yml b/detections/endpoint/windows_ssh_proxy_command.yml index d8d2fc28bf9..02812d7a620 100644 --- a/detections/endpoint/windows_ssh_proxy_command.yml +++ b/detections/endpoint/windows_ssh_proxy_command.yml @@ -1,8 +1,8 @@ name: Windows SSH Proxy Command id: ac520039-21f1-4567-b528-5b7133dba76f -version: 6 +version: 7 creation_date: '2025-03-24' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, AJ King, Nasreddine Bencherchali, Splunk, Jesse Hunter, Splunk Community Contributor status: production type: Anomaly @@ -12,7 +12,6 @@ description: | This technique can be used by attackers to execute arbitrary commands through SSH proxy configurations, potentially enabling command & control activities or remote code execution. The detection focuses on commonly abused Windows scripting engines and web requests that may indicate malicious activity when spawned through SSH proxy commands. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml b/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml index 7719a175dbc..667888e72b3 100644 --- a/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml +++ b/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml @@ -1,8 +1,8 @@ name: Windows Suspicious React or Next.js Child Process id: baa80bc8-7c9c-4395-b458-b69feb92830a -version: 5 +version: 6 creation_date: '2025-12-08' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -13,7 +13,6 @@ description: | Such activity might be a strong indicator of exploitation of the aforementioned vulnerability. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: | | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes diff --git a/detections/endpoint/windows_time_based_evasion.yml b/detections/endpoint/windows_time_based_evasion.yml index 8356037e58d..f8cfd97a98d 100644 --- a/detections/endpoint/windows_time_based_evasion.yml +++ b/detections/endpoint/windows_time_based_evasion.yml @@ -1,8 +1,8 @@ name: Windows Time Based Evasion id: 34502357-deb1-499a-8261-ffe144abf561 -version: 14 +version: 15 creation_date: '2023-09-19' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: TTP @@ -13,7 +13,6 @@ description: |- If confirmed malicious, this activity could indicate an active infection attempting to evade detection, potentially leading to further compromise and persistence within the environment. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime From d84e86d7e2796c5f06c1373c6e9e532d1620dd78 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 9 Oct 2026 13:16:10 +0200 Subject: [PATCH 141/162] Fix #4275 (#4330) --- detections/endpoint/windows_ngrok_reverse_proxy_usage.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml index 02f70368d58..0f8ad3b931f 100644 --- a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml +++ b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml @@ -1,8 +1,8 @@ name: Windows Ngrok Reverse Proxy Usage id: e2549f2c-0aef-408a-b0c1-e0f270623436 -version: 13 +version: 14 creation_date: '2022-11-16' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -13,7 +13,7 @@ data_source: - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process_name=ngrok.exe Processes.process IN ("*start*", "*--config*","*http*","*authtoken*", "*http*", "*tcp*") + WHERE Processes.process_name=ngrok.exe Processes.process IN ("*start*", "*--config*","*http*","*authtoken*", "*tcp*") BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path From 1b2142fdd2d1358b4ac6ad3dfc47e5e455e619e8 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 9 Oct 2026 17:45:29 +0200 Subject: [PATCH 142/162] Fix Data Sources with Links to Archived TAs (#4307) --- contentctl.yml | 8 ++++---- data_sources/cisco_ios_logs.yml | 12 ++++++------ .../circle_ci_disable_security_job.yml | 10 +++++++--- .../circle_ci_disable_security_step.yml | 10 +++++++--- macros/{ => deprecated}/circleci.yml | 0 scripts/check_archived_tas.py | 2 ++ 6 files changed, 26 insertions(+), 16 deletions(-) rename detections/{cloud => deprecated}/circle_ci_disable_security_job.yml (92%) rename detections/{cloud => deprecated}/circle_ci_disable_security_step.yml (91%) rename macros/{ => deprecated}/circleci.yml (100%) diff --git a/contentctl.yml b/contentctl.yml index 2669049f6c6..1d6537fc169 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -241,10 +241,10 @@ apps: version: 4.0.3 hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-vmware-indexes_403.tgz - uid: 1467 - title: Cisco Networks Add-on - appid: TA-cisco_ios - version: 2.7.9 - hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/add-on-for-cisco-network-data_279.tgz + title: Cisco Enterprise Networking Add-on for Splunk + appid: TA-cisco-enterprise-networking-add-on-for-splunk + version: 4.0.35 + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-enterprise-networking-add-on-for-splunk_4035.tgz - uid: 8024 title: TA-ollama appid: ta-ollama diff --git a/data_sources/cisco_ios_logs.yml b/data_sources/cisco_ios_logs.yml index bf6b6c5e82a..d8d10d3b7ec 100644 --- a/data_sources/cisco_ios_logs.yml +++ b/data_sources/cisco_ios_logs.yml @@ -1,17 +1,17 @@ name: Cisco IOS Logs id: 9e4c8d7b-6f5e-4a3d-b2c1-0a9b8c7d6e5f -version: 2 +version: 3 creation_date: '2025-08-21' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Michael Haag, Splunk -description: Data source object for Cisco IOS system logs. Cisco IOS logs provide operational and security telemetry from Cisco network devices (IOS, IOS XE, IOS XR, NX-OS, WLC, and APs). The Cisco Networks Add-on for Splunk (TA-cisco_ios) normalizes these events by setting proper sourcetypes and extracting fields for switches, routers, controllers, and access points; deploy the TA on indexers/HFs and search heads, and the Cisco Networks (cisco_ios) App on search heads. Supported platforms include Catalyst, ASR, ISR, Nexus, CRS, and other IOS-based devices, enabling consistent investigation, alerting, and reporting in Splunk Enterprise and Splunk Cloud. This data is ingested via SYSLOG. +description: Data source object for Cisco IOS system logs. source: cisco:ios sourcetype: cisco:ios separator: supported_TA: - - name: Cisco Networks Add-on - url: https://splunkbase.splunk.com/app/1467 - version: 2.8.2 + - name: Cisco Enterprise Networking Add-on for Splunk + url: https://splunkbase.splunk.com/app/7538 + version: 4.0.35 fields: - _time - aci_message_text diff --git a/detections/cloud/circle_ci_disable_security_job.yml b/detections/deprecated/circle_ci_disable_security_job.yml similarity index 92% rename from detections/cloud/circle_ci_disable_security_job.yml rename to detections/deprecated/circle_ci_disable_security_job.yml index 22d5f050395..b93cd1860a7 100644 --- a/detections/cloud/circle_ci_disable_security_job.yml +++ b/detections/deprecated/circle_ci_disable_security_job.yml @@ -1,10 +1,10 @@ name: Circle CI Disable Security Job id: 4a2fdd41-c578-4cd4-9ef7-980e352517f2 -version: 11 +version: 12 creation_date: '2021-09-02' -modification_date: '2026-09-22' +modification_date: '2026-10-01' author: Patrick Bareiss, Splunk -status: production +status: deprecated type: Anomaly description: The following analytic detects the disabling of security jobs in CircleCI pipelines. It leverages CircleCI log data, renaming and extracting fields such as job names, workflow IDs, user information, commit messages, URLs, and branches. The detection identifies mandatory jobs for each workflow and checks if they were executed. This activity is significant because disabling security jobs can allow malicious code to bypass security checks, leading to potential data breaches, system downtime, and reputational damage. If confirmed malicious, this could result in unauthorized code execution and compromised pipeline integrity. data_source: @@ -60,3 +60,7 @@ tests: sourcetype: circleci source: circleci test_type: unit +deprecation_info: + reason: Detection deprecated because the Technology Add-on it uses has been archived, and no replacement TA exists. + removed_in_version: 6.12.0 + replacement_content: [] diff --git a/detections/cloud/circle_ci_disable_security_step.yml b/detections/deprecated/circle_ci_disable_security_step.yml similarity index 91% rename from detections/cloud/circle_ci_disable_security_step.yml rename to detections/deprecated/circle_ci_disable_security_step.yml index 9f5d5ce02e0..5b234e57c1c 100644 --- a/detections/cloud/circle_ci_disable_security_step.yml +++ b/detections/deprecated/circle_ci_disable_security_step.yml @@ -1,10 +1,10 @@ name: Circle CI Disable Security Step id: 72cb9de9-e98b-4ac9-80b2-5331bba6ea97 -version: 9 +version: 10 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Patrick Bareiss, Splunk -status: experimental +status: deprecated type: Anomaly description: The following analytic detects the disablement of security steps in a CircleCI pipeline. It leverages CircleCI logs, using field renaming, joining, and statistical analysis to identify instances where mandatory security steps are not executed. This activity is significant because disabling security steps can introduce vulnerabilities, unauthorized changes, or malicious code into the pipeline. If confirmed malicious, this could lead to potential attacks, data breaches, or compromised infrastructure. Investigate by reviewing job names, commit details, and user information associated with the disablement, and examine any relevant artifacts and concurrent processes. data_source: @@ -58,3 +58,7 @@ tests: source: circleci test_type: experimental description: This test is a legacy experimental test and may not be accurate. +deprecation_info: + reason: Detection deprecated because the Technology Add-on it uses has been archived, and no replacement TA exists. + removed_in_version: 6.12.0 + replacement_content: [] diff --git a/macros/circleci.yml b/macros/deprecated/circleci.yml similarity index 100% rename from macros/circleci.yml rename to macros/deprecated/circleci.yml diff --git a/scripts/check_archived_tas.py b/scripts/check_archived_tas.py index a3b433e0703..27269974ddf 100644 --- a/scripts/check_archived_tas.py +++ b/scripts/check_archived_tas.py @@ -61,6 +61,8 @@ def discover_used_tas() -> dict[str, dict[str, Any]]: detection = load_yaml(path) if not detection: continue + if str(detection.get("status") or "").strip().casefold() == "deprecated": + continue references = detection.get("data_source") or [] if isinstance(references, str): references = [references] From e2275d40f9c12302e04479c845d30efcffbe3cb9 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 12 Oct 2026 03:45:51 -0500 Subject: [PATCH 143/162] Update data source TA and install.yml app versions (#4335) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/cisco_ios_logs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data_sources/cisco_ios_logs.yml b/data_sources/cisco_ios_logs.yml index d8d10d3b7ec..31ab89661c7 100644 --- a/data_sources/cisco_ios_logs.yml +++ b/data_sources/cisco_ios_logs.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Enterprise Networking Add-on for Splunk url: https://splunkbase.splunk.com/app/7538 - version: 4.0.35 + version: 4.0.50 fields: - _time - aci_message_text From c653da7c11fc74a5410646c96cb05b8998fd6d44 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 12 Oct 2026 15:04:44 +0200 Subject: [PATCH 144/162] Add Atomic GUID Mappings - Batch 1 (#4315) --- .../detect_html_help_spawn_child_process.yml | 5 +++- .../access_lsass_memory_for_dump_creation.yml | 5 +++- .../adsisearcher_account_discovery.yml | 5 +++- .../bcdedit_failure_recovery_modification.yml | 5 +++- detections/endpoint/bits_job_persistence.yml | 5 +++- .../endpoint/bitsadmin_download_file.yml | 5 +++- .../certutil_with_decode_argument.yml | 5 +++- ...t___curl_execution_with_insecure_flags.yml | 3 ++- ..._loading_from_world_writable_directory.yml | 5 +++- ...or_delete_windows_shares_using_net_exe.yml | 7 +++++- .../creation_of_lsass_dump_with_taskmgr.yml | 5 +++- .../endpoint/creation_of_shadow_copy.yml | 7 +++++- ...f_shadow_copy_with_wmic_and_powershell.yml | 7 +++++- ...ping_via_copy_command_from_shadow_copy.yml | 5 +++- ...ial_dumping_via_symlink_to_shadow_copy.yml | 5 +++- .../delete_shadowcopy_with_powershell.yml | 5 +++- .../endpoint/deleting_shadow_copies.yml | 5 +++- ...redential_dumping_through_lsass_access.yml | 5 +++- .../detect_html_help_url_in_command_line.yml | 5 +++- ...l_help_using_infotech_storage_handlers.yml | 5 +++- .../detect_mshta_inline_hta_execution.yml | 9 ++++++- .../detect_mshta_url_in_command_line.yml | 5 +++- .../detect_new_local_admin_account.yml | 7 ++++-- ...nterception_by_creation_of_program_exe.yml | 5 +++- .../detect_psexec_with_accepteula_flag.yml | 5 +++- ...ct_regsvr32_application_control_bypass.yml | 5 +++- ...t_remote_access_software_usage_process.yml | 25 ++++++++++++++++++- .../detect_rundll32_inline_hta_execution.yml | 7 +++++- ...tect_sharphound_command_line_arguments.yml | 5 +++- .../detect_sharphound_file_modifications.yml | 5 +++- .../endpoint/detect_sharphound_usage.yml | 5 +++- .../endpoint/disable_etw_through_registry.yml | 7 +++++- .../endpoint/disable_logs_using_wevtutil.yml | 5 +++- detections/endpoint/disable_registry_tool.yml | 5 +++- .../disable_windows_behavior_monitoring.yml | 5 +++- .../endpoint/disabling_cmd_application.yml | 5 +++- .../disabling_remote_user_account_control.yml | 7 ++++-- .../disabling_systemrestore_in_registry.yml | 5 +++- ...main_group_discovery_with_adsisearcher.yml | 5 +++- .../endpoint/dsquery_domain_discovery.yml | 5 +++- .../endpoint/dump_lsass_via_comsvcs_dll.yml | 5 +++- .../endpoint/dump_lsass_via_procdump.yml | 5 +++- ...le_wdigest_uselogoncredential_registry.yml | 7 +++++- detections/endpoint/esentutl_sam_copy.yml | 5 +++- detections/endpoint/eventvwr_uac_bypass.yml | 7 +++++- detections/endpoint/fodhelper_uac_bypass.yml | 7 +++++- ...ltdomainpasswordpolicy_with_powershell.yml | 5 +++- .../endpoint/get_aduser_with_powershell.yml | 5 +++- ...et_aduser_with_powershell_script_block.yml | 5 +++- .../get_domainpolicy_with_powershell.yml | 5 +++- .../get_domaintrust_with_powershell.yml | 5 +++- .../get_domainuser_with_powershell.yml | 5 +++- .../get_foresttrust_with_powershell.yml | 5 +++- .../get_wmiobject_group_discovery.yml | 5 +++- ...up_discovery_with_script_block_logging.yml | 5 +++- ...dcomputer_with_powershell_script_block.yml | 5 +++- .../endpoint/getadgroup_with_powershell.yml | 5 +++- ...etadgroup_with_powershell_script_block.yml | 5 +++- .../getcurrent_user_with_powershell.yml | 5 +++- ...rent_user_with_powershell_script_block.yml | 5 +++- .../getdomaincontroller_with_powershell.yml | 5 +++- .../getdomaingroup_with_powershell.yml | 5 +++- ...maingroup_with_powershell_script_block.yml | 5 +++- .../endpoint/getlocaluser_with_powershell.yml | 5 +++- ...twmiobject_ds_computer_with_powershell.yml | 5 +++- ..._files_and_directories_with_attrib_exe.yml | 7 ++++-- ...ovement_wmiexec_commandline_parameters.yml | 5 +++- ...asting_spn_request_with_rc4_encryption.yml | 7 +++++- .../endpoint/linux_add_user_account.yml | 5 +++- .../linux_at_application_execution.yml | 5 ++-- .../linux_auditd_add_user_account.yml | 5 +++- .../linux_auditd_clipboard_data_copy.yml | 5 +++- .../linux_auditd_dd_file_overwrite.yml | 5 +++- ...ux_auditd_file_and_directory_discovery.yml | 5 +++- ...ert_kernel_module_using_insmod_utility.yml | 5 +++- ...td_possible_access_to_credential_files.yml | 5 +++- .../endpoint/linux_auditd_stop_services.yml | 5 +++- ...system_network_configuration_discovery.yml | 5 +++- .../linux_auditd_whoami_user_discovery.yml | 5 +++- .../endpoint/linux_clipboard_data_copy.yml | 5 +++- .../endpoint/linux_curl_upload_file.yml | 5 +++- .../endpoint/linux_dd_file_overwrite.yml | 5 +++- .../endpoint/linux_decode_base64_to_shell.yml | 5 +++- .../linux_docker_root_directory_mount.yml | 5 +++- .../linux_ingress_tool_transfer_hunting.yml | 5 +++- .../linux_ingress_tool_transfer_with_curl.yml | 5 +++- ...ert_kernel_module_using_insmod_utility.yml | 5 +++- .../linux_kernel_module_enumeration.yml | 5 +++- .../endpoint/linux_magic_sysrq_key_abuse.yml | 7 +++++- ...ted_files_or_information_base64_decode.yml | 5 +++- ...linux_ssh_authorized_keys_modification.yml | 5 +++- .../linux_system_network_discovery.yml | 5 +++- ...x_system_reboot_via_system_request_key.yml | 5 +++- .../endpoint/macos_gatekeeper_bypass.yml | 5 +++- .../endpoint/macos_keychains_dumped.yml | 5 +++- .../endpoint/macos_list_firewall_rules.yml | 5 +++- .../macos_network_share_discovery.yml | 5 +++- ...ript_displaying_suspicious_user_prompt.yml | 7 +++++- ...s_powershell_process___encoded_command.yml | 5 +++- ...nitor_registry_keys_for_print_monitors.yml | 7 ++++-- ...etwork_share_discovery_via_dir_command.yml | 3 ++- .../nltest_domain_trust_discovery.yml | 5 +++- detections/endpoint/ntdsutil_export_ntds.yml | 5 +++- .../overwriting_accessibility_binaries.yml | 17 +++++++++++-- ..._hijacking_inprocserver32_modification.yml | 5 +++- ...powershell_disable_security_monitoring.yml | 5 +++- .../powershell_enable_powershell_remoting.yml | 5 +++- .../powershell_execute_com_object.yml | 5 +++- .../powershell_get_localgroup_discovery.yml | 5 +++- ...up_discovery_with_script_block_logging.yml | 5 +++- ...powershell_invoke_cimmethod_cimsession.yml | 5 +++- .../powershell_start_bitstransfer.yml | 5 +++- .../powershell_start_or_stop_service.yml | 5 +++- .../endpoint/process_execution_via_wmi.yml | 7 ++++-- ...istry_keys_for_creating_shim_databases.yml | 7 ++++-- .../registry_keys_used_for_persistence.yml | 7 ++++-- ...try_keys_used_for_privilege_escalation.yml | 9 ++++++- ...2_silent_and_install_param_dll_loading.yml | 5 +++- .../remote_process_instantiation_via_wmi.yml | 5 +++- ...ote_system_discovery_with_adsisearcher.yml | 5 +++- .../endpoint/remote_wmi_command_attempt.yml | 5 +++- .../endpoint/resize_shadowstorage_volume.yml | 5 +++- .../endpoint/rundll32_control_rundll_hunt.yml | 5 +++- .../rundll_loading_dll_by_ordinal.yml | 5 +++- ...eduled_task_deleted_or_created_via_cmd.yml | 5 +++- ...led_task_initiation_on_remote_endpoint.yml | 5 +++- ...htasks_scheduling_job_on_remote_system.yml | 7 ++++-- ...ceprincipalnames_discovery_with_setspn.yml | 5 +++- .../endpoint/shim_database_file_creation.yml | 7 ++++-- ...nstallation_with_suspicious_parameters.yml | 7 ++++-- .../endpoint/short_lived_windows_accounts.yml | 7 +++++- ...ation_certificates_behavior_identified.yml | 5 +++- ...ious_microsoft_workflow_compiler_usage.yml | 5 +++- .../suspicious_mshta_child_process.yml | 7 +++++- .../endpoint/suspicious_reg_exe_process.yml | 5 +++- .../endpoint/suspicious_rundll32_startw.yml | 5 +++- .../endpoint/suspicious_wevtutil_usage.yml | 5 +++- ...system_information_discovery_detection.yml | 9 ++++++- ...rocesses_run_from_unexpected_locations.yml | 5 +++- .../system_user_discovery_with_query.yml | 7 +++++- .../endpoint/unload_sysmon_filter_driver.yml | 5 +++- ...ser_discovery_with_env_vars_powershell.yml | 5 +++- ..._with_env_vars_powershell_script_block.yml | 5 +++- detections/endpoint/usn_journal_deletion.yml | 5 +++- .../wbadmin_delete_system_backups.yml | 5 +++- ...ss_token_manipulation_sedebugprivilege.yml | 5 +++- .../windows_ad_dsrm_password_reset.yml | 5 +++- detections/endpoint/windows_adfind_exe.yml | 8 +++++- ...itelisting_bypass_attempt_via_rundll32.yml | 11 +++++++- ...ndows_attempt_to_stop_security_service.yml | 5 +++- ...ion_lsass_driver_registry_modification.yml | 5 +++- ...roxy_execution_mavinject_dll_injection.yml | 5 +++- ...ows_cabinet_file_extraction_via_expand.yml | 5 +++- ...ckdoor_execution_via_powershell_script.yml | 5 +++- .../endpoint/windows_create_local_account.yml | 7 +++++- ...te_local_administrator_account_via_net.yml | 7 ++++-- ...ential_dumping_lsass_memory_createdump.yml | 5 +++- ...ndows_curl_download_to_suspicious_path.yml | 5 +++- ...dows_curl_upload_to_remote_destination.yml | 5 +++- ...sable_change_password_through_registry.yml | 5 +++- ...k_workstation_feature_through_registry.yml | 5 +++- ...disable_logoff_button_through_registry.yml | 5 +++- .../windows_disable_notification_center.yml | 5 +++- ...sable_shutdown_button_through_registry.yml | 5 +++- ...ows_event_logging_disable_http_logging.yml | 5 +++- ...group_policy_features_through_registry.yml | 17 ++++++++++++- .../windows_disableantispyware_registry.yml | 7 +++++- .../endpoint/windows_dism_remove_defender.yml | 5 +++- ...earch_order_hijacking_hunt_with_sysmon.yml | 5 +++- ...ows_dotnet_binary_in_non_standard_path.yml | 5 +++- ...ws_entra_user_management_via_azure_cli.yml | 5 +++- ...dows_esx_admins_group_creation_via_net.yml | 5 +++- .../endpoint/windows_event_log_cleared.yml | 5 +++- ...ows_event_logging_service_has_shutdown.yml | 7 +++++- ...image_file_execution_options_injection.yml | 5 +++- .../windows_eventlog_cleared_via_wevtutil.yml | 5 +++- .../endpoint/windows_export_certificate.yml | 5 +++- .../windows_file_download_via_certutil.yml | 7 +++++- .../windows_file_download_via_powershell.yml | 5 +++- ...ws_file_share_discovery_with_powerview.yml | 5 +++- ..._access_rights_modification_via_icacls.yml | 5 ++-- ..._exe_execution_from_windowsapps_folder.yml | 5 +++- .../windows_group_discovery_via_net.yml | 5 +++- ...dows_guest_account_enabled_via_net_exe.yml | 6 ++++- ...ttp_network_communication_from_msiexec.yml | 5 +++- .../windows_identify_protocol_handlers.yml | 5 +++- .../windows_iis_components_add_new_module.yml | 5 +++- ...indows_iis_components_new_module_added.yml | 5 +++- ...r_defenses_disable_auto_logger_session.yml | 5 +++- .../windows_impair_defenses_disable_hvci.yml | 3 ++- ...ndirect_command_execution_via_forfiles.yml | 3 +++ ..._indirect_command_execution_via_pcalua.yml | 3 +++ ...mmand_execution_via_series_of_forfiles.yml | 5 +++- ..._input_capture_using_credential_ui_dll.yml | 5 +++- ...ndows_installutil_in_non_standard_path.yml | 5 +++- .../windows_installutil_uninstall_option.yml | 5 +++- ...ndows_ldifde_directory_object_behavior.yml | 3 ++- ...dows_linked_policies_in_adsi_discovery.yml | 5 +++- ...mimikatz_crypto_export_file_extensions.yml | 5 +++- ...y_registry_authenticationleveloverride.yml | 5 +++- ...dows_modify_registry_auto_update_notif.yml | 5 ++-- .../windows_modify_registry_disable_rdp.yml | 5 +++- ...y_registry_disable_toast_notifications.yml | 5 +++- ...y_disable_win_defender_raw_write_notif.yml | 5 +++- ...stry_disable_windefender_notifications.yml | 3 ++- ..._disable_windows_security_center_notif.yml | 5 +++- ...registry_disableremotedesktopantialias.yml | 5 +++- ...odify_registry_disablesecuritysettings.yml | 5 +++- ...modify_registry_disabling_wer_settings.yml | 5 +++- ...s_modify_registry_disallow_windows_app.yml | 5 +++- ..._registry_do_not_connect_to_win_update.yml | 5 ++-- .../windows_modify_registry_dontshowui.yml | 5 +++- ...odify_registry_enablelinkedconnections.yml | 3 ++- ...ndows_modify_registry_longpathsenabled.yml | 3 ++- ...modify_registry_maxconnectionperserver.yml | 5 +++- ...egistry_no_auto_reboot_with_logon_user.yml | 5 ++-- ...windows_modify_registry_no_auto_update.yml | 5 ++-- ...fy_registry_on_smart_card_group_policy.yml | 5 +++- .../windows_modify_registry_proxyenable.yml | 5 +++- .../windows_modify_registry_proxyserver.yml | 5 +++- ...y_registry_suppress_win_defender_notif.yml | 5 +++- ...dows_modify_registry_tamper_protection.yml | 5 ++-- ...w_compress_color_and_info_tip_registry.yml | 5 +++- ..._mof_event_triggered_execution_via_wmi.yml | 5 +++- .../windows_msiexec_dllregisterserver.yml | 5 +++- .../windows_msiexec_remote_download.yml | 5 +++- ...s_msiexec_unregister_dllregisterserver.yml | 5 +++- ...d_to_authenticate_from_host_using_ntlm.yml | 5 +++- .../windows_net_system_service_discovery.yml | 5 +++- ...dows_network_share_interaction_via_net.yml | 7 ++++-- ...windows_network_sniffing_tool_executed.yml | 7 +++++- ...ity_descriptor_set_on_eventlog_channel.yml | 5 +++- ...ntlog_channelaccess_registry_value_set.yml | 5 +++- .../endpoint/windows_nirsoft_advancedrun.yml | 5 +++- .../endpoint/windows_nirsoft_utilities.yml | 5 +++- ...ows_non_system_account_targeting_lsass.yml | 5 +++- .../endpoint/windows_odbcconf_hunting.yml | 7 +++++- .../endpoint/windows_odbcconf_load_dll.yml | 5 +++- .../windows_odbcconf_load_response_file.yml | 5 +++- ..._outlook_webview_registry_modification.yml | 5 +++- ...dows_parent_pid_spoofing_with_explorer.yml | 5 +++- .../windows_possible_credential_dumping.yml | 5 +++- ...indows_powershell_disable_http_logging.yml | 5 +++- .../windows_powershell_export_certificate.yml | 5 +++- ...ndows_powershell_export_pfxcertificate.yml | 5 +++- ...rshell_get_ciminstance_remote_computer.yml | 5 +++- ...l_iis_components_webglobalmodule_usage.yml | 5 +++- .../windows_powershell_scheduletask.yml | 3 ++- ...erview_kerberos_service_ticket_request.yml | 5 +++- .../endpoint/windows_proxy_via_netsh.yml | 3 ++- .../endpoint/windows_proxy_via_registry.yml | 3 ++- ...dows_registry_bootexecute_modification.yml | 5 +++- .../windows_registry_certificate_added.yml | 5 +++- ...y_dotnet_etw_disabled_via_env_variable.yml | 11 +++++++- ...modification_for_safe_mode_persistence.yml | 7 +++++- .../windows_remote_create_service.yml | 5 +++- ..._root_domain_linked_policies_discovery.yml | 5 +++- .../windows_runmru_command_execution.yml | 3 ++- ...curity_descriptor_tampering_via_sc_exe.yml | 5 +++- ...ows_sensitive_group_discovery_with_net.yml | 5 +++- ...ive_registry_hive_dump_via_commandline.yml | 7 +++++- .../windows_service_create_with_tscon.yml | 5 +++- ..._service_creation_using_registry_entry.yml | 5 +++- .../windows_service_execution_remcom.yml | 5 +++- .../endpoint/windows_service_stop_attempt.yml | 5 +++- ...snake_malware_file_modification_crmlog.yml | 3 ++- ...s_snake_malware_kernel_driver_comadmin.yml | 3 ++- ...istry_modification_wav_openwithprogids.yml | 3 ++- .../windows_snake_malware_service_create.yml | 3 ++- .../endpoint/windows_sqlcmd_execution.yml | 5 +++- ..._authentication_certificates_cryptoapi.yml | 5 +++- ...cation_certificates_export_certificate.yml | 5 +++- ...ion_certificates_export_pfxcertificate.yml | 5 +++- .../endpoint/windows_subinacl_execution.yml | 5 +++- ...execution_compiled_html_file_decompile.yml | 5 +++- ...em_network_connections_discovery_netsh.yml | 5 +++- ...oxy_execution_syncappvpublishingserver.yml | 5 +++- ...dows_system_time_discovery_w32tm_delay.yml | 5 +++- ...indows_system_user_discovery_via_quser.yml | 7 +++++- .../windows_wmi_process_call_create.yml | 5 +++- ...windows_wmi_reconnaissance_class_query.yml | 9 ++++++- .../windows_wmic_shadowcopy_delete.yml | 5 +++- .../windows_wmic_systeminfo_discovery.yml | 5 +++- .../wmi_permanent_event_subscription.yml | 9 ++++++- ..._permanent_event_subscription___sysmon.yml | 9 ++++++- detections/endpoint/wmic_group_discovery.yml | 5 +++- .../endpoint/wmic_xsl_execution_via_url.yml | 5 +++- .../xsl_script_execution_with_wmic.yml | 5 +++- 288 files changed, 1254 insertions(+), 306 deletions(-) diff --git a/detections/application/detect_html_help_spawn_child_process.yml b/detections/application/detect_html_help_spawn_child_process.yml index 0b070d38386..27905230b3c 100644 --- a/detections/application/detect_html_help_spawn_child_process.yml +++ b/detections/application/detect_html_help_spawn_child_process.yml @@ -2,7 +2,7 @@ name: Detect HTML Help Spawn Child Process id: 723716de-ee55-4cd4-9759-c44e7e55ba4b version: 16 creation_date: '2021-02-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ references: - https://lolbas-project.github.io/lolbas/Binaries/Hh/ - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.001/T1218.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -66,6 +67,8 @@ analytic_story: - Compromised Windows Host - APT37 Rustonotto and FadeStealer asset_type: Endpoint +atomic_guid: + - 5cb87818-0d7c-4469-b7ef-9224107aebe8 mitre_attack_id: - T1218.001 product: diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index e09ae3823a9..bb435a02c50 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -2,7 +2,7 @@ name: Access LSASS Memory for Dump Creation id: fb4c31b0-13e8-4155-8aa5-24de4b8d6717 version: 16 creation_date: '2019-12-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -29,6 +29,7 @@ how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, w known_false_positives: Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -54,6 +55,8 @@ analytic_story: - Lokibot - Scattered Lapsus$ Hunters asset_type: Windows +atomic_guid: + - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml index 9092c986eae..9e7ebdc39cc 100644 --- a/detections/endpoint/adsisearcher_account_discovery.yml +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -2,7 +2,7 @@ name: AdsiSearcher Account Discovery id: de7fcadc-04f3-11ec-a241-acde48001122 version: 13 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: TTP @@ -27,6 +27,7 @@ references: - https://attack.mitre.org/techniques/T1087/002/ - https://www.blackhillsinfosec.com/red-blue-purple/ - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L234 drilldown_searches: - name: View the detection results for - "$dest$" and "$user_id$" search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' @@ -55,6 +56,8 @@ analytic_story: - Data Destruction - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 02e8be5a-3065-4e54-8cc8-a14d138834d3 mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index 9db0967a1f8..c2c09667a35 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -2,7 +2,7 @@ name: BCDEdit Failure Recovery Modification id: 809b31d2-5462-11eb-ae93-0242ac130002 version: 15 creation_date: '2021-01-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators may modify the boot configuration. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L66 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - Storm-2460 CLFS Zero Day Exploitation - Void Manticore asset_type: Endpoint +atomic_guid: + - cf21060a-80b3-4238-a595-22525de4ab81 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index b7f6c0dce0a..d60fb19be34 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -2,7 +2,7 @@ name: BITS Job Persistence id: e97a5ffe-90bf-11eb-928a-acde48001122 version: 13 creation_date: '2021-03-30' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1197/T1197.yaml#L51 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - BITS Jobs - Living Off The Land asset_type: Endpoint +atomic_guid: + - 62a06ec5-5754-47d2-bcfc-123d8314c6ae mitre_attack_id: - T1197 product: diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index ec76c0eedfd..76c73828b14 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -2,7 +2,7 @@ name: BITSAdmin Download File id: 80630ff4-8e4c-11eb-aab5-acde48001122 version: 18 creation_date: '2021-03-30' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Sittikorn S status: production type: TTP @@ -32,6 +32,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md - https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L236 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -70,6 +71,8 @@ analytic_story: - GhostRedirector IIS Module and Rungan Backdoor - Hellcat Ransomware asset_type: Endpoint +atomic_guid: + - a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b mitre_attack_id: - T1197 - T1105 diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml index 42845a1248a..69b55219b93 100644 --- a/detections/endpoint/certutil_with_decode_argument.yml +++ b/detections/endpoint/certutil_with_decode_argument.yml @@ -2,7 +2,7 @@ name: CertUtil With Decode Argument id: bfe94226-8c10-11eb-a4b3-acde48001122 version: 15 creation_date: '2021-03-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil - https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml#L25 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -70,6 +71,8 @@ threat_group: - Cozy Bear - Midnight Blizzard asset_type: Endpoint +atomic_guid: + - 71abc534-3c05-4d0c-80f7-cbe93cb2aa94 mitre_attack_id: - T1140 product: diff --git a/detections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml b/detections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml index e7875db3e45..eaf17da0a93 100644 --- a/detections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml +++ b/detections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml @@ -2,7 +2,7 @@ name: Cisco Isovalent - Curl Execution With Insecure Flags id: c16c4899-d3f7-461b-92c2-cc0ef5758855 version: 5 creation_date: '2026-01-05' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Bhavin Patel, Splunk status: production type: Anomaly @@ -22,6 +22,7 @@ known_false_positives: This activity may be triggered by legitimate administrati references: - https://rawcode7.medium.com/understanding-the-kubernetes-attack-surface-9a48ebcb6bc4 - https://www.tutorialworks.com/kubernetes-curl/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L1275 drilldown_searches: - name: View the detection results for - "$pod_name$" search: '%original_detection_search% | search pod_name = "$pod_name$"' diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml index 49b1b9120d8..7eb280d8203 100644 --- a/detections/endpoint/control_loading_from_world_writable_directory.yml +++ b/detections/endpoint/control_loading_from_world_writable_directory.yml @@ -2,7 +2,7 @@ name: Control Loading from World Writable Directory id: 10423ac4-10c9-11ec-8dc4-acde48001122 version: 13 creation_date: '2021-09-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -20,6 +20,7 @@ references: - https://attack.mitre.org/techniques/T1218/011/ - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.002/T1218.002.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -53,6 +54,8 @@ analytic_story: asset_type: Endpoint cve: - CVE-2021-40444 +atomic_guid: + - 037e9d8a-9e46-4255-8b33-2ae3b545ca6f mitre_attack_id: - T1218.002 product: diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index 88e5ff9751b..d5039c90a25 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -2,7 +2,7 @@ name: Create or delete windows shares using net exe id: 743a322c-9a68-4a0f-9c17-85d9cce2a27c version: 18 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Splunk status: production type: TTP @@ -30,6 +30,8 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators often leverage net.exe to create or delete network shares. You should verify that the activity was intentional and is legitimate. references: - https://attack.mitre.org/techniques/T1070/005/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1070.005/T1070.005.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1070.005/T1070.005.yaml#L21 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +65,9 @@ analytic_story: - Prestige Ransomware - DarkGate Malware asset_type: Endpoint +atomic_guid: + - 14c38f32-6509-46d8-ab43-d53e32d2b131 + - 09210ad5-1ef2-4077-9ad3-7351e13e9222 mitre_attack_id: - T1070.005 product: diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml index 25294be65c0..c0b325b2304 100644 --- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml +++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml @@ -2,7 +2,7 @@ name: Creation of lsass Dump with Taskmgr id: b2fbe95a-9c62-4c12-8a29-24b97e84c0cd version: 15 creation_date: '2019-12-11' -modification_date: '2026-09-21' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -34,6 +34,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-5---dump-lsassexe-memory-using-windows-task-manager - https://attack.mitre.org/techniques/T1003/001/ - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L122 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -59,6 +60,8 @@ analytic_story: - Seashell Blizzard - Scattered Lapsus$ Hunters asset_type: Windows +atomic_guid: + - dea6c349-f1c6-44f3-87a1-1ed33a59a607 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index 05b52a99353..d5262c808c0 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -2,7 +2,7 @@ name: Creation of Shadow Copy id: eb120f5f-b879-4a63-97c1-93352b5df844 version: 13 creation_date: '2019-12-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -33,6 +33,8 @@ known_false_positives: Legitimate administrator usage of Vssadmin or Wmic will c references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L116 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +64,9 @@ analytic_story: - Compromised Windows Host - Credential Dumping asset_type: Endpoint +atomic_guid: + - dcebead7-6c28-4b4b-bf3c-79deb1b1fc7f + - 224f7de0-8f0a-4a94-b5d8-989b036c86da mitre_attack_id: - T1003.003 product: diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index f6257bbe425..92750935e23 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -2,7 +2,7 @@ name: Creation of Shadow Copy with wmic and powershell id: 2ed8b538-d284-449a-be1d-82ad1dbd186b version: 15 creation_date: '2019-12-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -32,6 +32,8 @@ known_false_positives: Legitimate administrator usage of wmic to create a shadow references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L116 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L204 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +61,9 @@ analytic_story: - Compromised Windows Host - Credential Dumping asset_type: Endpoint +atomic_guid: + - 224f7de0-8f0a-4a94-b5d8-989b036c86da + - 542bb97e-da53-436b-8e43-e0a7d31a6c24 mitre_attack_id: - T1003.003 product: diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml index c62a95e4524..39fdc97d94a 100644 --- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml @@ -2,7 +2,7 @@ name: Credential Dumping via Copy Command from Shadow Copy id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -16,6 +16,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L31 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -41,6 +42,8 @@ analytic_story: - Compromised Windows Host - Credential Dumping asset_type: Endpoint +atomic_guid: + - c6237146-9ea6-4711-85c9-c56d263a6b03 mitre_attack_id: - T1003.003 product: diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml index 4363f7400e0..2dc83ba0168 100644 --- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml @@ -2,7 +2,7 @@ name: Credential Dumping via Symlink to Shadow Copy id: c5eac648-fae0-4263-91a6-773df1f4c903 version: 14 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L228 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -54,6 +55,8 @@ analytic_story: - Compromised Windows Host - Credential Dumping asset_type: Endpoint +atomic_guid: + - 21748c28-2793-4284-9e07-d6d028b66702 mitre_attack_id: - T1003.003 product: diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index c5148d86a4e..55a0ec44a14 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -2,7 +2,7 @@ name: Delete ShadowCopy With PowerShell id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122 version: 13 creation_date: '2021-05-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -26,6 +26,7 @@ known_false_positives: No false positives have been identified at this time. references: - https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations - https://www.techtarget.com/searchwindowsserver/tutorial/Set-up-PowerShell-script-block-logging-for-added-security + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L82 drilldown_searches: - name: View the detection results for - "$user_id$" and "$dest$" search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' @@ -55,6 +56,8 @@ analytic_story: - Cactus Ransomware - VanHelsing Ransomware asset_type: Endpoint +atomic_guid: + - 39a295ca-7059-4a88-86f6-09556c1211e7 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index a6317940389..4e8f64722a3 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -2,7 +2,7 @@ name: Deleting Shadow Copies id: b89919ed-ee5f-492c-b139-95dbb162039e version: 19 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -34,6 +34,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: vssadmin.exe and wmic.exe are standard applications shipped with modern versions of windows. They may be used by administrators to legitimately delete old backup copies, although this is typically rare. references: - https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -80,6 +81,8 @@ analytic_story: - Storm-2460 CLFS Zero Day Exploitation - Void Manticore asset_type: Endpoint +atomic_guid: + - 43819286-91a9-4369-90ed-d31fb4da2c01 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index 975c102a407..a7052b3dca7 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -2,7 +2,7 @@ name: Detect Credential Dumping through LSASS access id: 2c365e57-4414-4540-8dc0-73ab10729996 version: 16 creation_date: '2019-12-11' -modification_date: '2026-09-08' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -49,6 +49,7 @@ known_false_positives: The activity may be legitimate. Other tools can access ls references: - https://www.microsoft.com/en-us/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks/ - https://attack.mitre.org/techniques/T1003/001/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" and "$TargetImage$" search: '%original_detection_search% | search dest = "$dest$" TargetImage = "$TargetImage$"' @@ -75,6 +76,8 @@ analytic_story: - Lokibot - Scattered Lapsus$ Hunters asset_type: Windows +atomic_guid: + - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index b12bf89d2b9..5cd4424c36d 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -2,7 +2,7 @@ name: Detect HTML Help URL in Command Line id: 8c5835b9-39d9-438b-817c-95f14c69a31e version: 17 creation_date: '2021-02-11' -modification_date: '2026-07-14' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -35,6 +35,7 @@ references: - https://blog.sevagas.com/?Hacking-around-HTA-files - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.001/T1218.001.yaml#L30 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -68,6 +69,8 @@ analytic_story: - Compromised Windows Host - Cisco Network Visibility Module Analytics asset_type: Endpoint +atomic_guid: + - 0f8af516-9818-4172-922b-42986ef1e81d mitre_attack_id: - T1218.001 product: diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml index 246aba48a5f..874d1399a09 100644 --- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml @@ -2,7 +2,7 @@ name: Detect HTML Help Using InfoTech Storage Handlers id: 0b2eefa5-5508-450d-b970-3dd2fb761aec version: 15 creation_date: '2021-02-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -34,6 +34,7 @@ references: - https://lolbas-project.github.io/lolbas/Binaries/Hh/ - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.001/T1218.001.yaml#L121 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -64,6 +65,8 @@ analytic_story: - Compromised Windows Host - APT37 Rustonotto and FadeStealer asset_type: Endpoint +atomic_guid: + - 4f83adda-f5ec-406d-b318-9773c9ca92e5 mitre_attack_id: - T1218.001 product: diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml index 444545ff5eb..bac8267504f 100644 --- a/detections/endpoint/detect_mshta_inline_hta_execution.yml +++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml @@ -2,7 +2,7 @@ name: Detect mshta inline hta execution id: a0873b32-5b68-11eb-ae93-0242ac130002 version: 22 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Michael Haag, Splunk status: production type: TTP @@ -36,6 +36,9 @@ references: - https://github.com/redcanaryco/AtomicTestHarnesses - https://redcanary.com/blog/introducing-atomictestharnesses/ - https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L20 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L216 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -71,6 +74,10 @@ analytic_story: - APT37 Rustonotto and FadeStealer - BlankGrabber Stealer asset_type: Endpoint +atomic_guid: + - 1483fab9-4f52-4217-a9ce-daa9d7747cae + - 906865c3-e05f-4acc-85c4-fbc185455095 + - 8707a805-2b76-4f32-b1c0-14e558205772 mitre_attack_id: - T1218.005 product: diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index a38dbcb9880..e2e33938374 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -2,7 +2,7 @@ name: Detect MSHTA Url in Command Line id: 9b3af1e6-5b68-11eb-ae93-0242ac130002 version: 21 creation_date: '2020-04-29' -modification_date: '2026-07-20' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -36,6 +36,7 @@ references: - https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing - https://denwp.com/dissecting-lumma-malware/ - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/behind-the-captcha-a-clever-gateway-of-malware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L32 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -73,6 +74,8 @@ analytic_story: - NetSupport RMM Tool Abuse - Starland RAT Campaign asset_type: Endpoint +atomic_guid: + - c4b97eeb-5249-4455-a607-59f95485cb45 mitre_attack_id: - T1218.005 product: diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index 10c569305e2..f3230cf3a92 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -2,7 +2,7 @@ name: Detect New Local Admin account id: b25f6f62-0712-43c1-b203-083231ffd97d version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -36,7 +36,8 @@ search: | | `detect_new_local_admin_account_filter` how_to_implement: You must be ingesting Windows event logs using the Splunk Windows TA and collecting event code 4720 and 4732 known_false_positives: The activity may be legitimate. For this reason, it's best to verify the account with an administrator and ask whether there was a valid service request for the account creation. If your local administrator group name is not "Administrators", this search may generate an excessive number of false positives -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L156 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -65,6 +66,8 @@ analytic_story: - CISA AA24-241A - Scattered Lapsus$ Hunters asset_type: Windows +atomic_guid: + - fda74566-a604-4581-a4cc-fbbe21d66559 mitre_attack_id: - T1136.001 product: diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml index 3c269270f41..0e9292cc278 100644 --- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml @@ -2,7 +2,7 @@ name: Detect Path Interception By Creation Of program exe id: cbef820c-e1ff-407f-887f-0a9240a2d477 version: 18 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -16,6 +16,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1574.009/T1574.009.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -46,6 +47,8 @@ analytic_story: - Windows Persistence Techniques - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 2770dea7-c50f-457b-84c4-c40a47460d9f mitre_attack_id: - T1574.009 product: diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index cdc2f6698e5..847e1b446b6 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -2,7 +2,7 @@ name: Detect PsExec With accepteula Flag id: 27c3a83d-cada-47c6-9042-67baf19d2574 version: 19 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Splunk status: production type: TTP @@ -34,6 +34,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators can leverage PsExec for accessing remote systems and might pass `accepteula` as an argument if they are running this tool for the first time. However, it is not likely that you'd see multiple occurrences of this event on a machine references: - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1021.002/T1021.002.yaml#L55 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -79,6 +80,8 @@ analytic_story: - VanHelsing Ransomware - Storm-0501 Ransomware asset_type: Endpoint +atomic_guid: + - 0eb03d41-79e4-4393-8e57-6344856be1cf mitre_attack_id: - T1021.002 product: diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index d6c5a7d777b..6c4e565d054 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -2,7 +2,7 @@ name: Detect Regsvr32 Application Control Bypass id: 070e9b80-6252-11eb-ae93-0242ac130002 version: 15 creation_date: '2021-01-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/ - https://support.microsoft.com/en-us/topic/how-to-use-the-regsvr32-tool-and-troubleshoot-regsvr32-error-messages-a98d960a-7392-e6fe-d90a-3f4e0cb543e5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.010/T1218.010.yaml#L38 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -67,6 +68,8 @@ analytic_story: - BlackByte Ransomware - PHP-CGI RCE Attack on Japanese Organizations asset_type: Endpoint +atomic_guid: + - c9d0c4ef-8a96-4794-a75b-3d3a5e6f2a36 mitre_attack_id: - T1218.010 product: diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml index b80e1ec8b9d..b579e35a226 100644 --- a/detections/endpoint/detect_remote_access_software_usage_process.yml +++ b/detections/endpoint/detect_remote_access_software_usage_process.yml @@ -2,7 +2,7 @@ name: Detect Remote Access Software Usage Process id: ffd5e001-2e34-48f4-97a2-26dc4bb08178 version: 18 creation_date: '2024-03-06' -modification_date: '2026-09-22' +modification_date: '2026-10-09' author: Steven Dick, Sebastian Wurl, Splunk Community status: production type: Anomaly @@ -34,6 +34,17 @@ references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L95 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L222 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L250 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L287 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L314 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L342 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L371 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L452 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L483 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L509 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -77,6 +88,18 @@ analytic_story: - Scattered Lapsus$ Hunters - Storm-0501 Ransomware asset_type: Endpoint +atomic_guid: + - 8ca3b96d-8983-4a7f-b125-fc98cc0a2aa0 + - d03683ec-aae0-42f9-9b4c-534780e0f8e1 + - 0ae9e327-3251-465a-a53b-485d4e3f58fa + - fbff3f1f-b0bf-448e-840f-7e1687affdce + - ecca999b-e0c8-40e8-8416-ad320b146a75 + - 19acf63b-55c4-4b6a-8552-00a8865105c8 + - 42e51815-a6cc-4c75-b970-3f0ff54b610e + - b1b8128b-c5d4-4de9-bf70-e60419274562 + - b025c580-029e-4023-888d-a42710d76934 + - 3e1858ee-3550-401c-86ec-5e70ed79295b + - 1aea6d15-70f1-4b4e-8b02-397b5d5ffe75 mitre_attack_id: - T1219 product: diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml index 55da551a7bb..84014e941a4 100644 --- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml @@ -2,7 +2,7 @@ name: Detect Rundll32 Inline HTA Execution id: 91c79f14-5b41-11eb-ae93-0242ac130002 version: 14 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,8 @@ references: - https://github.com/redcanaryco/AtomicTestHarnesses - https://redcanary.com/blog/introducing-atomictestharnesses/ - https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L25 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L42 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -54,6 +56,9 @@ analytic_story: - Living Off The Land - APT37 Rustonotto and FadeStealer asset_type: Endpoint +atomic_guid: + - 638730e7-7aed-43dc-bf8c-8117f805f5bb + - 32d1cf1b-cbc2-4c09-8d05-07ec5c83a821 mitre_attack_id: - T1218.005 product: diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml index 63bdf218366..29bf8194068 100644 --- a/detections/endpoint/detect_sharphound_command_line_arguments.yml +++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml @@ -2,7 +2,7 @@ name: Detect SharpHound Command-Line Arguments id: a0bdd2f6-c2ff-11eb-b918-acde48001122 version: 12 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ references: - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors - https://github.com/BloodHoundAD/SharpHound3 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1059.001/T1059.001.yaml#L36 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -53,6 +54,8 @@ analytic_story: - Ransomware - BlackSuit Ransomware asset_type: Endpoint +atomic_guid: + - a21bb23e-e677-4ee7-af90-6931b57b6350 mitre_attack_id: - T1069.001 - T1069.002 diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml index 37561415c35..30c27dcd9d3 100644 --- a/detections/endpoint/detect_sharphound_file_modifications.yml +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -2,7 +2,7 @@ name: Detect SharpHound File Modifications id: 42b4b438-beed-11eb-ba1d-acde48001122 version: 13 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -29,6 +29,7 @@ references: - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors - https://github.com/BloodHoundAD/SharpHound3 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1059.001/T1059.001.yaml#L36 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -55,6 +56,8 @@ analytic_story: - Ransomware - BlackSuit Ransomware asset_type: Endpoint +atomic_guid: + - a21bb23e-e677-4ee7-af90-6931b57b6350 mitre_attack_id: - T1069.001 - T1069.002 diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml index ae3e4b97b96..db38a68f5dd 100644 --- a/detections/endpoint/detect_sharphound_usage.yml +++ b/detections/endpoint/detect_sharphound_usage.yml @@ -2,7 +2,7 @@ name: Detect SharpHound Usage id: dd04b29a-beed-11eb-87bc-acde48001122 version: 13 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -37,6 +37,7 @@ references: - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors - https://github.com/BloodHoundAD/SharpHound3 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1059.001/T1059.001.yaml#L36 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -56,6 +57,8 @@ analytic_story: - Windows Discovery Techniques - Ransomware asset_type: Endpoint +atomic_guid: + - a21bb23e-e677-4ee7-af90-6931b57b6350 mitre_attack_id: - T1069.001 - T1069.002 diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index 1e8c89f64a5..0f2a1fc0a0a 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -2,7 +2,7 @@ name: Disable ETW Through Registry id: f0eacfa4-d33f-11eb-8f9d-acde48001122 version: 15 creation_date: '2021-06-23' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: network operator may disable this feature of windows but not so common. references: - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1571 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1581 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +36,9 @@ analytic_story: - CISA AA23-347A - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 8a4c33be-a0d3-434a-bee6-315405edbd5b + - 19c07a45-452d-4620-90ed-4c34fffbe758 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml index 67810100423..88c0511f904 100644 --- a/detections/endpoint/disable_logs_using_wevtutil.yml +++ b/detections/endpoint/disable_logs_using_wevtutil.yml @@ -2,7 +2,7 @@ name: Disable Logs Using WevtUtil id: 236e7c8e-c9d9-11eb-a824-acde48001122 version: 14 creation_date: '2021-06-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -33,6 +33,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: network operator may disable audit event logs for debugging purposes. references: - https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L105 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -53,6 +54,8 @@ analytic_story: - CISA AA23-347A - Rhysida Ransomware asset_type: Endpoint +atomic_guid: + - b26a3340-dad7-4360-9176-706269c74103 mitre_attack_id: - T1685.005 product: diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 95c6027ece7..29007d8b5cd 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -2,7 +2,7 @@ name: Disable Registry Tool id: cd2cf33c-9201-11eb-a10a-acde48001122 version: 17 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: admin may disable this application for non technical user. references: - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L174 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Windows Registry Abuse - NjRAT asset_type: Endpoint +atomic_guid: + - ac34b0f7-0f85-4ac0-b93e-3ced2bc69bb8 mitre_attack_id: - T1112 - T1685 diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index f01e4f92e98..d08ed0971c1 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -2,7 +2,7 @@ name: Disable Windows Behavior Monitoring id: 79439cae-9200-11eb-a4d3-acde48001122 version: 24 creation_date: '2021-03-31' -modification_date: '2026-06-08' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -31,6 +31,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: admin or user may choose to disable this windows features. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1051 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -63,6 +64,8 @@ analytic_story: - BlankGrabber Stealer - Salat Stealer asset_type: Endpoint +atomic_guid: + - a72cfef8-d252-48b3-b292-635d332625c3 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index ca614ff9528..947161c2e43 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -2,7 +2,7 @@ name: Disabling CMD Application id: ff86077c-9212-11eb-a1e6-acde48001122 version: 17 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: admin may disable this application for non technical user. references: - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L188 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -40,6 +41,8 @@ analytic_story: - Windows Registry Abuse - NjRAT asset_type: Endpoint +atomic_guid: + - d2561a6d-72bd-408c-b150-13efe1801c2a mitre_attack_id: - T1112 - T1685 diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index 3e4d52301ee..3332cbc903e 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -2,7 +2,7 @@ name: Disabling Remote User Account Control id: bbc644bc-37df-4e1a-9c88-ec9a53e2038c version: 14 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Patrick Bareiss, Splunk status: production type: TTP @@ -12,7 +12,8 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA* Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `disabling_remote_user_account_control_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. known_false_positives: This registry key may be modified via administrators to implement a change in system policy. This type of change should be a very rare occurrence. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1548.002/T1548.002.yaml#L151 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -42,6 +43,8 @@ analytic_story: - Azorult - AgentTesla asset_type: Endpoint +atomic_guid: + - 9e8af564-53ec-407e-aaa8-3cb20c3af7f9 mitre_attack_id: - T1548.002 product: diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 1d00844d939..3a75b8fc099 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -2,7 +2,7 @@ name: Disabling SystemRestore In Registry id: f4f837e2-91fb-11eb-8bf6-acde48001122 version: 15 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: in some cases admin can disable systemrestore on a machine. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L132 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -40,6 +41,8 @@ analytic_story: - Windows Registry Abuse - NjRAT asset_type: Endpoint +atomic_guid: + - 66e647d1-8741-4e43-b7c1-334760c2047f mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml index 1a3b7b14d24..4913e9b7abd 100644 --- a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml +++ b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml @@ -2,7 +2,7 @@ name: Domain Group Discovery with Adsisearcher id: 089c862f-5f83-49b5-b1c8-7e4ff66560c7 version: 14 creation_date: '2021-08-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -26,6 +26,7 @@ known_false_positives: Administrators or power users may use Adsisearcher for tr references: - https://attack.mitre.org/techniques/T1069/002/ - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L150 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +46,8 @@ analytic_story: - Scattered Lapsus$ Hunters - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 9f4e344b-8434-41b3-85b1-d38f29d148d0 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml index 0897dbdc89a..12add244b61 100644 --- a/detections/endpoint/dsquery_domain_discovery.yml +++ b/detections/endpoint/dsquery_domain_discovery.yml @@ -2,7 +2,7 @@ name: DSQuery Domain Discovery id: cc316032-924a-11eb-91a2-acde48001122 version: 13 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://blog.harmj0y.net/redteaming/a-guide-to-attacking-domain-trusts/ - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11) - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc754232(v=ws.11) + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +64,8 @@ analytic_story: - Domain Trust Discovery - Compromised Windows Host asset_type: Endpoint +atomic_guid: + - 4700a710-c821-4e17-a3ec-9e4c81d6845f mitre_attack_id: - T1482 product: diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index e5bad39bcfd..ce62844c17e 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -2,7 +2,7 @@ name: Dump LSASS via comsvcs DLL id: 8943b567-f14d-4ee8-a0bb-2121d4ce3184 version: 17 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Patrick Bareiss, Splunk status: production type: TTP @@ -31,6 +31,7 @@ references: - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/ - https://twitter.com/SBousseaden/status/1167417096374050817 - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L45 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -73,6 +74,8 @@ analytic_story: - Scattered Lapsus$ Hunters - Hellcat Ransomware asset_type: Endpoint +atomic_guid: + - 2536dee2-12fb-459a-8c37-971844fa73be mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index c02b721f037..f83b777679a 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -2,7 +2,7 @@ name: Dump LSASS via procdump id: 3742ebfe-64c2-11eb-ae93-0242ac130002 version: 20 creation_date: '2021-02-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -76,6 +76,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - https://x.com/wietze/status/1958302556033065292?s=12 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -110,6 +111,8 @@ analytic_story: - Seashell Blizzard - Storm-2460 CLFS Zero Day Exploitation asset_type: Endpoint +atomic_guid: + - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index e207d4573fd..e2c065432ac 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -2,7 +2,7 @@ name: Enable WDigest UseLogonCredential Registry id: 0c7d8ffe-25b1-11ec-9f39-acde48001122 version: 16 creation_date: '2021-10-05' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: No false positives have been identified at this time. references: - https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L39 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L54 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -40,6 +42,9 @@ analytic_story: - Windows Registry Abuse - CISA AA22-320A asset_type: Endpoint +atomic_guid: + - c0413fb5-33e2-40b7-9b6f-60b29f4a7a18 + - 68254a85-aa42-4312-a695-38b7276307f8 mitre_attack_id: - T1112 - T1003 diff --git a/detections/endpoint/esentutl_sam_copy.yml b/detections/endpoint/esentutl_sam_copy.yml index bff789bd1fa..508a661ec4e 100644 --- a/detections/endpoint/esentutl_sam_copy.yml +++ b/detections/endpoint/esentutl_sam_copy.yml @@ -2,7 +2,7 @@ name: Esentutl SAM Copy id: d372f928-ce4f-11eb-a762-acde48001122 version: 10 creation_date: '2021-08-18' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -31,10 +31,13 @@ known_false_positives: False positives should be limited. Filter as needed. references: - https://github.com/redcanaryco/atomic-red-team/blob/6a570c2a4630cf0c2bd41a2e8375b5d5ab92f700/atomics/T1003.002/T1003.002.md - https://attack.mitre.org/software/S0404/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.002/T1003.002.yaml#L66 analytic_story: - Credential Dumping - Living Off The Land asset_type: Endpoint +atomic_guid: + - a90c2f4d-6726-444e-99d2-a00cd7c20480 mitre_attack_id: - T1003.002 product: diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 9238e5d7fff..277d02f4520 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -2,7 +2,7 @@ name: Eventvwr UAC Bypass id: 9cf8fe08-7ad8-11eb-9819-acde48001122 version: 13 creation_date: '2021-03-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Steven Dick, Michael Haag, Splunk status: production type: TTP @@ -17,6 +17,8 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md - https://attack.mitre.org/techniques/T1548/002/ - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1548.002/T1548.002.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1548.002/T1548.002.yaml#L24 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -45,6 +47,9 @@ analytic_story: - Windows Registry Abuse - ValleyRAT asset_type: Endpoint +atomic_guid: + - 5073adf8-9a50-4bd9-b298-a9bd2ead8af9 + - a6ce9acf-842a-4af6-8f79-539be7608e2b mitre_attack_id: - T1548.002 product: diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml index 6faaff19d7d..f42622c18f9 100644 --- a/detections/endpoint/fodhelper_uac_bypass.yml +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -2,7 +2,7 @@ name: FodHelper UAC Bypass id: 909f8fd8-7ac8-11eb-a1f3-acde48001122 version: 15 creation_date: '2021-03-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,8 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md - https://github.com/gushmazuko/WinBypass/blob/master/FodhelperBypass.ps1 - https://attack.mitre.org/techniques/T1548/002/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1548.002/T1548.002.yaml#L44 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1548.002/T1548.002.yaml#L64 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +65,9 @@ analytic_story: - Windows Defense Evasion Tactics - BlankGrabber Stealer asset_type: Endpoint +atomic_guid: + - 58f641ea-12e3-499a-b684-44dee46bd182 + - 3f627297-6c38-4e7d-a278-fc2563eaaeaa mitre_attack_id: - T1112 - T1548.002 diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml index 35e8d5cd718..94aabd68e79 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml @@ -2,7 +2,7 @@ name: Get ADDefaultDomainPasswordPolicy with Powershell id: 36e46ebe-065a-11ec-b4c7-acde48001122 version: 10 creation_date: '2021-08-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -49,9 +49,12 @@ references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet - https://attack.mitre.org/techniques/T1201/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1201/T1201.yaml#L110 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - b2698b33-984c-4a1c-93bb-e4ba72a0babb mitre_attack_id: - T1201 product: diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml index bb2744dac84..0fd84d5b523 100644 --- a/detections/endpoint/get_aduser_with_powershell.yml +++ b/detections/endpoint/get_aduser_with_powershell.yml @@ -2,7 +2,7 @@ name: Get ADUser with PowerShell id: 0b6ee3f4-04e3-11ec-a87d-acde48001122 version: 10 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: Hunting @@ -36,10 +36,13 @@ references: - https://www.blackhillsinfosec.com/red-blue-purple/ - https://attack.mitre.org/techniques/T1087/002/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L17 analytic_story: - Active Directory Discovery - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 8b8a6449-be98-4f42-afd2-dedddc7453b2 mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml index b6c105338ea..7d47e8dcceb 100644 --- a/detections/endpoint/get_aduser_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -2,7 +2,7 @@ name: Get ADUser with PowerShell Script Block id: 21432e40-04f4-11ec-b7e6-acde48001122 version: 10 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: Hunting @@ -27,10 +27,13 @@ references: - https://www.blackhillsinfosec.com/red-blue-purple/ - https://attack.mitre.org/techniques/T1087/002/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L17 analytic_story: - Active Directory Discovery - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 8b8a6449-be98-4f42-afd2-dedddc7453b2 mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml index 19669f89fd2..6a4263494ec 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell.yml @@ -2,7 +2,7 @@ name: Get DomainPolicy with Powershell id: b8f9947e-065a-11ec-aafb-acde48001122 version: 11 creation_date: '2021-08-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: TTP @@ -36,6 +36,7 @@ references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/ - https://attack.mitre.org/techniques/T1201/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1201/T1201.yaml#L99 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +64,8 @@ threat_objects: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 3177f4da-3d4b-4592-8bdc-aa23d0b2e843 mitre_attack_id: - T1201 product: diff --git a/detections/endpoint/get_domaintrust_with_powershell.yml b/detections/endpoint/get_domaintrust_with_powershell.yml index 8276c690bd9..f74ffdc7a44 100644 --- a/detections/endpoint/get_domaintrust_with_powershell.yml +++ b/detections/endpoint/get_domaintrust_with_powershell.yml @@ -2,7 +2,7 @@ name: Get-DomainTrust with PowerShell id: 4fa7f846-054a-11ec-a836-acde48001122 version: 10 creation_date: '2021-09-02' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute. references: - https://blog.harmj0y.net/redteaming/a-guide-to-attacking-domain-trusts/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml#L118 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -53,6 +54,8 @@ intermediate_findings: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - f974894c-5991-4b19-aaf5-7cc2fe298c5d mitre_attack_id: - T1482 product: diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml index a8879480e68..88ec1582dff 100644 --- a/detections/endpoint/get_domainuser_with_powershell.yml +++ b/detections/endpoint/get_domainuser_with_powershell.yml @@ -2,7 +2,7 @@ name: Get DomainUser with PowerShell id: 9a5a41d6-04e7-11ec-923c-acde48001122 version: 12 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: TTP @@ -34,6 +34,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L223 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - Active Directory Discovery - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 93662494-5ed7-4454-a04c-8c8372808ac2 mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/get_foresttrust_with_powershell.yml b/detections/endpoint/get_foresttrust_with_powershell.yml index 41c578874ec..e64ae44fd8a 100644 --- a/detections/endpoint/get_foresttrust_with_powershell.yml +++ b/detections/endpoint/get_foresttrust_with_powershell.yml @@ -2,7 +2,7 @@ name: Get-ForestTrust with PowerShell id: 584f4884-0bf1-11ec-a5ec-acde48001122 version: 10 creation_date: '2021-09-02' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -31,6 +31,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute. references: - https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml#L130 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -55,6 +56,8 @@ intermediate_findings: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 58ed10e8-0738-4651-8408-3a3e9a526279 mitre_attack_id: - T1482 product: diff --git a/detections/endpoint/get_wmiobject_group_discovery.yml b/detections/endpoint/get_wmiobject_group_discovery.yml index dcba3dc093c..4598e7afaac 100644 --- a/detections/endpoint/get_wmiobject_group_discovery.yml +++ b/detections/endpoint/get_wmiobject_group_discovery.yml @@ -2,7 +2,7 @@ name: Get WMIObject Group Discovery id: 5434f670-155d-11ec-8cca-acde48001122 version: 9 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -35,9 +35,12 @@ known_false_positives: False positives may be present. Tune as needed. references: - https://attack.mitre.org/techniques/T1069/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L94 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 69119e58-96db-4110-ad27-954e48f3bb13 mitre_attack_id: - T1069.001 product: diff --git a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml index 3a2cdee9a57..06687a5f053 100644 --- a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml +++ b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml @@ -2,7 +2,7 @@ name: Get WMIObject Group Discovery with Script Block Logging id: 69df7f7c-155d-11ec-a055-acde48001122 version: 11 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -30,9 +30,12 @@ references: - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L94 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 69119e58-96db-4110-ad27-954e48f3bb13 mitre_attack_id: - T1069.001 product: diff --git a/detections/endpoint/getadcomputer_with_powershell_script_block.yml b/detections/endpoint/getadcomputer_with_powershell_script_block.yml index 600cf3dc6da..4c45f3b0557 100644 --- a/detections/endpoint/getadcomputer_with_powershell_script_block.yml +++ b/detections/endpoint/getadcomputer_with_powershell_script_block.yml @@ -2,7 +2,7 @@ name: GetAdComputer with PowerShell Script Block id: a9a1da02-8e27-4bf7-a348-f4389c9da487 version: 11 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -25,12 +25,15 @@ known_false_positives: Administrators or power users may use this PowerShell com references: - https://attack.mitre.org/techniques/T1018/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml#L346 analytic_story: - Active Directory Discovery - CISA AA22-320A - Medusa Ransomware - Gozi Malware asset_type: Endpoint +atomic_guid: + - 97e89d9e-e3f5-41b5-a90f-1e0825df0fdf mitre_attack_id: - T1018 product: diff --git a/detections/endpoint/getadgroup_with_powershell.yml b/detections/endpoint/getadgroup_with_powershell.yml index 997e7928c36..c1bbefd3b0f 100644 --- a/detections/endpoint/getadgroup_with_powershell.yml +++ b/detections/endpoint/getadgroup_with_powershell.yml @@ -2,7 +2,7 @@ name: GetAdGroup with PowerShell id: 872e3063-0fc4-4e68-b2f3-f2b99184a708 version: 9 creation_date: '2021-08-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -33,9 +33,12 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://attack.mitre.org/techniques/T1069/002/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L19 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 6d5d8c96-3d2a-4da9-9d6d-9a9d341899a7 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/getadgroup_with_powershell_script_block.yml b/detections/endpoint/getadgroup_with_powershell_script_block.yml index 42f816782f9..6e962e28926 100644 --- a/detections/endpoint/getadgroup_with_powershell_script_block.yml +++ b/detections/endpoint/getadgroup_with_powershell_script_block.yml @@ -2,7 +2,7 @@ name: GetAdGroup with PowerShell Script Block id: e4c73d68-794b-468d-b4d0-dac1772bbae7 version: 12 creation_date: '2021-08-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -26,10 +26,13 @@ known_false_positives: Administrators or power users may use this PowerShell com references: - https://attack.mitre.org/techniques/T1069/002/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L19 analytic_story: - Scattered Lapsus$ Hunters - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 6d5d8c96-3d2a-4da9-9d6d-9a9d341899a7 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/getcurrent_user_with_powershell.yml b/detections/endpoint/getcurrent_user_with_powershell.yml index 543c998725a..4920d258f43 100644 --- a/detections/endpoint/getcurrent_user_with_powershell.yml +++ b/detections/endpoint/getcurrent_user_with_powershell.yml @@ -2,7 +2,7 @@ name: GetCurrent User with PowerShell id: 7eb9c3d5-c98c-4088-acc5-8240bad15379 version: 8 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -32,9 +32,12 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1033/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L67 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 1392bd0f-5d5a-429e-81d9-eb9d4d4d5b3b mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml index bda0937e98e..a1f4716abcc 100644 --- a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml +++ b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml @@ -2,7 +2,7 @@ name: GetCurrent User with PowerShell Script Block id: 80879283-c30f-44f7-8471-d1381f6d437a version: 10 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -26,9 +26,12 @@ known_false_positives: Administrators or power users may use this PowerShell com references: - https://attack.mitre.org/techniques/T1033/ - https://docs.microsoft.com/en-us/dotnet/api/system.security.principal.windowsidentity.getcurrent?view=net-6.0&viewFallbackFrom=net-5.0 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L55 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - dcb6cdee-1fb0-4087-8bf8-88cfd136ba51 mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/getdomaincontroller_with_powershell.yml b/detections/endpoint/getdomaincontroller_with_powershell.yml index 6d257dfc2b7..47c45c98fcf 100644 --- a/detections/endpoint/getdomaincontroller_with_powershell.yml +++ b/detections/endpoint/getdomaincontroller_with_powershell.yml @@ -2,7 +2,7 @@ name: GetDomainController with PowerShell id: 868ee0e4-52ab-484a-833a-6d85b7c028d0 version: 8 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -33,9 +33,12 @@ known_false_positives: Administrators or power users may use PowerView for troub references: - https://attack.mitre.org/techniques/T1018/ - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml#L372 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - b9d2e8ca-5520-4737-8076-4f08913da2c4 mitre_attack_id: - T1018 product: diff --git a/detections/endpoint/getdomaingroup_with_powershell.yml b/detections/endpoint/getdomaingroup_with_powershell.yml index 538ed03bad9..4a0f23382c7 100644 --- a/detections/endpoint/getdomaingroup_with_powershell.yml +++ b/detections/endpoint/getdomaingroup_with_powershell.yml @@ -2,7 +2,7 @@ name: GetDomainGroup with PowerShell id: 93c94be3-bead-4a60-860f-77ca3fe59903 version: 11 creation_date: '2021-08-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -33,6 +33,7 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://attack.mitre.org/techniques/T1069/002/ - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L200 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -51,6 +52,8 @@ finding: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 5a8a181c-2c8e-478d-a943-549305a01230 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml index 0e920c4bf7d..a02305e9030 100644 --- a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml @@ -2,7 +2,7 @@ name: GetDomainGroup with PowerShell Script Block id: 09725404-a44f-4ed3-9efa-8ed5d69e4c53 version: 13 creation_date: '2021-08-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -26,6 +26,7 @@ known_false_positives: Administrators or power users may use this PowerView func references: - https://attack.mitre.org/techniques/T1069/002/ - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L138 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -44,6 +45,8 @@ finding: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 3d1fcd2a-e51c-4cbe-8d84-9a843bad8dc8 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml index 4401f356384..e5b1606c69e 100644 --- a/detections/endpoint/getlocaluser_with_powershell.yml +++ b/detections/endpoint/getlocaluser_with_powershell.yml @@ -2,7 +2,7 @@ name: GetLocalUser with PowerShell id: 85fae8fa-0427-11ec-8b78-acde48001122 version: 9 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -32,9 +32,12 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting. references: - https://attack.mitre.org/techniques/T1087/001/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.001/T1087.001.yaml#L151 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - ae4b6361-b5f8-46cb-a3f9-9cf108ccfe7b mitre_attack_id: - T1087.001 product: diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml index 484c938c43d..fa061c119e2 100644 --- a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml @@ -2,7 +2,7 @@ name: GetWmiObject Ds Computer with PowerShell id: 7141122c-3bc2-4aaa-ab3b-7a85a0bbefc3 version: 9 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Anomaly @@ -54,6 +54,7 @@ known_false_positives: |- Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1018/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml#L383 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -77,6 +78,8 @@ threat_objects: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - e3cf5123-f6c9-4375-bdf2-1bb3ba43a1ad mitre_attack_id: - T1018 product: diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml index 13d308b0783..b23955db43d 100644 --- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml @@ -2,7 +2,7 @@ name: Hiding Files And Directories With Attrib exe id: 6e5a3ae4-90a3-462d-9aa6-0119f638c0f1 version: 18 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Splunk status: production type: TTP @@ -27,7 +27,8 @@ search: |- | `hiding_files_and_directories_with_attrib_exe_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Some applications and users may legitimately use attrib.exe to interact with the files. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1222.001/T1222.001.yaml#L90 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -58,6 +59,8 @@ analytic_story: - Crypto Stealer - VIP Keylogger asset_type: Endpoint +atomic_guid: + - 32b979da-7b68-42c9-9a99-0e39900fc36c mitre_attack_id: - T1222.001 product: diff --git a/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml index a2989a0e6a4..c0a9f61513f 100644 --- a/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml @@ -2,7 +2,7 @@ name: Impacket Lateral Movement WMIExec Commandline Parameters id: d6e464e4-5c6a-474e-82d2-aed616a3a492 version: 12 creation_date: '2021-11-19' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -24,6 +24,7 @@ references: - https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L238 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -52,6 +53,8 @@ analytic_story: - CISA AA22-277A - Storm-0501 Ransomware asset_type: Endpoint +atomic_guid: + - a3ddaf15-d1a1-4bc3-8683-84c7c67120fe mitre_attack_id: - T1021.002 - T1021.003 diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml index a986cf92e75..59273ca788e 100644 --- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml +++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml @@ -2,7 +2,7 @@ name: Kerberoasting spn request with RC4 encryption id: 5cc67381-44fa-4111-8a37-7a230943f027 version: 15 creation_date: '2020-06-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Jose Hernandez, Patrick Bareiss, Mauricio Velazco, Dean Luxton, Splunk status: production type: TTP @@ -23,6 +23,8 @@ known_false_positives: Older systems that support kerberos RC4 by default like N references: - https://github.com/redcanaryco/atomic-red-team/blob/4e3e9c8096dde00639a6b98845ec349135554ed5/atomics/T1208/T1208.md - https://www.hub.trimarcsecurity.com/post/trimarc-research-detecting-kerberoasting-activity + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1558.003/T1558.003.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1558.003/T1558.003.yaml#L30 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +47,9 @@ analytic_story: - Compromised Windows Host - Hermetic Wiper asset_type: Endpoint +atomic_guid: + - 3f987809-3681-43c8-bcd8-b3ff3a28533a + - 14625569-6def-4497-99ac-8e7817105b55 mitre_attack_id: - T1558.003 product: diff --git a/detections/endpoint/linux_add_user_account.yml b/detections/endpoint/linux_add_user_account.yml index 5dde70f3539..c15a28e179e 100644 --- a/detections/endpoint/linux_add_user_account.yml +++ b/detections/endpoint/linux_add_user_account.yml @@ -2,7 +2,7 @@ name: Linux Add User Account id: 51fbcaf2-6259-11ec-b0f3-acde48001122 version: 10 creation_date: '2022-01-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Bhavin Patel, Splunk status: production type: Hunting @@ -30,11 +30,14 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L5 analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques - Cisco Isovalent Suspicious Activity asset_type: Endpoint +atomic_guid: + - 40d8eabd-e394-46f6-8785-b9bfa1d011d2 mitre_attack_id: - T1136.001 product: diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml index a1d7ffa6500..0311793793b 100644 --- a/detections/endpoint/linux_at_application_execution.yml +++ b/detections/endpoint/linux_at_application_execution.yml @@ -2,7 +2,7 @@ name: Linux At Application Execution id: bf0a378e-5f3c-11ec-a6de-acde48001122 version: 13 creation_date: '2021-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Bhavin Patel, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ known_false_positives: Administrator or network operator can use this applicatio references: - https://attack.mitre.org/techniques/T1053/001/ - https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1053.002/T1053.002.yaml#L20 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -53,7 +54,7 @@ analytic_story: - Cisco Isovalent Suspicious Activity asset_type: Endpoint atomic_guid: - - 9ddf2e5e-7e2c-46c2-9940-3c2ff29c7213 + - 7266d898-ac82-4ec0-97c7-436075d0d08e mitre_attack_id: - T1053.002 product: diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml index 9824c54cf7f..cd965ede127 100644 --- a/detections/endpoint/linux_auditd_add_user_account.yml +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -2,7 +2,7 @@ name: Linux Auditd Add User Account id: aae66dc0-74b4-4807-b480-b35f8027abb4 version: 10 creation_date: '2022-01-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -21,6 +21,7 @@ how_to_implement: To implement this detection, the process begins by ingesting a known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -41,6 +42,8 @@ analytic_story: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - 40d8eabd-e394-46f6-8785-b9bfa1d011d2 mitre_attack_id: - T1136.001 product: diff --git a/detections/endpoint/linux_auditd_clipboard_data_copy.yml b/detections/endpoint/linux_auditd_clipboard_data_copy.yml index bb9a48d432c..79d77ca293a 100644 --- a/detections/endpoint/linux_auditd_clipboard_data_copy.yml +++ b/detections/endpoint/linux_auditd_clipboard_data_copy.yml @@ -2,7 +2,7 @@ name: Linux Auditd Clipboard Data Copy id: 9ddfe470-c4d0-4e60-8668-7337bd699edd version: 9 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -24,6 +24,7 @@ known_false_positives: False positives may be present on Linux desktop as it may references: - https://attack.mitre.org/techniques/T1115/ - https://linux.die.net/man/1/xclip + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1115/T1115.yaml#L73 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -43,6 +44,8 @@ analytic_story: - Linux Living Off The Land - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - ee363e53-b083-4230-aff3-f8d955f2d5bb mitre_attack_id: - T1115 product: diff --git a/detections/endpoint/linux_auditd_dd_file_overwrite.yml b/detections/endpoint/linux_auditd_dd_file_overwrite.yml index dae8597a7a5..068bfe8ecad 100644 --- a/detections/endpoint/linux_auditd_dd_file_overwrite.yml +++ b/detections/endpoint/linux_auditd_dd_file_overwrite.yml @@ -2,7 +2,7 @@ name: Linux Auditd Dd File Overwrite id: d1b74420-4cea-4752-a123-9b40dfcca49a version: 9 creation_date: '2024-08-09' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -22,6 +22,7 @@ known_false_positives: Administrator or network operator can execute this comman references: - https://gtfobins.github.io/gtfobins/dd/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1485/T1485.yaml#L37 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -42,6 +43,8 @@ analytic_story: - Data Destruction - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - 38deee99-fd65-4031-bec8-bfa4f9f26146 mitre_attack_id: - T1485 product: diff --git a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml index 4047605305d..31443e42291 100644 --- a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml @@ -2,7 +2,7 @@ name: Linux Auditd File And Directory Discovery id: 0bbfb79c-a755-49a5-a38a-1128d0a452f1 version: 9 creation_date: '2024-08-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -24,6 +24,7 @@ known_false_positives: Administrator or network operator can use this applicatio references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1083/T1083.yaml#L40 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +46,8 @@ analytic_story: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - ffc8b249-372a-4b74-adcd-e4c0430842de mitre_attack_id: - T1083 product: diff --git a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml index c6646ed32d3..d47d541e842 100644 --- a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml @@ -2,7 +2,7 @@ name: Linux Auditd Insert Kernel Module Using Insmod Utility id: bc0ca53f-dea6-4906-9b12-09c396fdf1d3 version: 11 creation_date: '2024-08-09' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -25,6 +25,7 @@ references: - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ - https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup - https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.006/T1547.006.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint +atomic_guid: + - 687dcb93-9656-4853-9c36-9977315e9d23 mitre_attack_id: - T1547.006 product: diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index 576808b5d50..03d5a7c4cae 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -2,7 +2,7 @@ name: Linux Auditd Possible Access To Credential Files id: 0419cb7a-57ea-467b-974f-77c303dfe2a3 version: 13 creation_date: '2024-08-19' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: Administrator or network operator can execute this comman references: - https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd - https://attack.mitre.org/techniques/T1003/008/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.008/T1003.008.yaml#L61 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -38,6 +39,8 @@ analytic_story: - Linux Privilege Escalation - Axios Supply Chain Post Compromise asset_type: Endpoint +atomic_guid: + - df1a55ae-019d-4120-bc35-94f4bc5c4b0a mitre_attack_id: - T1003.008 product: diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml index 93512a389ed..096dc9401e6 100644 --- a/detections/endpoint/linux_auditd_stop_services.yml +++ b/detections/endpoint/linux_auditd_stop_services.yml @@ -2,7 +2,7 @@ name: Linux Auditd Stop Services id: 43bc9281-753b-4743-b4b7-60af84f085f3 version: 9 creation_date: '2024-08-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -23,6 +23,7 @@ known_false_positives: Administrator or network operator can use this applicatio references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - https://cert.gov.ua/article/39518 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml#L63 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -38,6 +39,8 @@ analytic_story: - AwfulShred - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - 42e3a5bd-1e45-427f-aa08-2a65fa29a820 mitre_attack_id: - T1489 product: diff --git a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml index d0c23eb7f1a..0935ded19f5 100644 --- a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml +++ b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml @@ -2,7 +2,7 @@ name: Linux Auditd System Network Configuration Discovery id: 5db16825-81bd-4923-a8d6-d6a13a59832a version: 9 creation_date: '2024-08-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -23,6 +23,7 @@ how_to_implement: To implement this detection, the process begins by ingesting a known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1016/T1016.yaml#L33 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -44,6 +45,8 @@ analytic_story: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - c141bbdb-7fca-4254-9fd6-f47e79447e17 mitre_attack_id: - T1016 product: diff --git a/detections/endpoint/linux_auditd_whoami_user_discovery.yml b/detections/endpoint/linux_auditd_whoami_user_discovery.yml index 7fa8e37fef1..99c021d2f88 100644 --- a/detections/endpoint/linux_auditd_whoami_user_discovery.yml +++ b/detections/endpoint/linux_auditd_whoami_user_discovery.yml @@ -2,7 +2,7 @@ name: Linux Auditd Whoami User Discovery id: d1ff2e22-310d-446a-80b3-faedaa7b3b52 version: 9 creation_date: '2024-08-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -24,6 +24,7 @@ known_false_positives: Administrator or network operator can use this applicatio references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L131 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -46,6 +47,8 @@ analytic_story: - Compromised Linux Host - QuietVault asset_type: Endpoint +atomic_guid: + - aab580c7-cc30-4a7c-b5a9-46a29066b022 mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/linux_clipboard_data_copy.yml b/detections/endpoint/linux_clipboard_data_copy.yml index 9aa385a01a7..ff3d0c76b84 100644 --- a/detections/endpoint/linux_clipboard_data_copy.yml +++ b/detections/endpoint/linux_clipboard_data_copy.yml @@ -2,7 +2,7 @@ name: Linux Clipboard Data Copy id: 7173b2ad-6146-418f-85ae-c3479e4515fc version: 11 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -28,6 +28,7 @@ known_false_positives: False positives may be present on Linux desktop as it may references: - https://attack.mitre.org/techniques/T1115/ - https://linux.die.net/man/1/xclip + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1115/T1115.yaml#L73 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -53,6 +54,8 @@ threat_objects: analytic_story: - Linux Living Off The Land asset_type: Endpoint +atomic_guid: + - ee363e53-b083-4230-aff3-f8d955f2d5bb mitre_attack_id: - T1115 product: diff --git a/detections/endpoint/linux_curl_upload_file.yml b/detections/endpoint/linux_curl_upload_file.yml index 5421e5f8f4e..52c42cdbf09 100644 --- a/detections/endpoint/linux_curl_upload_file.yml +++ b/detections/endpoint/linux_curl_upload_file.yml @@ -2,7 +2,7 @@ name: Linux Curl Upload File id: c1de2d9a-0c02-4bb4-a49a-510c6e9cf2bf version: 13 creation_date: '2022-07-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://curl.se/docs/manpage.html - https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/ - https://gtfobins.github.io/gtfobins/curl/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L501 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - Ingress Tool Transfer - NPM Supply Chain Compromise asset_type: Endpoint +atomic_guid: + - 635c9a38-6cbf-47dc-8615-3810bc1167cf mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/linux_dd_file_overwrite.yml b/detections/endpoint/linux_dd_file_overwrite.yml index db17611ba4d..3db2e4903f9 100644 --- a/detections/endpoint/linux_dd_file_overwrite.yml +++ b/detections/endpoint/linux_dd_file_overwrite.yml @@ -2,7 +2,7 @@ name: Linux DD File Overwrite id: 9b6aae5e-8d85-11ec-b2ae-acde48001122 version: 10 creation_date: '2022-02-15' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: Administrator or network operator can execute this comman references: - https://gtfobins.github.io/gtfobins/dd/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1485/T1485.yaml#L37 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -49,6 +50,8 @@ analytic_story: - Data Destruction - Industroyer2 asset_type: Endpoint +atomic_guid: + - 38deee99-fd65-4031-bec8-bfa4f9f26146 mitre_attack_id: - T1485 product: diff --git a/detections/endpoint/linux_decode_base64_to_shell.yml b/detections/endpoint/linux_decode_base64_to_shell.yml index e3e800b6581..500697152f3 100644 --- a/detections/endpoint/linux_decode_base64_to_shell.yml +++ b/detections/endpoint/linux_decode_base64_to_shell.yml @@ -2,7 +2,7 @@ name: Linux Decode Base64 to Shell id: 637b603e-1799-40fd-bf87-47ecbd551b66 version: 14 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md#atomic-test-1---decode-base64-data-into-script - https://redcanary.com/blog/lateral-movement-with-secure-shell/ - https://linux.die.net/man/1/base64 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml#L240 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +64,8 @@ analytic_story: - Linux Living Off The Land - Cisco Isovalent Suspicious Activity asset_type: Endpoint +atomic_guid: + - 3a15c372-67c1-4430-ac8e-ec06d641ce4d mitre_attack_id: - T1027 - T1059.004 diff --git a/detections/endpoint/linux_docker_root_directory_mount.yml b/detections/endpoint/linux_docker_root_directory_mount.yml index d055ab84d4e..e5e94296a05 100644 --- a/detections/endpoint/linux_docker_root_directory_mount.yml +++ b/detections/endpoint/linux_docker_root_directory_mount.yml @@ -2,7 +2,7 @@ name: Linux Docker Root Directory Mount id: aa049566-f76a-43b9-908c-3c27e079fd43 version: 4 creation_date: '2026-03-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Gowthamaraj Rajendran, Splunk, Emil Elsetrønning status: production type: TTP @@ -41,6 +41,7 @@ known_false_positives: False positives are present based on automated tooling or references: - https://docs.docker.com/engine/storage/volumes/ - https://gtfobins.github.io/gtfobins/docker/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1611/T1611.yaml#L59 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -69,6 +70,8 @@ analytic_story: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint +atomic_guid: + - 6c499943-b098-4bc6-8d38-0956fc182984 mitre_attack_id: - T1611 product: diff --git a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml index fa0e86065ce..c117c573c21 100644 --- a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml +++ b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml @@ -2,7 +2,7 @@ name: Linux Ingress Tool Transfer Hunting id: 52fd468b-cb6d-48f5-b16a-92f1c9bb10cf version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Hunting @@ -34,6 +34,7 @@ references: - https://curl.se/docs/manpage.html#-I - https://gtfobins.github.io/gtfobins/curl/ - https://github.com/rapid7/metasploit-framework/search?q=curl + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L763 analytic_story: - Ingress Tool Transfer - Linux Living Off The Land @@ -41,6 +42,8 @@ analytic_story: - NPM Supply Chain Compromise - Axios Supply Chain Post Compromise asset_type: Endpoint +atomic_guid: + - bdc373c5-e9cf-4563-8a7b-a9ba720a90f3 mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml index b56bae8e7e5..de6be1e2157 100644 --- a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml +++ b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml @@ -2,7 +2,7 @@ name: Linux Ingress Tool Transfer with Curl id: 8c1de57d-abc1-4b41-a727-a7a8fc5e0857 version: 14 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -39,6 +39,7 @@ references: - https://curl.se/docs/manpage.html#-I - https://gtfobins.github.io/gtfobins/curl/ - https://github.com/rapid7/metasploit-framework/search?q=curl + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L763 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -67,6 +68,8 @@ analytic_story: - XorDDos - NPM Supply Chain Compromise asset_type: Endpoint +atomic_guid: + - bdc373c5-e9cf-4563-8a7b-a9ba720a90f3 mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml index 254f4b5f1e1..47e497dcdb3 100644 --- a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml @@ -2,7 +2,7 @@ name: Linux Insert Kernel Module Using Insmod Utility id: 18b5a1a0-6326-11ec-943a-acde48001122 version: 12 creation_date: '2022-01-05' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -31,6 +31,7 @@ references: - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ - https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup - https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.006/T1547.006.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -52,6 +53,8 @@ analytic_story: - Linux Rootkit - Linux Privilege Escalation asset_type: Endpoint +atomic_guid: + - 687dcb93-9656-4853-9c36-9977315e9d23 mitre_attack_id: - T1547.006 product: diff --git a/detections/endpoint/linux_kernel_module_enumeration.yml b/detections/endpoint/linux_kernel_module_enumeration.yml index 0d1d07356f8..87223e336ec 100644 --- a/detections/endpoint/linux_kernel_module_enumeration.yml +++ b/detections/endpoint/linux_kernel_module_enumeration.yml @@ -2,7 +2,7 @@ name: Linux Kernel Module Enumeration id: 6df99886-0e04-4c11-8b88-325747419278 version: 13 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -27,6 +27,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. references: - https://man7.org/linux/man-pages/man8/kmod.8.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml#L357 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -55,6 +56,8 @@ analytic_story: - XorDDos - Linux Rootkit asset_type: Endpoint +atomic_guid: + - 034fe21c-3186-49dd-8d5d-128b35f181c7 mitre_attack_id: - T1082 - T1014 diff --git a/detections/endpoint/linux_magic_sysrq_key_abuse.yml b/detections/endpoint/linux_magic_sysrq_key_abuse.yml index a11c81271a0..72e51baaa80 100644 --- a/detections/endpoint/linux_magic_sysrq_key_abuse.yml +++ b/detections/endpoint/linux_magic_sysrq_key_abuse.yml @@ -2,7 +2,7 @@ name: Linux Magic SysRq Key Abuse id: 22c03600-f84a-47fa-abaa-ffbe3e72c782 version: 5 creation_date: '2025-08-28' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Milad Cheraghi status: production type: TTP @@ -62,6 +62,8 @@ references: - https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel - https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml#L157 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml#L282 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest="$dest$"' @@ -80,6 +82,9 @@ finding: analytic_story: - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - 6e76f56f-2373-4a6c-a63f-98b7b72761f1 + - d2a1f4bc-a064-4223-8281-a086dce5423c mitre_attack_id: - T1059.004 - T1529 diff --git a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml index 57811191502..3d698d7a8c0 100644 --- a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml +++ b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml @@ -2,7 +2,7 @@ name: Linux Obfuscated Files or Information Base64 Decode id: 303b38b2-c03f-44e2-8f41-4594606fcfc7 version: 13 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -29,6 +29,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md#atomic-test-1---decode-base64-data-into-script - https://redcanary.com/blog/lateral-movement-with-secure-shell/ - https://linux.die.net/man/1/base64 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -56,6 +57,8 @@ threat_objects: analytic_story: - Linux Living Off The Land asset_type: Endpoint +atomic_guid: + - f45df6be-2e1e-4136-a384-8f18ab3826fb mitre_attack_id: - T1027 product: diff --git a/detections/endpoint/linux_ssh_authorized_keys_modification.yml b/detections/endpoint/linux_ssh_authorized_keys_modification.yml index ea690990975..3fa6d9e2a51 100644 --- a/detections/endpoint/linux_ssh_authorized_keys_modification.yml +++ b/detections/endpoint/linux_ssh_authorized_keys_modification.yml @@ -2,7 +2,7 @@ name: Linux SSH Authorized Keys Modification id: f5ab595e-28e5-4327-8077-5008ba97c850 version: 14 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -28,6 +28,7 @@ known_false_positives: Filtering will be required as system administrators will references: - https://redcanary.com/blog/lateral-movement-with-secure-shell/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1098.004/T1098.004.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098.004/T1098.004.yaml#L7 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -57,6 +58,8 @@ analytic_story: - Hellcat Ransomware - VoidLink Cloud-Native Linux Malware asset_type: Endpoint +atomic_guid: + - 342cc723-127c-4d3a-8292-9c0c6b4ecadc mitre_attack_id: - T1098.004 product: diff --git a/detections/endpoint/linux_system_network_discovery.yml b/detections/endpoint/linux_system_network_discovery.yml index 5a7f67486d4..f41e115544d 100644 --- a/detections/endpoint/linux_system_network_discovery.yml +++ b/detections/endpoint/linux_system_network_discovery.yml @@ -2,7 +2,7 @@ name: Linux System Network Discovery id: 535cb214-8b47-11ec-a2c7-acde48001122 version: 11 creation_date: '2022-02-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -65,6 +65,7 @@ known_false_positives: |- Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1016/T1016.yaml#L33 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -91,6 +92,8 @@ analytic_story: - Industroyer2 - VoidLink Cloud-Native Linux Malware asset_type: Endpoint +atomic_guid: + - c141bbdb-7fca-4254-9fd6-f47e79447e17 mitre_attack_id: - T1016 product: diff --git a/detections/endpoint/linux_system_reboot_via_system_request_key.yml b/detections/endpoint/linux_system_reboot_via_system_request_key.yml index 9d3f412eb63..fae06269f2f 100644 --- a/detections/endpoint/linux_system_reboot_via_system_request_key.yml +++ b/detections/endpoint/linux_system_reboot_via_system_request_key.yml @@ -2,7 +2,7 @@ name: Linux System Reboot Via System Request Key id: e1912b58-ed9c-422c-bbb0-2dbc70398345 version: 11 creation_date: '2023-02-09' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -28,6 +28,7 @@ references: - https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html - https://cert.gov.ua/article/3718487 - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml#L282 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - AwfulShred - Data Destruction asset_type: Endpoint +atomic_guid: + - d2a1f4bc-a064-4223-8281-a086dce5423c mitre_attack_id: - T1529 product: diff --git a/detections/endpoint/macos_gatekeeper_bypass.yml b/detections/endpoint/macos_gatekeeper_bypass.yml index 79c9774b6e2..2525ad03a2e 100644 --- a/detections/endpoint/macos_gatekeeper_bypass.yml +++ b/detections/endpoint/macos_gatekeeper_bypass.yml @@ -2,7 +2,7 @@ name: MacOS Gatekeeper Bypass id: 2c9346f3-bbeb-48ce-8411-fc13d09d83a5 version: 3 creation_date: '2026-04-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Raven Tait, Splunk status: production type: Anomaly @@ -48,6 +48,7 @@ references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ - https://ss64.com/mac/xattr.html - https://ss64.com/mac/spctl.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1553.001/T1553.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -75,6 +76,8 @@ analytic_story: - MacOS Post-Exploitation - MacOS Persistence Techniques asset_type: Endpoint +atomic_guid: + - fb3d46c6-9480-4803-8d7d-ce676e1f1a9b mitre_attack_id: - T1553.001 product: diff --git a/detections/endpoint/macos_keychains_dumped.yml b/detections/endpoint/macos_keychains_dumped.yml index 2e6aa922738..baa8affa24f 100644 --- a/detections/endpoint/macos_keychains_dumped.yml +++ b/detections/endpoint/macos_keychains_dumped.yml @@ -2,7 +2,7 @@ name: MacOS Keychains Dumped id: dcb45a09-5e6f-441e-b2f8-cbbf923e36d9 version: 4 creation_date: '2026-04-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Raven Tait, Jamie Windley, Splunk status: production type: TTP @@ -70,6 +70,7 @@ references: - https://gist.github.com/hfeeki/88c12f01d00534e09a84 - https://ss64.com/mac/security-keychain-settings.html - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.001/T1555.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1555.001/T1555.001.yaml#L6 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -94,6 +95,8 @@ intermediate_findings: analytic_story: - MacOS Privilege Escalation asset_type: Endpoint +atomic_guid: + - 88e1fa00-bf63-4e5b-a3e1-e2ea51c8cca6 mitre_attack_id: - T1555.001 product: diff --git a/detections/endpoint/macos_list_firewall_rules.yml b/detections/endpoint/macos_list_firewall_rules.yml index 488af3e2302..a09c47f4b16 100644 --- a/detections/endpoint/macos_list_firewall_rules.yml +++ b/detections/endpoint/macos_list_firewall_rules.yml @@ -2,7 +2,7 @@ name: MacOS List Firewall Rules id: f8db6e0b-55bb-40ca-bc85-2b3700adb0f8 version: 2 creation_date: '2026-04-15' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Jamie Windley, Splunk status: production type: Anomaly @@ -52,6 +52,7 @@ known_false_positives: | references: - https://www.manpagez.com/man/8/socketfilterfw/ - https://ss64.com/mac/defaults.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1016/T1016.yaml#L183 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" AND dest = "$dest$"' @@ -81,6 +82,8 @@ threat_objects: analytic_story: - Network Discovery asset_type: Endpoint +atomic_guid: + - ff1d8c25-2aa4-4f18-a425-fede4a41ee88 mitre_attack_id: - T1016 product: diff --git a/detections/endpoint/macos_network_share_discovery.yml b/detections/endpoint/macos_network_share_discovery.yml index e5a07e40a3b..f5a37a09cc2 100644 --- a/detections/endpoint/macos_network_share_discovery.yml +++ b/detections/endpoint/macos_network_share_discovery.yml @@ -2,7 +2,7 @@ name: MacOS Network Share Discovery id: a5f5fe52-8e50-4fb0-ad1b-780be6c0d857 version: 3 creation_date: '2026-04-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Raven Tait, Splunk status: production type: Anomaly @@ -39,6 +39,7 @@ references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ - https://leopard-adc.pepas.com/documentation/Darwin/Reference/ManPages/man8/showmount.8.html - https://www.unix.com/man_page/osx/1/smbutil/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -64,6 +65,8 @@ threat_objects: analytic_story: - MacOS Post-Exploitation asset_type: Endpoint +atomic_guid: + - f94b5ad9-911c-4eff-9718-fd21899db4f7 mitre_attack_id: - T1135 product: diff --git a/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml b/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml index b3a93b80666..983787c0c01 100644 --- a/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml +++ b/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml @@ -2,7 +2,7 @@ name: MacOS Osascript Displaying Suspicious User Prompt id: d565ae18-7db6-460c-a2eb-a7109f18bc5e version: 1 creation_date: '2026-08-03' -modification_date: '2026-08-31' +modification_date: '2026-10-02' author: Radka Viskova, Splunk status: production type: Anomaly @@ -62,6 +62,8 @@ references: - https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/#cq=i1 - https://www.infostealers.com/article/an-infostealers-brewin-cuckoo-atomicstealer-get-creative/ - https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1056.002/T1056.002.yaml#L31 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1056.002/T1056.002.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -83,6 +85,9 @@ threat_objects: analytic_story: - MacOS Privilege Escalation asset_type: Endpoint +atomic_guid: + - b7037b89-947a-427a-ba29-e7e9f09bc045 + - 76628574-0bc1-4646-8fe2-8f4427b47d15 mitre_attack_id: - T1059.002 - T1056.002 diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 4155e06ea08..744d2ba42f5 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -2,7 +2,7 @@ name: Malicious PowerShell Process - Encoded Command id: c4db14d9-7909-48b4-a054-aa14d89dbb19 version: 21 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Michael Haag, Splunk, SirDuckly, GitHub Community status: production type: Hunting @@ -48,6 +48,7 @@ references: - https://twitter.com/M_haggis/status/1440758396534214658?s=20 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml#L39 analytic_story: - SolarWinds WHD RCE Post Exploitation - CISA AA22-320A @@ -67,6 +68,8 @@ analytic_story: - GhostRedirector IIS Module and Rungan Backdoor - Microsoft WSUS CVE-2025-59287 asset_type: Endpoint +atomic_guid: + - a50d5a97-2531-499e-a1de-5544c74432c6 mitre_attack_id: - T1027 product: diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index eddcaed3e3c..59f00a04fa0 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -2,7 +2,7 @@ name: Monitor Registry Keys for Print Monitors id: f5f6af30-7ba7-4295-bfe9-07de87c01bbc version: 15 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk, Steven Dick, Bhavin Patel status: production type: TTP @@ -12,7 +12,8 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `monitor_registry_keys_for_print_monitors_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: You will encounter noise from legitimate print-monitor registry entries. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.010/T1547.010.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ analytic_story: - Windows Persistence Techniques - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - d34ef297-f178-4462-871e-9ce618d44e50 mitre_attack_id: - T1547.010 product: diff --git a/detections/endpoint/network_share_discovery_via_dir_command.yml b/detections/endpoint/network_share_discovery_via_dir_command.yml index bb6f37b475f..6373999c085 100644 --- a/detections/endpoint/network_share_discovery_via_dir_command.yml +++ b/detections/endpoint/network_share_discovery_via_dir_command.yml @@ -2,7 +2,7 @@ name: Network Share Discovery Via Dir Command id: dc1457d0-1d9b-422e-b5a7-db46c184d9aa version: 7 creation_date: '2023-05-23' -modification_date: '2026-08-05' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -51,6 +51,7 @@ references: - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140#table-of-file-access-codes - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml#L166 analytic_story: - IcedID asset_type: Endpoint diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index 4b5982ff643..6424ba14476 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -2,7 +2,7 @@ name: NLTest Domain Trust Discovery id: c3e05466-5f22-11eb-ae93-0242ac130002 version: 14 creation_date: '2021-01-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -40,6 +40,7 @@ references: - https://ss64.com/nt/nltest.html - https://redcanary.com/threat-detection-report/techniques/domain-trust-discovery/ - https://thedfirreport.com/2020/10/08/ryuks-return/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml#L16 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -66,6 +67,8 @@ analytic_story: - Ryuk Ransomware - Storm-0501 Ransomware asset_type: Endpoint +atomic_guid: + - 2e22641d-0498-48d2-b9ff-c71e496ccdbe mitre_attack_id: - T1482 product: diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml index 500aedd2cac..7ebf6578f52 100644 --- a/detections/endpoint/ntdsutil_export_ntds.yml +++ b/detections/endpoint/ntdsutil_export_ntds.yml @@ -2,7 +2,7 @@ name: Ntdsutil Export NTDS id: da63bc76-61ae-11eb-ae93-0242ac130002 version: 12 creation_date: '2021-01-28' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Patrick Bareiss, Splunk status: production type: TTP @@ -35,6 +35,7 @@ references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf - https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L83 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -59,6 +60,8 @@ analytic_story: - Rhysida Ransomware - NetSupport RMM Tool Abuse asset_type: Endpoint +atomic_guid: + - 2364e33d-ceab-4641-8468-bfb1d7cc2723 mitre_attack_id: - T1003.003 product: diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index 7c7e4800678..1cc5ecc0aa7 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -2,7 +2,7 @@ name: Overwriting Accessibility Binaries id: 13c2f6c3-10c5-4deb-9ba1-7c4460ebe4ae version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -12,7 +12,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem where (Filesystem.file_path=*\\Windows\\System32\\sethc.exe* OR Filesystem.file_path=*\\Windows\\System32\\utilman.exe* OR Filesystem.file_path=*\\Windows\\System32\\osk.exe* OR Filesystem.file_path=*\\Windows\\System32\\Magnify.exe* OR Filesystem.file_path=*\\Windows\\System32\\Narrator.exe* OR Filesystem.file_path=*\\Windows\\System32\\DisplaySwitch.exe* OR Filesystem.file_path=*\\Windows\\System32\\AtBroker.exe*) by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `overwriting_accessibility_binaries_filter`' how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. known_false_positives: Microsoft may provide updates to these binaries. Verify that these changes do not correspond with your normal software update cycle. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L50 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L125 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L141 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L157 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L173 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L189 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -37,6 +43,13 @@ analytic_story: - Windows Privilege Escalation - Flax Typhoon asset_type: Endpoint +atomic_guid: + - 934e90cf-29ca-48b3-863c-411737ad44e3 + - 1db380da-3422-481d-a3c8-6d5770dba580 + - 5e4fa70d-c789-470e-85e1-6992b92bb321 + - 2002f5ea-cd13-4c82-bf73-e46722e5dc5e + - 825ba8ca-71cc-436b-b1dd-ea0d5e109086 + - 210be7ea-d841-40ec-b3e1-ff610bb62744 mitre_attack_id: - T1546.008 product: diff --git a/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml index 8a3b89b1145..c5982ee92c5 100644 --- a/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml +++ b/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml @@ -2,7 +2,7 @@ name: Powershell COM Hijacking InprocServer32 Modification id: ea61e291-af05-4716-932a-67faddb6ae6f version: 10 creation_date: '2022-09-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -17,6 +17,7 @@ references: - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.015/T1546.015.yaml#L5 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -35,6 +36,8 @@ finding: analytic_story: - Malicious PowerShell asset_type: Endpoint +atomic_guid: + - 48117158-d7be-441b-bc6a-d9e36e47b52b mitre_attack_id: - T1059.001 - T1546.015 diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index 2c505368865..7f5e5a62b20 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -2,7 +2,7 @@ name: Powershell Disable Security Monitoring id: c148a894-dd93-11eb-bf2a-acde48001122 version: 17 creation_date: '2021-07-05' -modification_date: '2026-06-08' +modification_date: '2026-10-02' author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -92,6 +92,7 @@ known_false_positives: | references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell - https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps + - https://github.com/redcanaryco/atomic-red-team/blob/61080b19460f2c6431c31689d58063c5f6c1f8fb/atomics/T1562.001/T1562.001.yaml#L328 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -114,6 +115,8 @@ analytic_story: - BlankGrabber Stealer - Salat Stealer asset_type: Endpoint +atomic_guid: + - 6b8df440-51ec-4d53-bf83-899591c9b5d7 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/powershell_enable_powershell_remoting.yml b/detections/endpoint/powershell_enable_powershell_remoting.yml index fa068b59638..cd1f780f46a 100644 --- a/detections/endpoint/powershell_enable_powershell_remoting.yml +++ b/detections/endpoint/powershell_enable_powershell_remoting.yml @@ -2,7 +2,7 @@ name: PowerShell Enable PowerShell Remoting id: 40e3b299-19a5-4460-96e9-e1467f714f8e version: 12 creation_date: '2023-03-22' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -25,6 +25,7 @@ how_to_implement: To successfully implement this analytic, you will need to enab known_false_positives: Note that false positives may occur due to the use of the Enable-PSRemoting cmdlet by legitimate users, such as system administrators. It is recommended to apply appropriate filters as needed to minimize the number of false positives. references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.3 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1021.006/T1021.006.yaml#L5 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -43,6 +44,8 @@ intermediate_findings: analytic_story: - Malicious PowerShell asset_type: Endpoint +atomic_guid: + - 9059e8de-3d7d-4954-a322-46161880b9cf mitre_attack_id: - T1059.001 product: diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index 1b2cd0e10c4..c35197e74fc 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -2,7 +2,7 @@ name: Powershell Execute COM Object id: 65711630-f9bf-11eb-8d72-acde48001122 version: 12 creation_date: '2021-08-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -26,6 +26,7 @@ known_false_positives: network operrator may use this command. references: - https://threadreaderapp.com/thread/1423361119926816776.html - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.015/T1546.015.yaml#L58 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - Hermetic Wiper - Data Destruction asset_type: Endpoint +atomic_guid: + - 752191b1-7c71-445c-9dbe-21bb031b18eb mitre_attack_id: - T1059.001 - T1546.015 diff --git a/detections/endpoint/powershell_get_localgroup_discovery.yml b/detections/endpoint/powershell_get_localgroup_discovery.yml index 62987dfb8ef..fce9a2354d9 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery.yml @@ -2,7 +2,7 @@ name: PowerShell Get LocalGroup Discovery id: b71adfcc-155b-11ec-9413-acde48001122 version: 9 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -35,9 +35,12 @@ known_false_positives: False positives may be present. Tune as needed. references: - https://attack.mitre.org/techniques/T1069/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L33 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - a580462d-2c19-4bc7-8b9a-57a41b7d3ba4 mitre_attack_id: - T1069.001 product: diff --git a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml index 979ae189536..81e3c49d6ba 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml @@ -2,7 +2,7 @@ name: Powershell Get LocalGroup Discovery with Script Block Logging id: d7c6ad22-155c-11ec-bb64-acde48001122 version: 11 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -30,9 +30,12 @@ references: - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L33 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - a580462d-2c19-4bc7-8b9a-57a41b7d3ba4 mitre_attack_id: - T1069.001 product: diff --git a/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml b/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml index 25c23b9b490..da3bad95877 100644 --- a/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml +++ b/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml @@ -2,7 +2,7 @@ name: PowerShell Invoke CIMMethod CIMSession id: 651ee958-a433-471c-b264-39725b788b83 version: 12 creation_date: '2023-03-22' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -25,6 +25,7 @@ how_to_implement: To successfully implement this analytic, you will need to enab known_false_positives: False positives may be present based on third-party applications or administrators using CIM. It is recommended to apply appropriate filters as needed to minimize the number of false positives. references: - https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/invoke-cimmethod?view=powershell-7.3 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546/T1546.yaml#L72 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -45,6 +46,8 @@ analytic_story: - Malicious PowerShell - Active Directory Lateral Movement asset_type: Endpoint +atomic_guid: + - adae83d3-0df6-45e7-b2c3-575f91584577 mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml index 729331c475c..3b69c4a75d2 100644 --- a/detections/endpoint/powershell_start_bitstransfer.yml +++ b/detections/endpoint/powershell_start_bitstransfer.yml @@ -2,7 +2,7 @@ name: PowerShell Start-BitsTransfer id: 39e2605a-90d8-11eb-899e-acde48001122 version: 12 creation_date: '2021-03-30' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: Limited false positives. It is possible administrators wi references: - https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281 - https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1197/T1197.yaml#L27 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -55,6 +56,8 @@ analytic_story: - BITS Jobs - Gozi Malware asset_type: Endpoint +atomic_guid: + - f63b8bc4-07e5-4112-acba-56f646f3f0bc mitre_attack_id: - T1197 product: diff --git a/detections/endpoint/powershell_start_or_stop_service.yml b/detections/endpoint/powershell_start_or_stop_service.yml index f7608d09ab7..84b0b7eb74a 100644 --- a/detections/endpoint/powershell_start_or_stop_service.yml +++ b/detections/endpoint/powershell_start_or_stop_service.yml @@ -2,7 +2,7 @@ name: PowerShell Start or Stop Service id: 04207f8a-e08d-4ee6-be26-1e0c4488b04a version: 12 creation_date: '2023-03-24' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -26,6 +26,7 @@ known_false_positives: This behavior may be noisy, as these cmdlets are commonly references: - https://learn-powershell.net/2012/01/15/startingstopping-and-restarting-remote-services-with-powershell/ - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/start-service?view=powershell-7.3 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1543.003/T1543.003.yaml#L191 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -45,6 +46,8 @@ analytic_story: - Scattered Lapsus$ Hunters - Active Directory Lateral Movement asset_type: Endpoint +atomic_guid: + - 1f896ce4-8070-4959-8a25-2658856a70c9 mitre_attack_id: - T1059.001 product: diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml index 22b1972074f..8b86ff9be68 100644 --- a/detections/endpoint/process_execution_via_wmi.yml +++ b/detections/endpoint/process_execution_via_wmi.yml @@ -2,7 +2,7 @@ name: Process Execution via WMI id: 24869767-8579-485d-9a4f-d9ddfd8f0cac version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rico Valdez, Michael Haag, Splunk status: production type: TTP @@ -14,7 +14,8 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=WmiPrvSE.exe NOT (Processes.process IN ("*\\dismhost.exe*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_execution_via_wmi_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Although unlikely, administrators may use wmi to execute commands for legitimate purposes. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L85 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -39,6 +40,8 @@ intermediate_findings: analytic_story: - Suspicious WMI Use asset_type: Endpoint +atomic_guid: + - b3bdfc91-b33e-4c6d-a5c8-d64bee0276b3 mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 795aad1726d..e4b56f2824e 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -2,7 +2,7 @@ name: Registry Keys for Creating SHIM Databases id: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb version: 17 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Teoderick Contreras, Splunk, Steven Dick, Bhavin Patel status: production type: TTP @@ -12,7 +12,8 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB*) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_for_creating_shim_databases_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: There are many legitimate applications that leverage shim databases for compatibility purposes for legacy applications -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.011/T1546.011.yaml#L61 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -39,6 +40,8 @@ analytic_story: - Windows Persistence Techniques - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 9b6a06f9-ab5e-4e8d-8289-1df4289db02f mitre_attack_id: - T1546.011 product: diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index a01367e4256..8cd37e1aa5b 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -2,7 +2,7 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b version: 35 creation_date: '2020-04-29' -modification_date: '2026-07-20' +modification_date: '2026-10-09' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk status: production type: TTP @@ -12,7 +12,8 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce OR Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run OR Registry.registry_path= "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\*" OR Registry.registry_path= "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\*" OR Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* OR Registry.registry_path=*\\SOFTWARE\\Microsoft\\Netsh\\* OR Registry.registry_path= "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup" OR Registry.registry_path= *\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SharedTaskScheduler OR Registry.registry_path= *\\Classes\\htmlfile\\shell\\open\\command OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows" AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" AND Registry.registry_key_name="auto_update")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_used_for_persistence_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. known_false_positives: There are many legitimate applications that must execute on system startup and will use these registry keys to accomplish that task. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.001/T1547.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -85,6 +86,8 @@ analytic_story: - Phantom Stealer - Starland RAT Campaign asset_type: Endpoint +atomic_guid: + - e55be3fd-3521-4610-9d1a-e210e42dcf05 mitre_attack_id: - T1547.001 product: diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index e26ba5a7ae3..10e5ebad02c 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -2,7 +2,7 @@ name: Registry Keys Used For Privilege Escalation id: c9f4b923-f8af-4155-b697-1354f5bcbc5e version: 17 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,9 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: There are many legitimate applications that must execute upon system startup and will use these registry keys to accomplish that task. references: - https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.012/T1546.012.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.012/T1546.012.yaml#L27 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.012/T1546.012.yaml#L53 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -43,6 +46,10 @@ analytic_story: - Data Destruction - Suspicious Windows Registry Activities asset_type: Endpoint +atomic_guid: + - fdda2626-5234-4c90-b163-60849a24c0b8 + - 46b1f278-c8ee-4aa5-acce-65e77b11f3c1 + - 13117939-c9b2-4a43-999e-0a543df92f0d mitre_attack_id: - T1546.012 product: diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index 46996d8c896..87f04574190 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -2,7 +2,7 @@ name: Regsvr32 Silent and Install Param Dll Loading id: f421c250-24e7-11ec-bc43-acde48001122 version: 15 creation_date: '2021-10-04' -modification_date: '2026-06-09' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -40,6 +40,7 @@ known_false_positives: | references: - https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/ - https://attack.mitre.org/techniques/T1218/010/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.010/T1218.010.yaml#L133 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -72,6 +73,8 @@ analytic_story: - Remcos - Suspicious Regsvr32 Activity asset_type: Endpoint +atomic_guid: + - 9d71c492-ea2e-4c08-af16-c6994cdf029f mitre_attack_id: - T1218.010 product: diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 9f27b3820a0..2f1ac099df1 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -2,7 +2,7 @@ name: Remote Process Instantiation via WMI id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da version: 19 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Mauricio Velazco, Splunk status: production type: TTP @@ -36,6 +36,7 @@ known_false_positives: The wmic.exe utility is a benign Windows application. It references: - https://attack.mitre.org/techniques/T1047/ - https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/create-method-in-class-win32-process + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L103 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -66,6 +67,8 @@ analytic_story: - Active Directory Lateral Movement - Void Manticore asset_type: Endpoint +atomic_guid: + - 9c8ef159-c666-472f-9874-90c8d60d136b mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml index dd954094480..ee8f9d31a3f 100644 --- a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml +++ b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml @@ -2,7 +2,7 @@ name: Remote System Discovery with Adsisearcher id: 70803451-0047-4e12-9d63-77fa7eb8649c version: 12 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -25,6 +25,7 @@ known_false_positives: Administrators or power users may use Adsisearcher for tr references: - https://attack.mitre.org/techniques/T1018/ - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml#L359 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -43,6 +44,8 @@ finding: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 64ede6ac-b57a-41c2-a7d1-32c6cd35397d mitre_attack_id: - T1018 product: diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml index ff26b5ddb97..b7f9a718a63 100644 --- a/detections/endpoint/remote_wmi_command_attempt.yml +++ b/detections/endpoint/remote_wmi_command_attempt.yml @@ -2,7 +2,7 @@ name: Remote WMI Command Attempt id: 272df6de-61f1-4784-877c-1fbc3e2d0838 version: 13 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Rico Valdez, Michael Haag, Splunk status: production type: TTP @@ -31,6 +31,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L103 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -60,6 +61,8 @@ analytic_story: - Suspicious WMI Use - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 9c8ef159-c666-472f-9874-90c8d60d136b mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml index a2952ed45c7..f0450790d44 100644 --- a/detections/endpoint/resize_shadowstorage_volume.yml +++ b/detections/endpoint/resize_shadowstorage_volume.yml @@ -2,7 +2,7 @@ name: Resize ShadowStorage volume id: bc760ca6-8336-11eb-bcbb-acde48001122 version: 11 creation_date: '2021-03-19' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras status: production type: TTP @@ -39,6 +39,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md - https://redcanary.com/blog/blackbyte-ransomware/ - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin-resize-shadowstorage + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L152 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -67,6 +68,8 @@ analytic_story: - BlackByte Ransomware - VanHelsing Ransomware asset_type: Endpoint +atomic_guid: + - da558b07-69ae-41b9-b9d4-4d98154a7049 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml index 4ec87180d0e..253a86ce924 100644 --- a/detections/endpoint/rundll32_control_rundll_hunt.yml +++ b/detections/endpoint/rundll32_control_rundll_hunt.yml @@ -2,7 +2,7 @@ name: Rundll32 Control RunDLL Hunt id: c8e7ced0-10c5-11ec-8b03-acde48001122 version: 10 creation_date: '2021-09-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -34,6 +34,7 @@ references: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml - https://redcanary.com/blog/intelligence-insights-december-2021/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L250 analytic_story: - Suspicious Rundll32 Activity - Microsoft MSHTML Remote Code Execution CVE-2021-40444 @@ -41,6 +42,8 @@ analytic_story: asset_type: Endpoint cve: - CVE-2021-40444 +atomic_guid: + - e4c04b6f-c492-4782-82c7-3bf75eb8077e mitre_attack_id: - T1218.011 product: diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index 3123233083d..cf0aed06433 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -2,7 +2,7 @@ name: RunDLL Loading DLL By Ordinal id: 6c135f8d-5e60-454e-80b7-c56eed739833 version: 16 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, David Dorsey, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ - https://twitter.com/M_haggis/status/1491109262428635136 - https://twitter.com/pr0xylife/status/1590394227758104576 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L222 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -59,6 +60,8 @@ analytic_story: - Living Off The Land - IcedID asset_type: Endpoint +atomic_guid: + - 9fd5a74b-ba89-482a-8a3e-a5feaa3697b0 mitre_attack_id: - T1218.011 product: diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 06db197fc7c..94b93cb98e9 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -2,7 +2,7 @@ name: Scheduled Task Deleted Or Created via CMD id: d5af132c-7c17-439c-9d31-13d55340f36c version: 28 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Splunk status: production type: Anomaly @@ -60,6 +60,7 @@ references: - https://www.joesandbox.com/analysis/691823/0/html - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-delete - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1053.005/T1053.005.yaml#L21 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -124,6 +125,8 @@ analytic_story: - PlugX - Remcos asset_type: Endpoint +atomic_guid: + - 42f53695-ad4a-4546-abb6-7d837f644a71 mitre_attack_id: - T1053.005 product: diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml index 5d75b6e9d95..4a5ca53c4f1 100644 --- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml @@ -2,7 +2,7 @@ name: Scheduled Task Initiation on Remote Endpoint id: 95cf4608-4302-11ec-8194-3e22fbd008af version: 13 creation_date: '2021-11-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk, Badoodish, Github Community status: production type: TTP @@ -35,6 +35,7 @@ known_false_positives: Administrators may start scheduled tasks on remote system references: - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks - https://attack.mitre.org/techniques/T1053/005/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1053.005/T1053.005.yaml#L43 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -57,6 +58,8 @@ analytic_story: - Medusa Ransomware - Seashell Blizzard asset_type: Endpoint +atomic_guid: + - 2e5eac3e-327b-4a88-a0c0-c4057039a8dd mitre_attack_id: - T1053.005 product: diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index 67d1e5a5b90..e8269ce2321 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -2,7 +2,7 @@ name: Schtasks scheduling job on remote system id: 1297fb80-f42a-4b4a-9c8a-88c066237cf6 version: 20 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: David Dorsey, Mauricio Velazco, Splunk status: production type: TTP @@ -32,7 +32,8 @@ search: |- | `schtasks_scheduling_job_on_remote_system_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: While it is possible to have false positives, due to legitimate administrative tasks, these are usually limited and should still be validated and investigated as appropriate. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1053.005/T1053.005.yaml#L43 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -68,6 +69,8 @@ analytic_story: - NOBELIUM Group - Compromised Windows Host asset_type: Endpoint +atomic_guid: + - 2e5eac3e-327b-4a88-a0c0-c4057039a8dd mitre_attack_id: - T1053.005 product: diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml index f061c3f6caa..90b3694e8c4 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml @@ -2,7 +2,7 @@ name: ServicePrincipalNames Discovery with SetSPN id: ae8b3efc-2d2e-11ec-8b57-acde48001122 version: 13 creation_date: '2021-10-15' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -47,6 +47,7 @@ references: - https://blog.zsec.uk/paving-2-da-wholeset/ - https://msitpros.com/?p=3113 - https://adsecurity.org/?p=3466 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1558.003/T1558.003.yaml#L82 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -79,6 +80,8 @@ analytic_story: - Compromised Windows Host - Active Directory Kerberos Attacks asset_type: Endpoint +atomic_guid: + - e6f4affd-d826-4871-9a62-6c9004b8fe06 mitre_attack_id: - T1558.003 product: diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml index 2c0b0f9eb92..d382049a835 100644 --- a/detections/endpoint/shim_database_file_creation.yml +++ b/detections/endpoint/shim_database_file_creation.yml @@ -2,7 +2,7 @@ name: Shim Database File Creation id: 6e4c4588-ba2f-42fa-97e6-9f6f548eaa33 version: 13 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -12,7 +12,8 @@ data_source: search: '| tstats `security_content_summariesonly` count values(Filesystem.action) values(Filesystem.file_hash) as file_hash values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path=*Windows\\AppPatch\\Custom* by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` |`drop_dm_object_name(Filesystem)` | `shim_database_file_creation_filter`' how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. known_false_positives: Because legitimate shim files are created and used all the time, this event, in itself, is not suspicious. However, if there are other correlating events, it may warrant further investigation. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.011/T1546.011.yaml#L44 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ threat_objects: analytic_story: - Windows Persistence Techniques asset_type: Endpoint +atomic_guid: + - aefd6866-d753-431f-a7a4-215ca7e3f13d mitre_attack_id: - T1546.011 product: diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml index d7bacbc89ba..cc68f93c14a 100644 --- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml +++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml @@ -2,7 +2,7 @@ name: Shim Database Installation With Suspicious Parameters id: 404620de-46d8-48b6-90cc-8a8d7b0876a3 version: 15 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -14,7 +14,8 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sdbinst.exe NOT Processes.process IN ("\"C:\\Windows\\System32\\sdbinst.exe\"", "C:\\Windows\\System32\\sdbinst.exe", "*-mm", "*-?", "*-m -bg") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `shim_database_installation_with_suspicious_parameters_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: No false positives have been identified at this time. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.011/T1546.011.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -40,6 +41,8 @@ analytic_story: - Windows Persistence Techniques - Compromised Windows Host asset_type: Endpoint +atomic_guid: + - 9ab27e22-ee62-4211-962b-d36d9a0e6a18 mitre_attack_id: - T1546.011 product: diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml index a54276b474b..e645476aa65 100644 --- a/detections/endpoint/short_lived_windows_accounts.yml +++ b/detections/endpoint/short_lived_windows_accounts.yml @@ -2,7 +2,7 @@ name: Short Lived Windows Accounts id: b25f6f62-0782-43c1-b403-083231ffd97d version: 14 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Bhavin Patel, Splunk status: production type: TTP @@ -32,6 +32,8 @@ known_false_positives: It is possible that an administrator created and deleted references: - https://www.youtube.com/watch?v=D4Cd-KK4ctk - https://attack.mitre.org/techniques/T1078/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L68 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L91 drilldown_searches: - name: View the detection results for - "$dest$" and "$src_user$" search: '%original_detection_search% | search dest = "$dest$" src_user = "$src_user$"' @@ -57,6 +59,9 @@ analytic_story: - Active Directory Lateral Movement - GhostRedirector IIS Module and Rungan Backdoor asset_type: Windows +atomic_guid: + - 6657864e-0323-4206-9344-ac9cd7265a4f + - bc8be0ac-475c-4fbf-9b1d-9fffd77afbde mitre_attack_id: - T1078.003 - T1136.001 diff --git a/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml b/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml index bb94157473c..18647c0001a 100644 --- a/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml +++ b/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml @@ -2,7 +2,7 @@ name: Steal or Forge Authentication Certificates Behavior Identified id: 87ac670e-bbfd-44ca-b566-44e9f835518d version: 9 creation_date: '2023-05-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Correlation @@ -22,6 +22,9 @@ known_false_positives: False positives may be present based on automated tooling references: - https://research.splunk.com/stories/windows_certificate_services/ - https://attack.mitre.org/techniques/T1649/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L377 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L351 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L325 drilldown_searches: - name: View the detection results for - "$risk_object$" search: '%original_detection_search% | search risk_object = "$risk_object$"' diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml index f6d98621048..a06f18a25fd 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml @@ -2,7 +2,7 @@ name: Suspicious microsoft workflow compiler usage id: 9bbc62e8-55d8-11eb-ae93-0242ac130002 version: 13 creation_date: '2021-01-19' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -34,6 +34,7 @@ known_false_positives: Although unlikely, limited instances have been identified references: - https://lolbas-project.github.io/lolbas/Binaries/Msbuild/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-6---microsoftworkflowcompilerexe-payload-execution + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml#L112 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -59,6 +60,8 @@ analytic_story: - Trusted Developer Utilities Proxy Execution - Living Off The Land asset_type: Endpoint +atomic_guid: + - 7cbb0f26-a4c1-4f77-b180-a009aa05637e mitre_attack_id: - T1127 product: diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml index d175f3d219e..abb3eb65e56 100644 --- a/detections/endpoint/suspicious_mshta_child_process.yml +++ b/detections/endpoint/suspicious_mshta_child_process.yml @@ -2,7 +2,7 @@ name: Suspicious mshta child process id: 60023bb6-5500-11eb-ae93-0242ac130002 version: 15 creation_date: '2021-01-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Teoderick Contreras Splunk status: production type: TTP @@ -32,6 +32,8 @@ known_false_positives: Although unlikely, some legitimate applications may exhib references: - https://github.com/redcanaryco/AtomicTestHarnesses - https://redcanary.com/blog/introducing-atomictestharnesses/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L20 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L216 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +64,9 @@ analytic_story: - Lumma Stealer - MuddyWater asset_type: Endpoint +atomic_guid: + - 906865c3-e05f-4acc-85c4-fbc185455095 + - 8707a805-2b76-4f32-b1c0-14e558205772 mitre_attack_id: - T1218.005 product: diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml index 36c2cd036ec..f563ea52fd0 100644 --- a/detections/endpoint/suspicious_reg_exe_process.yml +++ b/detections/endpoint/suspicious_reg_exe_process.yml @@ -2,7 +2,7 @@ name: Suspicious Reg exe Process id: a6b3ab4e-dd77-4213-95fa-fc94701995e0 version: 16 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: Anomaly @@ -39,6 +39,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: It's possible for system administrators to write scripts that exhibit this behavior. If this is the case, the search will need to be modified to filter them out. references: - https://car.mitre.org/wiki/CAR-2013-03-001/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L39 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -68,6 +69,8 @@ analytic_story: - Disabling Security Tools - DHS Report TA18-074A asset_type: Endpoint +atomic_guid: + - c0413fb5-33e2-40b7-9b6f-60b29f4a7a18 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml index 9be3b0f5307..eae3bc1abe6 100644 --- a/detections/endpoint/suspicious_rundll32_startw.yml +++ b/detections/endpoint/suspicious_rundll32_startw.yml @@ -2,7 +2,7 @@ name: Suspicious Rundll32 StartW id: 9319dda5-73f2-4d43-a85a-67ce961bddb7 version: 15 creation_date: '2021-02-09' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ references: - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/index.htm#cshid=1036 - https://lolbas-project.github.io/lolbas/Binaries/Rundll32/ - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L195 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -62,6 +63,8 @@ analytic_story: - Graceful Wipe Out Attack - Hellcat Ransomware asset_type: Endpoint +atomic_guid: + - ae3a8605-b26e-457c-b6b3-2702fd335bac mitre_attack_id: - T1218.011 product: diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index bde70a84a00..09efb091a46 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -2,7 +2,7 @@ name: Suspicious wevtutil Usage id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f version: 22 creation_date: '2019-10-16' -modification_date: '2026-09-21' +modification_date: '2026-10-02' author: David Dorsey, Michael Haag, Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -71,6 +71,7 @@ how_to_implement: |- known_false_positives: The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/61080b19460f2c6431c31689d58063c5f6c1f8fb/atomics/T1070.001/T1070.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -107,6 +108,8 @@ analytic_story: - Storm-0501 Ransomware - VoidLink Cloud-Native Linux Malware asset_type: Endpoint +atomic_guid: + - e6abb60e-26b8-41da-8aae-0c35174b0967 mitre_attack_id: - T1685.005 product: diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index e762a054875..1cda3a4ce34 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -2,7 +2,7 @@ name: System Information Discovery Detection id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72 version: 16 creation_date: '2020-10-14' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -16,6 +16,9 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators debugging servers references: - https://web.archive.org/web/20210119205146/https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml#L95 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L43 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -50,6 +53,10 @@ analytic_story: - BlankGrabber Stealer - Lotus Blossom Chrysalis Backdoor asset_type: Windows +atomic_guid: + - 66703791-c902-4560-8770-42b8a91f7667 + - 85cfbf23-4a1e-4342-8792-007e004b975f + - 718aebaa-d0e0-471a-8241-c5afa69c7414 mitre_attack_id: - T1082 product: diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml index 34973c0d0a6..1de08f7f7e3 100644 --- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml +++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml @@ -2,7 +2,7 @@ name: System Processes Run From Unexpected Locations id: a34aae96-ccf8-4aef-952c-3ea21444444d version: 18 creation_date: '2019-10-16' -modification_date: '2026-09-22' +modification_date: '2026-10-02' author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -43,6 +43,7 @@ known_false_positives: This detection may require tuning based on third party ap references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml - https://attack.mitre.org/techniques/T1036/003/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1036.003/T1036.003.yaml#L74 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -70,6 +71,8 @@ analytic_story: - Windows Error Reporting Service Elevation of Privilege Vulnerability - DarkGate Malware asset_type: Endpoint +atomic_guid: + - ac9d0fc3-8aa8-4ab5-b11f-682cd63b40aa mitre_attack_id: - T1036.003 product: diff --git a/detections/endpoint/system_user_discovery_with_query.yml b/detections/endpoint/system_user_discovery_with_query.yml index 92519700dbf..f2f2511cf5e 100644 --- a/detections/endpoint/system_user_discovery_with_query.yml +++ b/detections/endpoint/system_user_discovery_with_query.yml @@ -2,7 +2,7 @@ name: System User Discovery With Query id: ad03bfcf-8a91-4bc2-a500-112993deba87 version: 9 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -34,10 +34,15 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1033/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L30 analytic_story: - Active Directory Discovery - Medusa Ransomware asset_type: Endpoint +atomic_guid: + - 4c4959bf-addf-4b4a-be86-8d09cc1857aa + - 2a9b677d-a230-44f4-ad86-782df1ef108c mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml index 63850b2cd6e..0761ee9525e 100644 --- a/detections/endpoint/unload_sysmon_filter_driver.yml +++ b/detections/endpoint/unload_sysmon_filter_driver.yml @@ -2,7 +2,7 @@ name: Unload Sysmon Filter Driver id: e5928ff3-23eb-4d8b-b8a4-dcbc844fdfbe version: 16 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Bhavin Patel, Splunk status: production type: TTP @@ -34,6 +34,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://www.ired.team/offensive-security/defense-evasion/unloading-sysmon-driver + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L236 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -53,6 +54,8 @@ analytic_story: - CISA AA23-347A - Disabling Security Tools asset_type: Endpoint +atomic_guid: + - 811b3e76-c41b-430c-ac0d-e2380bfaa164 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell.yml b/detections/endpoint/user_discovery_with_env_vars_powershell.yml index 0d800ec0e74..57b0d50680c 100644 --- a/detections/endpoint/user_discovery_with_env_vars_powershell.yml +++ b/detections/endpoint/user_discovery_with_env_vars_powershell.yml @@ -2,7 +2,7 @@ name: User Discovery With Env Vars PowerShell id: 0cdf318b-a0dd-47d7-b257-c621c0247de8 version: 8 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -32,9 +32,12 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1033/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L55 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - dcb6cdee-1fb0-4087-8bf8-88cfd136ba51 mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml index 70f9d59fb9f..5d3c9681ab5 100644 --- a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml +++ b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml @@ -2,7 +2,7 @@ name: User Discovery With Env Vars PowerShell Script Block id: 77f41d9e-b8be-47e3-ab35-5776f5ec1d20 version: 10 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -25,9 +25,12 @@ how_to_implement: To successfully implement this analytic, you will need to enab known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting. references: - https://attack.mitre.org/techniques/T1033/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L55 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - dcb6cdee-1fb0-4087-8bf8-88cfd136ba51 mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml index c40e3ee4119..634a025820c 100644 --- a/detections/endpoint/usn_journal_deletion.yml +++ b/detections/endpoint/usn_journal_deletion.yml @@ -2,7 +2,7 @@ name: USN Journal Deletion id: b6e0ff70-b122-4227-9368-4cf322ab43c3 version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -38,6 +38,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1070/T1070.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -57,6 +58,8 @@ analytic_story: - Windows Log Manipulation - Ransomware asset_type: Endpoint +atomic_guid: + - b4115c7a-0e92-47f0-a61e-17e7218b2435 mitre_attack_id: - T1070 product: diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml index 59931288430..2667b4b122f 100644 --- a/detections/endpoint/wbadmin_delete_system_backups.yml +++ b/detections/endpoint/wbadmin_delete_system_backups.yml @@ -2,7 +2,7 @@ name: WBAdmin Delete System Backups id: cd5aed7e-5cea-11eb-ae93-0242ac130002 version: 14 creation_date: '2021-01-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -38,6 +38,7 @@ references: - https://attack.mitre.org/techniques/T1490/ - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin - https://www.welivesecurity.com/2019/04/30/buhtrap-backdoor-ransomware-advertising-platform/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L108 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -61,6 +62,8 @@ analytic_story: - Storm-2460 CLFS Zero Day Exploitation - Storm-0501 Ransomware asset_type: Endpoint +atomic_guid: + - 584331dd-75bc-4c02-9e0b-17f5fd81c748 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index cee3e655c7a..f13ca4cd96e 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -2,7 +2,7 @@ name: Windows Access Token Manipulation SeDebugPrivilege id: 6ece9ed0-5f92-4315-889d-48560472b188 version: 24 creation_date: '2022-09-05' -modification_date: '2026-08-14' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -18,6 +18,7 @@ references: - https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e - https://atomicredteam.io/privilege-escalation/T1134.001/#atomic-test-2---%60sedebugprivilege%60-token-duplication - https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1134.001/T1134.001.yaml#L20 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -55,6 +56,8 @@ analytic_story: - Salat Stealer - Vidar Stealer asset_type: Endpoint +atomic_guid: + - 34f0a430-9d04-4d98-bcb5-1989f14719f0 mitre_attack_id: - T1134.002 product: diff --git a/detections/endpoint/windows_ad_dsrm_password_reset.yml b/detections/endpoint/windows_ad_dsrm_password_reset.yml index 45150fe2117..7ad5873bbb8 100644 --- a/detections/endpoint/windows_ad_dsrm_password_reset.yml +++ b/detections/endpoint/windows_ad_dsrm_password_reset.yml @@ -2,7 +2,7 @@ name: Windows AD DSRM Password Reset id: d1ab841c-36a6-46cf-b50f-b2b04b31182a version: 10 creation_date: '2022-09-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Dean Luxton status: production type: TTP @@ -22,6 +22,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: Resetting the DSRM password for legitamate reasons, i.e. forgot the password. Disaster recovery. Deploying AD backdoor deliberately. references: - https://adsecurity.org/?p=1714 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml#L533 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - Sneaky Active Directory Persistence Tricks - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - d5b886d9-d1c7-4b6e-a7b0-460041bf2823 mitre_attack_id: - T1098 product: diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml index 61a8f0b0b9e..e03658266cf 100644 --- a/detections/endpoint/windows_adfind_exe.yml +++ b/detections/endpoint/windows_adfind_exe.yml @@ -2,7 +2,7 @@ name: Windows AdFind Exe id: bd3b0187-189b-46c0-be45-f52da2bae67f version: 14 creation_date: '2020-12-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Jose Hernandez, Bhavin Patel, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -66,6 +66,12 @@ references: - https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption - https://www.joeware.net/freetools/tools/adfind/index.htm - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L71 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L96 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L121 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L146 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L378 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L399 drilldown_searches: - name: View the detection results for - "$user$" search: '%original_detection_search% | search user = "$user$"' diff --git a/detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml b/detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml index f050a23a177..f5925935625 100644 --- a/detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml +++ b/detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml @@ -2,7 +2,7 @@ name: Windows Application Whitelisting Bypass Attempt via Rundll32 id: 1ef5dab0-e1f1-495d-a272-d134583c10b1 version: 6 creation_date: '2021-02-05' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -65,6 +65,10 @@ references: - https://lolbas-project.github.io/lolbas/Libraries/Ieadvpack/ - https://lolbas-project.github.io/lolbas/Libraries/Setupapi/ - https://lolbas-project.github.io/lolbas/Libraries/Syssetup/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L59 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L85 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L112 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L138 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -96,6 +100,11 @@ analytic_story: - Living Off The Land - Compromised Windows Host asset_type: Endpoint +atomic_guid: + - d91cae26-7fc1-457b-a854-34c8aad48c89 + - 5e46a58e-cbf6-45ef-a289-ed7754603df9 + - 41fa324a-3946-401e-bbdd-d7991c628125 + - 71d771cd-d6b3-4f34-bc76-a63d47a10b19 mitre_attack_id: - T1218.011 product: diff --git a/detections/endpoint/windows_attempt_to_stop_security_service.yml b/detections/endpoint/windows_attempt_to_stop_security_service.yml index a0612d605f6..bb970385674 100644 --- a/detections/endpoint/windows_attempt_to_stop_security_service.yml +++ b/detections/endpoint/windows_attempt_to_stop_security_service.yml @@ -2,7 +2,7 @@ name: Windows Attempt To Stop Security Service id: 9ed27cea-4e27-4eff-b2c6-aac9e78a7517 version: 12 creation_date: '2020-04-29' -modification_date: '2026-09-22' +modification_date: '2026-10-02' author: Rico Valdez, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -37,6 +37,7 @@ known_false_positives: No false positives have been identified at this time. sho references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ + - https://github.com/redcanaryco/atomic-red-team/blob/61080b19460f2c6431c31689d58063c5f6c1f8fb/atomics/T1562.001/T1562.001.yaml#L306 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -71,6 +72,8 @@ analytic_story: - Azorult - Trickbot asset_type: Endpoint +atomic_guid: + - a1230893-56ac-4c81-b644-2108e982f8f5 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml index 68c633e1c8a..8e479ce37e2 100644 --- a/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml +++ b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml @@ -2,7 +2,7 @@ name: Windows Autostart Execution LSASS Driver Registry Modification id: 57fb8656-141e-4d8a-9f51-62cff4ecb82a version: 10 creation_date: '2022-08-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -15,6 +15,7 @@ known_false_positives: False positives may be present on recent Windows Operatin references: - https://blog.xpnsec.com/exploring-mimikatz-part-1/ - https://github.com/oxfemale/LogonCredentialsSteal/tree/master/lsass_lib + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.008/T1547.008.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ finding: analytic_story: - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 8ecef16d-d289-46b4-917b-0dba6dc81cf1 mitre_attack_id: - T1547.008 product: diff --git a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml index c9afe2a0c6b..53232bd57ed 100644 --- a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml +++ b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml @@ -2,7 +2,7 @@ name: Windows Binary Proxy Execution Mavinject DLL Injection id: ccf4b61b-1b26-4f2e-a089-f2009c569c57 version: 13 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -31,6 +31,7 @@ references: - https://attack.mitre.org/techniques/T1218/013/ - https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-1---mavinject---inject-dll-into-running-process + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -60,6 +61,8 @@ threat_objects: analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - c426dacf-575d-4937-8611-a148a86a5e61 mitre_attack_id: - T1218.013 product: diff --git a/detections/endpoint/windows_cabinet_file_extraction_via_expand.yml b/detections/endpoint/windows_cabinet_file_extraction_via_expand.yml index 8d6ee95eb72..d732490e0a7 100644 --- a/detections/endpoint/windows_cabinet_file_extraction_via_expand.yml +++ b/detections/endpoint/windows_cabinet_file_extraction_via_expand.yml @@ -2,7 +2,7 @@ name: Windows Cabinet File Extraction Via Expand id: 4e3e3b8c-6d3a-4b47-9f5a-9e3e0a0a6f2f version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -37,6 +37,7 @@ known_false_positives: | and sanctioned paths. references: - https://www.zscaler.com/blogs/security-research/apt37-targets-windows-rust-backdoor-and-python-loader + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml#L304 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -71,6 +72,8 @@ analytic_story: - APT37 Rustonotto and FadeStealer - NetSupport RMM Tool Abuse asset_type: Endpoint +atomic_guid: + - 9f8b1c54-cb76-4d5e-bb1f-2f5c0e8f5a11 mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/windows_convertto_aadintbackdoor_execution_via_powershell_script.yml b/detections/endpoint/windows_convertto_aadintbackdoor_execution_via_powershell_script.yml index 8dfa4e8e9e6..8eb5a955e07 100644 --- a/detections/endpoint/windows_convertto_aadintbackdoor_execution_via_powershell_script.yml +++ b/detections/endpoint/windows_convertto_aadintbackdoor_execution_via_powershell_script.yml @@ -2,7 +2,7 @@ name: Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script id: 59a8662f-f616-4494-8fa1-29ae77fc2018 version: 2 creation_date: '2026-05-05' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Raven Tait, Splunk status: production type: TTP @@ -33,6 +33,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Certain administrative or security testing activities in Azure AD environments may use ConvertTo-AADIntBackdoor for legitimate federation configuration changes. Review and allow such actions from trusted administrators and approved tools. references: - https://atomicredteam.io/privilege-escalation/T1484.002/#atomic-test-1---add-federation-to-azure-ad + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1484.002/T1484.002.yaml#L5 drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -53,6 +54,8 @@ analytic_story: - Azure Active Directory Account Takeover - Azure Active Directory Privilege Escalation asset_type: Endpoint +atomic_guid: + - 8906c5d0-3ee5-4f63-897a-f6cafd3fdbb7 mitre_attack_id: - T1482 - T1078 diff --git a/detections/endpoint/windows_create_local_account.yml b/detections/endpoint/windows_create_local_account.yml index b836178454f..e19c0130d9c 100644 --- a/detections/endpoint/windows_create_local_account.yml +++ b/detections/endpoint/windows_create_local_account.yml @@ -2,7 +2,7 @@ name: Windows Create Local Account id: 3fb2e8e3-7bc0-4567-9722-c5ab9f8595eb version: 13 creation_date: '2022-10-05' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -29,6 +29,8 @@ known_false_positives: | Restrict to critical infrastructure to reduce any volume. references: - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L68 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L91 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -54,6 +56,9 @@ analytic_story: - GhostRedirector IIS Module and Rungan Backdoor - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 6657864e-0323-4206-9344-ac9cd7265a4f + - bc8be0ac-475c-4fbf-9b1d-9fffd77afbde mitre_attack_id: - T1136.001 product: diff --git a/detections/endpoint/windows_create_local_administrator_account_via_net.yml b/detections/endpoint/windows_create_local_administrator_account_via_net.yml index c424345a12b..65e79e9e660 100644 --- a/detections/endpoint/windows_create_local_administrator_account_via_net.yml +++ b/detections/endpoint/windows_create_local_administrator_account_via_net.yml @@ -2,7 +2,7 @@ name: Windows Create Local Administrator Account Via Net id: 2c568c34-bb57-4b43-9d75-19c605b98e70 version: 11 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Splunk status: production type: Anomaly @@ -31,7 +31,8 @@ search: |- | `windows_create_local_administrator_account_via_net_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrators often leverage net.exe to create admin accounts. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L156 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -66,6 +67,8 @@ analytic_story: - GhostRedirector IIS Module and Rungan Backdoor - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - fda74566-a604-4581-a4cc-fbbe21d66559 mitre_attack_id: - T1136.001 product: diff --git a/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml b/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml index 3b24d5c3456..7003854e614 100644 --- a/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml +++ b/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml @@ -2,7 +2,7 @@ name: Windows Credential Dumping LSASS Memory Createdump id: b3b7ce35-fce5-4c73-85f4-700aeada81a9 version: 14 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: False positives may be present if an application is dumping processes, filter as needed. Recommend reviewing createdump.exe usage across the fleet to better understand all usage and by what. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-11---dump-lsass-with-createdumpexe-from-net-v5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L308 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -64,6 +65,8 @@ analytic_story: - Credential Dumping - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 9d0072c8-7cca-45c4-bd14-f852cfa35cf0 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index d17aeac465f..fab377f7cf4 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -2,7 +2,7 @@ name: Windows Curl Download to Suspicious Path id: c32f091e-30db-11ec-8738-acde48001122 version: 22 creation_date: '2021-10-19' -modification_date: '2026-07-20' +modification_date: '2026-10-02' author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -65,6 +65,7 @@ references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://attack.mitre.org/techniques/T1105/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L460 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -105,6 +106,8 @@ analytic_story: - Salt Typhoon - Starland RAT Campaign asset_type: Endpoint +atomic_guid: + - 2b080b99-0deb-4d51-af0f-833d37c4ca6a mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml index 6b6034e879d..5c630ac4f37 100644 --- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml +++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml @@ -2,7 +2,7 @@ name: Windows Curl Upload to Remote Destination id: 42f8f1a2-4228-11ec-aade-acde48001122 version: 18 creation_date: '2021-11-10' -modification_date: '2026-07-14' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -52,6 +52,7 @@ references: - https://everything.curl.dev/usingcurl/uploads - https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409 - https://twitter.com/d1r4c/status/1279042657508081664?s=20 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L501 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -87,6 +88,8 @@ analytic_story: - PromptLock - Axios Supply Chain Post Compromise asset_type: Endpoint +atomic_guid: + - 635c9a38-6cbf-47dc-8615-3810bc1167cf mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/windows_disable_change_password_through_registry.yml b/detections/endpoint/windows_disable_change_password_through_registry.yml index 9aae2524703..fa335865bff 100644 --- a/detections/endpoint/windows_disable_change_password_through_registry.yml +++ b/detections/endpoint/windows_disable_change_password_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Change Password Through Registry id: 0df33e1a-9ef6-11ec-a1ad-acde48001122 version: 14 creation_date: '2022-03-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: This windows feature may implemented by administrator to prevent normal user to change the password of a critical host or server, In this type of scenario filter is needed to minimized false positive. references: - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_heartbleed.thdobah + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L260 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ analytic_story: - Ransomware - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - d4a6da40-618f-454d-9a9e-26af552aaeb0 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml index 273cf3e2744..39eb28b1dee 100644 --- a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Lock Workstation Feature Through Registry id: c82adbc6-9f00-11ec-a81f-acde48001122 version: 15 creation_date: '2022-03-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: No false positives have been identified at this time. references: - https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/ - https://heimdalsecurity.com/blog/fatalrat-targets-telegram/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L274 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -35,6 +36,8 @@ analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 3dacb0d2-46ee-4c27-ac1b-f9886bf91a56 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disable_logoff_button_through_registry.yml b/detections/endpoint/windows_disable_logoff_button_through_registry.yml index 2471f816246..160d9a97553 100644 --- a/detections/endpoint/windows_disable_logoff_button_through_registry.yml +++ b/detections/endpoint/windows_disable_logoff_button_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable LogOff Button Through Registry id: b2fb6830-9ed1-11ec-9fcb-acde48001122 version: 14 creation_date: '2022-03-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -16,6 +16,7 @@ references: - https://www.hybrid-analysis.com/sample/e2d4018fd3bd541c153af98ef7c25b2bf4a66bc3bfb89e437cde89fd08a9dd7b/5b1f4d947ca3e10f22714774 - https://malwiki.org/index.php?title=DigiPop.xp - https://www.trendmicro.com/vinfo/be/threat-encyclopedia/search/js_noclose.e/2 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L244 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -35,6 +36,8 @@ analytic_story: - Ransomware - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - e246578a-c24d-46a7-9237-0213ff86fb0c mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disable_notification_center.yml b/detections/endpoint/windows_disable_notification_center.yml index b1091f67a91..22cc088717b 100644 --- a/detections/endpoint/windows_disable_notification_center.yml +++ b/detections/endpoint/windows_disable_notification_center.yml @@ -2,7 +2,7 @@ name: Windows Disable Notification Center id: 1cd983c8-8fd6-11ec-a09d-acde48001122 version: 15 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -28,6 +28,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: admin or user may choose to disable this windows features. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L216 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -52,6 +53,8 @@ analytic_story: - CISA AA23-347A - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - c0d6d67f-1f63-42cc-95c0-5fd6b20082ad mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index a9dbf0aa07a..a9d21b8e66e 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Shutdown Button Through Registry id: 55fb2958-9ecd-11ec-a06a-acde48001122 version: 15 creation_date: '2022-03-08' -modification_date: '2026-08-05' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -51,6 +51,7 @@ known_false_positives: |- In that scenario, filtering by the machines and users allowed to modify this registry key is recommended. references: - https://github.com/redcanaryco/atomic-red-team/blob/1ba1dd8d9ce6f74700f7aec2e60de5632f667f03/atomics/T1112/T1112.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L230 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -70,6 +71,8 @@ analytic_story: - Ransomware - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 6e0d1131-2d7e-4905-8ca5-d6172f05d03d mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml index 904f5374cbf..cc5b1ad88fc 100644 --- a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml +++ b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml @@ -2,7 +2,7 @@ name: Windows Disable Windows Event Logging Disable HTTP Logging id: 23fb6787-255f-4d5b-9a66-9fd7504032b5 version: 15 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -32,6 +32,7 @@ references: - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/ - https://www.secureworks.com/research/bronze-union - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L27 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - Compromised Windows Host - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - a957fb0f-1e85-49b2-a211-413366784b1e mitre_attack_id: - T1505.004 - T1685.001 diff --git a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml index 8e2ea14afc6..e39c448c01b 100644 --- a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml +++ b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Windows Group Policy Features Through Registry id: 63a449ae-9f04-11ec-945e-acde48001122 version: 15 creation_date: '2022-03-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Steven Dick, Teoderick Contreras, Splunk status: production type: Anomaly @@ -16,6 +16,13 @@ references: - https://hybrid-analysis.com/sample/ef1c427394c205580576d18ba68d5911089c7da0386f19d1ca126929d3e671ab?environmentId=120&lang=en - https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis - https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L288 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L318 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L333 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L348 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L363 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L378 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L393 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -37,6 +44,14 @@ analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 93386d41-525c-4a1b-8235-134a628dee17 + - ffbb407e-7f1d-4c95-b22e-548169db1fbd + - a450e469-ba54-4de1-9deb-9023a6111690 + - 5e27bdb4-7fd9-455d-a2b5-4b4b22c9dea4 + - 12f50e15-dbc6-478b-a801-a746e8ba1723 + - d29b7faf-7355-4036-9ed3-719bd17951ed + - 4d72d4b1-fa7b-4374-b423-0fe326da49d2 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disableantispyware_registry.yml b/detections/endpoint/windows_disableantispyware_registry.yml index ab31e349ec2..7bc79a33f8c 100644 --- a/detections/endpoint/windows_disableantispyware_registry.yml +++ b/detections/endpoint/windows_disableantispyware_registry.yml @@ -2,7 +2,7 @@ name: Windows DisableAntiSpyware Registry id: 23150a40-9301-4195-b802-5bb4f43067fb version: 13 creation_date: '2020-11-06' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rod Soto, Jose Hernandez, Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,8 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search. references: - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1004 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1051 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -39,6 +41,9 @@ analytic_story: - Windows Defense Evasion Tactics - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 1f6743da-6ecc-4a93-b03f-dc357e4b313f + - a72cfef8-d252-48b3-b292-635d332625c3 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml index c5a13db2c68..b0f9bd96ab0 100644 --- a/detections/endpoint/windows_dism_remove_defender.yml +++ b/detections/endpoint/windows_dism_remove_defender.yml @@ -2,7 +2,7 @@ name: Windows DISM Remove Defender id: 8567da9e-47f0-11ec-99a9-acde48001122 version: 15 creation_date: '2021-12-08' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -35,6 +35,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Some legitimate administrative tools leverage `dism.exe` to manipulate packages and features of the operating system. Filter as needed. references: - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L608 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -66,6 +67,8 @@ analytic_story: - Compromised Windows Host - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - 871438ac-7d6e-432a-b27d-3e7db69faf58 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml index f151287086b..21e2d8dc1d2 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml @@ -2,7 +2,7 @@ name: Windows DLL Search Order Hijacking Hunt with Sysmon id: 79c7d1fc-64c7-91be-a616-ccda752efe81 version: 13 creation_date: '2022-08-19' -modification_date: '2026-09-22' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -14,12 +14,15 @@ how_to_implement: The search is written against the latest Sysmon TA 4.0 https:/ known_false_positives: False positives will be present based on paths. Filter or add other paths to the exclusion as needed. Some applications may legitimately load libraries from non-standard paths. references: - https://hijacklibs.net + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1574.001/T1574.001.yaml#L67 analytic_story: - Qakbot - Windows Defense Evasion Tactics - Living Off The Land - Malicious Inno Setup Loader asset_type: Endpoint +atomic_guid: + - 65526037-7079-44a9-bda1-2cb624838040 mitre_attack_id: - T1574.001 product: diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml index eee16bce84a..fe022fd4bb9 100644 --- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml +++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml @@ -2,7 +2,7 @@ name: Windows DotNet Binary in Non Standard Path id: fddf3b56-7933-11ec-98a6-acde48001122 version: 15 creation_date: '2022-01-20' -modification_date: '2026-09-22' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -65,6 +65,7 @@ references: - https://attack.mitre.org/techniques/T1036/003/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1036.003/T1036.003.yaml#L74 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -99,6 +100,8 @@ analytic_story: - Data Destruction - WhisperGate asset_type: Endpoint +atomic_guid: + - ac9d0fc3-8aa8-4ab5-b11f-682cd63b40aa mitre_attack_id: - T1036.003 - T1218.004 diff --git a/detections/endpoint/windows_entra_user_management_via_azure_cli.yml b/detections/endpoint/windows_entra_user_management_via_azure_cli.yml index 35796b2a16e..823b3c0e1df 100644 --- a/detections/endpoint/windows_entra_user_management_via_azure_cli.yml +++ b/detections/endpoint/windows_entra_user_management_via_azure_cli.yml @@ -2,7 +2,7 @@ name: Windows Entra User Management Via Azure CLI id: f6332409-abeb-42f8-b6a7-76201bdc7a0a version: 2 creation_date: '2026-05-05' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Raven Tait, Splunk status: production type: Anomaly @@ -47,6 +47,7 @@ known_false_positives: Legitimate IT administrators commonly use the Azure CLI f references: - https://atomicredteam.io/persistence/T1136.003/#atomic-test-3---azure-ad---create-a-new-user-via-azure-cli - https://learn.microsoft.com/en-us/cli/azure/?view=azure-cli-latest + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.003/T1136.003.yaml#L67 drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -72,6 +73,8 @@ threat_objects: analytic_story: - Azure Active Directory Persistence asset_type: Endpoint +atomic_guid: + - 228c7498-be31-48e9-83b7-9cb906504ec8 mitre_attack_id: - T1136 - T1078.004 diff --git a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml index 86a7ddb47f9..6271efedb5a 100644 --- a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml +++ b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml @@ -2,7 +2,7 @@ name: Windows ESX Admins Group Creation via Net id: 3d7df60b-3332-4667-8090-afe03e08dce0 version: 11 creation_date: '2024-07-30' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ references: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24505 - https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/ - https://www.securityweek.com/microsoft-says-ransomware-gangs-exploiting-just-patched-vmware-esxi-flaw/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.002/T1136.002.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ analytic_story: asset_type: Endpoint cve: - CVE-2024-37085 +atomic_guid: + - fcec2963-9951-4173-9bfa-98d8b7834e62 mitre_attack_id: - T1136.002 - T1136.001 diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index 62f1270f73b..9998dbbd779 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -2,7 +2,7 @@ name: Windows Event Log Cleared id: ad517544-aff9-4c96-bd99-d6eb43bfbb6a version: 21 creation_date: '2019-10-16' -modification_date: '2026-06-08' +modification_date: '2026-10-02' author: Rico Valdez, Michael Haag, Splunk status: production type: TTP @@ -26,6 +26,7 @@ references: - https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog-service-threads - https://attack.mitre.org/techniques/T1070/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/61080b19460f2c6431c31689d58063c5f6c1f8fb/atomics/T1070.001/T1070.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -50,6 +51,8 @@ analytic_story: - Clop Ransomware - Salat Stealer asset_type: Endpoint +atomic_guid: + - e6abb60e-26b8-41da-8aae-0c35174b0967 mitre_attack_id: - T1685.005 product: diff --git a/detections/endpoint/windows_event_logging_service_has_shutdown.yml b/detections/endpoint/windows_event_logging_service_has_shutdown.yml index d6d0895a37c..db584fffad9 100644 --- a/detections/endpoint/windows_event_logging_service_has_shutdown.yml +++ b/detections/endpoint/windows_event_logging_service_has_shutdown.yml @@ -2,7 +2,7 @@ name: Windows Event Logging Service Has Shutdown id: d696f622-6b08-4336-b456-696cb5b43ba0 version: 7 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -27,12 +27,17 @@ references: - https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog-service-threads - https://attack.mitre.org/techniques/T1070/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L149 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L170 analytic_story: - Windows Log Manipulation - Ransomware - Clop Ransomware - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 8e81d090-0cd6-4d46-863c-eec11311298f + - 85e6eff8-3ed4-4e03-ae50-aa6a404898a5 mitre_attack_id: - T1685.005 product: diff --git a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml index 4c2862a4dd3..c6c2369d6fc 100644 --- a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml +++ b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml @@ -2,7 +2,7 @@ name: Windows Event Triggered Image File Execution Options Injection id: f7abfab9-12ea-44e8-8745-475f9ca6e0a4 version: 8 creation_date: '2022-09-09' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Hunting @@ -22,9 +22,12 @@ known_false_positives: False positives may be present and tuning will be require references: - https://blog.thinkst.com/2022/09/sensitive-command-token-so-much-offense.html - https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.012/T1546.012.yaml#L53 analytic_story: - Windows Persistence Techniques asset_type: Endpoint +atomic_guid: + - 13117939-c9b2-4a43-999e-0a543df92f0d mitre_attack_id: - T1546.012 product: diff --git a/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml b/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml index 836c6880c57..3a9363e33c4 100644 --- a/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml +++ b/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml @@ -2,7 +2,7 @@ name: Windows Eventlog Cleared Via Wevtutil id: fdb829a8-db84-4832-b64b-3e964cd44f01 version: 8 creation_date: '2019-10-16' -modification_date: '2026-09-21' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -68,6 +68,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/61080b19460f2c6431c31689d58063c5f6c1f8fb/atomics/T1070.001/T1070.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -94,6 +95,8 @@ analytic_story: - CISA AA23-347A - ShrinkLocker asset_type: Endpoint +atomic_guid: + - e6abb60e-26b8-41da-8aae-0c35174b0967 mitre_attack_id: - T1685.005 product: diff --git a/detections/endpoint/windows_export_certificate.yml b/detections/endpoint/windows_export_certificate.yml index fde7bd5856a..2eb87319c46 100644 --- a/detections/endpoint/windows_export_certificate.yml +++ b/detections/endpoint/windows_export_certificate.yml @@ -2,7 +2,7 @@ name: Windows Export Certificate id: d8ddfa9b-b724-4df9-9dbe-f34cc0936714 version: 11 creation_date: '2023-02-03' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -22,6 +22,7 @@ how_to_implement: To implement this analytic, you must collect Microsoft-Windows known_false_positives: False positives may be generated based on an automated process or service that exports certificates on the regular. Review is required before setting to alert. Monitor for abnormal processes performing an export. references: - https://atomicredteam.io/defense-evasion/T1553.004/#atomic-test-4---install-root-ca-on-windows + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1649/T1649.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -40,6 +41,8 @@ intermediate_findings: analytic_story: - Windows Certificate Services asset_type: Endpoint +atomic_guid: + - eb121494-82d1-4148-9e2b-e624e03fbf3d mitre_attack_id: - T1552.004 - T1649 diff --git a/detections/endpoint/windows_file_download_via_certutil.yml b/detections/endpoint/windows_file_download_via_certutil.yml index b8105a3497b..1c1e9b3c7c3 100644 --- a/detections/endpoint/windows_file_download_via_certutil.yml +++ b/detections/endpoint/windows_file_download_via_certutil.yml @@ -2,7 +2,7 @@ name: Windows File Download Via CertUtil id: 7fac8d40-e370-45ea-a4a3-031bbcc18b02 version: 7 creation_date: '2021-03-24' -modification_date: '2026-07-14' +modification_date: '2026-10-09' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: TTP @@ -41,6 +41,8 @@ references: - https://web.archive.org/web/20210921110637/https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html - https://lolbas-project.github.io/lolbas/Binaries/Certutil/ - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L190 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L211 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -78,6 +80,9 @@ analytic_story: - CISA AA22-277A - Cisco Network Visibility Module Analytics asset_type: Endpoint +atomic_guid: + - dd3b61dd-7bbc-48cd-ab51-49ad1a776df0 + - ffd492e3-0455-4518-9fb1-46527c9f241b mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/windows_file_download_via_powershell.yml b/detections/endpoint/windows_file_download_via_powershell.yml index 72f19c64fe8..1139e233861 100644 --- a/detections/endpoint/windows_file_download_via_powershell.yml +++ b/detections/endpoint/windows_file_download_via_powershell.yml @@ -2,7 +2,7 @@ name: Windows File Download Via PowerShell id: 58c4e56c-b5b8-46a3-b5fb-6537dca3c6de version: 10 creation_date: '2021-03-01' -modification_date: '2026-07-14' +modification_date: '2026-10-02' author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -42,6 +42,7 @@ references: - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L816 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -88,6 +89,8 @@ analytic_story: - StealC Stealer - SolarWinds WHD RCE Post Exploitation asset_type: Endpoint +atomic_guid: + - c01cad7f-7a4c-49df-985e-b190dcf6a279 mitre_attack_id: - T1059.001 - T1105 diff --git a/detections/endpoint/windows_file_share_discovery_with_powerview.yml b/detections/endpoint/windows_file_share_discovery_with_powerview.yml index f3e57138aea..0f2792ccfe0 100644 --- a/detections/endpoint/windows_file_share_discovery_with_powerview.yml +++ b/detections/endpoint/windows_file_share_discovery_with_powerview.yml @@ -2,7 +2,7 @@ name: Windows File Share Discovery With Powerview id: a44c0be1-d7ab-41e4-92fd-aa9af4fe232c version: 11 creation_date: '2023-03-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -27,6 +27,7 @@ references: - https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerView/powerview.ps1 - https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/ - https://attack.mitre.org/techniques/T1135/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml#L134 drilldown_searches: - name: View the detection results for - "$dest$" and "$user_id$" search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' @@ -52,6 +53,8 @@ analytic_story: - Active Directory Privilege Escalation - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - d07e4cc1-98ae-447e-9d31-36cb430d28c4 mitre_attack_id: - T1135 product: diff --git a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml index a466d494379..6d31c42deee 100644 --- a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml +++ b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml @@ -2,7 +2,7 @@ name: Windows Files and Dirs Access Rights Modification Via Icacls id: c76b796c-27e1-4520-91c4-4a58695c749e version: 15 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -37,6 +37,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1222.001/T1222.001.yaml#L31 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -61,7 +62,7 @@ analytic_story: - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint atomic_guid: - - 3309f53e-b22b-4eb6-8fd2-a6cf58b355a9 + - a8206bcc-f282-40a9-a389-05d9c0263485 mitre_attack_id: - T1222.001 product: diff --git a/detections/endpoint/windows_get_variable_exe_execution_from_windowsapps_folder.yml b/detections/endpoint/windows_get_variable_exe_execution_from_windowsapps_folder.yml index 1a5db7d7c1c..137faa5a6cb 100644 --- a/detections/endpoint/windows_get_variable_exe_execution_from_windowsapps_folder.yml +++ b/detections/endpoint/windows_get_variable_exe_execution_from_windowsapps_folder.yml @@ -2,7 +2,7 @@ name: Windows Get-Variable.EXE Execution from WindowsApps Folder id: 7edb95b6-bccf-4d8c-8ada-d1c5520cf0ed version: 2 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Raven Tait, Splunk status: production type: Anomaly @@ -38,6 +38,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Some legitimate administrative tools may use custom executables in the WindowsApps folder for persistence or automation. Verify the executable's origin before flagging to avoid false positives. references: - https://thehackernews.com/2022/04/researchers-uncover-how-colibri-malware.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1574.008/T1574.008.yaml#L5 drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Windows Persistence Techniques asset_type: Endpoint +atomic_guid: + - 1561de08-0b4b-498e-8261-e922f3494aae mitre_attack_id: - T1574.008 product: diff --git a/detections/endpoint/windows_group_discovery_via_net.yml b/detections/endpoint/windows_group_discovery_via_net.yml index eb0a473e803..1e10212df4c 100644 --- a/detections/endpoint/windows_group_discovery_via_net.yml +++ b/detections/endpoint/windows_group_discovery_via_net.yml @@ -2,7 +2,7 @@ name: Windows Group Discovery Via Net id: c5c8e0f3-147a-43da-bf04-4cfaec27dc44 version: 7 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Mauricio Velazco, Splunk status: production type: Hunting @@ -20,6 +20,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L21 analytic_story: - SolarWinds WHD RCE Post Exploitation - Windows Discovery Techniques @@ -35,6 +36,8 @@ analytic_story: - Volt Typhoon - Microsoft WSUS CVE-2025-59287 asset_type: Endpoint +atomic_guid: + - 1f454dd6-e134-44df-bebb-67de70fb6cd8 mitre_attack_id: - T1069.001 - T1069.002 diff --git a/detections/endpoint/windows_guest_account_enabled_via_net_exe.yml b/detections/endpoint/windows_guest_account_enabled_via_net_exe.yml index 47471c91e42..3fabe37f10b 100644 --- a/detections/endpoint/windows_guest_account_enabled_via_net_exe.yml +++ b/detections/endpoint/windows_guest_account_enabled_via_net_exe.yml @@ -2,7 +2,7 @@ name: Windows Guest Account Enabled Via Net.EXE id: 4f8cd681-7583-47a0-9f38-6337b7adf48a version: 2 creation_date: '2021-09-02' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Raven Tait, Splunk status: production type: Anomaly @@ -38,6 +38,8 @@ search: |- | `windows_guest_account_enabled_via_net_exe_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: The Windows guest account may be activated by IT or support teams for temporary access or troubleshooting. Filter activations related to authorized maintenance activities to reduce false alerts. +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1078.001/T1078.001.yaml#L51 drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -59,6 +61,8 @@ threat_objects: analytic_story: - Windows Persistence Techniques asset_type: Endpoint +atomic_guid: + - aa6cb8c4-b582-4f8e-b677-37733914abda mitre_attack_id: - T1078.001 product: diff --git a/detections/endpoint/windows_http_network_communication_from_msiexec.yml b/detections/endpoint/windows_http_network_communication_from_msiexec.yml index b9c1505e46f..7c39c7ede9e 100644 --- a/detections/endpoint/windows_http_network_communication_from_msiexec.yml +++ b/detections/endpoint/windows_http_network_communication_from_msiexec.yml @@ -2,7 +2,7 @@ name: Windows HTTP Network Communication From MSIExec id: b0fd38c7-f71a-43a2-870e-f3ca06bcdd99 version: 11 creation_date: '2022-06-17' -modification_date: '2026-07-14' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -58,6 +58,7 @@ known_false_positives: False positives will be present and filtering is required references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.007/T1218.007.yaml#L309 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -90,6 +91,8 @@ analytic_story: - Cisco Network Visibility Module Analytics - SolarWinds WHD RCE Post Exploitation asset_type: Endpoint +atomic_guid: + - 44a4bedf-ffe3-452e-bee4-6925ab125662 mitre_attack_id: - T1218.007 product: diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml index e6477a71bc9..fc2a6a88253 100644 --- a/detections/endpoint/windows_identify_protocol_handlers.yml +++ b/detections/endpoint/windows_identify_protocol_handlers.yml @@ -2,7 +2,7 @@ name: Windows Identify Protocol Handlers id: bd5c311e-a6ea-48ae-a289-19a3398e3648 version: 11 creation_date: '2022-07-12' -modification_date: '2026-09-22' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -38,9 +38,12 @@ references: - https://techcommunity.microsoft.com/t5/windows-it-pro-blog/disabling-the-msix-ms-appinstaller-protocol-handler/ba-p/3119479 - https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug - https://parsiya.net/blog/2021-03-17-attack-surface-analysis-part-2-custom-protocol-handlers/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml#L84 analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - db020456-125b-4c8b-a4a7-487df8afb5a2 mitre_attack_id: - T1059 product: diff --git a/detections/endpoint/windows_iis_components_add_new_module.yml b/detections/endpoint/windows_iis_components_add_new_module.yml index 7d94f63810c..3fbc5d7fbcc 100644 --- a/detections/endpoint/windows_iis_components_add_new_module.yml +++ b/detections/endpoint/windows_iis_components_add_new_module.yml @@ -2,7 +2,7 @@ name: Windows IIS Components Add New Module id: 38fe731c-1f13-43d4-b878-a5bbe44807e3 version: 14 creation_date: '2022-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -36,6 +36,7 @@ references: - https://www.secureworks.com/research/bronze-union - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004 - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1505.004/T1505.004.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -64,6 +65,8 @@ analytic_story: - IIS Components - GhostRedirector IIS Module and Rungan Backdoor asset_type: Endpoint +atomic_guid: + - 53adbdfa-8200-490c-871c-d3b1ab3324b2 mitre_attack_id: - T1505.004 product: diff --git a/detections/endpoint/windows_iis_components_new_module_added.yml b/detections/endpoint/windows_iis_components_new_module_added.yml index f23fda7fc0b..e9e7758e4c2 100644 --- a/detections/endpoint/windows_iis_components_new_module_added.yml +++ b/detections/endpoint/windows_iis_components_new_module_added.yml @@ -2,7 +2,7 @@ name: Windows IIS Components New Module Added id: 55f22929-cfd3-4388-ba5c-4d01fac7ee7e version: 11 creation_date: '2022-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -28,6 +28,7 @@ references: - https://www.secureworks.com/research/bronze-union - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004 - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1505.004/T1505.004.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - IIS Components - GhostRedirector IIS Module and Rungan Backdoor asset_type: Endpoint +atomic_guid: + - 53adbdfa-8200-490c-871c-d3b1ab3324b2 mitre_attack_id: - T1505.004 product: diff --git a/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml b/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml index 15a6f78e8d8..bfc8e823e9e 100644 --- a/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml +++ b/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml @@ -2,7 +2,7 @@ name: Windows Impair Defenses Disable Auto Logger Session id: dc6a5613-d024-47e7-9997-ab6477a483d3 version: 9 creation_date: '2020-11-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -18,6 +18,7 @@ references: - https://isc.sans.edu/diary/rss/28628 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1201 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -37,6 +38,8 @@ analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 653c6e17-14a2-4849-851d-f1c0cc8ea9ab mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/windows_impair_defenses_disable_hvci.yml b/detections/endpoint/windows_impair_defenses_disable_hvci.yml index 01a14841644..9e676c6e08c 100644 --- a/detections/endpoint/windows_impair_defenses_disable_hvci.yml +++ b/detections/endpoint/windows_impair_defenses_disable_hvci.yml @@ -2,7 +2,7 @@ name: Windows Impair Defenses Disable HVCI id: b061dfcc-f0aa-42cc-a6d4-a87f172acb79 version: 11 creation_date: '2023-04-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives will be limited to administrative scripts disabling HVCI. Filter as needed. references: - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L913 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml index de6a411fc9d..3ba7218fe85 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml @@ -28,6 +28,7 @@ known_false_positives: Some legacy applications may be run using pcalua.exe. Sim references: - https://twitter.com/KyleHanslovan/status/912659279806640128 - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml#L27 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - Living Off The Land - Windows Post-Exploitation asset_type: Endpoint +atomic_guid: + - 8b34a448-40d9-4fc3-a8c8-4bb286faf7dc mitre_attack_id: - T1202 product: diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml index 296099e1af8..3cbdbe4f1c9 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml @@ -28,6 +28,7 @@ known_false_positives: Some legacy applications may be run using pcalua.exe. Fi references: - https://twitter.com/KyleHanslovan/status/912659279806640128 - https://lolbas-project.github.io/lolbas/Binaries/Pcalua/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -46,6 +47,8 @@ finding: analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - cecfea7a-5f03-4cdd-8bc8-6f7c22862440 mitre_attack_id: - T1202 product: diff --git a/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml index ef5bbd798f5..c514963b3ea 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml @@ -2,7 +2,7 @@ name: Windows Indirect Command Execution Via Series Of Forfiles id: bfdaabe7-3db8-48c5-80c1-220f9b8f22be version: 11 creation_date: '2022-12-07' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -29,6 +29,7 @@ references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml#L27 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -48,6 +49,8 @@ analytic_story: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint +atomic_guid: + - 8b34a448-40d9-4fc3-a8c8-4bb286faf7dc mitre_attack_id: - T1202 product: diff --git a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml index f770c33e4da..8353103cd7c 100644 --- a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml +++ b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml @@ -2,7 +2,7 @@ name: Windows Input Capture Using Credential UI Dll id: 406c21d6-6c75-4e9f-9ca9-48049a1dd90e version: 9 creation_date: '2022-08-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -15,10 +15,13 @@ known_false_positives: this module can be loaded by a third party application. F references: - https://docs.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-creduipromptforcredentialsa - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md#atomic-test-2---powershell---prompt-user-for-password + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1056.002/T1056.002.yaml#L16 analytic_story: - Brute Ratel C4 - APT37 Rustonotto and FadeStealer asset_type: Endpoint +atomic_guid: + - 2b162bfd-0928-4d4c-9ec3-4d9f88374b52 mitre_attack_id: - T1056.002 product: diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml index 9bbc67e9c51..76c22050810 100644 --- a/detections/endpoint/windows_installutil_in_non_standard_path.yml +++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml @@ -2,7 +2,7 @@ name: Windows InstallUtil in Non Standard Path id: dcf74b22-7933-11ec-857c-acde48001122 version: 12 creation_date: '2022-01-20' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -19,6 +19,7 @@ references: - https://attack.mitre.org/techniques/T1036/003/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.004/T1218.004.yaml#L460 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -54,6 +55,8 @@ analytic_story: - Data Destruction - WhisperGate asset_type: Endpoint +atomic_guid: + - 559e6d06-bb42-4307-bff7-3b95a8254bad mitre_attack_id: - T1036.003 - T1218.004 diff --git a/detections/endpoint/windows_installutil_uninstall_option.yml b/detections/endpoint/windows_installutil_uninstall_option.yml index 9212841d132..52534c68fd3 100644 --- a/detections/endpoint/windows_installutil_uninstall_option.yml +++ b/detections/endpoint/windows_installutil_uninstall_option.yml @@ -2,7 +2,7 @@ name: Windows InstallUtil Uninstall Option id: cfa7b9ac-43f0-11ec-9b48-acde48001122 version: 14 creation_date: '2021-11-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -18,6 +18,7 @@ references: - https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12 - https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.004/T1218.004.yaml#L265 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -49,6 +50,8 @@ analytic_story: - Compromised Windows Host - Signed Binary Proxy Execution InstallUtil asset_type: Endpoint +atomic_guid: + - 34428cfa-8e38-41e5-aff4-9e1f8f3a7b4b mitre_attack_id: - T1218.004 product: diff --git a/detections/endpoint/windows_ldifde_directory_object_behavior.yml b/detections/endpoint/windows_ldifde_directory_object_behavior.yml index f6cb824804e..03d828f6386 100644 --- a/detections/endpoint/windows_ldifde_directory_object_behavior.yml +++ b/detections/endpoint/windows_ldifde_directory_object_behavior.yml @@ -2,7 +2,7 @@ name: Windows Ldifde Directory Object Behavior id: 35cd29ca-f08c-4489-8815-f715c45460d3 version: 12 creation_date: '2023-05-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF - https://twitter.com/0gtweet/status/1564968845726580736?s=20 - https://strontic.github.io/xcyclopedia/library/ldifde.exe-45D28FB47E9B6ACC5DCA9FDA3E790210.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L211 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' diff --git a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml index 68e4ad1895d..87f0252f6b7 100644 --- a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml +++ b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml @@ -2,7 +2,7 @@ name: Windows Linked Policies In ADSI Discovery id: 510ea428-4731-4d2f-8829-a28293e427aa version: 11 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -26,6 +26,7 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - https://medium.com/@pentesttas/discover-hidden-gpo-s-on-active-directory-using-ps-adsi-a284b6814c81 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L247 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -46,6 +47,8 @@ analytic_story: - Active Directory Discovery - Industroyer2 asset_type: Endpoint +atomic_guid: + - 7ab0205a-34e4-4a44-9b04-e1541d1a57be mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml index 53147d54e3d..710e1709ccf 100644 --- a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml +++ b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml @@ -2,7 +2,7 @@ name: Windows Mimikatz Crypto Export File Extensions id: 3a9a6806-16a8-4cda-8d73-b49d10a05b16 version: 10 creation_date: '2023-02-09' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -25,6 +25,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present and may need to be reviewed before this can be turned into a TTP. In addition, remove .pfx (standalone) if it's too much volume. references: - https://github.com/gentilkiwi/mimikatz/blob/master/mimikatz/modules/kuhl_m_crypto.c#L628-L645 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L377 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +46,8 @@ analytic_story: - CISA AA23-347A - Windows Certificate Services asset_type: Endpoint +atomic_guid: + - 290df60e-4b5d-4a5e-b0c7-dc5348ea0c86 mitre_attack_id: - T1649 product: diff --git a/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml b/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml index c2284f8abbd..8dcdd84b190 100644 --- a/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml +++ b/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry AuthenticationLevelOverride id: 6410a403-36bb-490f-a06a-11c3be7d2a41 version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1061 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ intermediate_findings: analytic_story: - DarkGate Malware asset_type: Endpoint +atomic_guid: + - 7e7b62e9-5f83-477d-8935-48600f38a3c6 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_auto_update_notif.yml b/detections/endpoint/windows_modify_registry_auto_update_notif.yml index 081b1225948..d7edff1a2b9 100644 --- a/detections/endpoint/windows_modify_registry_auto_update_notif.yml +++ b/detections/endpoint/windows_modify_registry_auto_update_notif.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Auto Update Notif id: 4d1409df-40c7-4b11-aec4-bd0e709dfc12 version: 11 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: administrators may enable or disable this feature that may cause some false positive. references: - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L835 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,7 +34,7 @@ analytic_story: - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - 335a6b15-b8d2-4a3f-a973-ad69aa2620d7 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disable_rdp.yml b/detections/endpoint/windows_modify_registry_disable_rdp.yml index b56ea1e175a..df4afcc733f 100644 --- a/detections/endpoint/windows_modify_registry_disable_rdp.yml +++ b/detections/endpoint/windows_modify_registry_disable_rdp.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disable RDP id: 11ed764f-eb9c-4be7-bdad-2209b9d33ee1 version: 10 creation_date: '2024-07-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: administrators may enable or disable this feature that may cause some false positive. references: - https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1138 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ analytic_story: - ShrinkLocker - Windows RDP Artifacts and Defense Evasion asset_type: Endpoint +atomic_guid: + - 5f8e36de-37ca-455e-b054-a2584f043c06 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml index a0e28655d9a..37ad6574340 100644 --- a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml +++ b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disable Toast Notifications id: ed4eeacb-8d5a-488e-bc97-1ce6ded63b84 version: 11 creation_date: '2022-06-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: administrators may enable or disable this feature that ma references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L563 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ intermediate_findings: analytic_story: - Azorult asset_type: Endpoint +atomic_guid: + - 003f466a-6010-4b15-803a-cbb478a314d7 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml index 48861e46a97..09e6f55681a 100644 --- a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml +++ b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disable Win Defender Raw Write Notif id: 0e5e25c3-32f4-46f7-ba4a-5b95c3b90f5b version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: Administrators may enable or disable this feature that ma references: - https://admx.help/?Category=SystemCenterEndpointProtection&Policy=Microsoft.Policies.Antimalware::real-time_protection_disablerawwritenotification - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L796 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Azorult - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 12e03af7-79f9-4f95-af48-d3f12f28a260 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml index da42d17dcd0..906d72ca7ff 100644 --- a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml +++ b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disable WinDefender Notifications id: 8e207707-ad40-4eb3-b865-3a52aec91f26 version: 12 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: administrators may enable or disable this feature that may cause some false positive. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L796 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml index cf6e6e234c2..d50a14b0a68 100644 --- a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml +++ b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disable Windows Security Center Notif id: 27ed3e79-6d86-44dd-b9ab-524451c97a7b version: 11 creation_date: '2022-06-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: administrators may enable or disable this feature that ma references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L577 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Azorult - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 45914594-8df6-4ea9-b3cc-7eb9321a807e mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml b/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml index 101583af230..d7047f51b85 100644 --- a/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml +++ b/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry DisableRemoteDesktopAntiAlias id: 4927c6f1-4667-42e6-bd7a-f5222116386b version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L994 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ finding: analytic_story: - DarkGate Malware asset_type: Endpoint +atomic_guid: + - 61d35188-f113-4334-8245-8c6556d43909 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml b/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml index 8bbf7c95860..1fd32a56a89 100644 --- a/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml +++ b/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry DisableSecuritySettings id: 989019b4-b7aa-418a-9a17-2293e91288b6 version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1007 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ analytic_story: - DarkGate Malware - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 4b81bcfa-fb0a-45e9-90c2-e3efe5160140 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml index afb52af6c27..c605fa982fa 100644 --- a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml +++ b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disabling WER Settings id: 21cbcaf1-b51f-496d-a0c1-858ff3070452 version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,6 +15,7 @@ known_false_positives: Administrators may enable or disable this feature that ma references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L675 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Azorult - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - d2c9e41e-cd86-473d-980d-b6403562e3e1 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml index fe7158b2008..7f813886786 100644 --- a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml +++ b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry DisAllow Windows App id: 4bc788d3-c83a-48c5-a4e2-e0c6dba57889 version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. Filter as needed. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L692 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ finding: analytic_story: - Azorult asset_type: Endpoint +atomic_guid: + - 71db768a-5a9c-4047-b5e7-59e01f188e84 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml index 0f7a6e5632a..4fcbff8da43 100644 --- a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml +++ b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Do Not Connect To Win Update id: e09c598e-8dd0-4e73-b740-4b96b689199e version: 11 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: administrators may enable or disable this feature that ma references: - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsUpdate::DoNotConnectToWindowsUpdateInternetLocations + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L848 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,7 +35,7 @@ analytic_story: - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - d1de3767-99c2-4c6c-8c5a-4ba4586474c8 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_dontshowui.yml b/detections/endpoint/windows_modify_registry_dontshowui.yml index d020f7be17d..26351e0a9f0 100644 --- a/detections/endpoint/windows_modify_registry_dontshowui.yml +++ b/detections/endpoint/windows_modify_registry_dontshowui.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry DontShowUI id: 4ff9767b-fdf2-489c-83a5-c6c34412d72e version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1020 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ finding: analytic_story: - DarkGate Malware asset_type: Endpoint +atomic_guid: + - 09147b61-40f6-4b2a-b6fb-9e73a3437c96 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml b/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml index 013437ecd0d..343b7fed613 100644 --- a/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml +++ b/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry EnableLinkedConnections id: 93048164-3358-4af0-8680-aa5f38440516 version: 12 creation_date: '2023-07-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. references: - https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L126 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_modify_registry_longpathsenabled.yml b/detections/endpoint/windows_modify_registry_longpathsenabled.yml index cb58e89edb6..ae6f6a9182a 100644 --- a/detections/endpoint/windows_modify_registry_longpathsenabled.yml +++ b/detections/endpoint/windows_modify_registry_longpathsenabled.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry LongPathsEnabled id: 36f9626c-4272-4808-aadd-267acce681c0 version: 12 creation_date: '2023-07-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. references: - https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L126 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml b/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml index 77dae0130ff..420b4c96813 100644 --- a/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml +++ b/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry MaxConnectionPerServer id: 064cd09f-1ff4-4823-97e0-45c2f5b087ec version: 11 creation_date: '2023-07-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: Administrators may enable or disable this feature that ma references: - https://asec.ahnlab.com/en/17692/ - https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/warzone#:~:text=Warzone%20RAT%20(AKA%20Ave%20Maria)%20is%20a%20remote%20access%20trojan,is%20as%20an%20information%20stealer. + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L890 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ intermediate_findings: analytic_story: - Warzone RAT asset_type: Endpoint +atomic_guid: + - 37950714-e923-4f92-8c7c-51e4b6fffbf6 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml index f99e065abb8..6d6fd1e86fd 100644 --- a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml +++ b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry No Auto Reboot With Logon User id: 6a12fa9f-580d-4627-8c7f-313e359bdc6a version: 11 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. references: - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L822 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,7 +34,7 @@ analytic_story: - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - 396f997b-c5f8-4a96-bb2c-3c8795cf459d mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_no_auto_update.yml b/detections/endpoint/windows_modify_registry_no_auto_update.yml index 566ad5c9469..4c332ede536 100644 --- a/detections/endpoint/windows_modify_registry_no_auto_update.yml +++ b/detections/endpoint/windows_modify_registry_no_auto_update.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry No Auto Update id: fbd4f333-17bb-4eab-89cb-860fa2e0600e version: 11 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. references: - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L809 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,7 +35,7 @@ analytic_story: - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - 01b20ca8-c7a3-4d86-af59-059f15ed5474 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml b/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml index 9c46c0f4a7c..14c926a0496 100644 --- a/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml +++ b/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry on Smart Card Group Policy id: 1522145a-8e86-4f83-89a8-baf62a8f489d version: 9 creation_date: '2024-07-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: administrators may enable or disable this feature that may cause some false positive. references: - https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1151 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ intermediate_findings: analytic_story: - ShrinkLocker asset_type: Endpoint +atomic_guid: + - 4c4bf587-fe7f-448f-ba8d-1ecec9db88be mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_proxyenable.yml b/detections/endpoint/windows_modify_registry_proxyenable.yml index 792d6146dfd..13261230dae 100644 --- a/detections/endpoint/windows_modify_registry_proxyenable.yml +++ b/detections/endpoint/windows_modify_registry_proxyenable.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry ProxyEnable id: b27f20bd-ef20-41d1-a1e9-25dedd5bf2f5 version: 11 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1034 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ intermediate_findings: analytic_story: - DarkGate Malware asset_type: Endpoint +atomic_guid: + - eb0ba433-63e5-4a8c-a9f0-27c4192e1336 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_proxyserver.yml b/detections/endpoint/windows_modify_registry_proxyserver.yml index c94161b8658..edfd77e587f 100644 --- a/detections/endpoint/windows_modify_registry_proxyserver.yml +++ b/detections/endpoint/windows_modify_registry_proxyserver.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry ProxyServer id: 12bdaa0b-3c59-4489-aae1-bff6d67746ef version: 11 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1047 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ intermediate_findings: analytic_story: - DarkGate Malware asset_type: Endpoint +atomic_guid: + - d88a3d3b-d016-4939-a745-03638aafd21b mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml index 32a3377cb70..302cd984a9b 100644 --- a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml +++ b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Suppress Win Defender Notif id: e3b42daf-fff4-429d-bec8-2a199468cea9 version: 11 creation_date: '2022-06-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: administrators may enable or disable this feature that ma references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L591 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Azorult - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - c30dada3-7777-4590-b970-dc890b8cf113 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_tamper_protection.yml b/detections/endpoint/windows_modify_registry_tamper_protection.yml index a1444c7c9fb..9dcb2e5c5d0 100644 --- a/detections/endpoint/windows_modify_registry_tamper_protection.yml +++ b/detections/endpoint/windows_modify_registry_tamper_protection.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Tamper Protection id: 12094335-88fc-4c3a-b55f-e62dd8c93c23 version: 12 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L861 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,7 +35,7 @@ analytic_story: - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - 3b625eaa-c10d-4635-af96-3eae7d2a2f3c mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index 377bb7c4cf9..014065e3024 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -2,7 +2,7 @@ name: Windows Modify Show Compress Color And Info Tip Registry id: b7548c2e-9a10-11ec-99e3-acde48001122 version: 15 creation_date: '2022-03-02' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: No false positives have been identified at this time. references: - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L498 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -35,6 +36,8 @@ analytic_story: - Windows Registry Abuse - Hermetic Wiper asset_type: Endpoint +atomic_guid: + - 795d3248-0394-4d4d-8e86-4e8df2a2693f mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml index 00b2ebf2c38..28d2662d68b 100644 --- a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml +++ b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml @@ -2,7 +2,7 @@ name: Windows MOF Event Triggered Execution via WMI id: e59b5a73-32bf-4467-a585-452c36ae10c1 version: 13 creation_date: '2022-07-19' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -20,6 +20,7 @@ references: - https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp - https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/ - https://www.sakshamdixit.com/wmi-events/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L86 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -50,6 +51,8 @@ analytic_story: - Living Off The Land - Compromised Windows Host asset_type: Endpoint +atomic_guid: + - 29786d7e-8916-4de6-9c55-be7b093b2706 mitre_attack_id: - T1546.003 product: diff --git a/detections/endpoint/windows_msiexec_dllregisterserver.yml b/detections/endpoint/windows_msiexec_dllregisterserver.yml index 3d5d5728659..ed67803245b 100644 --- a/detections/endpoint/windows_msiexec_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_dllregisterserver.yml @@ -2,7 +2,7 @@ name: Windows MSIExec DLLRegisterServer id: fdb59aef-d88f-4909-8369-ec2afbd2c398 version: 14 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: This analytic will need to be tuned for your environment references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.007/T1218.007.yaml#L253 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -60,6 +61,8 @@ analytic_story: - Windows System Binary Proxy Execution MSIExec - Water Gamayun asset_type: Endpoint +atomic_guid: + - 0106ffa5-fab6-4c7d-82e3-e6b8867d5e5d mitre_attack_id: - T1218.007 product: diff --git a/detections/endpoint/windows_msiexec_remote_download.yml b/detections/endpoint/windows_msiexec_remote_download.yml index b6fc68b7953..bfb1bd01bf6 100644 --- a/detections/endpoint/windows_msiexec_remote_download.yml +++ b/detections/endpoint/windows_msiexec_remote_download.yml @@ -2,7 +2,7 @@ name: Windows MSIExec Remote Download id: 6aa49ff2-3c92-4586-83e0-d83eb693dfda version: 17 creation_date: '2022-06-17' -modification_date: '2026-07-14' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -48,6 +48,7 @@ known_false_positives: | references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.007/T1218.007.yaml#L309 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -79,6 +80,8 @@ analytic_story: - StealC Stealer - SolarWinds WHD RCE Post Exploitation asset_type: Endpoint +atomic_guid: + - 44a4bedf-ffe3-452e-bee4-6925ab125662 mitre_attack_id: - T1218.007 product: diff --git a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml index 5886cd31667..8d9f150a6b8 100644 --- a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml @@ -2,7 +2,7 @@ name: Windows MSIExec Unregister DLLRegisterServer id: a27db3c5-1a9a-46df-a577-765d3f1a3c24 version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: This analytic will need to be tuned for your environment references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.007/T1218.007.yaml#L281 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Windows System Binary Proxy Execution MSIExec asset_type: Endpoint +atomic_guid: + - ab09ec85-4955-4f9c-b8e0-6851baf4d47f mitre_attack_id: - T1218.007 product: diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml index 2776bccf2e7..907bc7ac7de 100644 --- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml @@ -2,7 +2,7 @@ name: Windows Multiple Users Failed To Authenticate From Host Using NTLM id: 7ed272a4-9c77-11eb-af22-acde48001122 version: 13 creation_date: '2021-04-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -22,6 +22,7 @@ references: - https://attack.mitre.org/techniques/T1110/003/ - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1110.003/T1110.003.yaml#L55 drilldown_searches: - name: View the detection results for - "$Workstation$" search: '%original_detection_search% | search Workstation = "$Workstation$"' @@ -41,6 +42,8 @@ analytic_story: - Active Directory Password Spraying - Volt Typhoon asset_type: Endpoint +atomic_guid: + - f14d956a-5b6e-4a93-847f-0c415142f07d mitre_attack_id: - T1110.003 product: diff --git a/detections/endpoint/windows_net_system_service_discovery.yml b/detections/endpoint/windows_net_system_service_discovery.yml index db8ca969a59..78a2d604241 100644 --- a/detections/endpoint/windows_net_system_service_discovery.yml +++ b/detections/endpoint/windows_net_system_service_discovery.yml @@ -2,7 +2,7 @@ name: Windows Net System Service Discovery id: dd7da098-83b8-4c48-b09d-e51aeb621e81 version: 5 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -31,10 +31,13 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://cert.gov.ua/article/6284730 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1007/T1007.yaml#L20 analytic_story: - LAMEHUG - Gh0st RAT asset_type: Endpoint +atomic_guid: + - 5f864a3f-8ce9-45c0-812c-bdf7d8aeacc3 mitre_attack_id: - T1007 product: diff --git a/detections/endpoint/windows_network_share_interaction_via_net.yml b/detections/endpoint/windows_network_share_interaction_via_net.yml index 31f9444cb5e..dc8554eb1be 100644 --- a/detections/endpoint/windows_network_share_interaction_via_net.yml +++ b/detections/endpoint/windows_network_share_interaction_via_net.yml @@ -2,7 +2,7 @@ name: Windows Network Share Interaction Via Net id: e51fbdb0-0be0-474f-92ea-d289f71a695e version: 7 creation_date: '2024-07-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Dean Luxton status: production type: Hunting @@ -36,13 +36,16 @@ how_to_implement: The detection is based on data originating from either Endpoin known_false_positives: Administrators or power users may use this command. Additional filters needs to be applied. references: - https://attack.mitre.org/techniques/T1135/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml#L79 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1021.002/T1021.002.yaml#L5 analytic_story: - Active Directory Discovery - Active Directory Privilege Escalation - Network Discovery asset_type: Endpoint atomic_guid: - - ab39a04f-0c93-4540-9ff2-83f862c385ae + - 20f1097d-81c1-405c-8380-32174d493bbb + - 3386975b-367a-4fbb-9d77-4dcf3639ffd3 mitre_attack_id: - T1135 - T1039 diff --git a/detections/endpoint/windows_network_sniffing_tool_executed.yml b/detections/endpoint/windows_network_sniffing_tool_executed.yml index 66ede70c619..c2688a50b95 100644 --- a/detections/endpoint/windows_network_sniffing_tool_executed.yml +++ b/detections/endpoint/windows_network_sniffing_tool_executed.yml @@ -2,7 +2,7 @@ name: Windows Network Sniffing Tool Executed id: 0c594353-e12d-4867-92f6-2a1b8a1faf5f version: 1 creation_date: '2026-07-30' -modification_date: '2026-07-30' +modification_date: '2026-10-02' author: Raven Tait, Splunk status: production type: Anomaly @@ -51,6 +51,8 @@ known_false_positives: |- Legitimate network administrators and security teams may use these tools for authorized network monitoring and troubleshooting. Filter based on approved software inventory and known administrative activity. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1040/T1040.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml#L86 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml#L154 drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -80,6 +82,9 @@ analytic_story: - Windows Discovery Techniques - Network Discovery asset_type: Endpoint +atomic_guid: + - a5b2f6a0-24b4-493e-9590-c699f75723ca + - c67ba807-f48b-446e-b955-e4928cd1bf91 mitre_attack_id: - T1040 product: diff --git a/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml b/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml index 7f45ca027ab..428bde53f8e 100644 --- a/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml +++ b/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml @@ -2,7 +2,7 @@ name: Windows New Custom Security Descriptor Set On EventLog Channel id: c0e5dd5a-2117-41d5-a04c-82a762a86a38 version: 9 creation_date: '2023-01-18' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: No false positives have been identified at this time. a l references: - https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/set-event-log-security-locally-or-via-group-policy - https://attack.mitre.org/techniques/T1562/002/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L192 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -38,6 +39,8 @@ analytic_story: - LockBit Ransomware - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint +atomic_guid: + - a0cb81f8-44d0-4ac4-a8f3-c5c7f43a12c1 mitre_attack_id: - T1685.001 product: diff --git a/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml b/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml index 34dff0237d2..e8905ea4a08 100644 --- a/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml +++ b/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml @@ -2,7 +2,7 @@ name: Windows New EventLog ChannelAccess Registry Value Set id: 16eb11bc-ef42-42e8-9d0c-d21e0fa15725 version: 8 creation_date: '2024-12-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: False positives may be triggered from newly installed eve references: - https://web.archive.org/web/20220710181255/https://blog.minerva-labs.com/lockbit-3.0-aka-lockbit-black-is-here-with-a-new-icon-new-ransom-note-new-wallpaper-but-less-evasiveness - https://attack.mitre.org/techniques/T1562/002/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L170 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -38,6 +39,8 @@ analytic_story: - LockBit Ransomware - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint +atomic_guid: + - 85e6eff8-3ed4-4e03-ae50-aa6a404898a5 mitre_attack_id: - T1685.001 product: diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/endpoint/windows_nirsoft_advancedrun.yml index 7954dc5dcc7..b91a5c4c4c5 100644 --- a/detections/endpoint/windows_nirsoft_advancedrun.yml +++ b/detections/endpoint/windows_nirsoft_advancedrun.yml @@ -2,7 +2,7 @@ name: Windows NirSoft AdvancedRun id: bb4f3090-7ae4-11ec-897f-acde48001122 version: 12 creation_date: '2022-01-24' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -35,6 +35,7 @@ known_false_positives: False positives should be limited as it is specific to Ad references: - http://www.nirsoft.net/utils/advanced_run.html - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L623 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -67,6 +68,8 @@ analytic_story: - Data Destruction - WhisperGate asset_type: Endpoint +atomic_guid: + - 81ce22fd-9612-4154-918e-8a1f285d214d mitre_attack_id: - T1588.002 product: diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index 41f70c18715..eb146d19cc4 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -2,7 +2,7 @@ name: Windows NirSoft Utilities id: 5b2f4596-7d4c-11ec-88a7-acde48001122 version: 11 creation_date: '2022-01-24' -modification_date: '2026-09-22' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Hunting @@ -38,10 +38,13 @@ references: - https://www.cisa.gov/uscert/ncas/alerts/TA18-201A - http://www.nirsoft.net/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L623 analytic_story: - Data Destruction - WhisperGate asset_type: Endpoint +atomic_guid: + - 81ce22fd-9612-4154-918e-8a1f285d214d mitre_attack_id: - T1588.002 product: diff --git a/detections/endpoint/windows_non_system_account_targeting_lsass.yml b/detections/endpoint/windows_non_system_account_targeting_lsass.yml index 9b2389e4f62..902254e559a 100644 --- a/detections/endpoint/windows_non_system_account_targeting_lsass.yml +++ b/detections/endpoint/windows_non_system_account_targeting_lsass.yml @@ -2,7 +2,7 @@ name: Windows Non-System Account Targeting Lsass id: b1ce9a72-73cf-11ec-981b-acde48001122 version: 14 creation_date: '2022-01-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -18,6 +18,7 @@ references: - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html - https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1 - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$user_id$" and "$dest$" search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' @@ -48,6 +49,8 @@ analytic_story: - Lokibot - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/windows_odbcconf_hunting.yml b/detections/endpoint/windows_odbcconf_hunting.yml index c6541e4295d..600ac7ab14b 100644 --- a/detections/endpoint/windows_odbcconf_hunting.yml +++ b/detections/endpoint/windows_odbcconf_hunting.yml @@ -2,7 +2,7 @@ name: Windows Odbcconf Hunting id: 0562ad4b-fdaa-4882-b12f-7b8e0034cd72 version: 9 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Hunting @@ -30,9 +30,14 @@ known_false_positives: False positives will be present as this is meant to assis references: - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.008/T1218.008.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.008/T1218.008.yaml#L29 analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - 2430498b-06c0-4b92-a448-8ad263c388e2 + - 331ce274-f9c9-440b-9f8c-a1006e1fce0b mitre_attack_id: - T1218.008 product: diff --git a/detections/endpoint/windows_odbcconf_load_dll.yml b/detections/endpoint/windows_odbcconf_load_dll.yml index c1e6eb06967..73a269d2df5 100644 --- a/detections/endpoint/windows_odbcconf_load_dll.yml +++ b/detections/endpoint/windows_odbcconf_load_dll.yml @@ -2,7 +2,7 @@ name: Windows Odbcconf Load DLL id: 141e7fca-a9f0-40fd-a539-9aac8be41f1b version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: False positives may be present and filtering may need to references: - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.008/T1218.008.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - 2430498b-06c0-4b92-a448-8ad263c388e2 mitre_attack_id: - T1218.008 product: diff --git a/detections/endpoint/windows_odbcconf_load_response_file.yml b/detections/endpoint/windows_odbcconf_load_response_file.yml index cfb0efbea35..9a9028cbaf0 100644 --- a/detections/endpoint/windows_odbcconf_load_response_file.yml +++ b/detections/endpoint/windows_odbcconf_load_response_file.yml @@ -2,7 +2,7 @@ name: Windows Odbcconf Load Response File id: 1acafff9-1347-4b40-abae-f35aa4ba85c1 version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: False positives may be present and filtering may need to references: - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.008/T1218.008.yaml#L29 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - 331ce274-f9c9-440b-9f8c-a1006e1fce0b mitre_attack_id: - T1218.008 product: diff --git a/detections/endpoint/windows_outlook_webview_registry_modification.yml b/detections/endpoint/windows_outlook_webview_registry_modification.yml index 8793cec91b5..775ca988648 100644 --- a/detections/endpoint/windows_outlook_webview_registry_modification.yml +++ b/detections/endpoint/windows_outlook_webview_registry_modification.yml @@ -2,7 +2,7 @@ name: Windows Outlook WebView Registry Modification id: 6e1ad5d4-d9af-496a-96ec-f31c11cd09f2 version: 9 creation_date: '2024-07-30' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: False positives may occur if legitimate Outlook processes references: - https://gist.github.com/MHaggis/c6318acde2e2f691b550e3a491f49ff1 - https://github.com/trustedsec/specula/wiki + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1137.004/T1137.004.yaml#L6 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ intermediate_findings: analytic_story: - Suspicious Windows Registry Activities asset_type: Endpoint +atomic_guid: + - 7a91ad51-e6d2-4d43-9471-f26362f5738e mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml b/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml index a287671fc93..d12ab3f3c17 100644 --- a/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml +++ b/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml @@ -2,7 +2,7 @@ name: Windows Parent PID Spoofing with Explorer id: 17f8f69c-5d00-4c88-9c6f-493bbdef20a1 version: 13 creation_date: '2022-05-30' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://x.com/CyberRaiju/status/1273597319322058752?s=20 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1134.004/T1134.004.yaml#L90 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -48,6 +49,8 @@ analytic_story: - Compromised Windows Host - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - cbbff285-9051-444a-9d17-c07cd2d230eb mitre_attack_id: - T1134.004 product: diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml index 9d8d8f18398..c4dc611bb05 100644 --- a/detections/endpoint/windows_possible_credential_dumping.yml +++ b/detections/endpoint/windows_possible_credential_dumping.yml @@ -2,7 +2,7 @@ name: Windows Possible Credential Dumping id: e4723b92-7266-11ec-af45-acde48001122 version: 15 creation_date: '2022-01-11' -modification_date: '2026-09-08' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -60,6 +60,7 @@ references: - https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1 - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/Windows/TestHarnesses/T1003.001_DumpLSASS/DumpLSASS.ps1 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$user_id$" and "$dest$" search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' @@ -87,6 +88,8 @@ analytic_story: - CISA AA22-257A - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/windows_powershell_disable_http_logging.yml b/detections/endpoint/windows_powershell_disable_http_logging.yml index 13be42e2d9b..47ae84c3fc3 100644 --- a/detections/endpoint/windows_powershell_disable_http_logging.yml +++ b/detections/endpoint/windows_powershell_disable_http_logging.yml @@ -2,7 +2,7 @@ name: Windows PowerShell Disable HTTP Logging id: 27958de0-2857-43ca-9d4c-b255cf59dcab version: 13 creation_date: '2022-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -28,6 +28,7 @@ references: - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/ - https://www.secureworks.com/research/bronze-union + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L27 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -47,6 +48,8 @@ analytic_story: - IIS Components - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - a957fb0f-1e85-49b2-a211-413366784b1e mitre_attack_id: - T1505.004 - T1685.001 diff --git a/detections/endpoint/windows_powershell_export_certificate.yml b/detections/endpoint/windows_powershell_export_certificate.yml index 1ca80887919..11d6e2368d3 100644 --- a/detections/endpoint/windows_powershell_export_certificate.yml +++ b/detections/endpoint/windows_powershell_export_certificate.yml @@ -2,7 +2,7 @@ name: Windows PowerShell Export Certificate id: 5e38ded4-c964-41f4-8cb6-4a1a53c6929f version: 12 creation_date: '2023-02-03' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -27,6 +27,7 @@ known_false_positives: It is possible administrators or scripts may run these co references: - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj - https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1649/T1649.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +46,8 @@ intermediate_findings: analytic_story: - Windows Certificate Services asset_type: Endpoint +atomic_guid: + - eb121494-82d1-4148-9e2b-e624e03fbf3d mitre_attack_id: - T1552.004 - T1649 diff --git a/detections/endpoint/windows_powershell_export_pfxcertificate.yml b/detections/endpoint/windows_powershell_export_pfxcertificate.yml index 891c3a563f7..d497c1abb9e 100644 --- a/detections/endpoint/windows_powershell_export_pfxcertificate.yml +++ b/detections/endpoint/windows_powershell_export_pfxcertificate.yml @@ -2,7 +2,7 @@ name: Windows PowerShell Export PfxCertificate id: ed06725f-6da6-439f-9dcc-ab30e891297c version: 14 creation_date: '2023-02-03' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -26,6 +26,7 @@ known_false_positives: It is possible administrators or scripts may run these co references: - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L325 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -46,6 +47,8 @@ analytic_story: - Windows Certificate Services - Water Gamayun asset_type: Endpoint +atomic_guid: + - 7617f689-bbd8-44bc-adcd-6f8968897848 mitre_attack_id: - T1552.004 - T1649 diff --git a/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml b/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml index d1d0f0aa91c..e023cb7ee97 100644 --- a/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml +++ b/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml @@ -2,7 +2,7 @@ name: Windows PowerShell Get CIMInstance Remote Computer id: d8c972eb-ed84-431a-8869-ca4bd83257d1 version: 11 creation_date: '2023-03-27' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -25,6 +25,7 @@ how_to_implement: To successfully implement this analytic, you will need to enab known_false_positives: This is meant to be a low risk RBA anomaly analytic or to be used for hunting. Enable this with a low risk score and let it generate risk in the risk index. references: - https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/get-ciminstance?view=powershell-7.3 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1104 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -43,6 +44,8 @@ intermediate_findings: analytic_story: - Active Directory Lateral Movement asset_type: Endpoint +atomic_guid: + - ac494fe5-81a4-4897-af42-e774cf005ecb mitre_attack_id: - T1059.001 product: diff --git a/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml b/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml index 82cf168718d..e81a5f975ef 100644 --- a/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml +++ b/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml @@ -2,7 +2,7 @@ name: Windows PowerShell IIS Components WebGlobalModule Usage id: 33fc9f6f-0ce7-4696-924e-a69ec61a3d57 version: 13 creation_date: '2022-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ references: - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/ - https://www.secureworks.com/research/bronze-union - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1505.004/T1505.004.yaml#L39 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -49,6 +50,8 @@ analytic_story: - GhostRedirector IIS Module and Rungan Backdoor - IIS Components asset_type: Endpoint +atomic_guid: + - cc3381fb-4bd0-405c-a8e4-6cacfac3b06c mitre_attack_id: - T1505.004 product: diff --git a/detections/endpoint/windows_powershell_scheduletask.yml b/detections/endpoint/windows_powershell_scheduletask.yml index dc161addefa..2a5eed3da25 100644 --- a/detections/endpoint/windows_powershell_scheduletask.yml +++ b/detections/endpoint/windows_powershell_scheduletask.yml @@ -2,7 +2,7 @@ name: Windows PowerShell ScheduleTask id: ddf82fcb-e9ee-40e3-8712-a50b5bf323fc version: 14 creation_date: '2023-06-12' -modification_date: '2026-07-20' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -26,6 +26,7 @@ known_false_positives: Benign administrative tasks can also trigger alerts, nece references: - https://learn.microsoft.com/en-us/powershell/module/scheduledtasks/?view=windowsserver2022-ps - https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1053.005/T1053.005.yaml#L78 drilldown_searches: - name: View the detection results for - "$Computer$" and "$user_id$" search: '%original_detection_search% | search Computer = "$Computer$" user_id = "$user_id$"' diff --git a/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml b/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml index cbff0e938df..750c9d8558b 100644 --- a/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml +++ b/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml @@ -2,7 +2,7 @@ name: Windows PowerView Kerberos Service Ticket Request id: 970455a1-4ac2-47e1-a9a5-9e75443ddcb9 version: 11 creation_date: '2022-06-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Gowthamaraj Rajendran, Splunk status: production type: TTP @@ -29,6 +29,7 @@ references: - https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1 - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting - https://attack.mitre.org/techniques/T1558/003 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1558.003/T1558.003.yaml#L129 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -48,6 +49,8 @@ analytic_story: - Active Directory Kerberos Attacks - Rhysida Ransomware asset_type: Endpoint +atomic_guid: + - 902f4ed2-1aba-4133-90f2-cff6d299d6da mitre_attack_id: - T1558.003 product: diff --git a/detections/endpoint/windows_proxy_via_netsh.yml b/detections/endpoint/windows_proxy_via_netsh.yml index 0f29361b67d..1d1515e80c4 100644 --- a/detections/endpoint/windows_proxy_via_netsh.yml +++ b/detections/endpoint/windows_proxy_via_netsh.yml @@ -2,7 +2,7 @@ name: Windows Proxy Via Netsh id: c137bfe8-6036-4cff-b77b-4e327dd0a1cf version: 11 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Some VPN applications are known to launch netsh.exe. Outside of these instances, it is unusual for an executable to launch netsh.exe and run commands. references: - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1090.001/T1090.001.yaml#L81 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' diff --git a/detections/endpoint/windows_proxy_via_registry.yml b/detections/endpoint/windows_proxy_via_registry.yml index 23e5d18f0e7..11bd729a263 100644 --- a/detections/endpoint/windows_proxy_via_registry.yml +++ b/detections/endpoint/windows_proxy_via_registry.yml @@ -2,7 +2,7 @@ name: Windows Proxy Via Registry id: 0270455b-1385-4579-9ac5-e77046c508ae version: 12 creation_date: '2023-05-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: No false positives have been identified at this time. references: - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1090.001/T1090.001.yaml#L81 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_registry_bootexecute_modification.yml b/detections/endpoint/windows_registry_bootexecute_modification.yml index 4e2d65a3570..c730c2797a7 100644 --- a/detections/endpoint/windows_registry_bootexecute_modification.yml +++ b/detections/endpoint/windows_registry_bootexecute_modification.yml @@ -2,7 +2,7 @@ name: Windows Registry BootExecute Modification id: eabbac3a-45aa-4659-920f-6b8cff383fb8 version: 12 creation_date: '2023-05-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present and will need to be filtered. references: - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.001/T1547.001.yaml#L404 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ finding: analytic_story: - Windows BootKits asset_type: Endpoint +atomic_guid: + - 6e1666d5-3f2b-4b9a-80aa-f011322380d4 mitre_attack_id: - T1542 - T1547.001 diff --git a/detections/endpoint/windows_registry_certificate_added.yml b/detections/endpoint/windows_registry_certificate_added.yml index c1eb7a475bc..5cd9cd3a76f 100644 --- a/detections/endpoint/windows_registry_certificate_added.yml +++ b/detections/endpoint/windows_registry_certificate_added.yml @@ -2,7 +2,7 @@ name: Windows Registry Certificate Added id: 5ee98b2f-8b9e-457a-8bdc-dd41aaba9e87 version: 12 creation_date: '2022-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Teodeerick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: False positives will be limited to a legitimate business references: - https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1553.004 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1553.004/T1553.004.yaml#L116 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Windows Drivers - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 76f49d86-5eb1-461a-a032-a480f86652f1 mitre_attack_id: - T1553.004 product: diff --git a/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml b/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml index d09656e8646..fb9e911b686 100644 --- a/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml +++ b/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml @@ -2,7 +2,7 @@ name: Windows Registry Dotnet ETW Disabled Via ENV Variable id: 55502381-5cce-491b-9277-7cb1d10bc0df version: 11 creation_date: '2021-10-07' -modification_date: '2026-08-05' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -42,6 +42,10 @@ references: - https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 - https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/ - https://attack.mitre.org/techniques/T1562/006/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1621 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1630 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1639 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1649 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -67,6 +71,11 @@ analytic_story: - Windows Registry Abuse - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - fdac1f79-b833-4bab-b4a1-11b1ed676a4b + - b42c1f8c-399b-47ae-8fd8-763181395fee + - 110b4281-43fe-405f-a184-5d8eaf228ebf + - 4d61779d-be7f-425c-b560-0cafb2522911 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml index f5d8d1aea6e..dcafbddd166 100644 --- a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml +++ b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml @@ -2,7 +2,7 @@ name: Windows Registry Modification for Safe Mode Persistence id: c6149154-c9d8-11eb-9da7-acde48001122 version: 14 creation_date: '2022-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Michael Haag, Splunk status: production type: TTP @@ -17,6 +17,8 @@ references: - https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1112/T1112.md - https://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L533 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L548 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -37,6 +39,9 @@ analytic_story: - Windows Registry Abuse - Windows Drivers asset_type: Endpoint +atomic_guid: + - 1dd59fb3-1cb3-4828-805d-cf80b4c3bbb5 + - c173c948-65e5-499c-afbe-433722ed5bd4 mitre_attack_id: - T1547.001 product: diff --git a/detections/endpoint/windows_remote_create_service.yml b/detections/endpoint/windows_remote_create_service.yml index 644c9a52270..9feb7c268c2 100644 --- a/detections/endpoint/windows_remote_create_service.yml +++ b/detections/endpoint/windows_remote_create_service.yml @@ -2,7 +2,7 @@ name: Windows Remote Create Service id: 0dc44d03-8c00-482d-ba7c-796ba7ab18c9 version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -16,6 +16,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Note that false positives may occur, and filtering may be necessary, especially when it comes to remote service creation by administrators or software management utilities. references: - https://attack.mitre.org/techniques/T1543/003/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1543.003/T1543.003.yaml#L145 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -45,6 +46,8 @@ analytic_story: - CISA AA23-347A - BlackSuit Ransomware asset_type: Endpoint +atomic_guid: + - fb4151a2-db33-4f8c-b7f8-78ea8790f961 mitre_attack_id: - T1543.003 product: diff --git a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml index f0b4a4123e1..924a74e51c6 100644 --- a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml +++ b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml @@ -2,7 +2,7 @@ name: Windows Root Domain linked policies Discovery id: 80ffaede-1f12-49d5-a86e-b4b599b68b3c version: 11 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -26,6 +26,7 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - https://medium.com/@pentesttas/discover-hidden-gpo-s-on-active-directory-using-ps-adsi-a284b6814c81 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L260 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -46,6 +47,8 @@ analytic_story: - Active Directory Discovery - Industroyer2 asset_type: Endpoint +atomic_guid: + - 00c652e2-0750-4ca6-82ff-0204684a6fe4 mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/windows_runmru_command_execution.yml b/detections/endpoint/windows_runmru_command_execution.yml index 7768f86cb8d..035fa471453 100644 --- a/detections/endpoint/windows_runmru_command_execution.yml +++ b/detections/endpoint/windows_runmru_command_execution.yml @@ -2,7 +2,7 @@ name: Windows RunMRU Command Execution id: a15aa1ab-2b79-467f-8201-65e0f32d5b1a version: 11 creation_date: '2024-11-13' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: Anomaly @@ -17,6 +17,7 @@ references: - https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71 - https://www.forensafe.com/blogs/runmrukey.html - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/registry/registry_set/registry_set_runmru_command_execution.yml + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml#L79 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml b/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml index cc80df82e7f..6f28e045505 100644 --- a/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml +++ b/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml @@ -2,7 +2,7 @@ name: Windows ScManager Security Descriptor Tampering Via Sc.EXE id: 04023928-0381-4935-82cb-03372b2ef644 version: 9 creation_date: '2024-12-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: TTP @@ -36,6 +36,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/8ac5c4f84692b11ea2832d18d3dc6f1ce7fb4e41/atomics/T1569.002/T1569.002.md#atomic-test-7---modifying-acl-of-service-control-manager-via-sdet - https://0xv1n.github.io/posts/scmanager/ - https://attack.mitre.org/techniques/T1569/002/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1569.002/T1569.002.yaml#L208 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +64,8 @@ threat_objects: analytic_story: - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint +atomic_guid: + - bf07f520-3909-4ef5-aa22-877a50f2f77b mitre_attack_id: - T1569.002 product: diff --git a/detections/endpoint/windows_sensitive_group_discovery_with_net.yml b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml index 352d9aea298..0628f561ccf 100644 --- a/detections/endpoint/windows_sensitive_group_discovery_with_net.yml +++ b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml @@ -2,7 +2,7 @@ name: Windows Sensitive Group Discovery With Net id: d9eb7cda-5622-4722-bc88-7f2442f4b5af version: 9 creation_date: '2021-08-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Anomaly @@ -33,6 +33,7 @@ references: - https://adsecurity.org/?p=3658 - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L35 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -56,6 +57,8 @@ analytic_story: - IcedID - Microsoft WSUS CVE-2025-59287 asset_type: Endpoint +atomic_guid: + - 0afb5163-8181-432e-9405-4322710c0c37 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml index c4d05fdf286..37af44ada55 100644 --- a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -2,7 +2,7 @@ name: Windows Sensitive Registry Hive Dump Via CommandLine id: 5aaff29d-0cce-405b-9ee8-5d06b49d045e version: 11 creation_date: '2021-05-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Patrick Bareiss, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -49,6 +49,8 @@ references: - https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.002/T1003.002.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.002/T1003.002.yaml#L176 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -85,6 +87,9 @@ analytic_story: - Windows Registry Abuse - Seashell Blizzard asset_type: Endpoint +atomic_guid: + - 5c2571d0-1572-416d-9676-812e64ca9f44 + - 21df41be-cdd8-4695-a650-c3981113aa3c mitre_attack_id: - T1003.002 product: diff --git a/detections/endpoint/windows_service_create_with_tscon.yml b/detections/endpoint/windows_service_create_with_tscon.yml index 3e5a52271b7..7702b9a3d68 100644 --- a/detections/endpoint/windows_service_create_with_tscon.yml +++ b/detections/endpoint/windows_service_create_with_tscon.yml @@ -2,7 +2,7 @@ name: Windows Service Create with Tscon id: c13b3d74-6b63-4db5-a841-4206f0370077 version: 15 creation_date: '2023-03-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: False positives may arise in the RDP Hijacking analytic w references: - https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1563.002/T1563.002.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1563.002/T1563.002.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -61,6 +62,8 @@ analytic_story: - Compromised Windows Host - Windows RDP Artifacts and Defense Evasion asset_type: Endpoint +atomic_guid: + - a37ac520-b911-458e-8aed-c5f1576d9f46 mitre_attack_id: - T1543.003 - T1563.002 diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index f2509cb3cc7..6a955fbe973 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -2,7 +2,7 @@ name: Windows Service Creation Using Registry Entry id: 25212358-948e-11ec-ad47-acde48001122 version: 20 creation_date: '2022-02-23' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: Third party tools may used this technique to create services but not so common. references: - https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1574.011/T1574.011.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1574.011/T1574.011.yaml#L22 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +46,8 @@ analytic_story: - Brute Ratel C4 - Gh0st RAT asset_type: Endpoint +atomic_guid: + - f38e9eea-e1d7-4ba6-b716-584791963827 mitre_attack_id: - T1574.011 product: diff --git a/detections/endpoint/windows_service_execution_remcom.yml b/detections/endpoint/windows_service_execution_remcom.yml index be8ac4dd2b7..a98b4246e48 100644 --- a/detections/endpoint/windows_service_execution_remcom.yml +++ b/detections/endpoint/windows_service_execution_remcom.yml @@ -2,7 +2,7 @@ name: Windows Service Execution RemCom id: 7e3d68db-ea4d-419b-adbd-e14a525ecf09 version: 8 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -17,6 +17,7 @@ known_false_positives: False positives may be present based on Administrative us references: - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ - https://github.com/kavika13/RemCom + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1569.002/T1569.002.yaml#L158 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -46,6 +47,8 @@ threat_objects: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - a5d8cdeb-be90-43a9-8b26-cc618deac1e0 mitre_attack_id: - T1569.002 product: diff --git a/detections/endpoint/windows_service_stop_attempt.yml b/detections/endpoint/windows_service_stop_attempt.yml index 6008781baf6..800a48499cb 100644 --- a/detections/endpoint/windows_service_stop_attempt.yml +++ b/detections/endpoint/windows_service_stop_attempt.yml @@ -2,7 +2,7 @@ name: Windows Service Stop Attempt id: dd0f07ea-f08f-4d88-96e5-cb58156e82b6 version: 8 creation_date: '2022-11-30' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -34,6 +34,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Windows OS or software may stop and restart services due to some critical update. references: - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml#L25 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -49,6 +50,8 @@ analytic_story: - Scattered Lapsus$ Hunters - Gh0st RAT asset_type: Endpoint +atomic_guid: + - 41274289-ec9c-4213-bea4-e43c4aa57954 mitre_attack_id: - T1489 product: diff --git a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml index 62ee6a86437..7f30fc9011f 100644 --- a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml +++ b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml @@ -2,7 +2,7 @@ name: Windows Snake Malware File Modification Crmlog id: 27187e0e-c221-471d-a7bd-04f698985ff6 version: 9 creation_date: '2023-05-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present as the file pattern does match legitimate files on disk. It is possible other native tools write the same file name scheme. references: - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml#L208 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml index 6dd8cab6f1f..58cf6a4b3c8 100644 --- a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml +++ b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml @@ -2,7 +2,7 @@ name: Windows Snake Malware Kernel Driver Comadmin id: 628d9c7c-3242-43b5-9620-7234c080a726 version: 9 creation_date: '2023-05-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present, filter as needed. references: - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.006/T1547.006.yaml#L110 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml index f4a4d3beb98..8b662a65d1a 100644 --- a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml +++ b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml @@ -2,7 +2,7 @@ name: Windows Snake Malware Registry Modification wav OpenWithProgIds id: 13cf8b79-805d-443c-bf52-f55bd7610dfd version: 11 creation_date: '2023-05-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present and will require tuning based on program Ids in large organizations. references: - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L876 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_snake_malware_service_create.yml b/detections/endpoint/windows_snake_malware_service_create.yml index ec9bf5438b4..9417bdc3bd3 100644 --- a/detections/endpoint/windows_snake_malware_service_create.yml +++ b/detections/endpoint/windows_snake_malware_service_create.yml @@ -2,7 +2,7 @@ name: Windows Snake Malware Service Create id: 64eb091f-8cab-4b41-9b09-8fb4942377df version: 9 creation_date: '2023-05-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives should be limited as this is a strict primary indicator used by Snake Malware. references: - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1569.002/T1569.002.yaml#L192 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_sqlcmd_execution.yml b/detections/endpoint/windows_sqlcmd_execution.yml index 49330409033..05f388a9050 100644 --- a/detections/endpoint/windows_sqlcmd_execution.yml +++ b/detections/endpoint/windows_sqlcmd_execution.yml @@ -2,7 +2,7 @@ name: Windows SQLCMD Execution id: 4e7c2f85-8f02-4bd2-a48b-5ec98a2c5f72 version: 5 creation_date: '2025-02-13' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -28,10 +28,13 @@ references: - https://attack.mitre.org/techniques/T1213/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md#atomic-test-32---file-download-with-sqlcmdexe - https://unit42.paloaltonetworks.com/espionage-campaign-targets-south-asian-entities/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L900 analytic_story: - SQL Server Abuse - GhostRedirector IIS Module and Rungan Backdoor asset_type: Endpoint +atomic_guid: + - 6934c16e-0b3a-4e7f-ab8c-c414acd32181 mitre_attack_id: - T1059.003 product: diff --git a/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml b/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml index f4c330f6da8..88962307ce9 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml @@ -2,7 +2,7 @@ name: Windows Steal Authentication Certificates CryptoAPI id: 905d5692-6d7c-432f-bc7e-a6b4f464d40e version: 10 creation_date: '2023-02-09' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -22,6 +22,7 @@ how_to_implement: To implement this analytic, one will need to enable the Micros known_false_positives: False positives may be present in some instances of legitimate applications requiring to export certificates. Filter as needed. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-vista/cc749296(v=ws.10) + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1649/T1649.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -41,6 +42,8 @@ analytic_story: - Windows Certificate Services - Hellcat Ransomware asset_type: Endpoint +atomic_guid: + - eb121494-82d1-4148-9e2b-e624e03fbf3d mitre_attack_id: - T1649 product: diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml index 0b54ae8603d..c1ba66028d4 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml @@ -2,7 +2,7 @@ name: Windows Steal Authentication Certificates Export Certificate id: e39dc429-c2a5-4f1f-9c3c-6b211af6b332 version: 12 creation_date: '2023-02-03' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ known_false_positives: Filtering may be requried based on automated utilities an references: - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj - https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1649/T1649.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -57,6 +58,8 @@ threat_objects: analytic_story: - Windows Certificate Services asset_type: Endpoint +atomic_guid: + - eb121494-82d1-4148-9e2b-e624e03fbf3d mitre_attack_id: - T1649 product: diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml index bdddbd21249..703769f961c 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml @@ -2,7 +2,7 @@ name: Windows Steal Authentication Certificates Export PfxCertificate id: 391329f3-c14b-4b8d-8b37-ac5012637360 version: 12 creation_date: '2023-02-03' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ known_false_positives: Filtering may be requried based on automated utilities an references: - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L325 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -57,6 +58,8 @@ threat_objects: analytic_story: - Windows Certificate Services asset_type: Endpoint +atomic_guid: + - 7617f689-bbd8-44bc-adcd-6f8968897848 mitre_attack_id: - T1649 product: diff --git a/detections/endpoint/windows_subinacl_execution.yml b/detections/endpoint/windows_subinacl_execution.yml index 1618c7539e6..26d5dd45645 100644 --- a/detections/endpoint/windows_subinacl_execution.yml +++ b/detections/endpoint/windows_subinacl_execution.yml @@ -2,7 +2,7 @@ name: Windows SubInAcl Execution id: 12491419-1a6f-4af4-afc3-4e2052f0610e version: 9 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: Anomaly @@ -34,6 +34,7 @@ known_false_positives: No false positives have been identified at this time. sho references: - https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf - https://attack.mitre.org/techniques/T1222/001/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1222.001/T1222.001.yaml#L144 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint +atomic_guid: + - a8568b10-9ab9-4140-a523-1c72e0176924 mitre_attack_id: - T1222.001 product: diff --git a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 080690f079f..6cd471d6f50 100644 --- a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -2,7 +2,7 @@ name: Windows System Binary Proxy Execution Compiled HTML File Decompile id: 2acf0e19-4149-451c-a3f3-39cd3c77e37d version: 15 creation_date: '2022-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://redcanary.com/blog/introducing-atomictestharnesses/ - https://attack.mitre.org/techniques/T1218/001/ - https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.001/T1218.001.yaml#L191 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - Compromised Windows Host - APT37 Rustonotto and FadeStealer asset_type: Endpoint +atomic_guid: + - 20cb05e0-1fa5-406d-92c1-84da4ba01813 mitre_attack_id: - T1218.001 product: diff --git a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml index ea161433fb1..a0660e5aa91 100644 --- a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml +++ b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml @@ -2,7 +2,7 @@ name: Windows System Network Connections Discovery Netsh id: abfb7cc5-c275-4a97-9029-62cd8d4ffeca version: 12 creation_date: '2022-12-06' -modification_date: '2026-06-25' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -41,6 +41,7 @@ references: - https://attack.mitre.org/techniques/T1049/ - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1016/T1016.yaml#L21 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -64,6 +65,8 @@ analytic_story: - VIP Keylogger - Phantom Stealer asset_type: Endpoint +atomic_guid: + - 038263cb-00f4-4b0a-98ae-0696c67e1752 mitre_attack_id: - T1049 product: diff --git a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml index 6cdd11a4d42..42e84f9ed2e 100644 --- a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml +++ b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml @@ -2,7 +2,7 @@ name: Windows System Script Proxy Execution Syncappvpublishingserver id: 8dd73f89-682d-444c-8b41-8e679966ad3c version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: False positives may be present if the vbscript syncappvpu references: - https://lolbas-project.github.io/lolbas/Scripts/Syncappvpublishingserver/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1216/T1216.md#atomic-test-1---syncappvpublishingserver-signed-script-powershell-command-execution + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1216.002/T1216.002.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - 275d963d-3f36-476c-8bef-a2a3960ee6eb mitre_attack_id: - T1216 - T1218 diff --git a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml index 0e00d651980..2d254087fea 100644 --- a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml +++ b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml @@ -2,7 +2,7 @@ name: Windows System Time Discovery W32tm Delay id: b2cc69e7-11ba-42dc-a269-59c069a48870 version: 11 creation_date: '2022-07-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -31,6 +31,7 @@ references: - https://cert.gov.ua/article/405538 - https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1124/T1124.yaml#L42 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -49,6 +50,8 @@ intermediate_findings: analytic_story: - DarkCrystal RAT asset_type: Endpoint +atomic_guid: + - d5d5a6b0-0f92-42d8-985d-47aafa2dd4db mitre_attack_id: - T1124 product: diff --git a/detections/endpoint/windows_system_user_discovery_via_quser.yml b/detections/endpoint/windows_system_user_discovery_via_quser.yml index 3e67a3b86f3..94d79507ab5 100644 --- a/detections/endpoint/windows_system_user_discovery_via_quser.yml +++ b/detections/endpoint/windows_system_user_discovery_via_quser.yml @@ -2,7 +2,7 @@ name: Windows System User Discovery Via Quser id: 0c3f3e09-e47a-410e-856f-a02a5c5fafb0 version: 8 creation_date: '2022-12-13' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -33,11 +33,16 @@ references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L30 analytic_story: - Prestige Ransomware - Crypto Stealer - Windows Post-Exploitation asset_type: Endpoint +atomic_guid: + - 4c4959bf-addf-4b4a-be86-8d09cc1857aa + - 2a9b677d-a230-44f4-ad86-782df1ef108c mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/windows_wmi_process_call_create.yml b/detections/endpoint/windows_wmi_process_call_create.yml index 3e93492d9ef..72ddb7df02c 100644 --- a/detections/endpoint/windows_wmi_process_call_create.yml +++ b/detections/endpoint/windows_wmi_process_call_create.yml @@ -2,7 +2,7 @@ name: Windows WMI Process Call Create id: 0661c2de-93de-11ec-9833-acde48001122 version: 9 creation_date: '2022-02-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -32,6 +32,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/2b804d25418004a5f1ba50e9dc637946ab8733c7/atomics/T1047/T1047.md - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L85 analytic_story: - Volt Typhoon - Qakbot @@ -40,6 +41,8 @@ analytic_story: - CISA AA23-347A - Cactus Ransomware asset_type: Endpoint +atomic_guid: + - b3bdfc91-b33e-4c6d-a5c8-d64bee0276b3 mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/windows_wmi_reconnaissance_class_query.yml b/detections/endpoint/windows_wmi_reconnaissance_class_query.yml index 414b2eb0dd1..5170634032b 100644 --- a/detections/endpoint/windows_wmi_reconnaissance_class_query.yml +++ b/detections/endpoint/windows_wmi_reconnaissance_class_query.yml @@ -2,7 +2,7 @@ name: Windows WMI Reconnaissance Class Query id: 5e38bd3e-5da7-483d-aa61-27f7e8c27ad1 version: 3 creation_date: '2026-03-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -64,6 +64,9 @@ how_to_implement: | known_false_positives: Administrators may execute this command for testing or auditing. references: - https://malpedia.caad.fkie.fraunhofer.de/details/py.blankgrabber + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L24 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L43 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -91,6 +94,10 @@ threat_objects: analytic_story: - BlankGrabber Stealer asset_type: Endpoint +atomic_guid: + - c107778c-dcf5-47c5-af2e-1d058a3df3ea + - 5750aa16-0e59-4410-8b9a-8a47ca2788e2 + - 718aebaa-d0e0-471a-8241-c5afa69c7414 mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/windows_wmic_shadowcopy_delete.yml b/detections/endpoint/windows_wmic_shadowcopy_delete.yml index aad14e502be..26a3b9d0b51 100644 --- a/detections/endpoint/windows_wmic_shadowcopy_delete.yml +++ b/detections/endpoint/windows_wmic_shadowcopy_delete.yml @@ -2,7 +2,7 @@ name: Windows WMIC Shadowcopy Delete id: 0a8c4b26-a4e2-4ef1-b0d9-62af6d36bdc8 version: 5 creation_date: '2025-03-18' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, AJ King, Splunk status: production type: Anomaly @@ -20,6 +20,7 @@ known_false_positives: Legitimate system maintenance or backup operations may oc references: - https://any.run/malware-trends/cactus - https://attack.mitre.org/techniques/T1490/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L29 drilldown_searches: - name: View the detection results for - "$dest$" and "$process_name$" search: '%original_detection_search% | search dest = "$dest$" process_name = "$process_name$"' @@ -45,6 +46,8 @@ analytic_story: - Volt Typhoon - Suspicious WMI Use asset_type: Endpoint +atomic_guid: + - 6a3ff8dd-f49c-4272-a658-11c2fe58bd88 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/windows_wmic_systeminfo_discovery.yml b/detections/endpoint/windows_wmic_systeminfo_discovery.yml index e91dc6acd9f..e1c8573531c 100644 --- a/detections/endpoint/windows_wmic_systeminfo_discovery.yml +++ b/detections/endpoint/windows_wmic_systeminfo_discovery.yml @@ -2,7 +2,7 @@ name: Windows Wmic Systeminfo Discovery id: 97937ece-cb13-4dbc-9684-c0dc3afd400a version: 5 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators may execute this command for testing or auditing. references: - https://cert.gov.ua/article/6284730 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml#L381 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -58,6 +59,8 @@ analytic_story: - BlankGrabber Stealer - Lotus Blossom Chrysalis Backdoor asset_type: Endpoint +atomic_guid: + - 8851b73a-3624-4bf7-8704-aa312411565c mitre_attack_id: - T1082 product: diff --git a/detections/endpoint/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml index 367735a71ca..43eb55bf2d1 100644 --- a/detections/endpoint/wmi_permanent_event_subscription.yml +++ b/detections/endpoint/wmi_permanent_event_subscription.yml @@ -2,7 +2,7 @@ name: WMI Permanent Event Subscription id: 71bfdb13-f200-4c6c-b2c9-a2e07adf437d version: 11 creation_date: '2020-04-29' -modification_date: '2026-10-05' +modification_date: '2026-10-09' author: Rico Valdez, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -57,6 +57,9 @@ references: - https://learn.microsoft.com/en-us/windows/win32/wmisdk/binding-an-event-filter-with-a-logical-consumer - https://learn.microsoft.com/en-us/windows/win32/wmisdk/commandlineeventconsumer - https://learn.microsoft.com/en-us/windows/win32/wmisdk/activescripteventconsumer + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L44 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L86 intermediate_findings: entities: - field: dest @@ -69,6 +72,10 @@ threat_objects: analytic_story: - Suspicious WMI Use asset_type: Endpoint +atomic_guid: + - 3c64f177-28e2-49eb-a799-d767b24dd1e0 + - fecd0dfd-fb55-45fa-a10b-6250272d0832 + - 29786d7e-8916-4de6-9c55-be7b093b2706 mitre_attack_id: - T1546.003 product: diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index 605bf5d24e8..14db112d4c3 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -2,7 +2,7 @@ name: WMI Permanent Event Subscription - Sysmon id: ad05aae6-3b2a-4f73-af97-57bd26cee3b9 version: 13 creation_date: '2020-04-29' -modification_date: '2026-10-05' +modification_date: '2026-10-09' author: Rico Valdez, Michael Haag, Splunk status: production type: Anomaly @@ -35,6 +35,9 @@ references: - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ - https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/WMI-events.md - https://in.security/2019/04/03/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L44 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L86 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -53,6 +56,10 @@ intermediate_findings: analytic_story: - Suspicious WMI Use asset_type: Endpoint +atomic_guid: + - 3c64f177-28e2-49eb-a799-d767b24dd1e0 + - fecd0dfd-fb55-45fa-a10b-6250272d0832 + - 29786d7e-8916-4de6-9c55-be7b093b2706 mitre_attack_id: - T1546.003 product: diff --git a/detections/endpoint/wmic_group_discovery.yml b/detections/endpoint/wmic_group_discovery.yml index 2afa39f3c54..f8a291d67da 100644 --- a/detections/endpoint/wmic_group_discovery.yml +++ b/detections/endpoint/wmic_group_discovery.yml @@ -2,7 +2,7 @@ name: Wmic Group Discovery id: 83317b08-155b-11ec-8e00-acde48001122 version: 12 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://attack.mitre.org/techniques/T1069/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L83 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -58,6 +59,8 @@ analytic_story: - Active Directory Discovery - LAMEHUG asset_type: Endpoint +atomic_guid: + - 7413be50-be8e-430f-ad4d-07bf197884b2 mitre_attack_id: - T1069.001 product: diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml index 62ae6bd88a3..c3688205fd8 100644 --- a/detections/endpoint/wmic_xsl_execution_via_url.yml +++ b/detections/endpoint/wmic_xsl_execution_via_url.yml @@ -2,7 +2,7 @@ name: WMIC XSL Execution via URL id: 787e9dd0-4328-11ec-a029-acde48001122 version: 14 creation_date: '2021-11-12' -modification_date: '2026-07-14' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -53,6 +53,7 @@ references: - https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-4---wmic-bypass-using-remote-xsl-file - https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN-201017061100.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1220/T1220.yaml#L126 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -84,6 +85,8 @@ analytic_story: - Suspicious WMI Use - Cisco Network Visibility Module Analytics asset_type: Endpoint +atomic_guid: + - 7f5be499-33be-4129-a560-66021f379b9b mitre_attack_id: - T1220 product: diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml index d37e6117534..5497c015bc5 100644 --- a/detections/endpoint/xsl_script_execution_with_wmic.yml +++ b/detections/endpoint/xsl_script_execution_with_wmic.yml @@ -2,7 +2,7 @@ name: XSL Script Execution With WMIC id: 004e32e2-146d-11ec-a83f-acde48001122 version: 13 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://attack.mitre.org/groups/G0046/ - https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-3---wmic-bypass-using-local-xsl-file + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1220/T1220.yaml#L92 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - FIN7 - Suspicious WMI Use asset_type: Endpoint +atomic_guid: + - 1b237334-3e21-4a0c-8178-b8c996124988 mitre_attack_id: - T1220 product: From a13d5f78d9dce3d006b8706783c665536eee618b Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Tue, 13 Oct 2026 12:22:57 +0200 Subject: [PATCH 145/162] Promote AI Content to Prod and Enhance it (#4287) --- .../ollama_abnormal_network_connectivity.yml | 88 +++++++++++------ .../ollama_excessive_api_requests.yml | 61 +++++++++--- ...ollama_long_running_inference_requests.yml | 97 +++++++++++++++++++ ...sible_api_endpoint_scan_reconnaissance.yml | 78 ++++++++++----- ...sible_memory_exhaustion_resource_abuse.yml | 69 ++++++++++--- .../ollama_repeated_application_errors.yml | 85 ++++++++++++++++ ...rmal_service_crash_availability_attack.yml | 14 ++- ...ssible_model_exfiltration_data_leakage.yml | 10 +- .../ollama_possible_rce_via_model_loading.yml | 13 ++- ..._suspicious_prompt_injection_jailbreak.yml | 14 ++- 10 files changed, 429 insertions(+), 100 deletions(-) create mode 100644 detections/application/ollama_long_running_inference_requests.yml create mode 100644 detections/application/ollama_repeated_application_errors.yml rename detections/{application => deprecated}/ollama_abnormal_service_crash_availability_attack.yml (90%) rename detections/{application => deprecated}/ollama_possible_model_exfiltration_data_leakage.yml (92%) rename detections/{application => deprecated}/ollama_possible_rce_via_model_loading.yml (92%) rename detections/{application => deprecated}/ollama_suspicious_prompt_injection_jailbreak.yml (90%) diff --git a/detections/application/ollama_abnormal_network_connectivity.yml b/detections/application/ollama_abnormal_network_connectivity.yml index c12fe51364c..2a48c920127 100644 --- a/detections/application/ollama_abnormal_network_connectivity.yml +++ b/detections/application/ollama_abnormal_network_connectivity.yml @@ -1,54 +1,79 @@ name: Ollama Abnormal Network Connectivity id: 19ec30ad-faa2-496a-a6a9-f2e5f778fbdb -version: 5 +version: 6 creation_date: '2025-10-13' -modification_date: '2026-05-13' -author: Rod Soto -status: experimental +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production type: Anomaly -description: Detects abnormal network activity and connectivity issues in Ollama including non-localhost API access attempts and warning-level network errors such as DNS lookup failures, TCP connection issues, or host resolution problems that may indicate network-based attacks, unauthorized access attempts, or infrastructure reconnaissance activity. +description: |- + Detects repeated Ollama warning-level network errors, such as DNS lookup failures, TCP connection issues, or host resolution problems. These events can indicate a connectivity issue and warrant investigation, but do not by themselves establish unauthorized access or reconnaissance. data_source: - Ollama Server search: |- - `ollama_server` level=WARN (msg="*failed*" OR msg="*dial tcp*" OR msg="*lookup*" OR msg="*no such host*" OR msg="*connection*" OR msg="*network*" OR msg="*timeout*" OR msg="*unreachable*" OR msg="*refused*") - | eval src=coalesce(src, src_ip, "N/A") - | stats count as incidents, values(src) as src, values(msg) as warning_messages, latest(_time) as last_incident - BY host - | eval last_incident=strftime(last_incident, "%Y-%m-%d %H:%M:%S") - | eval severity="medium" - | eval attack_type="Abnormal Network Connectivity" - | stats count - BY last_incident, host, incidents, - src, warning_messages, severity, - attack_type - | `ollama_abnormal_network_connectivity_filter` -how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' -known_false_positives: Legitimate remote access from authorized users or applications connecting from non-localhost addresses, temporary network infrastructure issues causing DNS resolution failures, firewall or network configuration changes resulting in connection timeouts, cloud-hosted Ollama instances receiving valid external API requests, or intermittent connectivity problems during network maintenance may trigger this detection during normal operations. + `ollama_server` + level=WARN + msg IN ( + "*connection*", + "*dial tcp*", + "*failed*", + "*lookup*", + "*network*", + "*no such host*", + "*refused*", + "*timeout*", + "*unreachable*" + ) + + | bin _time span=5m + | stats count as incidents + values(msg) as warning_messages + latest(_time) as last_incident + by _time dest + + | where incidents > 3 + + | eval last_incident=strftime(last_incident, "%Y-%m-%d %H:%M:%S") + + | eval severity="medium" + + | eval attack_type="Abnormal Network Connectivity" + + | table last_incident dest incidents warning_messages severity attack_type + + | `ollama_abnormal_network_connectivity_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate remote access from authorized users or applications connecting from non-localhost addresses, temporary network infrastructure issues causing DNS resolution failures, firewall or network configuration changes resulting in connection timeouts, cloud-hosted Ollama instances receiving valid external API requests, or intermittent connectivity problems during network maintenance may trigger this detection during normal operations. references: - https://github.com/rosplk/ta-ollama drilldown_searches: - - name: View the detection results for - "$src$" - search: '%original_detection_search% | search "$src = "$src$"' + - name: View the detection results for - "$dest$" + search: |- + %original_detection_search% + | search dest="$dest$" earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - - name: View risk events for the last 7 days for - "$src$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$",) | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + - name: View risk events for the last 7 days for - "$dest$" + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$dest$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` earliest_offset: 7d latest_offset: "0" intermediate_findings: entities: - - field: host + - field: dest type: system score: 20 - message: 'Abnormal network activity detected on $host$ with $incidents$ incidents from $src$. Investigation needed for network errors: $warning_messages$.' -threat_objects: - - field: src - type: system + message: Abnormal network activity on [$dest$] with [$incidents$] matching warnings [$warning_messages$]. Investigate DNS and network reachability. analytic_story: - Suspicious Ollama Activities asset_type: Web Application -mitre_attack_id: - - T1571 +mitre_attack_id: [] product: - Splunk Enterprise - Splunk Enterprise Security @@ -61,5 +86,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log sourcetype: ollama:server source: app.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_excessive_api_requests.yml b/detections/application/ollama_excessive_api_requests.yml index 42f4958876a..76eb6313a1f 100644 --- a/detections/application/ollama_excessive_api_requests.yml +++ b/detections/application/ollama_excessive_api_requests.yml @@ -1,26 +1,62 @@ name: Ollama Excessive API Requests id: 1cfab663-9adc-4169-a88c-6bae29ba3c70 -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' -author: Rod Soto -status: experimental +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production type: Anomaly -description: Detects potential Distributed Denial of Service (DDoS) attacks or rate limit abuse against Ollama API endpoints by identifying excessive request volumes from individual client IP addresses. This detection monitors GIN-formatted Ollama server logs to identify clients generating abnormally high request rates within short time windows, which may indicate automated attacks, botnet activity, or resource exhaustion attempts targeting local AI model infrastructure. +description: Detects high Ollama API request volumes from a single client in a short time window. A burst may indicate automated abuse or contribute to resource contention, but GIN access logs do not establish malicious intent or service impact; validate the client and workload against local usage baselines. data_source: - Ollama Server -search: '`ollama_server` | rex field=_raw "\|\s+(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+\|" | eval src=coalesce(src, client_ip) | eval dest=coalesce(dest, url, uripath, endpoint) | bin _time span=5m | stats count as request_count by _time, src, dest, host | where request_count > 120 | eval severity="high" | eval attack_type="Rate Limit Abuse / DDoS" | stats count by _time, host, src, dest, request_count, severity, attack_type | `ollama_excessive_api_requests_filter`' -how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' -known_false_positives: Legitimate automated services (CI/CD pipelines, monitoring tools, batch jobs), multiple users behind NAT/proxy infrastructure, or authorized load testing activities may trigger this detection during normal operations. Operator must adjust threshold accordingly. +search: |- + `ollama_server` + "[GIN]" + + | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+(?:µs|ms|s))\s+\|\s+(?[^|]+?)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" + + | eval src=coalesce(src, trim(raw_src)) + | eval uri_path=coalesce(uri_path, raw_path) + | eval http_method=coalesce(http_method, raw_method) + | eval http_response_code=coalesce(http_response_code, raw_status) + | eval response_time_ms=coalesce(response_time_ms, case(match(raw_latency, "µs$"), tonumber(replace(raw_latency, "µs", ""))/1000, match(raw_latency, "ms$"), tonumber(replace(raw_latency, "ms", "")), match(raw_latency, "s$"), tonumber(replace(raw_latency, "s", ""))*1000)) + + | where isnotnull(src) + + | bin _time span=5m + + | stats count as request_count + dc(uri_path) as distinct_endpoints + values(uri_path) as endpoints + by _time src + + | where request_count > 120 + + | eval severity="medium" + + | eval attack_type="High Volume API Activity" + + | `ollama_excessive_api_requests_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate automated services (CI/CD pipelines, monitoring tools, batch jobs), multiple users behind NAT/proxy infrastructure, or authorized load testing activities may trigger this detection during normal operations. Operator must adjust threshold accordingly. references: - https://github.com/rosplk/ta-ollama drilldown_searches: - name: View the detection results for - "$src$" - search: '%original_detection_search% | search "$src = "$src$"' + search: |- + %original_detection_search% + | search src="$src$" earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$src$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$src$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` earliest_offset: 7d latest_offset: "0" intermediate_findings: @@ -28,7 +64,7 @@ intermediate_findings: - field: src type: system score: 20 - message: Possible DDoS attack from $src$ against Ollama server detected with request count $request_count$ in 1 minute, potentially causing service degradation or complete unavailability. + message: '[$request_count$] Ollama API requests from [$src$] across [$distinct_endpoints$] endpoints were observed in 5 minutes. Validate the client and workload before attributing the burst to abuse or service impact.' analytic_story: - Suspicious Ollama Activities asset_type: Web Application @@ -46,5 +82,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_long_running_inference_requests.yml b/detections/application/ollama_long_running_inference_requests.yml new file mode 100644 index 00000000000..49661c873ee --- /dev/null +++ b/detections/application/ollama_long_running_inference_requests.yml @@ -0,0 +1,97 @@ +name: Ollama Long-Running Inference Requests +id: 7619c98c-f53b-445f-87ca-b148e8560340 +version: 1 +creation_date: '2026-10-09' +modification_date: '2026-10-10' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: |- + Identifies repeated Ollama inference requests with long response times on /api/generate, /api/chat, and /v1/chat/completions. + Long response time can result from model size, prompt length, host resources, or normal workload. GIN access logs do not include prompt content and cannot establish a prompt injection or jailbreak attempt, so use this as an exploratory performance signal. +data_source: + - Ollama Server +search: |- + `ollama_server` + "[GIN]" + + | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?(?:\d+h)?(?:\d+m)?[\d\.]+(?:µs|ms|s))\s+\|\s+(?[^|]+?)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" + + | eval src=coalesce(src, trim(raw_src)) + | eval uri_path=mvindex(split(coalesce(uri_path, raw_path), "?"), 0) + | eval http_method=coalesce(http_method, raw_method) + | eval http_response_code=coalesce(http_response_code, raw_status) + | rex field=raw_latency "^(?:(?\d+)h)?(?:(?\d+)m)?(?[\d\.]+)(?µs|ms|s)$" + | eval response_time_ms=(coalesce(tonumber(raw_latency_hours), 0) * 3600000) + (coalesce(tonumber(raw_latency_minutes), 0) * 60000) + (tonumber(raw_latency_value) * case(raw_latency_unit="µs", 0.001, raw_latency_unit="ms", 1, raw_latency_unit="s", 1000)) + + | where isnotnull(src) AND in(uri_path, "/api/generate", "/api/chat", "/v1/chat/completions") AND response_time_ms > 30000 + + | eval response_time_seconds=response_time_ms/1000 + + | bin _time span=10m + + | stats count as long_request_count + avg(response_time_seconds) as avg_response_time + max(response_time_seconds) as max_response_time + values(uri_path) as uri_path + values(http_response_code) as status_codes + by _time src host + + | where long_request_count > 1 + + | eval avg_response_time=round(avg_response_time, 2) + | eval max_response_time=round(max_response_time, 2) + | eval severity=case(max_response_time > 55, "high", 1=1, "medium") + | eval attack_type="Long-Running Inference Requests" + + | table _time host src uri_path long_request_count + avg_response_time max_response_time + status_codes severity attack_type + + | `ollama_long_running_inference_requests_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate complex queries requiring extensive model reasoning, large context windows processing substantial amounts of text, batch processing operations, or resource-constrained systems experiencing performance degradation may trigger this detection during normal operations. +references: + - https://github.com/rosplk/ta-ollama + - https://github.com/OWASP/www-project-ai-testing-guide +drilldown_searches: + - name: View the detection results for - "$src$" + search: |- + %original_detection_search% + | search src="$src$" + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$src$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: '[$long_request_count$] long-running inference requests from [$src$] averaged [$avg_response_time$] seconds and reached [$max_response_time$] seconds. Investigate workload, model size, prompt length, and host capacity; access logs do not establish prompt injection or data exfiltration.' +analytic_story: + - Suspicious Ollama Activities +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log + sourcetype: ollama:server + source: server.log + test_type: unit diff --git a/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml b/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml index aa1b54cd733..524253871e7 100644 --- a/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml +++ b/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml @@ -1,38 +1,69 @@ name: Ollama Possible API Endpoint Scan Reconnaissance id: ad3f352a-0347-48ee-86b9-670b5025a548 -version: 5 +version: 6 creation_date: '2025-10-13' -modification_date: '2026-05-13' -author: Rod Soto -status: experimental +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production type: Anomaly -description: Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks. +description: |- + Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks. data_source: - Ollama Server search: |- - `ollama_server` "[GIN]" - | bin _time span=5m - | stats count as total_requests, values(dest) as dest, values(http_method) as methods, values(status) as status_codes - BY _time, src, host - | where total_requests > 120 - | eval severity="medium" - | eval attack_type="API Activity Surge" - | stats count - BY _time, host, src, - total_requests, dest, methods, - status_codes, severity, attack_type - | `ollama_possible_api_endpoint_scan_reconnaissance_filter` -how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' -known_false_positives: Legitimate web application clients or mobile apps that access multiple API endpoints as part of normal functionality, monitoring and health check systems probing various endpoints for availability, load balancers performing health checks across different paths, API testing frameworks during development and QA processes, or users navigating through web interfaces that trigger multiple API calls may generate similar patterns during normal operations. + `ollama_server` + "[GIN]" + + | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+(?:µs|ms|s))\s+\|\s+(?[^|]+?)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" + + | eval src=coalesce(src, trim(raw_src)) + | eval uri_path=coalesce(uri_path, raw_path) + | eval http_method=coalesce(http_method, raw_method) + | eval http_response_code=coalesce(http_response_code, raw_status) + | eval response_time_ms=coalesce(response_time_ms, case(match(raw_latency, "µs$"), tonumber(replace(raw_latency, "µs", ""))/1000, match(raw_latency, "ms$"), tonumber(replace(raw_latency, "ms", "")), match(raw_latency, "s$"), tonumber(replace(raw_latency, "s", ""))*1000)) + + | where isnotnull(src) AND isnotnull(uri_path) + + | bin _time span=5m + + | stats count as total_requests + dc(uri_path) as distinct_endpoints + count(eval(http_method="HEAD")) as head_requests + values(uri_path) as endpoints + values(http_method) as methods + values(http_response_code) as status_codes + by _time src host + + | where total_requests > 120 AND (distinct_endpoints >= 3 OR (distinct_endpoints >= 2 AND head_requests > 0)) + + | eval severity="medium" + | eval attack_type="API Activity Surge" + + | table _time host src total_requests + distinct_endpoints endpoints methods + status_codes severity attack_type + + | `ollama_possible_api_endpoint_scan_reconnaissance_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate web application clients or mobile apps that access multiple API endpoints as part of normal functionality, monitoring and health check systems probing various endpoints for availability, load balancers performing health checks across different paths, API testing frameworks during development and QA processes, or users navigating through web interfaces that trigger multiple API calls may generate similar patterns during normal operations. references: - https://github.com/rosplk/ta-ollama drilldown_searches: - name: View the detection results for - "$src$" - search: '%original_detection_search% | search "$src = "$src$"' + search: |- + %original_detection_search% + | search src="$src$" earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$src$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$src$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` earliest_offset: 7d latest_offset: "0" intermediate_findings: @@ -40,7 +71,7 @@ intermediate_findings: - field: src type: system score: 20 - message: API reconnaissance activity detected from $src$ on $host$ with $total_requests$ requests across different endpoints using methods $methods$ and receiving status codes $status_codes$, indicating systematic endpoint enumeration to map API attack surface and identify potential vulnerabilities. + message: 'Possible API reconnaissance from [$src$] on [$host$] with [$total_requests$] requests across [$distinct_endpoints$] endpoints ([$endpoints$]) using methods [$methods$] and receiving status codes [$status_codes$].' analytic_story: - Suspicious Ollama Activities asset_type: Web Application @@ -58,5 +89,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml b/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml index 6b9e2b38cbc..a124408fcbb 100644 --- a/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml +++ b/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml @@ -1,26 +1,70 @@ name: Ollama Possible Memory Exhaustion Resource Abuse id: ca96297f-e82e-4749-8cc9-d1ab555abb57 -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' -author: Rod Soto -status: experimental +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production type: Anomaly -description: Detects abnormal memory allocation patterns and excessive runner operations in Ollama that may indicate resource exhaustion attacks, memory abuse through malicious model loading, or attempts to degrade system performance by overwhelming GPU/CPU resources. Adversaries may deliberately load multiple large models, trigger repeated model initialization cycles, or exploit memory allocation mechanisms to exhaust available system resources, causing denial of service conditions or degrading performance for legitimate users. +description: |- + Identifies high Ollama runner counts and large model buffer allocations as possible resource pressure indicators. Memory values vary with model size and hardware, and these operational logs do not establish malicious intent; validate against host capacity and workload baselines. data_source: - Ollama Server -search: '`ollama_server` ("*llama_kv_cache*" OR "*compute buffer*" OR "*llama runner started*" OR "*loaded runners*") | rex field=_raw "count=(?\d+)" | rex field=_raw "size\s*=\s*(?[\d\.]+)\s+MiB" | rex field=_raw "started in\s*(?[\d\.]+)\s*seconds" | rex field=_raw "source=(?[^\s]+)" | bin _time span=5m | stats count as operations, sum(runner_count) as total_runners, dc(code_source) as unique_sources, values(code_source) as code_sources, avg(memory_mb) as avg_memory, max(memory_mb) as max_memory, sum(memory_mb) as total_memory, avg(load_time) as avg_load_time, max(load_time) as max_load_time by _time, host | where operations > 5 OR total_runners > 0 OR max_memory > 400 OR total_memory > 500 | eval avg_memory=round(avg_memory, 2) | eval max_memory=round(max_memory, 2) | eval total_memory=round(total_memory, 2) | eval avg_load_time=round(avg_load_time, 2) | eval severity=case( max_memory > 500 OR total_memory > 1000, "critical", max_memory > 400 OR operations > 20, "high", operations > 10, "medium", 1=1, "low" ) | eval attack_type="Resource Exhaustion / Memory Abuse" | sort -_time | table _time, host, operations, total_runners, unique_sources, avg_memory, max_memory, total_memory, avg_load_time, max_load_time, severity, attack_type | `ollama_possible_memory_exhaustion_resource_abuse_filter`' -how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' -known_false_positives: Legitimate high-volume production workloads processing multiple concurrent requests, users loading large language models (7B+ parameters) that naturally require substantial memory allocation, simultaneous multi-model deployments during system scaling, batch processing operations, or initial system startup sequences may generate similar memory allocation patterns during normal operations. +search: |- + `ollama_server` + ("*llama_kv_cache*" OR "*compute buffer*" OR "*llama runner started*" OR "*loaded runners*") + + | rex field=_raw "count=(?\d+)" + | rex field=_raw "(?[\d\.]+)\s+MiB" + | rex field=_raw "started in\s*(?[\d\.]+)\s*seconds" + | rex field=_raw "source=(?[^\s]+)" + + | bin _time span=5m + + | stats count as operations + avg(load_time) as avg_load_time + avg(memory_mb) as avg_memory + dc(code_source) as unique_sources + max(load_time) as max_load_time + max(memory_mb) as max_memory + max(runner_count) as peak_loaded_runners + values(code_source) as code_sources + by _time host + + | where operations > 10 OR peak_loaded_runners > 5 OR max_memory > 400 + + | eval avg_memory=round(avg_memory, 2) + | eval max_memory=round(max_memory, 2) + | eval avg_load_time=round(avg_load_time, 2) + | eval max_load_time=round(max_load_time, 2) + | eval severity=case(peak_loaded_runners > 10, "critical", peak_loaded_runners > 5 OR operations > 20, "high", max_memory > 400 OR operations > 10, "medium", 1=1, "low") + | eval attack_type="Resource Pressure / Memory Allocation" + + | table _time host operations peak_loaded_runners + unique_sources avg_memory max_memory + avg_load_time max_load_time severity attack_type + + | `ollama_possible_memory_exhaustion_resource_abuse_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate high-volume production workloads processing multiple concurrent requests, users loading large language models (7B+ parameters) that naturally require substantial memory allocation, simultaneous multi-model deployments during system scaling, batch processing operations, or initial system startup sequences may generate similar memory allocation patterns during normal operations. references: - https://github.com/rosplk/ta-ollama drilldown_searches: - name: View the detection results for - "$host$" - search: '%original_detection_search% | search "$host = "$host$"' + search: |- + %original_detection_search% + | search host="$host$" earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$host$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$host$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` earliest_offset: 7d latest_offset: "0" intermediate_findings: @@ -28,7 +72,7 @@ intermediate_findings: - field: host type: system score: 20 - message: Potential resource exhaustion attack detected on $host$ with $operations$ memory operations in 5 minutes, utilizing $max_memory$ MiB peak memory and $total_runners$ runners, indicating possible attempts to exhaust system resources through excessive model loading or memory abuse. + message: 'Ollama resource pressure indicators on [$host$]: [$peak_loaded_runners$] peak loaded runners and [$max_memory$] MiB largest observed buffer across [$operations$] log events in 5 minutes. Compare with expected workloads before escalation.' analytic_story: - Suspicious Ollama Activities asset_type: Web Application @@ -46,5 +90,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_repeated_application_errors.yml b/detections/application/ollama_repeated_application_errors.yml new file mode 100644 index 00000000000..0dd0538dec1 --- /dev/null +++ b/detections/application/ollama_repeated_application_errors.yml @@ -0,0 +1,85 @@ +name: Ollama Repeated Application Errors +id: e0fff27e-ee9b-4b8d-b247-f93a93cefa71 +version: 1 +creation_date: '2026-10-09' +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: |- + Detects repeated Ollama application error events as a possible availability issue. Ollama application logs do not reliably record process termination, so this search cannot confirm a service crash without operating system or service manager telemetry. +data_source: + - Ollama Server +search: |- + `ollama_server` + (level=ERROR OR level=FATAL) + + | rex field=_raw "msg=\"(?[^\"]+)\"" + | rex field=_raw "exit_code=(?\d+)" + + | bin _time span=5m + + | stats count as error_count + earliest(_time) as first_seen + latest(_time) as last_seen + values(msg) as error_messages + values(exit_code) as exit_codes + dc(msg) as unique_errors + by _time host + + | where error_count > 1 + + | eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S") + | eval last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S") + | eval severity=case(error_count > 5, "critical", error_count > 2, "high", 1=1, "medium") + | eval attack_type="Repeated Ollama Application Errors" + + | table first_seen last_seen host error_count + unique_errors error_messages severity attack_type + + | `ollama_repeated_application_errors_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Recoverable model load failures, temporary registry or network errors, resource constraints, and other repeated application errors may trigger this exploratory signal without causing a service outage. +references: + - https://github.com/rosplk/ta-ollama +drilldown_searches: + - name: View the detection results for - "$host$" + search: |- + %original_detection_search% + | search host="$host$" + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$host$" + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$host$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: host + type: system + score: 20 + message: 'Repeated Ollama application errors detected on host [$host$] between [$first_seen$] and [$last_seen$]: [$error_count$] events and [$unique_errors$] unique error types. Correlate with service manager logs to determine whether availability was affected. Error messages: [$error_messages$].' +analytic_story: + - Suspicious Ollama Activities +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log + sourcetype: ollama:server + source: app.log + test_type: unit diff --git a/detections/application/ollama_abnormal_service_crash_availability_attack.yml b/detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml similarity index 90% rename from detections/application/ollama_abnormal_service_crash_availability_attack.yml rename to detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml index e37ebbe1b63..9c14555e326 100644 --- a/detections/application/ollama_abnormal_service_crash_availability_attack.yml +++ b/detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml @@ -1,10 +1,10 @@ name: Ollama Abnormal Service Crash Availability Attack id: 327fa152-9b56-4e4e-bc0b-2795d4068afa -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rod Soto -status: experimental +status: deprecated type: Anomaly description: Detects critical service crashes, fatal errors, and abnormal process terminations in Ollama that may indicate exploitation attempts, resource exhaustion attacks, malicious input triggering unhandled exceptions, or deliberate denial of service attacks designed to disrupt AI model availability and degrade system stability. data_source: @@ -46,5 +46,9 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log sourcetype: ollama:server source: app.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit +deprecation_info: + reason: This experimental rule is being deprecated while we enhance Ollama availability detection. Application errors alone do not confirm a service outage, so we are improving the evidence needed to identify service interruptions reliably. + removed_in_version: 6.12.0 + replacement_content: + - Ollama Repeated Application Errors diff --git a/detections/application/ollama_possible_model_exfiltration_data_leakage.yml b/detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml similarity index 92% rename from detections/application/ollama_possible_model_exfiltration_data_leakage.yml rename to detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml index 3140267adc4..f04b73cb26f 100644 --- a/detections/application/ollama_possible_model_exfiltration_data_leakage.yml +++ b/detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml @@ -1,10 +1,10 @@ name: Ollama Possible Model Exfiltration Data Leakage id: c9fd1a54-0eab-4470-8970-d5fcc3c740fb -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rod Soto -status: experimental +status: deprecated type: Anomaly description: Detects data leakage and exfiltration attempts targeting Ollama model metadata and configuration endpoints. Adversaries repeatedly query /api/show, /api/tags, and /api/v1/models to systematically extract sensitive model information including architecture details, fine-tuning parameters, system paths, Modelfile configurations, and proprietary customizations. Multiple inspection attempts within a 15-minute window indicate automated exfiltration of valuable intellectual property such as custom model configurations, system prompts, and internal model specifications. This activity represents unauthorized data disclosure that could enable competitive intelligence gathering, model replication, or preparation for advanced attacks against the AI infrastructure. data_source: @@ -48,3 +48,7 @@ tests: source: server.log test_type: experimental description: This test is a legacy experimental test and may not be accurate. +deprecation_info: + reason: This experimental rule is being deprecated while we enhance Ollama exfiltration detection. Access requests and response timing alone do not show what data was returned or transferred, so stronger evidence and correlation are needed. + removed_in_version: 6.12.0 + replacement_content: [] diff --git a/detections/application/ollama_possible_rce_via_model_loading.yml b/detections/deprecated/ollama_possible_rce_via_model_loading.yml similarity index 92% rename from detections/application/ollama_possible_rce_via_model_loading.yml rename to detections/deprecated/ollama_possible_rce_via_model_loading.yml index be366b8ce8f..8fdeddd5eea 100644 --- a/detections/application/ollama_possible_rce_via_model_loading.yml +++ b/detections/deprecated/ollama_possible_rce_via_model_loading.yml @@ -1,10 +1,10 @@ name: Ollama Possible RCE via Model Loading id: 3f28c930-5208-425d-a7b9-53d349756d91 -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rod Soto -status: experimental +status: deprecated type: Anomaly description: Detects Ollama server errors and failures during model loading operations that may indicate malicious model injection, path traversal attempts, or exploitation of model loading mechanisms to achieve remote code execution. Adversaries may attempt to load specially crafted malicious models or exploit vulnerabilities in the model loading process to execute arbitrary code on the server. This detection monitors error messages and failure patterns that could signal attempts to abuse model loading functionality for malicious purposes. data_source: @@ -46,5 +46,8 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log sourcetype: ollama:server source: app.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit +deprecation_info: + reason: This experimental rule is being deprecated while we enhance Ollama model-loading detection. Model-loading errors alone do not confirm code execution, so the detection needs stronger evidence of execution. + removed_in_version: 6.12.0 + replacement_content: [] diff --git a/detections/application/ollama_suspicious_prompt_injection_jailbreak.yml b/detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml similarity index 90% rename from detections/application/ollama_suspicious_prompt_injection_jailbreak.yml rename to detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml index 3fdfeb434f1..691b8187d54 100644 --- a/detections/application/ollama_suspicious_prompt_injection_jailbreak.yml +++ b/detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml @@ -1,10 +1,10 @@ name: Ollama Suspicious Prompt Injection Jailbreak id: aac5df6f-9151-4da6-bdb2-5691aa6e376f -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rod Soto -status: experimental +status: deprecated type: Anomaly description: Detects potential prompt injection or jailbreak attempts against Ollama API endpoints by identifying requests with abnormally long response times. Attackers often craft complex, layered prompts designed to bypass AI safety controls, which typically result in extended processing times as the model attempts to parse and respond to these malicious inputs. This detection monitors /api/generate and /api/chat endpoints for requests exceeding 30 seconds, which may indicate sophisticated jailbreak techniques, multi-stage prompt injections, or attempts to extract sensitive information from the model. data_source: @@ -48,5 +48,9 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit +deprecation_info: + reason: This experimental rule is being deprecated while we enhance Ollama prompt-injection detection. Long response times do not reveal prompt content or show that safeguards were bypassed, so they are not enough to identify these attacks reliably. + removed_in_version: 6.12.0 + replacement_content: + - Ollama Long-Running Inference Requests From a3936a06504da4766ee58d3cb7cd5cc6f331cdad Mon Sep 17 00:00:00 2001 From: Steve Baker Date: Tue, 13 Oct 2026 06:24:38 -0500 Subject: [PATCH 146/162] PingID credential-reset correlation: normalize usernames and handle multiple resets (#4298) --------- Co-authored-by: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali --- ..._new_mfa_method_after_credential_reset.yml | 64 +++++++++++++++++-- 1 file changed, 57 insertions(+), 7 deletions(-) diff --git a/detections/application/pingid_new_mfa_method_after_credential_reset.yml b/detections/application/pingid_new_mfa_method_after_credential_reset.yml index 534ffc8cb25..7b0097d43ca 100644 --- a/detections/application/pingid_new_mfa_method_after_credential_reset.yml +++ b/detections/application/pingid_new_mfa_method_after_credential_reset.yml @@ -1,17 +1,57 @@ name: PingID New MFA Method After Credential Reset id: 2fcbce12-cffa-4c84-b70c-192604d201d0 -version: 9 +version: 10 creation_date: '2023-12-20' -modification_date: '2026-05-13' +modification_date: '2026-09-29' author: Steven Dick status: production type: TTP -description: The following analytic identifies the provisioning of a new MFA device shortly after a password reset. It detects this activity by correlating Windows Event Log events for password changes (EventID 4723, 4724) with PingID logs indicating device pairing. This behavior is significant as it may indicate a social engineering attack where a threat actor impersonates a valid user to reset credentials and add a new MFA device. If confirmed malicious, this activity could allow an attacker to gain persistent access to the compromised account, bypassing traditional security measures. +description: |- + The following analytic identifies the provisioning of a new MFA device shortly after a password reset. It detects this activity by correlating Windows Event Log events for password changes + (EventID 4723, 4724) with PingID logs indicating device pairing. This behavior is significant as it may indicate a social engineering attack where a threat actor impersonates a valid user + to reset credentials and add a new MFA device. If confirmed malicious, this activity could allow an attacker to gain persistent access to the compromised account, bypassing traditional security measures. data_source: - PingID -search: "`pingid` \"result.message\" = \"*Device Paired*\" | rex field=result.message \"Device (Unp)?(P)?aired (?.+)\" | eval src = coalesce('resources{}.ipaddress','resources{}.devicemodel'), user = upper('actors{}.name'), reason = 'result.message' | eval object=CASE(ISNOTNULL('resources{}.devicemodel'),'resources{}.devicemodel',true(),device_extract) | eval action=CASE(match('result.message',\"Device Paired*\"),\"created\",match('result.message', \"Device Unpaired*\"),\"deleted\") | stats count min(_time) as firstTime, max(_time) as lastTime, values(reason) as reason by src,user,action,object | join type=outer user [| search `wineventlog_security` EventID IN(4723,4724) | eval PW_Change_Time = _time, user = upper(user) | fields user,src_user,EventID,PW_Change_Time] | eval timeDiffRaw = round(lastTime - PW_Change_Time) | eval timeDiff = replace(tostring(abs(timeDiffRaw) ,\"duration\"),\"(\\d*)\\+*(\\d+):(\\d+):(\\d+)\",\"\\2 hours \\3 minutes\") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `security_content_ctime(PW_Change_Time)` | where timeDiffRaw > 0 AND timeDiffRaw < 3600 | `pingid_new_mfa_method_after_credential_reset_filter`" -how_to_implement: Target environment must ingest Windows Event Log and PingID(PingOne) data sources. Specifically from logs from Active Directory Domain Controllers and JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription. -known_false_positives: False positives may be generated by normal provisioning workflows that generate a password reset followed by a device registration. +search: | + `pingid` + "result.message" = "*Device Paired*" + + | rex field=result.message "Device (Unp)?(P)?aired (?.+)" + | eval src = coalesce('resources{}.ipaddress','resources{}.devicemodel') + + | eval user = upper('actors{}.name') + | eval reason = 'result.message' + | eval object=CASE(ISNOTNULL('resources{}.devicemodel'),'resources{}.devicemodel',true(),device_extract) + | eval action=CASE(match('result.message',"Device Paired*"),"created",match('result.message', "Device Unpaired*"),"deleted") + + | stats count min(_time) as firstTime, max(_time) as lastTime, values(reason) as reason by src,user,action,object + + ```Standardizes user field by removing NetBIOS and email from reported user name``` + + | eval join_user = replace(user, "^[^\x5c]*\x5c|@.*$", "") + | join type=outer max=0 join_user [ + | search `wineventlog_security` EventID IN(4723,4724) + | eval PW_Change_Time = _time + ```Standardizes user field by removing NetBIOS and email from reported user name``` + | eval join_user = replace(upper(user), "^[^\x5c]*\x5c|@.*$", "") + | fields join_user,src_user,EventID,PW_Change_Time + ] + + | eval timeDiffRaw = round(lastTime - PW_Change_Time) + | eval timeDiff = replace(tostring(abs(timeDiffRaw) ,"duration"),"(\d*)\+*(\d+):(\d+):(\d+)","\2 hours \3 minutes") + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(PW_Change_Time)` + + | where timeDiffRaw > 0 AND timeDiffRaw < 3600 + | dedup src, user, action, object, lastTime sortby +timeDiffRaw + | fields - join_user + + | `pingid_new_mfa_method_after_credential_reset_filter` +how_to_implement: |- + Target environment must ingest Windows Event Log and PingID(PingOne) data sources. Specifically from logs from Active Directory Domain Controllers and JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription. +known_false_positives: |- + False positives may be generated by normal provisioning workflows that generate a password reset followed by a device registration. references: - https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/defend-your-users-from-mfa-fatigue-attacks/ba-p/2365677 - https://www.bleepingcomputer.com/news/security/mfa-fatigue-hackers-new-favorite-tactic-in-high-profile-breaches/ @@ -28,11 +68,12 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: An MFA configuration change was detected for [$user$] within [$timeDiff$] of a password reset. The device [$object$] was $action$. + title: An MFA configuration change was detected for [$user$] within [$timeDiff$] of a password reset. The device [$object$] was [$action$]. entity: field: user type: user score: 50 +threat_objects: [] analytic_story: - Compromised User Account - Scattered Lapsus$ Hunters @@ -57,3 +98,12 @@ tests: source: PINGID sourcetype: _json test_type: unit + - name: True Positive Test - UPN usernames and multiple resets + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/windows_pw_reset_upn_multi_reset.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid_upn_multi_reset.log + source: PINGID + sourcetype: _json + test_type: unit From 7e9ead05a777ed79dfa56c49a9fd223aba6d5509 Mon Sep 17 00:00:00 2001 From: Raven Tait <93157481+RavenTait@users.noreply.github.com> Date: Tue, 13 Oct 2026 10:01:06 -0400 Subject: [PATCH 147/162] New Zeek Based Detections Migrated from SnapAttack(#4337) --------- Co-authored-by: Nasreddine Bencherchali --- data_sources/zeek_http.yml | 36 ++++++ data_sources/zeek_ssh.yml | 30 +++++ ...http_post_request_with_encoded_payload.yml | 89 +++++++++++++++ .../network/unusual_ssh_client_banner.yml | 102 +++++++++++++++++ .../web/unusual_http_request_method.yml | 104 ++++++++++++++++++ macros/zeek_http.yml | 8 ++ macros/zeek_ssh.yml | 8 ++ 7 files changed, 377 insertions(+) create mode 100644 data_sources/zeek_http.yml create mode 100644 data_sources/zeek_ssh.yml create mode 100644 detections/network/http_post_request_with_encoded_payload.yml create mode 100644 detections/network/unusual_ssh_client_banner.yml create mode 100644 detections/web/unusual_http_request_method.yml create mode 100644 macros/zeek_http.yml create mode 100644 macros/zeek_ssh.yml diff --git a/data_sources/zeek_http.yml b/data_sources/zeek_http.yml new file mode 100644 index 00000000000..23fb4433df2 --- /dev/null +++ b/data_sources/zeek_http.yml @@ -0,0 +1,36 @@ +name: Zeek HTTP +id: 257a3ae6-a3f6-44e0-9d10-bdc5b4f011a3 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Raven Tait, Nasreddine Bencherchali, Splunk +description: Logs HTTP requests and responses analyzed by Zeek, including methods, URI, host, status codes, and request bodies when configured. +mitre_components: + - Network Traffic Content + - Network Traffic Flow + - Application Log Content +source: http.log +sourcetype: zeek:http +supported_TA: + - name: TA for Zeek + url: https://splunkbase.splunk.com/app/5466 + version: 1.0.11 +fields: + - id.orig_h + - id.orig_p + - id.resp_h + - id.resp_p + - method + - uri + - host + - status_code + - post_body + - user_agent +output_fields: + - id.orig_h + - id.resp_h + - id.resp_p + - uri + - method + - status_code +example_log: '{"ts": 1665164348.511363, "uid": "Ct9dph2EXJhTjowDF3", "id.orig_h": "192.168.196.131", "id.orig_p": 50050, "id.resp_h": "192.168.196.129", "id.resp_p": 80, "trans_depth": 13, "method": "POST", "host": "192.168.196.129", "uri": "/test.php", "version": "1.1", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36", "request_body_len": 108, "response_body_len": 0, "status_code": 200, "status_msg": "OK", "tags": [], "orig_fuids": ["FwroIQ2TSmbiOBzVz4"], "orig_mime_types": ["text/plain"], "post_body": "hMUlHTVEzmc+5fNbbspSRUEVsphYbAJ2Sy3CJZ9K12xyL1cRo1jrslMNWGGNnxbHB14R/CMybW0Z2+wOIuWtkDfKUG2IMpcOUutkDFdSiKo=", "client_header_names": ["USER-AGENT", "HOST", "CONTENT-LENGTH", "CACHE-CONTROL"], "client_header_values": ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36", "192.168.196.129", "108", "no-cache"], "server_header_names": ["CONTENT-TYPE", "DATE", "CONTENT-LENGTH"], "server_header_values": ["text/html", "Fri, 07 Oct 2022 17:39:09 GMT", "0"], "row_id": "dd80e4d5-b10b-4de0-bcd8-dba62c2901ea", "snapattack_session": "e50dc64e-0fc6-b1ad-429c-23ccdd5452c4"}' diff --git a/data_sources/zeek_ssh.yml b/data_sources/zeek_ssh.yml new file mode 100644 index 00000000000..4e165c31372 --- /dev/null +++ b/data_sources/zeek_ssh.yml @@ -0,0 +1,30 @@ +name: Zeek SSH +id: 9e228bf6-8c75-4d36-997c-e5ef1e1bf760 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Raven Tait, Nasreddine Bencherchali, Splunk +description: Logs SSH handshakes analyzed by Zeek, including client and server banners and connection endpoints. +mitre_components: + - Network Traffic Content + - Network Traffic Flow +source: ssh.log +sourcetype: zeek:ssh +supported_TA: + - name: TA for Zeek + url: https://splunkbase.splunk.com/app/5466 + version: 1.0.11 +fields: + - id.orig_h + - id.orig_p + - id.resp_h + - id.resp_p + - client + - server + - uid +output_fields: + - id.orig_h + - id.resp_h + - id.resp_p + - client +example_log: '{"_path":"ssh","_write_ts":"2026-01-15T09:21:33.456789Z","ts":"2026-01-15T09:21:32.987654Z","uid":"CkLmNo2Yp3qrStUv56","id.orig_h":"192.168.20.75","id.orig_p":53874,"id.resp_h":"198.51.100.20","id.resp_p":2222,"version":2,"auth_success":true,"auth_attempts":1,"direction":"OUTBOUND","client":"SSH-2.0-SecureBlackbox","server":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17","cipher_alg":"aes256-ctr","mac_alg":"hmac-sha1","compression_alg":"none","kex_alg":"diffie-hellman-group-exchange-sha256","host_key_alg":"ssh-ed25519","host_key":"11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00","remote_location.country_code":"US","remote_location.region":"MD","remote_location.city":"Baltimore","remote_location.latitude":39.2904,"remote_location.longitude":-76.6122}' diff --git a/detections/network/http_post_request_with_encoded_payload.yml b/detections/network/http_post_request_with_encoded_payload.yml new file mode 100644 index 00000000000..f05fb1a082d --- /dev/null +++ b/detections/network/http_post_request_with_encoded_payload.yml @@ -0,0 +1,89 @@ +name: HTTP POST Request with Encoded Payload +id: 0590881d-7b81-48dd-9674-1f23f7db5d40 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex-encoded bytes or base64-encoded strings. + It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex escape sequences or sixteen or more consecutive base64 character groups. + This activity is significant as adversaries commonly use hex or base64 encoding to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads. +data_source: + - Zeek HTTP +search: |- + `zeek_http` + method="POST" + post_body="*" + + | eval dest_port=coalesce(dest_port, 'id.resp_p'), + dest=coalesce(dest, dest_ip, 'id.resp_h'), + src=coalesce(src, src_ip, 'id.orig_h') + + | eval _hex=if(match(post_body, "(?:\\\\x[0-9a-fA-F]{2}){8,}|(?:%[0-9a-fA-F]{2}){8,}"), 1, 0) + | eval _b64=if(match(post_body, "(?:[A-Za-z0-9+/]{4}){16,}={0,2}"), 1, 0) + + | where _hex=1 OR _b64=1 + + | eval encoding_type=case(_hex=1 AND _b64=1, "Hexadecimal + Base64", _hex=1, "Hexadecimal", _b64=1, "Base64") + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(encoding_type) as encoding_type + values(post_body) as post_body + + by src dest dest_port uri method status_code + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `http_post_request_with_encoded_payload_filter` +how_to_implement: |- + Zeek HTTP logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466). + The "post_body" field must be populated, which requires Zeek to be configured with the HTTP post body extraction policy. + Configure the `zeek_http` macro to match the sourcetype used by your Zeek add-on. +known_false_positives: |- + Legitimate applications may POST base64-encoded data, particularly APIs that transmit binary content. + Review the destination, URI, and post body content to confirm whether the activity is expected. +references: + - https://attack.mitre.org/techniques/T1071/001/ + - https://attack.mitre.org/techniques/T1132/001/ + - https://docs.zeek.org/en/master/logs/http.html +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$id.orig_h$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: An HTTP POST request with an encoded body of type [$encoding_type$] was detected from [$src$] to [$dest$] over port [$dest_port$] to URI - [$uri$]. +threat_objects: + - field: uri + type: uri +analytic_story: + - Command And Control + - Data Exfiltration +asset_type: Network +mitre_attack_id: + - T1071.001 + - T1132.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: network +security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.001/zeek_http_encoded_post/http.log + sourcetype: zeek:http + source: http.log + test_type: unit diff --git a/detections/network/unusual_ssh_client_banner.yml b/detections/network/unusual_ssh_client_banner.yml new file mode 100644 index 00000000000..5bd366d59ea --- /dev/null +++ b/detections/network/unusual_ssh_client_banner.yml @@ -0,0 +1,102 @@ +name: Unusual SSH Client Banner +id: 93d0f598-d65f-4c97-b030-5bb0af51a226 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects SSH connections presenting client banners that do not match known, common SSH client software by leveraging Zeek ssh logs. + Unusual or unknown SSH client banners may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement. +data_source: + - Zeek SSH +search: |- + `zeek_ssh` + client="*" + NOT client IN ( + "SSH-2.0-AsyncSSH*", + "SSH-2.0-Bitvise*", + "SSH-2.0-Cisco*", + "SSH-2.0-CyberArk*", + "SSH-2.0-dropbear*", + "SSH-2.0-FileZilla*", + "SSH-2.0-Go*", + "SSH-2.0-JSCH*", + "SSH-2.0-Juniper*", + "SSH-2.0-libssh*", + "SSH-2.0-MobaXterm*", + "SSH-2.0-OpenSSH*", + "SSH-2.0-paramiko*", + "SSH-2.0-PuTTY*", + "SSH-2.0-Renci.SshNet*", + "SSH-2.0-SecureCRT*", + "SSH-2.0-ssh2*", + "SSH-2.0-TTSSH*", + "SSH-2.0-WinSCP*", + "SSH-2.0-Xshell*" + ) + + | eval dest_port=coalesce(dest_port, 'id.resp_p'), + dest=coalesce(dest, dest_ip, 'id.resp_h'), + src=coalesce(src, src_ip, 'id.orig_h') + + | fillnull value=NULL + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(client) as client + values(post_body) as post_body + + by src dest dest_port + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `unusual_ssh_client_banner_filter` +how_to_implement: |- + Zeek SSH logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466). + The client field should be populated from the SSH handshake banner. + Configure the `zeek_ssh` macro to match the sourcetype used by your Zeek add-on. +known_false_positives: |- + Legitimate but uncommon SSH client software not included will generate false positives. + Review the client banner and tune the filter accordingly. +references: + - https://docs.zeek.org/en/master/logs/ssh.html + - https://attack.mitre.org/techniques/T1021/004/ + - https://attack.mitre.org/techniques/T1572/ +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$id.orig_h$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: An unusual SSH client banner [$client$] was observed from [$src$] connecting to [$dest$] over port [$dest_port$]. +threat_objects: [] +analytic_story: + - Ingress Tool Transfer + - Command And Control +asset_type: Network +mitre_attack_id: + - T1021.004 + - T1572 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: network +security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/zeek_ssh_unusual_client/ssh.log + sourcetype: zeek:ssh + source: ssh.log + test_type: unit diff --git a/detections/web/unusual_http_request_method.yml b/detections/web/unusual_http_request_method.yml new file mode 100644 index 00000000000..de653940668 --- /dev/null +++ b/detections/web/unusual_http_request_method.yml @@ -0,0 +1,104 @@ +name: Unusual HTTP Request Method +id: c086ad2b-a747-4c61-9c90-d6ffdcaefbe8 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects Zeek HTTP requests using methods outside a configurable allowlist of standard and commonly used HTTP methods. + Unusual methods can indicate protocol abuse, exploitation attempts, or command-and-control traffic. + Review the method, source, destination, and URI to assess the activity. +data_source: + - Zeek HTTP +search: |- + `zeek_http` + method=* + NOT method IN ( + "ACL", + "CCM_POST", + "CONNECT", + "COPY", + "DELETE", + "GET", + "HEAD", + "LOCK", + "MKCOL", + "MOVE", + "OPTIONS", + "PATCH", + "POST", + "PRI", + "PROPFIND", + "PROPPATCH", + "PUT", + "REPORT", + "SEARCH", + "TRACE", + "unknown", + "UNLOCK" + ) + + | eval dest_port=coalesce(dest_port, 'id.resp_p'), + dest=coalesce(dest, dest_ip, 'id.resp_h'), + src=coalesce(src, src_ip, 'id.orig_h') + + | stats count min(_time) as firstTime max(_time) as lastTime + values(method) as method + values(uri) as uri + values(status_code) as status_code + + by src dest dest_port + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `unusual_http_request_method_filter` +how_to_implement: |- + Zeek HTTP logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466). + Configure the `zeek_http` macro to match the sourcetype used by your Zeek add-on. +known_false_positives: |- + Some legitimate applications and frameworks may use non-standard HTTP methods. + Review the method and destination to determine whether the traffic is expected, then add confirmed legitimate methods to the allowlist. +references: + - https://attack.mitre.org/techniques/T1071/001/ + - https://attack.mitre.org/techniques/T1190/ + - https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$id.orig_h$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: An unusual HTTP method [$method$] ws observed from [$src$] to [$dest$] over port [$dest_port$] to URI - [$uri$]. +threat_objects: + - field: uri + type: uri +analytic_story: + - Command And Control + - HTTP Request Smuggling +asset_type: Web Server +mitre_attack_id: + - T1071.001 + - T1190 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: web +security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071/zeek_http_unusual_method/http.log + sourcetype: zeek:http + source: http.log + test_type: unit diff --git a/macros/zeek_http.yml b/macros/zeek_http.yml new file mode 100644 index 00000000000..f2428481eed --- /dev/null +++ b/macros/zeek_http.yml @@ -0,0 +1,8 @@ +name: zeek_http +id: 5deefc82-d7b0-4c6a-a9e3-fce5ebbd4291 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Splunk Threat Research Team +description: Customer specific Splunk configuration for Zeek HTTP logs. Update the sourcetype to match your environment. +definition: sourcetype="zeek:http" diff --git a/macros/zeek_ssh.yml b/macros/zeek_ssh.yml new file mode 100644 index 00000000000..090cc48ace9 --- /dev/null +++ b/macros/zeek_ssh.yml @@ -0,0 +1,8 @@ +name: zeek_ssh +id: 915ebcdf-ef44-4815-936a-901ee7dde6dc +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Splunk Threat Research Team +description: Customer specific Splunk configuration for Zeek SSH logs. Update the sourcetype to match your environment. +definition: sourcetype="zeek:ssh" From 6e6fe3b033317c6ba8a7c7e2317a73e734f70739 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 13 Oct 2026 10:12:01 -0700 Subject: [PATCH 148/162] Deprecated `Detect Large ICMP Traffic` Based On .conf Telemetry (#4313) --------- Co-authored-by: Nasreddine Bencherchali --- .../detect_large_icmp_traffic.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) rename detections/{network => deprecated}/detect_large_icmp_traffic.yml (95%) diff --git a/detections/network/detect_large_icmp_traffic.yml b/detections/deprecated/detect_large_icmp_traffic.yml similarity index 95% rename from detections/network/detect_large_icmp_traffic.yml rename to detections/deprecated/detect_large_icmp_traffic.yml index 98f14307a8c..f491f9d89e6 100644 --- a/detections/network/detect_large_icmp_traffic.yml +++ b/detections/deprecated/detect_large_icmp_traffic.yml @@ -1,10 +1,10 @@ name: Detect Large ICMP Traffic id: 9cd6d066-94d5-4ccd-a8b9-28c03ca91be8 -version: 8 +version: 9 creation_date: '2020-01-19' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Rico Valdez, Dean Luxton, Bhavin Patel, Splunk -status: production +status: deprecated type: TTP description: | The following analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes. @@ -95,3 +95,7 @@ tests: source: cisco_cloud_security_addon sourcetype: cisco:cloud_security:firewall test_type: unit +deprecation_info: + reason: Detection deprecated as it is determined to be very noisy in a production environment. + removed_in_version: 6.12.0 + replacement_content: [] From 19be274d85e51352b746f703db748cd948887340 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 13 Oct 2026 22:36:44 +0200 Subject: [PATCH 149/162] Automated NIST AI RMF lookup table update (#4340) --------- Co-authored-by: Nasreddine Bencherchali --- lookups/csv/detection_subcategory_map.csv | 14 ++++++-------- lookups/csv/detection_subcategory_map.yml | 2 +- .../generate_nist_ai_rmf_detection_map.py | 17 +++++++++++++++++ 3 files changed, 24 insertions(+), 9 deletions(-) diff --git a/lookups/csv/detection_subcategory_map.csv b/lookups/csv/detection_subcategory_map.csv index 5a4b9383433..25cf98922bf 100644 --- a/lookups/csv/detection_subcategory_map.csv +++ b/lookups/csv/detection_subcategory_map.csv @@ -23,11 +23,9 @@ MCP,MCP Server,MCP Github Suspicious Operation,production,Hunting,Suspicious MCP MCP,MCP Server,MCP Postgres Suspicious Query,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal MCP,MCP Server,MCP Prompt Injection,production,TTP,Suspicious MCP Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal MCP,MCP Server,MCP Sensitive System File Search,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal -Ollama,Ollama Server,Ollama Abnormal Network Connectivity,experimental,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" -Ollama,Ollama Server,Ollama Abnormal Service Crash Availability Attack,experimental,Anomaly,Suspicious Ollama Activities,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal -Ollama,Ollama Server,Ollama Excessive API Requests,experimental,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal -Ollama,Ollama Server,Ollama Possible API Endpoint Scan Reconnaissance,experimental,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" -Ollama,Ollama Server,Ollama Possible Memory Exhaustion Resource Abuse,experimental,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal -Ollama,Ollama Server,Ollama Possible Model Exfiltration Data Leakage,experimental,Anomaly,Suspicious Ollama Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal -Ollama,Ollama Server,Ollama Possible RCE via Model Loading,experimental,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.7|Manage 4.3,high,generated_rule,AI security and resilience evaluation signal; Incident tracking or response signal -Ollama,Ollama Server,Ollama Suspicious Prompt Injection Jailbreak,experimental,Anomaly,Suspicious Ollama Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +Ollama,Ollama Server,Ollama Abnormal Network Connectivity,production,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" +Ollama,Ollama Server,Ollama Excessive API Requests,production,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal +Ollama,Ollama Server,Ollama Long-Running Inference Requests,production,Anomaly,Suspicious Ollama Activities,MEASURE,Measure 2.4,high,generated_rule,Production AI functionality and behavior monitoring signal +Ollama,Ollama Server,Ollama Possible API Endpoint Scan Reconnaissance,production,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" +Ollama,Ollama Server,Ollama Possible Memory Exhaustion Resource Abuse,production,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal +Ollama,Ollama Server,Ollama Repeated Application Errors,production,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.3,high,generated_rule,Production behavior monitoring and incident/error tracking signal diff --git a/lookups/csv/detection_subcategory_map.yml b/lookups/csv/detection_subcategory_map.yml index 01c7b156b9d..dbf0a875df0 100644 --- a/lookups/csv/detection_subcategory_map.yml +++ b/lookups/csv/detection_subcategory_map.yml @@ -2,7 +2,7 @@ name: detection_subcategory_map id: 41c7e6c8-b835-4dd8-b7ed-b1f5d8476e84 version: 3 creation_date: '2026-09-02' -modification_date: '2026-10-08' +modification_date: '2026-10-13' author: Nasreddine Bencherchali, Rod Soto, Splunk Threat Research Team lookup_type: csv description: Generated mapping of AI-related ESCU detections to NIST AI RMF subcategory IDs for dashboard coverage reporting. diff --git a/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py b/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py index 9b651f28e65..7cf35488c19 100644 --- a/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py +++ b/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py @@ -81,6 +81,16 @@ class MappingRule: ("Measure 2.4",), "Production behavior monitoring signal", ), + MappingRule( + re.compile(r"\blong[- ]running inference requests?\b", re.I), + ("Measure 2.4",), + "Production AI functionality and behavior monitoring signal", + ), + MappingRule( + re.compile(r"\brepeated (?:ollama )?application errors?\b", re.I), + ("Measure 2.4", "Manage 4.3"), + "Production behavior monitoring and incident/error tracking signal", + ), MappingRule( re.compile(r"\b(prompt injection|jailbreak|ignore previous|system prompt override|hostile prompt|sentiment)\b", re.I), ("Measure 2.6",), @@ -383,6 +393,13 @@ def main() -> int: output_changed = write_csv_if_changed(csv_content, None if args.dry_run else args.output) message = f"Generated {len(rows)} detection mappings from {len(selectors)} data source selectors." + review_rows = [row for row in rows if row["mapping_source"] == "generated_review"] + if review_rows: + message += f" {len(review_rows)} mapping(s) need manual review:" + for row in review_rows: + message += f"\n - {row['ai_system']}: {row['detection_name']} — {row['mapping_reason']}" + else: + message += " No mappings need manual review." if not args.dry_run: if output_changed and not args.no_metadata_update: new_version = bump_lookup_metadata(args.metadata, validate_modified_date(args.modified_date)) From 13bf1750b21768c03a2237ecfd27b54644bc6de9 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Wed, 14 Oct 2026 02:12:41 +0200 Subject: [PATCH 150/162] Updating Set of Nirsoft Detections (#4303) --------- Co-authored-by: Nasreddine Bencherchali --- .../detection_of_tools_built_by_nirsoft.yml | 11 +- .../possible_browser_pass_view_parameter.yml | 11 +- .../windows_nirsoft_advancedrun.yml | 9 +- ...ndows_nirsoft_tool_bundle_file_created.yml | 40 +- .../endpoint/windows_nirsoft_utilities.yml | 53 +- lookups/csv/nirsoft_utilities_lookup.csv | 592 ++++++++++++++++++ lookups/csv/nirsoft_utilities_lookup.yml | 12 + 7 files changed, 688 insertions(+), 40 deletions(-) rename detections/{endpoint => deprecated}/detection_of_tools_built_by_nirsoft.yml (92%) rename detections/{endpoint => deprecated}/possible_browser_pass_view_parameter.yml (92%) rename detections/{endpoint => deprecated}/windows_nirsoft_advancedrun.yml (95%) create mode 100644 lookups/csv/nirsoft_utilities_lookup.csv create mode 100644 lookups/csv/nirsoft_utilities_lookup.yml diff --git a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml b/detections/deprecated/detection_of_tools_built_by_nirsoft.yml similarity index 92% rename from detections/endpoint/detection_of_tools_built_by_nirsoft.yml rename to detections/deprecated/detection_of_tools_built_by_nirsoft.yml index c41a4a0605d..2fe7690cc05 100644 --- a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml +++ b/detections/deprecated/detection_of_tools_built_by_nirsoft.yml @@ -1,10 +1,10 @@ name: Detection of tools built by NirSoft id: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0 -version: 11 +version: 12 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Bhavin Patel, Splunk -status: experimental +status: deprecated type: Anomaly description: The following analytic identifies the execution of tools built by NirSoft by detecting specific command-line arguments such as "/stext" and "/scomma". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because NirSoft tools, while legitimate, can be exploited by attackers for malicious purposes such as credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further compromise of the affected system. data_source: @@ -53,3 +53,8 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint +deprecation_info: + reason: Detection deprecated due to duplicated content already covered by other detections. + removed_in_version: 6.12.0 + replacement_content: + - Windows NirSoft Utilities diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/deprecated/possible_browser_pass_view_parameter.yml similarity index 92% rename from detections/endpoint/possible_browser_pass_view_parameter.yml rename to detections/deprecated/possible_browser_pass_view_parameter.yml index 70b5aa3b1a2..b21bcb9a319 100644 --- a/detections/endpoint/possible_browser_pass_view_parameter.yml +++ b/detections/deprecated/possible_browser_pass_view_parameter.yml @@ -1,10 +1,10 @@ name: Possible Browser Pass View Parameter id: 8ba484e8-4b97-11ec-b19a-acde48001122 -version: 8 +version: 9 creation_date: '2021-11-22' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: Hunting description: The following analytic identifies processes with command-line parameters associated with web browser credential dumping tools, specifically targeting behaviors used by Remcos RAT malware. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and specific file paths. This activity is significant as it indicates potential credential theft, a common tactic in broader cyber-espionage campaigns. If confirmed malicious, attackers could gain unauthorized access to sensitive web credentials, leading to further system compromise and data breaches. data_source: @@ -35,3 +35,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to duplicated content already covered by other detections. + removed_in_version: 6.12.0 + replacement_content: + - Windows NirSoft Utilities diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/deprecated/windows_nirsoft_advancedrun.yml similarity index 95% rename from detections/endpoint/windows_nirsoft_advancedrun.yml rename to detections/deprecated/windows_nirsoft_advancedrun.yml index b91a5c4c4c5..8e8fc5ffdff 100644 --- a/detections/endpoint/windows_nirsoft_advancedrun.yml +++ b/detections/deprecated/windows_nirsoft_advancedrun.yml @@ -1,10 +1,10 @@ name: Windows NirSoft AdvancedRun id: bb4f3090-7ae4-11ec-897f-acde48001122 -version: 12 +version: 13 creation_date: '2022-01-24' modification_date: '2026-10-09' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP description: The following analytic detects the execution of AdvancedRun.exe, a tool with capabilities similar to remote administration programs like PsExec. It identifies the process by its name or original file name and flags common command-line arguments. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. Monitoring this activity is crucial as AdvancedRun can be used for remote code execution and configuration-based automation. If malicious, this could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment. data_source: @@ -85,3 +85,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to duplicated content already covered by other detections. + removed_in_version: 6.12.0 + replacement_content: + - Windows NirSoft Utilities diff --git a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml index 3d410e82b46..7e4a09118f1 100644 --- a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml +++ b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml @@ -1,14 +1,13 @@ name: Windows NirSoft Tool Bundle File Created id: a2c8e8f8-18d6-4ad4-acf4-f58903bebe41 -version: 5 +version: 6 creation_date: '2025-10-24' -modification_date: '2026-05-13' -author: Nasreddine Bencherchali, Splunk +modification_date: '2026-10-01' +author: Nasreddine Bencherchali, Onur Mustafa Erdogan, Splunk status: production type: Anomaly description: | - The following analytic detects the creation of files associated with the NirSoft - tool bundles on Windows endpoints. + The following analytic detects the creation of files associated with the NirSoft tool bundles on Windows endpoints. NirSoft is a well-known provider of free, portable utilities that can be used for various system and network tasks. However, threat actors often leverage these tools for malicious purposes, such as credential harvesting, network reconnaissance, and data exfiltration. The detection focuses on the creation of specific NirSoft tool bundle files, which may indicate that an attacker is preparing to use these utilities on a compromised system. Security teams should investigate any instances of these files being created, especially if they are found in unexpected locations or on systems that should not be using such tools. @@ -20,23 +19,17 @@ search: | min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Filesystem where + FROM datamodel=Endpoint.Filesystem WHERE ``` Increase coverage by adding additional Nirsoft tool bundle or tool filenames ``` + [ + | inputlookup nirsoft_utilities_lookup + | search original_file_name = "*.zip" + | table original_file_name + | rename original_file_name as Filesystem.file_name + ] - Filesystem.file_name IN ( - "brtools.zip", - "mailpv.zip", - "networktools.zip", - "passreccommandline.zip", - "passrecenc.zip", - "progtools.zip", - "rdpv.zip", - "systools.zip", - "webbrowserpassview.zip" - ) - - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + BY Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product @@ -71,7 +64,12 @@ intermediate_findings: - field: dest type: system score: 20 - message: NirSoft tool bundle file $file_name$ created on host $dest$ + message: NirSoft tool bundle file [$file_name$] created on host [$dest$]. +threat_objects: + - field: file_name + type: file_name + - field: file_path + type: file_path analytic_story: - Unusual Processes - Data Destruction @@ -88,7 +86,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/nirsoft_tooling/nirsoft_file_bundle_created.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/nirsoft_tooling/nirsoft_file_bundle_created_new.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index eb146d19cc4..5d5dd6628d8 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -1,47 +1,78 @@ name: Windows NirSoft Utilities id: 5b2f4596-7d4c-11ec-88a7-acde48001122 -version: 11 +version: 12 creation_date: '2022-01-24' modification_date: '2026-10-09' author: Michael Haag, Splunk status: production -type: Hunting +type: Anomaly description: | The following analytic identifies the execution of commonly used NirSoft utilities on Windows systems. - It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution details such as process name, parent process, and command-line arguments. This activity is significant for a SOC because NirSoft utilities, while legitimate, can be used by adversaries for malicious purposes like credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further system compromise. Note that this search does not use a where clause to filter out known benign paths, as NirSoft utilities can be executed from various locations. This might hinder performance in environments with high data volumes. Apply additional filtering as necessary to enhance this. data_source: - Sysmon EventID 1 - - Windows Event Log Security 4688 - - CrowdStrike ProcessRollup2 search: | - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + [ + | inputlookup nirsoft_utilities_lookup + | search original_file_name=*.exe + | table original_file_name + | rename original_file_name as Processes.original_file_name + ] + + BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` + + | lookup local=t nirsoft_utilities_lookup original_file_name OUTPUT description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup local=t update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile - | search nirsoftFile=true | `windows_nirsoft_utilities_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +how_to_implement: |- + To successfully implement this search, ingest process creation events from your endpoints and normalize them to the Processes node of the Endpoint data model using the Splunk Common Information Model (CIM). + Ensure the normalized events populate the original_file_name field, which this search uses to identify NirSoft utilities. Supported sources might include Sysmon and CrowdStrike ProcessRollup2 when mapped to the data model. known_false_positives: False positives may be present. Filtering may be required before setting to alert. references: - https://www.cisa.gov/uscert/ncas/alerts/TA18-201A - http://www.nirsoft.net/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L623 +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: NirSoft tool [$process_name$] was executed on host [$dest$] with Command Line [$process$]. This utility [$description$]. +threat_objects: + - field: process_name + type: process_name analytic_story: - Data Destruction - WhisperGate + - Unusual Processes asset_type: Endpoint atomic_guid: - 81ce22fd-9612-4154-918e-8a1f285d214d diff --git a/lookups/csv/nirsoft_utilities_lookup.csv b/lookups/csv/nirsoft_utilities_lookup.csv new file mode 100644 index 00000000000..ba62fd11e72 --- /dev/null +++ b/lookups/csv/nirsoft_utilities_lookup.csv @@ -0,0 +1,592 @@ +original_file_name,description +acm.exe,"Disable/enable ActiveX components on Internet Explorer browser." +acm.zip,"ZIP Bundle for acm.exe" +AddrView.exe,"Extract URL addresses from HTML pages." +addrview.zip,"ZIP Bundle for AddrView.exe" +AdvancedRun.exe,"Run a program with different settings that you choose." +advancedrun.zip,"ZIP Bundle for AdvancedRun.exe" +AllThreadsView.exe,"Displays a list of all running threads in Windows" +allthreadsview.zip,"ZIP Bundle for AllThreadsView.exe" +AlternateStreamView.exe,"Find all hidden alternate streams stored in the file system." +alternatestreamview.zip,"ZIP Bundle for AlternateStreamView.exe" +AltStreamDump.exe,"Dumps the list of NTFS alternate streams" +altstreamdump.zip,"ZIP Bundle for AltStreamDump.exe" +AppAudioConfig.exe,"View/change audio settings of applications" +appaudioconfig.zip,"ZIP Bundle for AppAudioConfig.exe" +AppCompatibilityView.exe,"List of all programs that run with different compatibility setting" +appcompatibilityview.zip,"ZIP Bundle for AppCompatibilityView.exe" +AppCrashView.exe,"Displays the details of all application crashes occurred in your system. " +appcrashview.zip,"ZIP Bundle for AppCrashView.exe" +AppNetworkCounter.exe,"Displays number of TCP/UDP bytes and packets sent/received by every application" +appnetworkcounter.zip,"ZIP Bundle for AppNetworkCounter.exe" +AppReadWriteCounter.exe,"Displays read/write operations of every application running on your system." +appreadwritecounter.zip,"ZIP Bundle for AppReadWriteCounter.exe" +AppResourcesUsageView.exe,"View application resources usage information of Windows 10/11 " +appresourcesusageview.zip,"ZIP Bundle for AppResourcesUsageView.exe" +awatch.exe,"displays useful information about your network adapters." +awatch.zip,"ZIP Bundle for awatch.exe" +axhelper.exe,"view essential information about ActiveX components installed on your computer." +axhelper.zip,"ZIP Bundle for axhelper.exe" +BatteryHistoryView.exe,"Displays battery history information on Windows 11/10." +batteryhistoryview.zip,"ZIP Bundle for BatteryHistoryView.exe" +BatteryInfoView.exe,"Displays battery information on laptops and netbooks." +batteryinfoview.zip,"ZIP Bundle for BatteryInfoView.exe" +BlueScreenView.exe,"Show information about blue screen crashes occurred in your system." +bluescreenview.zip,"ZIP Bundle for BlueScreenView.exe" +BluetoothCL.exe,"Show bluetooth devices list" +bluetoothcl.zip,"ZIP Bundle for BluetoothCL.exe" +BluetoothLEView.exe,"Monitors the activity of Bluetooth Low Energy devices around you." +bluetoothleview.zip,"ZIP Bundle for BluetoothLEView.exe" +BluetoothLogView.exe,"Creates a log of Bluetooth activity in your area." +bluetoothlogview.zip,"ZIP Bundle for BluetoothLogView.exe" +BluetoothView.exe,"Monitors the activity of Bluetooth devices around you." +bluetoothview.zip,"ZIP Bundle for BluetoothView.exe" +BootPerformanceView.exe,"Displays the performance information of the boot process on Windows 11/10/8/7" +bootperformanceview.zip,"ZIP Bundle for BootPerformanceView.exe" +BrowserAddonsView.exe,"Displays the details of all Web browser addons/plugins installed in your system." +browseraddonsview.zip,"ZIP Bundle for BrowserAddonsView.exe" +BrowserAutoFillView.exe,"View form autofill text stored by Chrome and Firefox Web browsers" +browserautofillview.zip,"ZIP Bundle for BrowserAutoFillView.exe" +BrowserDownloadsView.exe,"Displays the details of downloaded files of Chrome and Firefox Web browsers" +browserdownloadsview.zip,"ZIP Bundle for BrowserDownloadsView.exe" +BrowsingHistoryView.exe,"View browsing history of popular Web browsers " +browsinghistoryview.zip,"ZIP Bundle for BrowsingHistoryView.exe" +brtools.zip,"ZIP Bundle for MozillaHistoryView.exe" +BulkFileChanger.exe,"Change date/time/attributes of multiple files." +bulkfilechanger.zip,"ZIP Bundle for BulkFileChanger.exe" +BulletsPassView.exe,"Reveals the passwords stored behind the bullets." +bulletspassview.zip,"ZIP Bundle for BulletsPassView.exe" +ChromeCacheView.exe,"Chrome Browser Cache Viewer" +chromecacheview.zip,"ZIP Bundle for ChromeCacheView.exe" +ChromeCookiesView.exe,"Alternative to the standard internal cookies viewer of Google Chrome" +chromecookiesview.zip,"ZIP Bundle for ChromeCookiesView.exe" +ChromeHistoryView.exe,"View the browsing history of Chrome Web browser" +chromehistoryview.zip,"ZIP Bundle for ChromeHistoryView.exe" +ChromePass.exe,"Password recovery tool for Google Chrome Web browser. " +chromepass.zip,"ZIP Bundle for ChromePass.exe" +CleanAfterMe.exe,"Clean files and Registry values in your system." +cleanafterme.zip,"ZIP Bundle for CleanAfterMe.exe" +Clipboardic.exe,"Small and simple clipboard manager." +clipboardic.zip,"ZIP Bundle for Clipboardic.exe" +ControlMyMonitor.exe,"View and modify the settings of your monitor." +controlmymonitor.zip,"ZIP Bundle for ControlMyMonitor.exe" +CountryTraceRoute.exe,"Fast Traceroute utility with IP country information." +countrytraceroute.zip,"ZIP Bundle for CountryTraceRoute.exe" +cports.exe,"Displays the list of all currently opened TCP/UDP ports on your computer." +cports.exe,"Package of network monitoring tools for Windows" +cports.zip,"ZIP Bundle for cports.exe" +CProcess.exe,"Displays the list of all processes currently running on your system." +cprocess.zip,"ZIP Bundle for CProcess.exe" +CredentialsFileView.exe,"Decrypts Credentials files of Windows." +credentialsfileview.zip,"ZIP Bundle for CredentialsFileView.exe" +CredHistView.exe,"Decrypt the CREDHIST file of Windows" +credhistview.zip,"ZIP Bundle for CredHistView.exe" +CSVFileView.exe,"CSV/Tab-delimited file viewer and converter" +csvfileview.zip,"ZIP Bundle for CSVFileView.exe" +ctie.exe,"Add/delete toolbar buttons and menu items in Internet Explorer." +ctie.zip,"ZIP Bundle for ctie.exe" +CustomExplorerToolbar.exe,"Add Copy/Cut/Paste buttons to the Explorer toolbar of Windows 7." +customexplorertoolbar.zip,"ZIP Bundle for CustomExplorerToolbar.exe" +DataProtectionDecryptor.exe,"Decrypt DPAPI-encrypted data of Windows." +dataprotectiondecryptor.zip,"ZIP Bundle for DataProtectionDecryptor.exe" +DeviceIOView.exe,"Watch the data transfer between a software or service and a device driver." +deviceioview.zip,"ZIP Bundle for DeviceIOView.exe" +DevManView.exe,"Alternative to the standard Device Manager of Windows." +devmanview.zip,"ZIP Bundle for DevManView.exe" +DHCPLogView.exe,"Displays DHCP requests sent by every device connect to your network." +dhcplogview.zip,"ZIP Bundle for DHCPLogView.exe" +Dialupass.exe,"NirSoft Dialupass utility." +dialupass.zip,"ZIP Bundle for Dialupass.exe" +DiskCountersView.exe,"Show disk drive read/write counters." +diskcountersview.zip,"ZIP Bundle for DiskCountersView.exe" +DiskSmartView.exe,"Retrieves S.M.A.R.T information from IDE/SATA disks." +disksmartview.zip,"ZIP Bundle for DiskSmartView.exe" +dllexp.exe,"Lists DLL exported functions and their memory addresses - for debugging." +dllexp.exe,"Small utilities package that can be used by programmers for debugging." +dllexp.zip,"ZIP Bundle for dllexp.exe" +DNSDataView.exe,"Retrieve the DNS records (MX, NS, A, SOA) of the specified domains. " +dnsdataview.zip,"ZIP Bundle for DNSDataView.exe" +DNSLookupView.exe,"DNS Lookup Viewer for Windows 11/10" +dnslookupview.zip,"ZIP Bundle for DNSLookupView.exe" +DNSQuerySniffer.exe,"Network sniffer utility that shows the DNS queries sent on your system. " +dnsquerysniffer.zip,"ZIP Bundle for DNSQuerySniffer.exe" +DomainHostingView.exe,"Displays extensive information about a domain." +DomainHostingView.exe,"Package of domain/ip address lookup tools for Windows" +domainhostingview.zip,"ZIP Bundle for DomainHostingView.exe" +domainlookuptools.zip,"ZIP Bundle for DomainHostingView.exe" +DotNetResourcesExtract.exe,"Extract embedded resources from .NET applications." +dotnetresourcesextract.zip,"ZIP Bundle for DotNetResourcesExtract.exe" +DownTester.exe,"Test your Internet download speed." +downtester.zip,"ZIP Bundle for DownTester.exe" +DriveLetterView.exe,"View and change drive letter assignments " +driveletterview.zip,"ZIP Bundle for DriveLetterView.exe" +DriverView.exe,"Displays the list of all device drivers currently loaded on your system." +driverview.zip,"ZIP Bundle for DriverView.exe" +DumpEDID.exe,"Dump EDID information into the console window." +dumpedid.zip,"ZIP Bundle for DumpEDID.exe" +EdgeCookiesView.exe,"Display cookies from new versions of MS-Edge" +edgecookiesview.zip,"ZIP Bundle for EdgeCookiesView.exe" +EncryptedRegView.exe,"Scans the Registry and decrypts the data encrypted with DPAPI." +encryptedregview.zip,"ZIP Bundle for EncryptedRegView.exe" +ESEDatabaseView.exe,"View the content of ESE database files (.edb files)" +esedatabaseview.zip,"ZIP Bundle for ESEDatabaseView.exe" +EventLogChannelsView.exe,"View, Disable, Enable Event Log Channels." +eventlogchannelsview.zip,"ZIP Bundle for EventLogChannelsView.exe" +EventLogSourcesView.exe,"Displays the list of all event log sources installed on your system. " +eventlogsourcesview.zip,"ZIP Bundle for EventLogSourcesView.exe" +ExecutedProgramsList.exe,"Displays programs and batch files that you previously executed on your system." +executedprogramslist.zip,"ZIP Bundle for ExecutedProgramsList.exe" +ExifDataView.exe,"Displays the Exif data stored inside .jpg image files" +exifdataview.zip,"ZIP Bundle for ExifDataView.exe" +ExtPassword.exe,"External Drive Password Recovery" +extpassword.zip,"ZIP Bundle for ExtPassword.exe" +FastResolver.exe,"Resolves multiple host names into IP addresses/MAC Addresses and vice versa. " +fastresolver.zip,"ZIP Bundle for FastResolver.exe" +faview.exe,"displays the list of all your Favorties/bookmarks in a single page." +faview.zip,"ZIP Bundle for faview.exe" +FBCacheView.exe,"Shows Facebook images stored in the cache of your Web browser." +fbcacheview.zip,"ZIP Bundle for FBCacheView.exe" +FileAccessErrorView.exe,"Displays file access error information" +fileaccesserrorview.zip,"ZIP Bundle for FileAccessErrorView.exe" +FileActivityWatch.exe,"Displays information about read/write/delete operations on your system." +fileactivitywatch.zip,"ZIP Bundle for FileActivityWatch.exe" +FileTypesMan.exe,"Alternative to the File Types manager of Windows." +filetypesman.zip,"ZIP Bundle for FileTypesMan.exe" +FirefoxDownloadsView.exe,"Displayed the list of downloaded files in Firefox" +firefoxdownloadsview.zip,"ZIP Bundle for FirefoxDownloadsView.exe" +FirmwareTablesView.exe,"Displays a list of firmware tables (ACPI, SMBIOS) stored on your system." +firmwaretablesview.zip,"ZIP Bundle for FirmwareTablesView.exe" +FlashCookiesView.exe,"View Flash cookies stored in your computer." +flashcookiesview.zip,"ZIP Bundle for FlashCookiesView.exe" +FolderChangesView.exe,"Monitor folder/drive changes." +folderchangesview.zip,"ZIP Bundle for FolderChangesView.exe" +FolderTimeUpdate.exe,"Updates the Modified Time of folders." +foldertimeupdate.zip,"ZIP Bundle for FolderTimeUpdate.exe" +folrep.exe,"Scans your disk, and displays a report about each folder." +folrep.zip,"ZIP Bundle for folrep.exe" +FreeSpaceLogView.exe,"View log of free disk space on Windows" +freespacelogview.zip,"ZIP Bundle for FreeSpaceLogView.exe" +FullEventLogView.exe,"Event log viewer for Windows 10/8/7/Vista." +fulleventlogview.zip,"ZIP Bundle for FullEventLogView.exe" +FullUpdatesHistoryView.exe,"Displays the history of Windows 11 updates on your system. " +fullupdateshistoryview.zip,"ZIP Bundle for FullUpdatesHistoryView.exe" +gacview.exe,"Alternative to the standard .NET assembly viewer on Windows Explorer." +gacview.zip,"ZIP Bundle for gacview.exe" +GDIView.exe,"Displays the list of GDI handles opened by every process" +gdiview.zip,"ZIP Bundle for GDIView.exe" +GetNir.exe,"Command line tool to extract values from tab-delimited and comma-delimited data" +getnir.zip,"ZIP Bundle for GetNir.exe" +GUIPropView.exe,"Displays extensive information about all windows currently opened on your system" +guipropview.zip,"ZIP Bundle for GUIPropView.exe" +HandleCountersView.exe,"Shows handle counter for every process" +handlecountersview.zip,"ZIP Bundle for HandleCountersView.exe" +HashMyFiles.exe,"Calculate the MD5/SHA1 hashes of your files" +hashmyfiles.zip,"ZIP Bundle for HashMyFiles.exe" +HeapMemView.exe,"View the content of all memory blocks allocated in the heap." +heapmemview.zip,"ZIP Bundle for HeapMemView.exe" +HostedNetworkStarter.exe,"Create a wifi hotspot with your wireless network adapter" +hostednetworkstarter.zip,"ZIP Bundle for HostedNetworkStarter.exe" +HotKeysList.exe,"Displays the list of hot keys that are currently registered on your system." +hotkeyslist.zip,"ZIP Bundle for HotKeysList.exe" +HtmlAsText.exe,"Converts HTML documents to simple text files." +htmlastext.zip,"ZIP Bundle for HtmlAsText.exe" +HtmlDocEdit.exe,"Simple HTML designer/editor" +htmldocedit.zip,"ZIP Bundle for HtmlDocEdit.exe" +HTTPNetworkSniffer.exe,"Captures and displays HTTP requests/responses." +httpnetworksniffer.zip,"ZIP Bundle for HTTPNetworkSniffer.exe" +iconsext.exe,"Extract icons and cursors from executbale files (EXE, DLL, OCX, CPL, etc.)" +iconsext.zip,"ZIP Bundle for iconsext.exe" +IECacheView.exe,"List all files currently stored in the cache of Internet Explorer." +iecacheview.zip,"ZIP Bundle for IECacheView.exe" +iecv.exe,"Displays the cookies that Internet Explorer stores on your computer" +iecv.zip,"ZIP Bundle for iecv.exe" +IEDesignMode.exe,"Switch the active Internet Explorer window to design mode. " +iedesignmode.zip,"ZIP Bundle for IEDesignMode.exe" +iehv.exe,"Displays the list of Web sites that you visited with IE Web browser." +iehv.zip,"ZIP Bundle for iehv.exe" +iepv.exe,"Recover passwords stored by Internet Explorer (Versions 4.0 - 8.0)" +iepv.zip,"ZIP Bundle for iepv.exe" +ImageCacheViewer.exe,"Displays images stored in the cache of your Web browsers." +imagecacheviewer.zip,"ZIP Bundle for ImageCacheViewer.exe" +InjectedDLL.exe,"Display the list of injected DLLs." +injecteddll.zip,"ZIP Bundle for InjectedDLL.exe" +InsideClipboard.exe,"Displays the content of all formats stored in the clipboard." +insideclipboard.zip,"ZIP Bundle for InsideClipboard.exe" +InstalledAppView.exe,"View installed Windows 10 apps" +installedappview.zip,"ZIP Bundle for InstalledAppView.exe" +InstalledCodec.exe,"List Codec drivers and DirectShow filters installed on your system." +installedcodec.zip,"ZIP Bundle for InstalledCodec.exe" +InstalledDriversList.exe,"Lists all device drivers that are currently installed on your system." +installeddriverslist.zip,"ZIP Bundle for InstalledDriversList.exe" +InstalledPackagesView.exe,"Displays installed MSI packages on your system." +installedpackagesview.zip,"ZIP Bundle for InstalledPackagesView.exe" +IPInfoOffline.exe,"view country information about IP addresses." +ipinfooffline.zip,"ZIP Bundle for IPInfoOffline.exe" +IPNeighborsView.exe,"View the IP neighbor table on Windows 10/8/7/Vista" +ipneighborsview.zip,"ZIP Bundle for IPNeighborsView.exe" +IPNetInfo.exe,"NirSoft IPNetInfo utility." +ipnetinfo.zip,"ZIP Bundle for ipnetinfo.exe" +IPPathTableView.exe,"IP Path Table Viewer" +ippathtableview.zip,"ZIP Bundle for IPPathTableView.exe" +jrview.exe,"Displays the installed Java Runtime Environments." +jrview.zip,"ZIP Bundle for jrview.exe" +jsae.exe,"Creates Javascript animation from image files on your local drive." +jsae.zip,"ZIP Bundle for jsae.exe" +JumpListsView.exe,"Displays the information stored by the Jump Lists feature of Windows 7." +jumplistsview.zip,"ZIP Bundle for JumpListsView.exe" +KeyboardStateView.exe,"Shows the current state and virtual key code of every key you press." +keyboardstateview.zip,"ZIP Bundle for KeyboardStateView.exe" +LANIPScanner.exe,"Local network scanner for Windows" +lanipscanner.zip,"ZIP Bundle for LANIPScanner.exe" +LastActivityView.exe,"View the latest computer activity." +lastactivityview.zip,"ZIP Bundle for LastActivityView.exe" +LiveContactsView.exe,"View the details of all contacts in your Windows Live Messenger." +livecontactsview.zip,"ZIP Bundle for LiveContactsView.exe" +LiveTcpUdpWatch.exe,"Displays live information about all TCP and UDP activity on your system." +livetcpudpwatch.zip,"ZIP Bundle for LiveTcpUdpWatch.exe" +LoadedDllsView.exe,"Displays all DLL files loaded on your system." +loadeddllsview.zip,"ZIP Bundle for LoadedDllsView.exe" +LostMyPassword.exe,"Password recovery tool for Windows" +lostmypassword.zip,"ZIP Bundle for LostMyPassword.exe" +LSASecretsDump.exe,"Dump the LSA secrets from the Registry." +lsasecretsdump.zip,"ZIP Bundle for LSASecretsDump.exe" +LSASecretsView.exe,"Displays the list of all LSA secrets stored in the Registry on your computer. " +lsasecretsview.zip,"ZIP Bundle for LSASecretsView.exe" +MACAddressView.exe,"MAC address lookup tool" +macaddressview.zip,"ZIP Bundle for MACAddressView.exe" +MadPassExt.exe,"Extract the secret DPAPI password generated for your Microsoft account" +madpassext.zip,"ZIP Bundle for MadPassExt.exe" +mailpv.exe,"Recovers email passwords" +mailpv.zip,"ZIP Bundle for mailpv.exe" +ManageWirelessNetworks.exe,"Alternative tool to the standard Manage Wireless Networks of Windows " +managewirelessnetworks.zip,"ZIP Bundle for ManageWirelessNetworks.exe" +mDNSView.exe,"Displays all mDNS records published by devcies connected to your local network." +mdnsview.zip,"ZIP Bundle for mDNSView.exe" +MMCSnapInsView.exe,"Displays the details of all MMC snap-ins installed on your system." +mmcsnapinsview.zip,"ZIP Bundle for MMCSnapInsView.exe" +mmview.exe,"Lists the installed Codec, and allows you to disable/enable them." +mmview.zip,"ZIP Bundle for mmview.exe" +MobileFileSearch.exe,"Search files inside a mobile device plugged to the USB port on your computer" +mobilefilesearch.zip,"ZIP Bundle for MobileFileSearch.exe" +MonitorInfoView.exe,"displays essential information about your monitor." +monitorinfoview.zip,"ZIP Bundle for MonitorInfoView.exe" +MozillaCacheView.exe,"Displays the list of files stored in the cache of Mozilla-based Web browsers." +mozillacacheview.zip,"ZIP Bundle for MozillaCacheView.exe" +MozillaHistoryView.exe,"Displays the list of visited Web sites in Firefox/Mozilla/Netscape Web browsers." +MozillaHistoryView.exe,"Package of Web browser tools for Windows" +mozillahistoryview.zip,"ZIP Bundle for MozillaHistoryView.exe" +mspass.exe,"Password Recovery package for Windows." +mspass.exe,"Recovers the passwords of instant messenger programs" +mspass.zip,"ZIP Bundle for mspass.exe" +MUICacheView.exe,"Edit/delete MUICache items in your system" +muicacheview.zip,"ZIP Bundle for MUICacheView.exe" +MultiMonitorTool.exe,"Enable, disable, and set the primary monitor in Multi-Monitor system." +multimonitortool.zip,"ZIP Bundle for MultiMonitorTool.exe" +mweather.exe,"Decode METAR weather reports, and display them in a simple weather report table." +mweather.zip,"ZIP Bundle for mweather.exe" +MyEventViewer.exe,"MyEventViewer is a simple alternative to the standard event viewer of Windows." +myeventviewer.zip,"ZIP Bundle for MyEventViewer.exe" +MyLastSearch.exe,"View your latest searches with Google, Yahoo, and MSN" +mylastsearch.zip,"ZIP Bundle for MyLastSearch.exe" +myuninst.exe,"Alternative utility to the standard Add/Remove applet of Windows." +myuninst.zip,"ZIP Bundle for myuninst.exe" +MZCacheView.exe,"List all files currently stored in the cache of Firefox/Mozilla browser." +mzcacheview.zip,"ZIP Bundle for MZCacheView.exe" +mzcv.exe,"alternative to the standard Cookie Manager provided by Firefox and Mozilla." +mzcv.zip,"ZIP Bundle for mzcv.exe" +NetBScanner.exe,"Scans all computers in the IP addresses range you choose, using NetBIOS protocol" +netbscanner.zip,"ZIP Bundle for NetBScanner.exe" +NetConnectChoose.exe,"Set default Internet connection and view general connection information." +netconnectchoose.zip,"ZIP Bundle for NetConnectChoose.exe" +netpass.exe,"Recover network passwords on Windows XP/2003/Vista." +netpass.zip,"ZIP Bundle for netpass.exe" +NetResView.exe,"displays the list of all network resources on your LAN." +netresview.zip,"ZIP Bundle for NetResView.exe" +NetRouteView.exe,"GUI alternative to the standard route utility of Windows." +netrouteview.zip,"ZIP Bundle for NetRouteView.exe" +NetworkConnectLog.exe,"Shows a log of connected/disconnected computers on your network." +networkconnectlog.zip,"ZIP Bundle for NetworkConnectLog.exe" +NetworkCountersWatch.exe,"Displays system counters for every network interface on your system." +networkcounterswatch.zip,"ZIP Bundle for NetworkCountersWatch.exe" +NetworkInterfacesView.exe,"Displays the list of all network adapters/interfaces installed on your system." +networkinterfacesview.zip,"ZIP Bundle for NetworkInterfacesView.exe" +NetworkLatencyView.exe,"Calculates the network latency (in milliseconds) for every new TCP connection." +networklatencyview.zip,"ZIP Bundle for NetworkLatencyView.exe" +NetworkOpenedFiles.exe,"Displays the files that are currently opened by other computers on your network." +networkopenedfiles.zip,"ZIP Bundle for NetworkOpenedFiles.exe" +networktools.zip,"ZIP Bundle for cports.exe" +NetworkTrafficView.exe,"Displays network traffic statistics on your network adapter" +networktrafficview.zip,"ZIP Bundle for NetworkTrafficView.exe" +NetworkUsageView.exe,"Displays network usage information for Windows 8 and Windows 10" +networkusageview.zip,"ZIP Bundle for NetworkUsageView.exe" +nircmd.exe,"Do many useful tasks from command-line." +nircmd.zip,"ZIP Bundle for nircmd.exe" +nirext.exe,"Adds 3 useful context menu extensions to your Windows Explorer environment." +nirext.zip,"ZIP Bundle for nirext.exe" +NK2Edit.exe,"Full NK2 (AutoComplete) editor for Microsoft Outlook" +nk2edit.zip,"ZIP Bundle for NK2Edit.exe" +nk2view.exe,"View the content of Outlook AutoComplete .NK2 file." +nk2view.zip,"ZIP Bundle for nk2view.exe" +NTFSLinksView.exe,"View the list of NTFS symbolic links/junctions in selected folder." +ntfslinksview.zip,"ZIP Bundle for NTFSLinksView.exe" +OfficeIns.exe,"displays the details of all installed Microsoft Office add-ins on your computer." +officeins.zip,"ZIP Bundle for OfficeIns.exe" +OfflineRegistryFinder.exe,"Find data in external Registry files" +offlineregistryfinder.zip,"ZIP Bundle for OfflineRegistryFinder.exe" +OfflineRegistryView.exe,"View offline Registry files" +offlineregistryview.zip,"ZIP Bundle for OfflineRegistryView.exe" +ofview.zip,"ZIP Bundle for OpenedFilesView.exe" +OpenedFilesView.exe,"Displays the list of all opened files on your system." +OpenSaveFilesView.exe,"Displays list of files that you previously opened." +opensavefilesview.zip,"ZIP Bundle for OpenSaveFilesView.exe" +OpenWithView.exe,"Disable/enable items in the Open With dialog-box of Windows." +openwithview.zip,"ZIP Bundle for OpenWithView.exe" +OperaCacheView.exe,"Cache viewer for Opera Web browser." +operacacheview.zip,"ZIP Bundle for OperaCacheView.exe" +OperaPassView.exe,"Password recovery tool for Opera Web browser." +operapassview.zip,"ZIP Bundle for OperaPassView.exe" +OutlookAccountsView.exe,"View POP3/IMAP/SMTP passwords and account settings of Outlook" +outlookaccountsview.zip,"ZIP Bundle for OutlookAccountsView.exe" +OutlookAddressBookView.exe,"Displays the details of all recipients stored in the address books of Outlook" +outlookaddressbookview.zip,"ZIP Bundle for OutlookAddressBookView.exe" +OutlookAttachView.exe,"Extract multiple attachments from Outlook." +outlookattachview.zip,"ZIP Bundle for OutlookAttachView.exe" +OutlookStatView.exe,"Display a general statistics of your Outlook emails." +outlookstatview.zip,"ZIP Bundle for OutlookStatView.exe" +outlooktools.zip,"ZIP Bundle for nk2edit.exe" +passreccommandline.zip,"ZIP Bundle for PassRecCommandLine.exe" +passrecenc.zip,"ZIP Bundle for PassRecEnc.exe" +passrecpk.zip,"ZIP Bundle for mspass.exe" +passrecview.zip,"ZIP Bundle for PassRecView.exe" +PasswordFox.exe,"View passwords stored in Firefox Web browser." +passwordfox.zip,"ZIP Bundle for PasswordFox.exe" +PasswordHashesView.exe,"Displays the SHA1 and NTLM hashes of login passwords for currently logged-in users." +passwordhashesview.zip,"ZIP Bundle for PasswordHashesView.exe" +PasswordScan.exe,"Displays security information about passwords stored in your system." +passwordscan.zip,"ZIP Bundle for PasswordScan.exe" +PingInfoView.exe,"ping multiple host names and IP addresses." +pinginfoview.zip,"ZIP Bundle for PingInfoView.exe" +PocketAsterisk.exe,"Reveals the passwords stored behind the asterisks (***)" +pocketasterisk.zip,"ZIP Bundle for PocketAsterisk.exe" +PreviousFilesRecovery.exe,"find and recovery files from Windows shadow copies" +previousfilesrecovery.zip,"ZIP Bundle for PreviousFilesRecovery.exe" +ProcessActivityView.exe,"Show the file activity for selected process." +processactivityview.zip,"ZIP Bundle for ProcessActivityView.exe" +ProcessTCPSummary.exe,"Displays TCP connections summary" +processtcpsummary.zip,"ZIP Bundle for ProcessTCPSummary.exe" +ProcessThreadsView.exe,"Displays extensive information about all threads of the process that you choose." +processthreadsview.zip,"ZIP Bundle for ProcessThreadsView.exe" +ProductKeyScanner.exe,"Find product keys stored in the Registry of Windows Operating system" +productkeyscanner.zip,"ZIP Bundle for ProductKeyScanner.exe" +ProduKey.exe,"Displays the CD-Keys of MS-Office/Windows installed on your computer." +ProduKey.exe,"Package of system tools for Windows" +produkey.zip,"ZIP Bundle for ProduKey.exe" +progtools.zip,"ZIP Bundle for dllexp.exe" +PropertySystemView.exe,"View/edit file properties" +propertysystemview.zip,"ZIP Bundle for PropertySystemView.exe" +pspv.exe,"reveals the passwords stored on your computer by Internet Explorer." +pspv.zip,"ZIP Bundle for pspv.exe" +PstPassword.exe,"Recover lost password of Outlook PST file." +pstpassword.zip,"ZIP Bundle for PstPassword.exe" +QuickSetDNS.exe,"Change the DNS servers that are used for your Internet connection." +quicksetdns.zip,"ZIP Bundle for QuickSetDNS.exe" +rdpv.exe,"Reveals the password stored by Microsoft Remote Desktop utility." +rdpv.zip,"ZIP Bundle for rdpv.exe" +RecentFilesView.exe,"Display the list of recently opened files" +recentfilesview.zip,"ZIP Bundle for RecentFilesView.exe" +RegDllView.exe,"RegDllView is a small utility that displays the list of all registered files." +regdllview.zip,"ZIP Bundle for RegDllView.exe" +RegFileExport.exe,"Export offline Registry file to .reg file" +regfileexport.zip,"ZIP Bundle for RegFileExport.exe" +RegFromApp.exe,"Creates .reg file according to Registry changes made by application." +regfromapp.zip,"ZIP Bundle for RegFromApp.exe" +RegHiveBackup.exe,"Backs up Registry files and user Registry hives to a specified folder." +reghivebackup.zip,"ZIP Bundle for RegHiveBackup.exe" +RegistryChangesView.exe,"Compares 2 snapshots of Windows Registry." +registrychangesview.zip,"ZIP Bundle for RegistryChangesView.exe" +RegScanner.exe,"Package of 5 Windows Registry tools for advanced users" +RegScanner.exe,"Scan and find values in the Registry" +regscanner.zip,"ZIP Bundle for RegScanner.exe" +regtools.zip,"ZIP Bundle for RegScanner.exe" +ResourcesExtract.exe,"Extract embedded resources from .NET applications." +ResourcesExtract.exe,"Extract resources from dll/ocx/exe files." +resourcesextract.zip,"ZIP Bundle for ResourcesExtract.exe" +RouterPassView.exe,"Recover passwords from router config file." +routerpassview.zip,"ZIP Bundle for RouterPassView.exe" +RTMPDumpHelper.exe,"Download RTMP streams in conjunction with RTMPDump toolkit." +rtmpdumphelper.zip,"ZIP Bundle for RTMPDumpHelper.exe" +RunAsDate.exe,"Run a program with the specified date." +runasdate.zip,"ZIP Bundle for RunAsDate.exe" +RunFromProcess.exe,"Run a program from another process that you choose." +runfromprocess.zip,"ZIP Bundle for RunFromProcess.exe" +RuntimeClassesView.exe,"Displays the list of Windows Runtime (WinRT) classes" +runtimeclassesview.zip,"ZIP Bundle for RuntimeClassesView.exe" +SafariCacheView.exe,"Cache viewer/extractor for Safari Web browser" +safaricacheview.zip,"ZIP Bundle for SafariCacheView.exe" +SafariHistoryView.exe,"History viewer for Safari Web browser" +safarihistoryview.zip,"ZIP Bundle for SafariHistoryView.exe" +SearchFilterView.exe,"view the search filters installed on your system." +searchfilterview.zip,"ZIP Bundle for SearchFilterView.exe" +SearchMyFiles.exe,"Alternative to the standard Search For Files And Folders module of Windows." +searchmyfiles.zip,"ZIP Bundle for SearchMyFiles.exe" +SecurityQuestionsView.exe,"View Windows 10 security questions" +securityquestionsview.zip,"ZIP Bundle for SecurityQuestionsView.exe" +SecuritySoftView.exe,"Displays the list of AntiVirus/AntiSpyware/ Firewall programs on your system." +securitysoftview.zip,"ZIP Bundle for SecuritySoftView.exe" +SeqDownload.exe,"Download sequence of images from the Web, and create animation from them." +seqdownload.zip,"ZIP Bundle for SeqDownload.exe" +serviwin.exe,"displays the list of installed drivers and services on your system." +serviwin.zip,"ZIP Bundle for serviwin.exe" +ShadowCopyView.exe,"View shadow copies on your system" +shadowcopyview.zip,"ZIP Bundle for ShadowCopyView.exe" +ShellBagsView.exe,"Displays the list of all folder settings saved by Windows. " +shellbagsview.zip,"ZIP Bundle for ShellBagsView.exe" +ShellMenuNew.exe,"Disable/Enable items in the New submenu of Explorer." +shellmenunew.zip,"ZIP Bundle for ShellMenuNew.exe" +shexview.exe,"Displays the details of shell extensions installed on your computer." +shexview.zip,"ZIP Bundle for shexview.exe" +shman.exe,"Lists all shortcuts on your desktop/start menu." +shman.zip,"ZIP Bundle for shman.exe" +shmnview.exe,"Disable/enable static menu items in context menu of Explorer." +shmnview.zip,"ZIP Bundle for shmnview.exe" +ShutdownPerformanceView.exe,"Displays the performance information of Windows shutdown process" +shutdownperformanceview.zip,"ZIP Bundle for ShutdownPerformanceView.exe" +SimpleCodeGenerator.exe,"QR Code Generator for Windows" +simplecodegenerator.zip,"ZIP Bundle for SimpleCodeGenerator.exe" +SimpleProgramDebugger.exe,"Displays debugging events of a running program." +simpleprogramdebugger.zip,"ZIP Bundle for SimpleProgramDebugger.exe" +SimpleWMIView.exe,"Displays the result of WMI queries in a simple table" +simplewmiview.zip,"ZIP Bundle for SimpleWMIView.exe" +SiteShoter.exe,"Save a screenshot of any Web page into a file." +siteshoter.zip,"ZIP Bundle for SiteShoter.exe" +SkypeContactsView.exe,"Displays the list of Skype contacts stored in the local database file of Skype." +skypecontactsview.zip,"ZIP Bundle for SkypeContactsView.exe" +SkypeLogView.exe,"View log files created by Skype" +skypelogview.zip,"ZIP Bundle for SkypeLogView.exe" +smsniff.exe,"Captures TCP/IP packets and view the captured data as sequence of conversations." +smsniff.zip,"ZIP Bundle for smsniff.exe" +SniffPass.exe,"capture the passwords that pass through your network adapter." +sniffpass.zip,"ZIP Bundle for SniffPass.exe" +SocketSniff.exe,"Watch the Windows Sockets (WinSock) activity of the selected process." +socketsniff.zip,"ZIP Bundle for SocketSniff.exe" +SoundVolumeView.exe,"A package of 6 tools for Windows related to video/audio." +SoundVolumeView.exe,"View/change sound levels & save/load sound level profiles on Windows Vista/7/8" +soundvolumeview.zip,"ZIP Bundle for SoundVolumeView.exe" +SpecialFoldersView.exe,"Easily jump to special folders in your system." +specialfoldersview.zip,"ZIP Bundle for SpecialFoldersView.exe" +strun.exe,"Displays the list of all applications that are loaded on startup." +strun.zip,"ZIP Bundle for strun.exe" +svcl.exe,"Sound volume command-line tool for Windows" +svcl.zip,"ZIP Bundle for svcl.exe" +sysexp.exe,"Grab the data stored in list-views, tree-views, list boxes, and combo boxes." +sysexp.zip,"ZIP Bundle for sysexp.exe" +systools.zip,"ZIP Bundle for ProduKey.exe" +TableTextCompare.exe,"Compare tab-delimited or comma-delimited (csv) files." +tabletextcompare.zip,"ZIP Bundle for TableTextCompare.exe" +TaskSchedulerView.exe,"View/Disable/Enable tasks from the Task Scheduler of Windows." +taskschedulerview.zip,"ZIP Bundle for TaskSchedulerView.exe" +TCPConnectProblemView.exe,"Monitor TCP connection problems." +tcpconnectproblemview.zip,"ZIP Bundle for TCPConnectProblemView.exe" +TcpLogView.exe,"Monitors the opened TCP connections on your system." +tcplogview.zip,"ZIP Bundle for TcpLogView.exe" +TimeZonesView.exe,"Displays all world time zones." +timezonesview.zip,"ZIP Bundle for TimeZonesView.exe" +TurnedOnTimesView.exe,"View the time/date ranges that your computer was turned on." +turnedontimesview.zip,"ZIP Bundle for TurnedOnTimesView.exe" +UninstallView.exe,"Shows installed programs on your system and allows you to uninstall them." +uninstallview.zip,"ZIP Bundle for UninstallView.exe" +URLProtocolView.exe,"View/disable/enable the URL protocols installed on your system" +urlprotocolview.zip,"ZIP Bundle for URLProtocolView.exe" +URLStringGrabber.exe,"Grab URL strings of Web sites from Internet Explorer" +urlstringgrabber.zip,"ZIP Bundle for URLStringGrabber.exe" +USBDeview.exe,"Lists all installed USB devices that you previously used." +usbdeview.zip,"ZIP Bundle for USBDeview.exe" +USBDriveLog.exe,"USB Drive Log For Windows 10" +usbdrivelog.zip,"ZIP Bundle for USBDriveLog.exe" +USBLogView.exe,"Records the details of any USB device that is plugged/unplugged into your system" +usblogview.zip,"ZIP Bundle for USBLogView.exe" +UserAssistView.exe,"This utility decrypt and displays the list of all UserAssist entries" +userassistview.zip,"ZIP Bundle for UserAssistView.exe" +UserProfilesView.exe,"View user profiles information on your system." +userprofilesview.zip,"ZIP Bundle for UserProfilesView.exe" +VaultPasswordView.exe,"Decrypts passwords stored in Windows Vault" +vaultpasswordview.zip,"ZIP Bundle for VaultPasswordView.exe" +videoaudiotools.zip,"ZIP Bundle for SoundVolumeView.exe" +VideoCacheView.exe,"Extract Web site video files from the cache of your Web browser" +videocacheview.zip,"ZIP Bundle for VideoCacheView.exe" +VNCPassView.exe,"Recover the passwords stored by the VNC tool." +vncpassview.zip,"ZIP Bundle for VNCPassView.exe" +volumouse.exe,"Adjust the volume of your speaker with the wheel of your mouse." +volumouse.zip,"ZIP Bundle for volumouse.exe" +WakeMeOnLan.exe,"Turn on one or more computers remotely by sending Wake-on-LAN (WOL) packet" +wakemeonlan.zip,"ZIP Bundle for WakeMeOnLan.exe" +WebBrowserBookmarksView.exe,"View all bookmarks of Chrome and Firefox Web browsers." +webbrowserbookmarksview.zip,"ZIP Bundle for WebBrowserBookmarksView.exe" +WebBrowserPassView.exe,"Recover lost passwords from your Web browser." +webbrowserpassview.zip,"ZIP Bundle for WebBrowserPassView.exe" +WebCacheImageInfo.exe,"Shows EXIF information of the images stored in Web browser cache." +webcacheimageinfo.zip,"ZIP Bundle for WebCacheImageInfo.exe" +WebCamImageSave.exe,"Capture still images from your WebCam." +webcamimagesave.zip,"ZIP Bundle for WebCamImageSave.exe" +WebCookiesSniffer.exe,"Captures Web site cookies and displays them in a simple table" +webcookiessniffer.zip,"ZIP Bundle for WebCookiesSniffer.exe" +WebSiteSniffer.exe,"Capture Web site files and save them on your hard drive." +websitesniffer.zip,"ZIP Bundle for WebSiteSniffer.exe" +WebVideoCap.exe,"Capture Flash Video files and RTSP streams while watching them in a Web browser." +webvideocap.zip,"ZIP Bundle for WebVideoCap.exe" +WhatInStartup.exe,"disable/enable/delete programs that are loaded at Windows startup." +whatinstartup.zip,"ZIP Bundle for WhatInStartup.exe" +WhatIsHang.exe,"Get information about Windows software that hangs." +whatishang.zip,"ZIP Bundle for WhatIsHang.exe" +WhoisCL.exe,"Get WHOIS information about a registered domain from command-line." +whoiscl.zip,"ZIP Bundle for WhoisCL.exe" +WhoIsConnectedSniffer.exe,"Shows who connects to your network by listening to network packets." +whoisconnectedsniffer.zip,"ZIP Bundle for WhoIsConnectedSniffer.exe" +whoistd.exe,"NirSoft WhoisTD utility." +whoistd.zip,"ZIP Bundle for whoistd.exe" +whosip.exe,"find all available information about an IP address from command-line." +whosip.zip,"ZIP Bundle for whosip.exe" +WifiChannelMonitor.exe,"Captures wifi traffic in monitor mode and displays AP/clients information." +wifichannelmonitor.zip,"ZIP Bundle for WifiChannelMonitor.exe" +WifiDiagnosticsView.exe,"Wifi diagnostics tool for Windows" +wifidiagnosticsview.zip,"ZIP Bundle for WifiDiagnosticsView.exe" +WifiHistoryView.exe,"Displays the history of connections to wireless networks on your computer. " +wifihistoryview.zip,"ZIP Bundle for WifiHistoryView.exe" +WifiInfoView.exe,"Displays extensive information about wireless networks in your area." +wifiinfoview.zip,"ZIP Bundle for WifiInfoView.exe" +WinCrashReport.exe,"Displays a report about crashed Windows application." +wincrashreport.zip,"ZIP Bundle for WinCrashReport.exe" +WinDefLogView.exe,"Windows Defender Log Viewer" +windeflogview.zip,"ZIP Bundle for WinDefLogView.exe" +WinDefThreatsView.exe,"View Windows Defender threats of local and remote computer" +windefthreatsview.zip,"ZIP Bundle for WinDefThreatsView.exe" +WinFontsView.exe,"Display sample of all fonts installed on your system." +winfontsview.zip,"ZIP Bundle for WinFontsView.exe" +winlister.exe,"This utility displays the list of opened windows on your system. " +winlister.zip,"ZIP Bundle for winlister.exe" +WinLogOnView.exe,"Displays logon/logoff times on Windows Vista/7/8/2008" +winlogonview.zip,"ZIP Bundle for WinLogOnView.exe" +WinMailPassRec.exe,"Password Recovery For Windows Mail App of Windows 10 and Windows 11" +winmailpassrec.zip,"ZIP Bundle for WinMailPassRec.exe" +WinPrefetchView.exe,"View the Prefetch files (.pf) stored in your system." +winprefetchview.zip,"ZIP Bundle for WinPrefetchView.exe" +WinsockServicesView.exe,"View/Disable/Enable Winsock service providers installed on your system." +winsockservicesview.zip,"ZIP Bundle for WinsockServicesView.exe" +WinUpdatesView.exe,"Displays the history of Windows updates for your system." +winupdatesview.zip,"ZIP Bundle for WinUpdatesView.exe" +WirelessConnectionInfo.exe,"Displays general information and statistics about the active wifi connection." +wirelessconnectioninfo.zip,"ZIP Bundle for WirelessConnectionInfo.exe" +WirelessKeyDump.exe,"dumps the list of all wireless keys stored by Windows" +wirelesskeydump.zip,"ZIP Bundle for WirelessKeyDump.exe" +WirelessKeyView.exe,"recovers lost wireless network keys (WEP/WPA) stored in your computer." +wirelesskeyview.zip,"ZIP Bundle for WirelessKeyView.exe" +WirelessNetConsole.exe,"View wireless networks information (console application)" +wirelessnetconsole.zip,"ZIP Bundle for WirelessNetConsole.exe" +WirelessNetView.exe,"Monitor the activity of wireless networks around you." +wirelessnetview.zip,"ZIP Bundle for WirelessNetView.exe" +WNetWatcher.exe,"Shows who is connected to your wireless network." +wnetwatcher.zip,"ZIP Bundle for WNetWatcher.exe" +wul.exe,"Displays the list of all Windows updates (Service Packs and Hotfixes)." +wul.zip,"ZIP Bundle for wul.exe" +zipinst.exe,"Install applications that do not provide an installation module." +zipinst.zip,"ZIP Bundle for zipinst.exe" diff --git a/lookups/csv/nirsoft_utilities_lookup.yml b/lookups/csv/nirsoft_utilities_lookup.yml new file mode 100644 index 00000000000..ebd1525ea4c --- /dev/null +++ b/lookups/csv/nirsoft_utilities_lookup.yml @@ -0,0 +1,12 @@ +name: nirsoft_utilities_lookup +id: 9ebf4dba-02a9-4f64-9f06-f02d4023c52a +version: 1 +creation_date: '2026-10-01' +modification_date: '2026-10-01' +author: Splunk Threat Research Team +lookup_type: csv +description: A subset of utilities provided by NirSoft that may be used by adversaries. +match_type: + - WILDCARD(original_file_name) +min_matches: 1 +case_sensitive_match: false From adc69d950e1fe19393d418269ed7881c95a98104 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 13 Oct 2026 18:19:57 -0700 Subject: [PATCH 151/162] Fix Failing Integration Tests (#4338) --------- Co-authored-by: Nasreddine Bencherchali --- data_sources/sysmon_eventid_15.yml | 72 ++++++++++--------- data_sources/sysmon_eventid_22.yml | 65 ++++++++--------- ..._aws_ecr_container_upload_unknown_user.yml | 50 +++++++++---- ...iles_filter_loaded_by_uncommon_process.yml | 40 ++++++----- ...tem_process_querying_definition_update.yml | 34 ++++++--- ...rmgr_alternate_data_stream_in_temp_dir.yml | 11 +-- 6 files changed, 157 insertions(+), 115 deletions(-) diff --git a/data_sources/sysmon_eventid_15.yml b/data_sources/sysmon_eventid_15.yml index 45aa929ea73..26bc8419fad 100644 --- a/data_sources/sysmon_eventid_15.yml +++ b/data_sources/sysmon_eventid_15.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 15 id: 95785e02-93b4-47e2-81f1-be326295348e -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-13' author: Patrick Bareiss, Splunk description: Logs the creation of a new file stream, including details about the file stream's hash, path, and associated process metadata. mitre_components: @@ -22,43 +22,11 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Computer - Contents - CreationUtcTime - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - Guid - - Hash - - IMPHASH - - Image - - Keywords - - Level - - MD5 - - Name - - Opcode - - ProcessGuid - - ProcessID - - ProcessId - - RecordID - - RecordNumber - - RuleName - - SHA256 - - SecurityID - - SystemTime - - System_Props_Xml - - TargetFilename - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -70,33 +38,66 @@ fields: - dest - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype - file_create_time - file_hash - file_name - file_path + - Guid + - Hash - host - id + - Image + - IMPHASH - index + - Keywords + - Level - linecount + - MD5 + - Name + - Opcode - os - process_exec - process_guid - process_id - process_name - process_path + - ProcessGuid + - ProcessId + - ProcessID - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID + - SHA256 - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - TargetFilename + - Task + - ThreadID + - TimeCreated - timeendpos - timestartpos + - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - dest - dvc @@ -110,6 +111,7 @@ output_fields: - process_path - signature - signature_id + - user - user_id - vendor_product example_log: 15241500x8000000000000000667860Microsoft-Windows-Sysmon/Operationalproject-mumbai-host-2021-04-28 20:11:34.709{ED2ECF8A-C154-6089-F967-00000000BB01}7000C:\Users\DefaultAccount\AppData\Roaming\Telegram Desktop\Telegram.exeC:\Users\DefaultAccount\Downloads\Telegram Desktop\Good(NLA).txt:Zone.Identifier2021-04-28 20:11:33.238MD5=C785C55D5FA3443A11B8417209C4B524,SHA256=D07777E0DC36EBECCE3FA9644F0F44DC4A0B7EDE0CBC1F5D33E8D6CB07AF5B5C,IMPHASH=00000000000000000000000000000000[ZoneTransfer] ZoneId=3 diff --git a/data_sources/sysmon_eventid_22.yml b/data_sources/sysmon_eventid_22.yml index fdaa49c1460..2a53a749620 100644 --- a/data_sources/sysmon_eventid_22.yml +++ b/data_sources/sysmon_eventid_22.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 22 id: 911538b2-eba7-4d3e-85e8-d82d380c37bf -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-13' author: Patrick Bareiss, Splunk description: Logs DNS query events, including details about the queried domain, source IP, query type, and response data. mitre_components: @@ -24,36 +24,6 @@ fields: - _time - Channel - Computer - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - Guid - - Image - - Keywords - - Level - - Name - - Opcode - - ProcessGuid - - ProcessID - - ProcessId - - QueryName - - QueryResults - - QueryStatus - - RecordID - - RecordNumber - - RuleName - - SecurityID - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - date_hour - date_mday - date_minute @@ -64,30 +34,61 @@ fields: - date_zone - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype + - Guid - host - id + - Image - index + - Keywords + - Level - linecount + - Name + - Opcode - process_exec - process_guid - process_name + - ProcessGuid + - ProcessId + - ProcessID - punct - query - query_count + - QueryName + - QueryResults + - QueryStatus + - record_type + - RecordID + - RecordNumber - reply_code_id + - RuleName + - SecurityID - signature - signature_id - source - sourcetype - splunk_server - src + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Task + - ThreadID + - TimeCreated - timeendpos - timestartpos - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - answer - answer_count diff --git a/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml b/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml index 404144c034e..6831869df1e 100644 --- a/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml +++ b/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml @@ -1,27 +1,47 @@ name: ASL AWS ECR Container Upload Unknown User id: 886a8f46-d7e2-4439-b9ba-aec238e31732 -version: 12 +version: 13 creation_date: '2024-05-22' modification_date: '2026-05-13' author: Patrick Bareiss, Splunk status: production type: Anomaly -description: The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events. It identifies instances where a new container is uploaded by a user not previously recognized as authorized. This detection is crucial for a SOC as it can indicate a potential compromise or misuse of AWS ECR, which could lead to unauthorized access to sensitive data or the deployment of malicious containers. By identifying and investigating these events, organizations can mitigate the risk of data breaches or other security incidents resulting from unauthorized container uploads. The impact of such an attack could be significant, compromising the integrity and security of the organization's cloud environment. +description: |- + The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events. + It identifies instances where a new container is uploaded by a user not previously recognized as authorized. data_source: - ASL AWS CloudTrail search: |- - `amazon_security_lake` api.operation=PutImage NOT `aws_ecr_users_asl` - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY actor.user.uid api.operation api.service.name - http_request.user_agent src_endpoint.ip actor.user.account.uid - cloud.provider cloud.region - | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `asl_aws_ecr_container_upload_unknown_user_filter` -how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App. -known_false_positives: No false positives have been identified at this time. + `amazon_security_lake` + api.operation=PutImage + NOT `aws_ecr_users_asl` + + | fillnull + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by actor.user.uid api.operation api.service.name + http_request.user_agent + src_endpoint.ip actor.user.account.uid + cloud.provider cloud.region + + | rename actor.user.account.uid as vendor_account + actor.user.uid as user + api.operation as action + api.service.name as dest + cloud.provider as vendor_product + cloud.region as vendor_region + http_request.user_agent as user_agent + src_endpoint.ip as src + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `asl_aws_ecr_container_upload_unknown_user_filter` +how_to_implement: |- + The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App. +known_false_positives: |- + No false positives have been identified at this time. references: - https://attack.mitre.org/techniques/T1204/003/ drilldown_searches: @@ -38,7 +58,7 @@ intermediate_findings: - field: user type: user score: 20 - message: Container uploaded from unknown user $user$ + message: Container uploaded from unknown user [$user$]. threat_objects: - field: src type: ip_address diff --git a/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml b/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml index f15a3995463..8e6bd9a38d5 100644 --- a/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml +++ b/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml @@ -1,13 +1,13 @@ name: Windows Cloud Files Filter Loaded by Uncommon Process id: 77b85062-274e-43a5-9dab-c25862b85291 -version: 1 +version: 2 creation_date: '2026-05-18' -modification_date: '2026-05-18' +modification_date: '2026-10-08' author: Raven Tait, Splunk status: production type: Anomaly description: |- - The following analytic detects cldapi.dll being loaded by a process not associated with legitimate cloud sync activity. + The following analytic detects "cldapi.dll" being loaded by a process not associated with legitimate cloud sync activity. The Windows Cloud Files API (cldapi.dll) is abused by several local privilege escalation exploits. data_source: - Sysmon EventID 7 @@ -16,22 +16,25 @@ search: |- EventID=7 ImageLoaded="*\\cldapi.dll" NOT Image IN ( - "*\\box.exe", - "*\\dropbox.exe", - "*\\googledrivefs.exe", - "*\\icloud.exe", - "*\\onedrive*.exe", - "*\\Windows\\explorer.exe" - "*\\Windows\\System32\\*", - "*\\Windows\\Syswow64\\*", - "*\\Windows\\WinSxS\\*" + "*\\box.exe", + "*\\dropbox.exe", + "*\\googledrivefs.exe", + "*\\icloud.exe", + "*\\onedrive*.exe", + "C:\\Windows\\explorer.exe", + "C:\\Windows\\System32\\*", + "C:\\Windows\\Syswow64\\*", + "C:\\Windows\\WinSxS\\*" ) + | stats count min(_time) as firstTime max(_time) as lastTime - by Computer ImageLoaded EventID dest loaded_file loaded_file_path process_exec - process_guid process_hash process_id process_name process_path - service_dll_signature_exists service_dll_signature_verified signature_id user_id - vendor_product + + by dest loaded_file_path loaded_file + process_path process_name process_exec process_guid process_hash process_id + service_dll_signature_exists service_dll_signature_verified + signature signature_id user_id vendor_product + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cloud_files_filter_loaded_by_uncommon_process_filter` @@ -57,7 +60,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: Cloud Files Filter ($ImageLoaded$) loaded by suspicious process $Image$ on $dest$ + message: Cloud Files Filter [$loaded_file_path$] loaded by suspicious process [$process_path$] on [$dest$] +threat_objects: + - field: loaded_file_path + type: loaded_file analytic_story: - RedSun - BlueHammer diff --git a/detections/endpoint/windows_non_system_process_querying_definition_update.yml b/detections/endpoint/windows_non_system_process_querying_definition_update.yml index f2a81e01160..b428d437a8c 100644 --- a/detections/endpoint/windows_non_system_process_querying_definition_update.yml +++ b/detections/endpoint/windows_non_system_process_querying_definition_update.yml @@ -1,13 +1,14 @@ name: Windows Non-System Process Querying Definition Update id: 9d375cfd-c9a5-48ff-b875-9bcaf6b63265 -version: 1 +version: 2 creation_date: '2026-04-27' -modification_date: '2026-04-27' +modification_date: '2026-10-08' author: Raven Tait, Splunk status: production type: Anomaly description: |- - Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component. BlueHammer utilizes these definition updates as part of its exploit chain. + Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component. + BlueHammer utilizes these definition updates as part of its exploit chain. data_source: - Sysmon EventID 22 search: |- @@ -15,16 +16,27 @@ search: |- EventID="22" QueryName="*definitionupdates.microsoft.com*" NOT Image IN ( - "*:\\Program Files\\Microsoft Office\\*", - "*:\\Program Files\\Windows Defender\\*", - "*:\\ProgramData\\Microsoft\\Windows Defender\\*", - "*:\\Windows\\System32\\*", - "*:\\Windows\\SysWOW64\\*" + "C:\\Program Files\\Microsoft Office\\*", + "C:\\Program Files\\Windows Defender\\*", + "C:\\ProgramData\\Microsoft\\Windows Defender\\*", + "C:\\Windows\\System32\\*", + "C:\\Windows\\SysWOW64\\*" ) - | stats count min(_time) as firstTime max(_time) as lastTime BY answer answer_count dvc Computer process_exec process_guid process_name query query_count reply_code_id signature signature_id src user_id vendor_product QueryName QueryResults QueryStatus + + | rename Computer as dest, + Image as process_path + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by src dest answer answer_count + process_path process_name process_exec process_guid + query query_count QueryResults record_type reply_code_id + signature signature_id user_id vendor_product + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | rename Computer as dest + | `windows_non_system_process_querying_definition_update_filter` how_to_implement: |- The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. @@ -46,7 +58,7 @@ intermediate_findings: - field: dest type: system score: 20 - message: Non-System process $Image$ queried Windows Defender Definition Updates domain $QueryName$ on $dest$. + message: Non-System process [$process_path$] queried Windows Defender Definition Updates domain [$query$] on [$dest$]. threat_objects: - field: process_name type: process_name diff --git a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml index 54fd1c50a9b..7f894ff9bfa 100644 --- a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml +++ b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml @@ -1,8 +1,8 @@ name: Windows Wermgr Alternate Data Stream in Temp Dir id: 65222e9b-9d0b-4bfe-8da1-199b98e1d44a -version: 2 +version: 3 creation_date: '2026-06-11' -modification_date: '2026-09-08' +modification_date: '2026-10-12' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -20,9 +20,10 @@ search: |- | stats count min(_time) as firstTime max(_time) as lastTime - by dest dvc file_hash file_name file_path process_exec - process_guid process_id process_name process_path - signature signature_id user_id vendor_product Contents Image + by dest file_hash file_name file_path + process_path process_name process_exec process_guid process_id + user_id user Contents + signature signature_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From a268aeebf542016206d23b27d6e2964f6dda3500 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 15 Oct 2026 04:18:14 -0700 Subject: [PATCH 152/162] Update data source TA and install.yml app versions (#4344) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/osquery_results.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data_sources/osquery_results.yml b/data_sources/osquery_results.yml index 5445233c455..6b841133167 100644 --- a/data_sources/osquery_results.yml +++ b/data_sources/osquery_results.yml @@ -16,7 +16,7 @@ sourcetype: osquery:results supported_TA: - name: TA-osquery url: https://splunkbase.splunk.com/app/8574 - version: 1.0.4 + version: 1.0.5 fields: - _time - calendarTime From 12b9d52ff37bd5bf78080de731b5798c83e858ca Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 16 Oct 2026 02:34:35 -0700 Subject: [PATCH 153/162] Update data source TA and install.yml app versions (#4347) Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> --- data_sources/splunk_stream_http.yml | 2 +- data_sources/splunk_stream_ip.yml | 2 +- data_sources/splunk_stream_tcp.yml | 2 +- install.yml | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/data_sources/splunk_stream_http.yml b/data_sources/splunk_stream_http.yml index 29522a4daac..d7d7f552869 100644 --- a/data_sources/splunk_stream_http.yml +++ b/data_sources/splunk_stream_http.yml @@ -16,7 +16,7 @@ sourcetype: stream:http supported_TA: - name: Splunk Add-on for Stream Wire Data url: https://splunkbase.splunk.com/app/5234 - version: 8.1.6 + version: 8.1.7 fields: - _time - bytes diff --git a/data_sources/splunk_stream_ip.yml b/data_sources/splunk_stream_ip.yml index a5ffb18d05e..1fbea554861 100644 --- a/data_sources/splunk_stream_ip.yml +++ b/data_sources/splunk_stream_ip.yml @@ -16,7 +16,7 @@ sourcetype: stream:ip supported_TA: - name: Splunk Add-on for Stream Wire Data url: https://splunkbase.splunk.com/app/5234 - version: 8.1.6 + version: 8.1.7 fields: - _time - action diff --git a/data_sources/splunk_stream_tcp.yml b/data_sources/splunk_stream_tcp.yml index a15f4041880..710bb9cb0b7 100644 --- a/data_sources/splunk_stream_tcp.yml +++ b/data_sources/splunk_stream_tcp.yml @@ -16,4 +16,4 @@ sourcetype: stream:tcp supported_TA: - name: Splunk Add-on for Stream Wire Data url: https://splunkbase.splunk.com/app/5234 - version: 8.1.6 + version: 8.1.7 diff --git a/install.yml b/install.yml index 28ef2c76795..cb3196171aa 100644 --- a/install.yml +++ b/install.yml @@ -12,10 +12,10 @@ apps: version: 2.3.4 - appid: Splunk_TA_stream url: https://splunkbase.splunk.com/app/5238 - version: 8.1.6 + version: 8.1.7 - appid: Splunk_TA_stream_wire_data url: https://splunkbase.splunk.com/app/5234 - version: 8.1.6 + version: 8.1.7 - appid: TA-Zscaler_CIM url: https://splunkbase.splunk.com/app/3865 version: 4.1.5 From d6afc62b750dc2ed34e3696999bf26fe476b9b1e Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 16 Oct 2026 15:12:12 +0200 Subject: [PATCH 154/162] Expand AI Defense Coverage (#4345) --------- Co-authored-by: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> --- data_sources/cisco_ai_defense_alerts.yml | 65 ++++++++- ...co_ai_defense_allowed_sensitive_prompt.yml | 96 +++++++++++++ ..._ai_defense_allowed_sensitive_response.yml | 73 ++++++++++ ...ai_defense_repeated_high_risk_activity.yml | 96 +++++++++++++ ...se_security_alerts_by_application_name.yml | 133 +++++++++++++----- ...buse_of_genai_systems_and_applications.yml | 23 +++ 6 files changed, 447 insertions(+), 39 deletions(-) create mode 100644 detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml create mode 100644 detections/application/cisco_ai_defense_allowed_sensitive_response.yml create mode 100644 detections/application/cisco_ai_defense_repeated_high_risk_activity.yml create mode 100644 stories/abuse_of_genai_systems_and_applications.yml diff --git a/data_sources/cisco_ai_defense_alerts.yml b/data_sources/cisco_ai_defense_alerts.yml index 2eba8da4082..60efe8e519b 100644 --- a/data_sources/cisco_ai_defense_alerts.yml +++ b/data_sources/cisco_ai_defense_alerts.yml @@ -1,11 +1,11 @@ name: Cisco AI Defense Alerts id: cbb06880-9dd9-4542-ac60-bd6e1d3c3e4e -version: 2 +version: 3 creation_date: '2025-02-14' -modification_date: '2026-05-13' -author: Bhavin Patel +modification_date: '2026-10-15' +author: Bhavin Patel, Nasreddine Bencherchali, Splunk description: Data source object for Cisco AI Defense Alerts -source: cisco_ai_defense +source: not_applicable sourcetype: cisco:ai:defense separator: supported_TA: @@ -13,3 +13,60 @@ supported_TA: url: https://splunkbase.splunk.com/app/7404 version: 4.1.2 fields: + - _time + - host + - app + - application_id + - connection_id + - connection.connection_name + - description + - dest_type + - event_action + - event_date + - event_id + - event_message_type + - event_messages{}.event_conversation.event_messages{}.content + - event_messages{}.event_conversation.event_messages{}.direction + - event_messages{}.event_conversation.event_messages{}.event_conversation_id + - event_messages{}.event_conversation.event_messages{}.event_ext_message_id + - event_messages{}.event_conversation.event_messages{}.event_ins_date + - event_messages{}.event_conversation.event_messages{}.event_message_id + - event_messages{}.event_conversation.event_messages{}.event_message_policy_assocs + - event_messages{}.event_conversation.event_messages{}.metadata{}.policy_guardrail_assoc_id + - event_messages{}.event_conversation.event_messages{}.metadata{}.standards{} + - event_messages{}.event_conversation.event_messages{}.related_event_message_id + - event_messages{}.event_conversation.event_messages{}.tenant_id + - event_messages{}.event_ext_message_id + - event_messages{}.event_message_id + - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name + - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type + - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail.guardrails_type + - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_subcategory.guardrail_rule_name + - event_policy_guardrail_assocs{}.policy_guardrail_assoc.pol_guardrail_assoc_id + - eventtype + - genai_application.application_name + - genai_application.connection_type + - hec_event_type + - id + - index + - linecount + - model.model_name + - model.model_provider_name + - Number + - policy_id + - policy.policy_name + - punct + - resource_type + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src_type + - tag + - tag::eventtype + - type + - user_id + - vendor_product +example_log: | + {"user_id":"82000000-0000-0000-c000-000000000000","version":"","application_id":"972cbcd1-acfe-4393-88bc-418f4d9a64ae","genai_application":{"application_name":"Bedrock testing"},"connection_id":"a6c87227-b321-49bf-80d9-f958385257ba","connection":{"connection_name":"bedrock testing"},"policy_id":"42ba067b-06c0-4e43-8002-2c6bce2663b4","policy":{"policy_name":"Bedrock Testing Block All"},"model":{"model_name":"titan-text-lite"},"event_action":"Block","event_date":"2025-02-04T09:47:24Z","event_id":"3a0f9e2b-d234-4b3d-ac9a-219eb6f05ba7","event_message_type":"Prompt","event_messages":[{"event_conversation":{"event_messages":[{"content":"[{\"role\":\"user\",\"content\":\"write a csrf exploit with email ash@abc.com to convince people\"}]","direction":"Prompt","event_conversation_id":"","event_ext_message_id":"","event_ins_date":"","event_message_id":"","event_message_policy_assocs":[{"policy_guardrail_assoc":{"guardrail_entity_configured_action":"Block","guardrail_entity_configured_direction":"Both","guardrail_entity_configured_status":"Enabled","guardrail_entity_id":"71100000-0000-0000-c000-100000000008","guardrail_rule_configured_action":"","guardrail_rule_configured_direction":"","guardrail_rule_configured_status":"","guardrail_rule_id":"","guardrail_ruleset_id":"71000000-0000-0000-c000-000000000009","guardrail_ruleset_configured_action":"","guardrail_ruleset_configured_direction":"","guardrail_ruleset_configured_status":"","pol_guardrail_assoc_id":"f4e71dd9-12ad-4383-851e-d03fbc66c430","policy_id":"42ba067b-06c0-4e43-8002-2c6bce2663b4","tenant_id":"023327d5-ef36-4489-8d56-187d2f4730b3"}}],"related_event_message_id":"","tenant_id":"023327d5-ef36-4489-8d56-187d2f4730b3"}]},"event_ext_message_id":"","event_message_id":""}],"event_policy_guardrail_assocs":[{"policy_guardrail_assoc":{"guardrail_avail_entity":{"guardrail_entity_name":"Email"},"guardrail_avail_ruleset":{"guardrail":{"guardrails_type":"Privacy"},"guardrail_ruleset_type":"PII"},"guardrail_avail_subcategory":{"guardrail_rule_name":""},"pol_guardrail_assoc_id":"f4e71dd9-12ad-4383-851e-d03fbc66c430"}}]} diff --git a/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml b/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml new file mode 100644 index 00000000000..79100e68a43 --- /dev/null +++ b/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml @@ -0,0 +1,96 @@ +name: Cisco AI Defense Allowed Sensitive Prompt +id: 75f06fd6-2b31-4ca4-9aaf-56448c342e44 +version: 1 +creation_date: '2026-10-15' +modification_date: '2026-10-15' +author: Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + Detects Cisco AI Defense prompt events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data. + These events may indicate that sensitive information was submitted to an AI application and should be reviewed against the organization's data handling policy. +data_source: + - Cisco AI Defense Alerts +search: |- + `cisco_ai_defense` + event_action="allow" + event_message_type="prompt" + + | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "), + + guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "), + + application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"), + + connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"), + + application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name), + + connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name), + + policy_name='policy.policy_name', + + event_time=_time + + | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0 + + | bin _time span=10m + + | stats count as event_count + dc(event_id) as distinct_event_count + min(event_time) as firstTime + max(event_time) as lastTime + values(event_id) as event_ids + values(guardrail_ruleset_type) as guardrail_ruleset_types + values(guardrail_entity_name) as guardrail_entity_names + values(policy_name) as policy_names + values(application_name) as application_names + values(connection_name) as connection_names + by _time application_key connection_key + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + + | table _time firstTime lastTime application_key application_names connection_key connection_names + distinct_event_count event_count event_ids guardrail_ruleset_types guardrail_entity_names policy_names + + | `cisco_ai_defense_allowed_sensitive_prompt_filter` +how_to_implement: |- + Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype. + Confirm that extraction is enabled for the required fields as shown in the detection search. + Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment. + The search groups matching prompt events by application and connection in ten-minute windows to reduce duplicate findings. +known_false_positives: |- + Authorized testing, demonstrations, synthetic data, or approved workflows may submit content that matches PII or PCI guardrails. + Review the application, connection, policy, guardrail entity, and data handling requirements before treating an event as a policy violation. +drilldown_searches: + - name: View the detection results for - "$application_names$" + search: '%original_detection_search% | search application_names="$application_names$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +finding: + title: Cisco AI Defense allowed [$distinct_event_count$] sensitive prompt event(s) for application [$application_names$] and connection [$connection_names$] matched guardrail(s) [$guardrail_ruleset_types$]. + entity: + field: application_key + type: other + score: 50 +threat_objects: [] +analytic_story: + - Abuse of GenAI Systems and Applications + - Data Protection + - Critical Alerts +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json + source: not_applicable + sourcetype: cisco:ai:defense + test_type: unit diff --git a/detections/application/cisco_ai_defense_allowed_sensitive_response.yml b/detections/application/cisco_ai_defense_allowed_sensitive_response.yml new file mode 100644 index 00000000000..4c823a71c61 --- /dev/null +++ b/detections/application/cisco_ai_defense_allowed_sensitive_response.yml @@ -0,0 +1,73 @@ +name: Cisco AI Defense Allowed Sensitive Response +id: 6e4cd833-ea98-4c16-a7e7-e1909fad3fb2 +version: 1 +creation_date: '2026-10-15' +modification_date: '2026-10-15' +author: Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + Detects Cisco AI Defense response events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data. + These events may indicate that sensitive information was returned to an AI application user and should be reviewed promptly. +data_source: + - Cisco AI Defense Alerts +search: |- + `cisco_ai_defense` + event_action="allow" + event_message_type="response" + + | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "), + + guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "), + + application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"), + + connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"), + + policy_name='policy.policy_name' + + | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0 + + | table _time event_date event_id event_message_type event_action resource_type + application_id application_name connection_id connection_name model.model_name + policy_name guardrail_ruleset_type guardrail_entity_name + + | `cisco_ai_defense_allowed_sensitive_response_filter` +how_to_implement: |- + Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype. + Confirm that extraction is enabled for the required fields as shown in the detection search. + Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment. +known_false_positives: |- + Authorized testing, demonstrations, or approved workflows may allow responses that match PII or PCI guardrails. + Review the application owner, policy, response context, and whether the data was expected to be disclosed. +drilldown_searches: + - name: View the detection results for - "$application_name$" + search: '%original_detection_search% | search application_name="$application_name$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +finding: + title: Cisco AI Defense allowed response [$event_id$] for application [$application_name$] matched privacy guardrail(s) [$guardrail_ruleset_type$] and entity [$guardrail_entity_name$]. + entity: + field: application_name + type: other + score: 50 +threat_objects: [] +analytic_story: + - Abuse of GenAI Systems and Applications + - Data Protection + - Critical Alerts +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json + source: not_applicable + sourcetype: cisco:ai:defense + test_type: unit diff --git a/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml new file mode 100644 index 00000000000..d267fb97c78 --- /dev/null +++ b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml @@ -0,0 +1,96 @@ +name: Cisco AI Defense Repeated High Risk Activity +id: 45c5cf84-8ad0-4923-8332-a7fd3dab59d4 +version: 1 +creation_date: '2026-10-15' +modification_date: '2026-10-15' +author: Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + Detects bursts of five or more distinct Cisco AI Defense event IDs, or three or more occurrences of the same event ID, matching prompt injection, code detection, PII, or PCI guardrails for the same application and connection within ten minutes. + Allowed PII/PCI prompt events are handled by Cisco AI Defense Allowed Sensitive Prompt. + These patterns can indicate iterative prompt-injection probing or repeated attempts to use an AI application to access restricted data or capabilities. +data_source: + - Cisco AI Defense Alerts +search: |- + `cisco_ai_defense` + + ```Leave allowed PII/PCI prompt events to Cisco AI Defense Allowed Sensitive Prompt``` + + | eval is_allowed_sensitive_prompt=if(lower(event_action)="allow" AND lower(event_message_type)="prompt" AND mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0, 1, 0) + | where is_allowed_sensitive_prompt=0 + + | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "), + application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"), + connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"), + application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name), + connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name) + + | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0 + + | bin _time span=10m + + ```Track repeated records with the same Cisco event ID separately from bursts of distinct event IDs``` + | eventstats count as same_event_id_count by _time application_key connection_key event_id + + | stats count as event_count + dc(event_id) as distinct_event_count + max(eval(if(isnotnull(event_id) AND len(trim(event_id))>0, same_event_id_count, 0))) as max_same_event_id_count + values(eval(if(isnotnull(event_id) AND len(trim(event_id))>0 AND same_event_id_count>=3, event_id, null()))) as repeated_event_ids + count(eval(lower(event_action)="allow")) as allowed_event_count + count(eval(lower(event_action)="block")) as blocked_event_count + values(event_id) as event_ids + values(event_action) as event_actions + values(event_message_type) as message_types + values(policy.policy_name) as policy_names + values(guardrail_ruleset_type) as guardrail_ruleset_types + values(connection_name) as connection_names + values(application_name) as application_names + by _time application_key connection_key + + | where distinct_event_count>=5 OR max_same_event_id_count>=3 + + | table _time application_key application_names connection_key connection_names + event_count distinct_event_count max_same_event_id_count repeated_event_ids + allowed_event_count blocked_event_count event_actions message_types policy_names + guardrail_ruleset_types event_ids + + | `cisco_ai_defense_repeated_high_risk_activity_filter` +how_to_implement: |- + Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk. + Confirm that extraction is enabled for the required fields as shown in the detection search. + Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment. + Adjust the five-distinct-event threshold, three-occurrence same-event-ID threshold, and ten-minute window as needed. +known_false_positives: |- + Automated testing, red-team exercises, application QA, or a popular shared application may generate repeated guardrail events. + Review whether the window contains allowed events and whether the activity was expected for the application and connection. +drilldown_searches: + - name: View the detection results for - "$application_key$" + search: '%original_detection_search% | search application_key="$application_key$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +finding: + title: Cisco AI Defense observed [$event_count$] high risk event occurrences across [$distinct_event_count$] unique event IDs in ten minutes for application [$application_names$] and connection [$connection_names$]. Maximum same-ID count -> [$max_same_event_id_count$] ; Allowed events -> [$allowed_event_count$] ; Blocked events -> [$blocked_event_count$]. + entity: + field: application_key + type: other + score: 50 +threat_objects: [] +analytic_story: + - Abuse of GenAI Systems and Applications + - Critical Alerts +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json + source: not_applicable + sourcetype: cisco:ai:defense + test_type: unit diff --git a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml index cf1d7ef9e39..9aba8ccc19f 100644 --- a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml +++ b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml @@ -1,45 +1,106 @@ name: Cisco AI Defense Security Alerts by Application Name id: 105e4a69-ec55-49fc-be1f-902467435ea8 -version: 7 +version: 8 creation_date: '2025-02-14' -modification_date: '2026-05-13' -author: Bhavin Patel, Splunk +modification_date: '2026-10-15' +author: Bhavin Patel, Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: The search surfaces alerts from the Cisco AI Defense product for potential attacks against the AI models running in your environment. This analytic identifies security events within Cisco AI Defense by examining event messages, actions, and policy names. It focuses on connections and applications associated with specific guardrail entities and ruleset types. By aggregating and analyzing these elements, the search helps detect potential policy violations and security threats, enabling proactive defense measures and ensuring network integrity. +description: |- + This analytic summarizes Cisco AI Defense events by application, connection, action, message direction, and severity over ten-minute intervals. + Allowed responses flagged for privacy guardrails are handled by the dedicated sensitive-response detection. + Allowed prompts flagged for privacy guardrails are handled by Cisco AI Defense Allowed Sensitive Prompt. + Repeated prompt injection, code detection, PII, or PCI events are handled by the repeated high-risk activity detection. data_source: - Cisco AI Defense Alerts search: |- `cisco_ai_defense` - | rename genai_application.application_name as application_name - | rename connection.connection_name as connection_name - ```Aggregating data by model name, connection name, application name, application ID, and user ID``` - | stats count - values(user_id) as user_id - values(event_message_type) as event_message_type - values(event_action) as event_action - values(policy.policy_name) as policy_name - values(event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name) as guardrail_entity_name - values(event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type) as guardrail_ruleset_type - by model.model_name connection_name application_name application_id - ```Evaluating severity based on policy name and guardrail ruleset type``` - | eval severity=case( - policy_name IN ("AI Runtime Latency Testing - Prompt Injection"), "critical", - policy_name IN ("AI Runtime Latency Testing - Code Detection"), "high", - guardrail_ruleset_type IN ("Toxicity"), "medium", + + | rename genai_application.application_name as application_name, + connection.connection_name as connection_name + + | eval policy_name='policy.policy_name', + + guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "), + + guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "), + + action=lower(event_action), message_type=lower(event_message_type), + + has_privacy=if(mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0, 1, 0), + + has_sensitive_response=if(message_type="response" AND has_privacy=1, 1, 0), + + has_security=if(mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)prompt injection|code detection")>=0, 1, 0) + + ```Prioritize allowed sensitive responses, then security and privacy guardrails``` + + | eval severity=case( + action="allow" AND has_sensitive_response=1, "critical", + action="block" AND has_sensitive_response=1, "high", + action="allow" AND has_security=1, "high", + action="block" AND has_security=1, "medium", + action="allow" AND has_privacy=1, "high", + action="block" AND has_privacy=1, "medium", true(), "low" ) - ```Calculating risk score based on severity level``` - | eval risk_score=case( - severity="critical", 100, - severity="high", 75, - severity="medium", 50, - severity="low", 25 - ) - | table model.model_name, user_id, event_action, application_id, application_name, severity, risk_score, policy_name, connection_name, guardrail_ruleset_type, guardrail_entity_name - | `cisco_ai_defense_security_alerts_by_application_name_filter` -how_to_implement: To enable this detection, you need to ingest alerts from the Cisco AI Defense product. This can be done by using this app from splunkbase - Cisco Security Cloud and ingest alerts into the cisco:ai:defense sourcetype. -known_false_positives: False positives may vary based on Cisco AI Defense configuration; monitor and filter out the alerts that are not relevant to your environment. + + | eval risk_score=case( + severity="critical", 100, + severity="high", 80, + severity="medium", 50, + severity="low", 20 + ) + + | eval application_name=if(isnotnull(application_name) AND len(trim(application_name))>0, application_name, "unknown"), + connection_name=if(isnotnull(connection_name) AND len(trim(connection_name))>0, connection_name, "unknown"), + application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name), + connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name), + is_high_risk=if(has_security=1 OR has_privacy=1, 1, 0), + is_allowed_sensitive_response=if(action="allow" AND has_sensitive_response=1, 1, 0), + is_allowed_sensitive_prompt=if(action="allow" AND message_type="prompt" AND has_privacy=1, 1, 0), + high_risk_event_id=if((has_security=1 OR has_privacy=1) AND is_allowed_sensitive_prompt=0, event_id, null()), + event_time=_time + + | bin _time span=10m + + ```Use the same application/connection window and threshold as Cisco AI Defense Repeated High Risk Activity``` + | eventstats dc(high_risk_event_id) as high_risk_event_count by _time application_key connection_key + + ```Leave allowed sensitive responses to Cisco AI Defense Allowed Sensitive Response, allowed sensitive prompts to Cisco AI Defense Allowed Sensitive Prompt, and repeated high-risk bursts to Cisco AI Defense Repeated High Risk Activity``` + | where is_allowed_sensitive_response=0 AND is_allowed_sensitive_prompt=0 AND NOT (is_high_risk=1 AND high_risk_event_count>=5) + + | stats count as event_count + dc(event_id) as distinct_event_count + min(event_time) as firstTime + max(event_time) as lastTime + values(event_id) as event_ids + values(event_action) as event_actions + values(event_message_type) as message_types + values(resource_type) as resource_types + values(model.model_name) as model_names + values(application_name) as application_name + values(connection_name) as connection_name + values(policy_name) as policy_names + values(guardrail_ruleset_type) as guardrail_ruleset_types + values(guardrail_entity_name) as guardrail_entity_names + max(risk_score) as risk_score + by _time application_key connection_key action message_type severity + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + + | table _time firstTime lastTime application_key application_name connection_key connection_name + action message_type severity risk_score event_count distinct_event_count event_ids + resource_types model_names policy_names guardrail_ruleset_types guardrail_entity_names + + | `cisco_ai_defense_security_alerts_by_application_name_filter` +how_to_implement: |- + Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype. + Confirm that extraction is enabled for the required fields as shown in the detection search. + Configure the cisco_ai_defense macro to match the index, source, and sourcetype used in your environment. +known_false_positives: |- + False positives may vary based on Cisco AI Defense configuration; monitor and filter out the alerts that are not relevant to your environment. references: - https://www.robustintelligence.com/blog-posts/prompt-injection-attack-on-gpt-4 - https://docs.aws.amazon.com/prescriptive-guidance/latest/llm-prompt-engineering-best-practices/common-attacks.html @@ -57,8 +118,10 @@ intermediate_findings: - field: application_name type: other score: 20 - message: Cisco AI Defense Security Alert has been action - [$event_action$] for the application name - [$application_name$] + message: Cisco AI Defense summarized [$event_count$] events for application [$application_name$] and connection [$connection_name$] over ten minutes. Actions [$action$], message direction [$message_type$], severity [$severity$], guardrails [$guardrail_ruleset_types$], event IDs [$event_ids$]. +threat_objects: [] analytic_story: + - Abuse of GenAI Systems and Applications - Critical Alerts asset_type: Web Application mitre_attack_id: [] @@ -72,7 +135,7 @@ tests: - name: True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json - source: cisco_ai_defense + source: not_applicable sourcetype: cisco:ai:defense - description: PORTED MANUAL TEST - We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. - test_type: experimental + description: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. + test_type: unit diff --git a/stories/abuse_of_genai_systems_and_applications.yml b/stories/abuse_of_genai_systems_and_applications.yml new file mode 100644 index 00000000000..872cc2f0b47 --- /dev/null +++ b/stories/abuse_of_genai_systems_and_applications.yml @@ -0,0 +1,23 @@ +name: Abuse of GenAI Systems and Applications +id: f79c6573-5550-4adc-b673-bb0d8c9e1df1 +version: 1 +creation_date: '2026-10-15' +modification_date: '2026-10-15' +author: Nasreddine Bencherchali, Splunk +status: production +description: |- + Detect and investigate threats targeting or abusing artificial intelligence systems, services and applications. + Coverage includes prompt injection, attempts to bypass model safeguards, repeated high-risk guardrail events, and possible sensitive data disclosure through model interactions. +narrative: |- + AI applications can expose sensitive information, invoke connected tools, or process untrusted prompts. Attackers and malicious insiders may try to override model instructions, extract restricted data, misuse AI-enabled tools, or repeatedly probe guardrails. + Use this story to investigate AI security events across model providers and application integrations. Review the affected application and connection, event action, prompt or response direction, policy, and guardrail categories. An allowed event can indicate exposure, while a blocked event records an attempt; neither alone confirms the full impact. Correlate high-risk events with identity, application, data access, and tool activity where those logs are available. +references: + - https://atlas.mitre.org/ + - https://owasp.org/www-project-top-10-for-large-language-model-applications/ +category: + - Adversary Tactics +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +usecase: Advanced Threat Detection From a2f5519321eb012aa073d2a18300ab9d9f051a36 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 17:48:15 +0000 Subject: [PATCH 155/162] Automated NIST AI RMF lookup table update (#4349) --------- Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali --- lookups/csv/detection_subcategory_map.csv | 5 ++++- lookups/csv/detection_subcategory_map.yml | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/lookups/csv/detection_subcategory_map.csv b/lookups/csv/detection_subcategory_map.csv index 25cf98922bf..de28148840e 100644 --- a/lookups/csv/detection_subcategory_map.csv +++ b/lookups/csv/detection_subcategory_map.csv @@ -6,7 +6,10 @@ AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Hostile Prompt Sentimen AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Possible Prompt Injection,production,Hunting,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Sensitive Data in Prompts,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Unusually Large Prompts,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal -Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Security Alerts by Application Name,production,Anomaly,Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal +Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Allowed Sensitive Prompt,production,TTP,Abuse of GenAI Systems and Applications|Data Protection|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal +Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Allowed Sensitive Response,production,TTP,Abuse of GenAI Systems and Applications|Data Protection|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal +Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Repeated High Risk Activity,production,TTP,Abuse of GenAI Systems and Applications|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal +Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Security Alerts by Application Name,production,Anomaly,Abuse of GenAI Systems and Applications|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal Local LLM Frameworks,CrowdStrike ProcessRollup2|Sysmon EventID 1|Windows Event Log Security 4688,Windows Local LLM Framework Execution,production,Hunting,Suspicious Local LLM Frameworks,GOVERN|MAP,Govern 1.6|Map 4.1|Map 4.2,high,generated_rule,"AI system or access inventory signal; AI component, model, or service discovery signal; AI system operating context signal" Local LLM Frameworks,Sysmon EventID 11,LLM Model File Creation,production,Hunting,Suspicious Local LLM Frameworks,GOVERN|MAP,Govern 1.6|Map 4.1,high,generated_rule,"AI system or access inventory signal; AI component, model, or service discovery signal" Local LLM Frameworks,Sysmon EventID 22,Local LLM Framework DNS Query,production,Hunting,Suspicious Local LLM Frameworks,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" diff --git a/lookups/csv/detection_subcategory_map.yml b/lookups/csv/detection_subcategory_map.yml index dbf0a875df0..e6b1ec04cc7 100644 --- a/lookups/csv/detection_subcategory_map.yml +++ b/lookups/csv/detection_subcategory_map.yml @@ -2,7 +2,7 @@ name: detection_subcategory_map id: 41c7e6c8-b835-4dd8-b7ed-b1f5d8476e84 version: 3 creation_date: '2026-09-02' -modification_date: '2026-10-13' +modification_date: '2026-10-18' author: Nasreddine Bencherchali, Rod Soto, Splunk Threat Research Team lookup_type: csv description: Generated mapping of AI-related ESCU detections to NIST AI RMF subcategory IDs for dashboard coverage reporting. From f41646a34626bc0b3ede1e8e9cd05f30750a6c40 Mon Sep 17 00:00:00 2001 From: Br3akp0int <26181693+tccontre@users.noreply.github.com> Date: Mon, 19 Oct 2026 01:24:00 +0200 Subject: [PATCH 156/162] Add Braodo Stealer Coverage For 2026 Variant (#4320) --------- Co-authored-by: Nasreddine Bencherchali --- .../download_files_using_telegram.yml | 5 +- ..._or_script_creation_in_suspicious_path.yml | 5 +- ...tables_or_script_creation_in_temp_path.yml | 5 +- ...fox_process_access_firefox_profile_dir.yml | 5 +- ...ell_download_from_code_hosting_service.yml | 91 +++++++++++++++ ..._autostart_execution_in_startup_folder.yml | 5 +- ...indows_disable_or_stop_browser_process.yml | 4 +- .../windows_dns_query_request_to_tinyurl.yml | 11 +- .../windows_password_managers_discovery.yml | 5 +- ...ound_connection_to_social_media_domain.yml | 107 ++++++++++++++++++ ..._dns_query_request_by_telegram_bot_api.yml | 5 +- stories/braodo_stealer.yml | 21 +++- 12 files changed, 246 insertions(+), 23 deletions(-) create mode 100644 detections/endpoint/powershell_download_from_code_hosting_service.yml create mode 100644 detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index 3403eef36a9..59268a324d4 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -1,8 +1,8 @@ name: Download Files Using Telegram id: 58194e28-ae5e-11eb-8912-acde48001122 -version: 12 +version: 13 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: TTP @@ -47,6 +47,7 @@ analytic_story: - XMRig - Water Gamayun - 0bj3ctivity Stealer + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1105 diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 88b6fb4b745..7bdf1594871 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,8 +1,8 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 -version: 31 +version: 32 creation_date: '2021-05-07' -modification_date: '2026-08-14' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -141,6 +141,7 @@ analytic_story: - Phantom Stealer - Starland RAT Campaign - Vidar Stealer + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml index 69962abd69f..70c7ca2f5d8 100644 --- a/detections/endpoint/executables_or_script_creation_in_temp_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml @@ -1,8 +1,8 @@ name: Executables Or Script Creation In Temp Path id: e0422b71-2c05-4f32-8754-01fb415f49c9 -version: 27 +version: 28 creation_date: '2021-05-07' -modification_date: '2026-08-14' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -134,6 +134,7 @@ analytic_story: - Salat Stealer - Phantom Stealer - Vidar Stealer + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1036 diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index 87b1884b1ca..c358aafab67 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -1,8 +1,8 @@ name: Non Firefox Process Access Firefox Profile Dir id: e6fc13b0-1609-11ec-b533-acde48001122 -version: 21 +version: 22 creation_date: '2021-09-15' -modification_date: '2026-08-14' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -54,6 +54,7 @@ analytic_story: - Salat Stealer - Phantom Stealer - Vidar Stealer + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1555.003 diff --git a/detections/endpoint/powershell_download_from_code_hosting_service.yml b/detections/endpoint/powershell_download_from_code_hosting_service.yml new file mode 100644 index 00000000000..2611e6247ec --- /dev/null +++ b/detections/endpoint/powershell_download_from_code_hosting_service.yml @@ -0,0 +1,91 @@ +name: PowerShell Download from Code Hosting Service +id: 3ffbd4d4-84a7-453e-9e06-8e9cd0350366 +version: 1 +creation_date: '2026-10-06' +modification_date: '2026-10-13' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: |- + This analytic detects PowerShell Script Block Logging (Event ID 4104) events that use common download methods to retrieve files directly from raw-content URLs on GitHub, GitLab, or Codeberg. + These code hosting services can be abused to stage payloads, but administrators and developers also download files from them. + A match identifies a download attempt; it does not establish that the file was successfully retrieved or executed. Review the full script block, destination path, process ancestry, and related endpoint activity. +data_source: + - Powershell Script Block Logging 4104 +search: |- + `powershell` EventCode=4104 ScriptBlockText IN ("*.DownloadFile(*", "*.DownloadData(*", "*.DownloadString(*", "*Invoke-WebRequest*", "*Invoke-RestMethod*", "*Start-BitsTransfer*", "*iwr *", "*irm *", "*curl *", "*wget *") + | where match( + ScriptBlockText, + "(?ix) + (?: + \.Download(?:File|Data|String)\s*\(\s*['\"]? + | + (?:Invoke-WebRequest|Invoke-RestMethod|iwr|irm) + (?:\s+(?:-Uri\s+)?|\b[^;\r\n]{0,200}?\s-Uri\s+)['\"]? + | + Start-BitsTransfer\b[^;\r\n]{0,200}?-Source\s+['\"]? + | + (?:curl|wget)\s+(?:-Uri\s+)?['\"]? + ) + https?:// + (?: + raw\.githubusercontent\.com/[^/\s'\"]+/[^/\s'\"]+/[^/\s'\"]+(?:/[^/\s'\"]+)* + | + (?:github|gitlab)\.com/[^/\s'\"]+/[^/\s'\"]+/(?:-/)?raw/(?:refs/(?:heads|tags)/)?[^/\s'\"]+(?:/[^/\s'\"]+)* + | + codeberg\.org/[^/\s'\"]+/[^/\s'\"]+/raw/(?:branch/)?[^/\s'\"]+(?:/[^/\s'\"]+)* + ) + \.(?:bat|cmd|ps1|js|vbs|vbe|py|zip|7z|rar|tar|gz|exe|dll|msi) + (?:[?#][^\s'\"]*)? + (?=['\"\s),;]|$)" + ) + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime + by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_download_from_code_hosting_service_filter` +how_to_implement: |- + To implement this analytic, enable PowerShell Script Block Logging and ingest Event ID 4104 events with the `ScriptBlockText` field extracted. + Confirm that the `powershell` macro scopes the search to the correct PowerShell Operational logs in your environment. +known_false_positives: |- + Administrators, developers, and software deployment tools may download legitimate files from GitHub, GitLab, and Codeberg. + Review repository ownership, the downloaded file, destination path, signer where applicable, process ancestry, and subsequent execution before taking action. +references: + - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html + - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.6 +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: A PowerShell script on [$dest$] invoked a download method with a raw code-hosting URL in ScriptBlockText with ScriptBlockId [$ScriptBlockId$]. +threat_objects: [] +analytic_story: + - Braodo Stealer +asset_type: Endpoint +mitre_attack_id: + - T1059.001 + - T1105 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_github/powershell_githu_download.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml index 48b60501976..6fa6786fe88 100644 --- a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml +++ b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml @@ -1,8 +1,8 @@ name: Windows Boot or Logon Autostart Execution In Startup Folder id: 99d157cb-923f-4a00-aee9-1f385412146f -version: 17 +version: 18 creation_date: '2023-01-16' -modification_date: '2026-07-20' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -51,6 +51,7 @@ analytic_story: - BlankGrabber Stealer - Phantom Stealer - Starland RAT Campaign + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1547.001 diff --git a/detections/endpoint/windows_disable_or_stop_browser_process.yml b/detections/endpoint/windows_disable_or_stop_browser_process.yml index 354d3e7a7d7..24eb9e8c80e 100644 --- a/detections/endpoint/windows_disable_or_stop_browser_process.yml +++ b/detections/endpoint/windows_disable_or_stop_browser_process.yml @@ -1,8 +1,8 @@ name: Windows Disable or Stop Browser Process id: 220d34b7-b6c7-45fe-8dbb-c35cdd9fe6d5 -version: 15 +version: 16 creation_date: '2024-10-18' -modification_date: '2026-08-14' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: TTP diff --git a/detections/endpoint/windows_dns_query_request_to_tinyurl.yml b/detections/endpoint/windows_dns_query_request_to_tinyurl.yml index cc66fe2bfe0..19d561e114b 100644 --- a/detections/endpoint/windows_dns_query_request_to_tinyurl.yml +++ b/detections/endpoint/windows_dns_query_request_to_tinyurl.yml @@ -1,8 +1,8 @@ name: Windows DNS Query Request To TinyUrl id: b1ea79da-719c-437c-acaf-5c93f838f425 -version: 5 +version: 6 creation_date: '2021-11-18' -modification_date: '2026-05-13' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -22,7 +22,11 @@ search: | "*\\ProgramData\\*", "*\\Temp\\*", "*\\Users\\Public\\*", - "*\\Windows\\Tasks\\*" + "*\\Windows\\Tasks\\*", + "*\\powershell.exe", + "*\\pwsh.exe", + "*\\cmd.exe", + "*\\python.exe", ) | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count dvc process_exec process_guid process_name query query_count @@ -58,6 +62,7 @@ threat_objects: type: process_name analytic_story: - Malicious Inno Setup Loader + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1105 diff --git a/detections/endpoint/windows_password_managers_discovery.yml b/detections/endpoint/windows_password_managers_discovery.yml index 7ad0eb58cc6..c5294dd898f 100644 --- a/detections/endpoint/windows_password_managers_discovery.yml +++ b/detections/endpoint/windows_password_managers_discovery.yml @@ -1,8 +1,8 @@ name: Windows Password Managers Discovery id: a3b3bc96-1c4f-4eba-8218-027cac739a48 -version: 13 +version: 14 creation_date: '2022-12-06' -modification_date: '2026-05-13' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -55,6 +55,7 @@ analytic_story: - Prestige Ransomware - Scattered Spider - Scattered Lapsus$ Hunters + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1555.005 diff --git a/detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml b/detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml new file mode 100644 index 00000000000..20207c5a705 --- /dev/null +++ b/detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml @@ -0,0 +1,107 @@ +name: Windows Process Outbound Connection To Social Media Domain +id: d6dc231e-8595-499b-889e-cf6a055df4d4 +version: 1 +creation_date: '2026-10-06' +modification_date: '2026-10-06' +author: Teoderick Contreras, Splunk +status: production +type: Anomaly +description: |- + This analytic detects outbound network connections from a Python process running from suspicious or non-standard directories to social media related domains. + It leverages Sysmon Event ID 3 to surface this anomalous behavior. + Legitimate Python applications rarely originate from paths such as "C:\Users\Public\", Windows font or debug folders, or the Recycle Bin, making direct outbound calls to social media infrastructure from these locations a strong indicator of compromise. + For example the Braodo Stealer, a Python-based credential-harvesting malware, abuses authenticated browser sessions to query the Meta Graph API and enumerate the victim's Facebook and Meta advertising infrastructure. +data_source: + - Sysmon EventID 3 +search: |- + `sysmon` + EventCode=3 + Image IN ( + "*:\\$Recycle.Bin\\*", + "*:\\PerfLogs\\*", + "*:\\Users\\Administrator\\Music\\*", + "*:\\Users\\Public\\*", + "*:\\Windows\\Cursors\\*", + "*:\\Windows\\debug\\*", + "*:\\Windows\\fonts\\*", + "*:\\Windows\\INF\\*", + "*:\\Windows\\Media\\*", + "*:\\Windows\\Prefetch\\*", + "*\\Windows\\repair\\*" + ) + + process_name IN ( + "py.exe", + "pypy.exe", + "python.exe", + "python2*.exe", + "python3*.exe", + "pythonw.exe" + ) + + dest IN ( + "*.facebook.com", + "*.facebook.net", + "*.facebook.org", + "*.fb.com", + "*.fbcd.net", + "*.fbsbx.com", + "*.fbstatic-a.akamaihd.net", + "*.tfbw.net" + ) + direction = outbound + + | rename Image as process_path + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by action app dest dest_ip dest_port direction dvc protocol protocol_version + process_path process_name process_guid process_id + src src_ip src_port transport user vendor_product + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_process_outbound_connection_to_social_media_domain_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 3 connection events from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: |- + No false positives have been identified at this time. +references: + - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: A python process located in [$process_path$] with the name [$process_name$] and GUID [$process_guid$] and ID [$process_id$] was observed accessing a social media domain [$dest$] +threat_objects: + - field: process_path + type: file_path +analytic_story: + - Braodo Stealer +asset_type: Endpoint +mitre_attack_id: + - T1586.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.001/python_fb/python_facebook.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml index dc872242386..f1d6a09ed25 100644 --- a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml +++ b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml @@ -1,8 +1,8 @@ name: Windows DNS Query Request by Telegram Bot API id: 86f66f44-94d9-412d-a71d-5d8ed0fef72e -version: 12 +version: 13 creation_date: '2021-08-03' -modification_date: '2026-07-20' +modification_date: '2026-10-06' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -47,6 +47,7 @@ analytic_story: - VIP Keylogger - Phantom Stealer - Starland RAT Campaign + - Braodo Stealer asset_type: Endpoint mitre_attack_id: - T1071.004 diff --git a/stories/braodo_stealer.yml b/stories/braodo_stealer.yml index f2ffbf3f1b2..c55ebb63d5a 100644 --- a/stories/braodo_stealer.yml +++ b/stories/braodo_stealer.yml @@ -1,15 +1,28 @@ name: Braodo Stealer id: ec5c8721-3c13-45ac-90e8-64c63a8fdc24 -version: 2 +version: 3 creation_date: '2024-10-15' -modification_date: '2026-05-13' +modification_date: '2026-10-07' author: Teoderick Contreras, Splunk status: production -description: Leverage searches that allow you to detect and investigate unusual activities that may be related to the Braodo Stealer malware, a malicious software designed to steal sensitive information from infected systems. This malware typically targets login credentials, browser history, cookies, and stored passwords. Braodo Stealer often infiltrates through phishing campaigns or malicious downloads, enabling attackers to gain unauthorized access to personal and financial data. By monitoring unusual system behaviors, such as unauthorized network connections or data exfiltration, you can help prevent data breaches and mitigate the impact of this threat. -narrative: Braodo Stealer is a stealthy and dangerous piece of malware specifically engineered to siphon sensitive information from compromised systems. Often spread through phishing emails or disguised as legitimate downloads, it silently infiltrates a victim’s device. Once inside, it scours through browser histories, steals login credentials, captures cookies, and even extracts saved passwords from various applications. With this stolen data, cybercriminals can gain access to banking accounts, social media profiles, or business platforms. What makes Braodo Stealer particularly threatening is its ability to remain undetected, allowing attackers to exploit compromised systems for extended periods before the user becomes aware. +description: |- + Leverage searches that allow you to detect and investigate unusual activities that may be related to the Braodo Stealer malware, a malicious software designed to steal sensitive information from infected systems. + This malware typically targets login credentials, browser history, cookies, and stored passwords. + Beyond credential theft, recent variants of Braodo Stealer abuse authenticated Facebook sessions to query the Meta Graph API, enumerating advertising accounts, Facebook Pages, and Business Manager infrastructure — including account balances, spending limits, payment thresholds, and associated credit-card payment methods. + Braodo Stealer often infiltrates through phishing campaigns or malicious downloads, enabling attackers to gain unauthorized access to personal and financial data. By monitoring unusual system behaviors, such as unauthorized network connections to Meta Graph API endpoints or data exfiltration, you can help prevent data breaches and mitigate the impact of this threat. +narrative: |- + Braodo Stealer is a stealthy and dangerous piece of malware specifically engineered to siphon sensitive information from compromised systems. + Often spread through phishing emails or disguised as legitimate downloads, it silently infiltrates a victim’s device. + Once inside, it scours through browser histories, steals login credentials, captures cookies, and extracts saved passwords from various applications. + In its latest observed variants, Braodo Stealer goes beyond traditional credential theft by leveraging stolen Facebook session cookies to query the Meta Graph API. + Using an authenticated session obtained from the victim’s browser, the malware enumerates advertising accounts, Facebook Pages, and Business Manager accounts associated with the victim. + For each discovered asset, it collects account IDs, status, currency, current balances, spending amounts, spending limits, payment thresholds, creation dates, and details about associated credit-card payment methods. For Business Manager accounts, it additionally checks advertising-account limits, giving the attacker a comprehensive picture of the victim’s advertising infrastructure and financial exposure. + With this stolen data, cybercriminals can hijack advertising accounts to run malicious ad campaigns, drain pre-funded ad balances, or sell access to high-value Business Manager accounts. + What makes Braodo Stealer particularly threatening is its ability to remain undetected while quietly profiling victims’ financial and advertising assets, allowing attackers to maximize monetization long after the initial compromise. references: - https://bazaar.abuse.ch/browse/tag/Braodo/ - https://g0njxa.medium.com/from-vietnam-to-united-states-malware-fraud-and-dropshipping-98b7a7b2c36d + - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html category: - Data Destruction - Malware From c13aa3bde996deec91af6a2ff0d0a00f01dfdca3 Mon Sep 17 00:00:00 2001 From: themaryjo Date: Mon, 19 Oct 2026 01:35:08 +0200 Subject: [PATCH 157/162] Add detection for repeated CloudWatch Logs read operations (#4288) --------- Co-authored-by: Nasreddine Bencherchali Co-authored-by: Bhavin Patel --- ...peated_cloudwatch_logs_read_operations.yml | 112 ++++++++++++++++++ 1 file changed, 112 insertions(+) create mode 100644 detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml diff --git a/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml b/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml new file mode 100644 index 00000000000..8ae7fe7b907 --- /dev/null +++ b/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml @@ -0,0 +1,112 @@ +name: AWS Repeated CloudWatch Logs Read Operations +id: 3f0ba9e1-c6cf-4317-a6bc-c4bcab2b5a06 +version: 1 +creation_date: '2026-09-21' +modification_date: '2026-09-21' +author: Maria Jose Erquiaga, Splunk +status: production +type: TTP +description: |- + The following analytic detects a high volume of Amazon CloudWatch Logs read operations performed by the same AWS principal and account within a + five-minute period. + It identifies more than 500 DescribeLogGroups, DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or GetQueryResults API calls. + This activity may indicate automated discovery or collection of operational, application, or security telemetry from CloudWatch Logs. +data_source: + - AWS CloudTrail +search: |- + `cloudtrail` + eventSource="logs.amazonaws.com" + eventName IN ( + "DescribeLogGroups", + "DescribeLogStreams", + "DownloadLogEvents", + "FilterLogEvents", + "GetLogEvents", + "GetQueryResults" + ) + + | eval user='userIdentity.principalId' + | eval vendor_account=coalesce( + vendor_account, + recipientAccountId, + 'userIdentity.accountId' + ) + | eval role_name='userIdentity.sessionContext.sessionIssuer.userName' + | eval signature=coalesce(signature, eventName) + | eval src=coalesce(src, sourceIPAddress) + | eval user_agent=coalesce(user_agent, userAgent) + | eval vendor_region=coalesce(vendor_region, awsRegion) + + | where isnotnull(user) AND len(trim(user)) > 0 + + | dedup eventID keepempty=true + + | sort 0 _time + + | streamstats time_window=5m count AS event_count + by user vendor_account + + | where event_count > 500 + + | stats max(_time) AS lastTime + max(event_count) AS event_count + min(_time) AS firstTime + values(role_name) AS role_name + values(signature) AS api_operations + values(src) AS src + values(user_agent) AS user_agent + values(vendor_region) AS vendor_region + by user vendor_account + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `aws_repeated_cloudwatch_logs_read_operations_filter` +how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. +known_false_positives: |- + Automated log analytics, SIEM pipelines, incident-response tooling, backup processes, and administrative troubleshooting may continuously read + CloudWatch Logs and generate a high volume of matching operations. + The prevalence of this activity has not yet been evaluated against broader customer telemetry. + Review the principal, account, source addresses, user agents, Regions, and accessed CloudWatch Logs resources before escalating. +references: + - https://attack.mitre.org/techniques/T1530/ + - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogGroups.html + - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogStreams.html + - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html + - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetLogEvents.html + - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetQueryResults.html +drilldown_searches: + - name: View CloudWatch Logs read operations for - "$user$" + search: '%original_detection_search% | search user="$user$" vendor_account="$vendor_account$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: The AWS principal [$user$] performed [$event_count$] CloudWatch Logs read operations + entity: + field: user + type: user + score: 50 +threat_objects: + - field: src + type: ip_address +analytic_story: + - Data Exfiltration +asset_type: AWS Account +mitre_attack_id: + - T1530 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: cloud +security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + test_type: unit From d0a1a07ca3e95b253a8d97d99360d91b7c74b8f8 Mon Sep 17 00:00:00 2001 From: themaryjo Date: Mon, 19 Oct 2026 01:36:36 +0200 Subject: [PATCH 158/162] Add AWS EC2 Instance Connect key upload detection (#4312) --------- Co-authored-by: Bhavin Patel Co-authored-by: Nasreddine Bencherchali --- ...lic_keys_uploaded_by_a_single_identity.yml | 75 +++++++++++ ...up_script_modified_on_stopped_instance.yml | 93 +++++++++++++ ...s_iam_role_created_with_external_trust.yml | 122 ++++++++++++++++++ 3 files changed, 290 insertions(+) create mode 100644 detections/cloud/aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity.yml create mode 100644 detections/cloud/aws_ec2_startup_script_modified_on_stopped_instance.yml create mode 100644 detections/cloud/aws_iam_role_created_with_external_trust.yml diff --git a/detections/cloud/aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity.yml b/detections/cloud/aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity.yml new file mode 100644 index 00000000000..ecb853e8910 --- /dev/null +++ b/detections/cloud/aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity.yml @@ -0,0 +1,75 @@ +name: AWS EC2 Multiple SSH Public Keys Uploaded by a Single Identity +id: 62afb4a9-d9d0-464a-9326-aacf61c5a9f2 +version: 1 +creation_date: '2026-09-29' +modification_date: '2026-09-29' +author: Maria Jose Erquiaga, Splunk +status: production +type: TTP +description: |- + Detects an AWS identity making 10 or more successful EC2 Instance ConnectSendSSHPublicKey API calls within the configured search interval. + EC2 Instance Connect temporarily makes an SSH public key available to an operating-system user on an EC2 instance. + A burst of these calls may indicate automated attempts to establish access or move laterally using compromised AWS credentials. +data_source: + - AWS CloudTrail +search: |- + `cloudtrail` + eventSource="ec2-instance-connect.amazonaws.com" + eventName="SendSSHPublicKey" + responseElements.success=true + + | stats dc('requestParameters.instanceId') as unique_instances + dc(eventID) as event_count + earliest(_time) as firstTime + latest(_time) as lastTime + values('requestParameters.instanceId') as targeted_instances + values('requestParameters.instanceOSUser') as targeted_users + values(src) as src + values(user_agent) as user_agent + values(vendor_region) as vendor_region + by user_arn + + | where event_count >= 10 + + | eval duration_seconds=lastTime-firstTime + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity_filter` +how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. +known_false_positives: |- + Administrators and automated orchestration may legitimately use EC2 Instance Connect repeatedly during fleet administration, troubleshooting, + or ephemeral-access workflows. + Review the AWS identity, source addresses, user agent, target instances, target operating-system users, and whether the activity corresponds to an approved administrative process. +references: + - https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSSHPublicKey.html + - https://stratus-red-team.cloud/attack-techniques/AWS/aws.lateral-movement.ec2-instance-connect/ + - https://www.elastic.co/guide/en/security/8.19/prebuilt-rule-8-19-14-aws-ec2-instance-connect-ssh-public-key-uploaded.html +finding: + title: The AWS identity [$user_arn$] uploaded [$event_count$] SSH public keys using EC2 Instance Connect + entity: + field: user_arn + type: user + score: 50 +threat_objects: + - field: src + type: ip_address +analytic_story: + - Suspicious Cloud Instance Activities +asset_type: AWS Account +mitre_attack_id: + - T1021.004 + - T1021.008 +product: + - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security +category: cloud +security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + test_type: unit diff --git a/detections/cloud/aws_ec2_startup_script_modified_on_stopped_instance.yml b/detections/cloud/aws_ec2_startup_script_modified_on_stopped_instance.yml new file mode 100644 index 00000000000..ec33d412481 --- /dev/null +++ b/detections/cloud/aws_ec2_startup_script_modified_on_stopped_instance.yml @@ -0,0 +1,93 @@ +name: AWS EC2 Startup Script Modified on Stopped Instance +id: 84578867-02bf-475e-9815-6e8e0d798253 +version: 1 +creation_date: '2026-10-07' +modification_date: '2026-10-07' +author: Maria Jose Erquiaga +status: production +type: TTP +description: |- + A successful EC2 StopInstances request was followed within one hour by a successful ModifyInstanceAttribute request targeting userData on the same instance, by the same IAM principal. + This may indicate an attempt to change instance startup behavior or establish persistence. + These CloudTrail events do not confirm that the modified user-data script executed. +data_source: + - AWS CloudTrail +search: |- + `cloudtrail` + eventSource="ec2.amazonaws.com" + eventName IN ("StopInstances", "ModifyInstanceAttribute") + + | eval user_arn='userIdentity.arn' + + | eval instance_id=case( + eventName="StopInstances", 'requestParameters.instancesSet.items{}.instanceId', + eventName="ModifyInstanceAttribute", 'requestParameters.instanceId' + ) + + | mvexpand instance_id + + | where isnotnull(eventID) AND isnotnull(instance_id) AND isnotnull(user_arn) + AND (isnull(errorCode) OR errorCode="" OR lower(errorCode)="success") + + | where eventName="StopInstances" + OR (eventName="ModifyInstanceAttribute" AND 'requestParameters.attribute'="userData") + + | dedup eventID instance_id + + | eval event_epoch=coalesce(strptime(eventTime, "%Y-%m-%dT%H:%M:%SZ"), _time) + + | sort 0 user_arn instance_id awsRegion event_epoch + + | streamstats current=f + last(eval(if(eventName="StopInstances", event_epoch, null()))) AS stop_epoch + last(eval(if(eventName="StopInstances", eventID, null()))) AS stop_event_id + BY user_arn instance_id awsRegion + + | where eventName="ModifyInstanceAttribute" AND isnotnull(stop_epoch) + + | eval elapsed_seconds=event_epoch-stop_epoch + + | where elapsed_seconds>0 AND elapsed_seconds<=3600 + + | eval stop_time_utc=strftime(stop_epoch, "%Y-%m-%dT%H:%M:%SZ") + + | eval modification_time_utc=strftime(event_epoch, "%Y-%m-%dT%H:%M:%SZ") + + | rename eventID AS modification_event_id + + | table user_arn instance_id awsRegion stop_time_utc modification_time_utc + elapsed_seconds stop_event_id modification_event_id + + | `aws_ec2_startup_script_modified_on_stopped_instance_filter` +how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. +known_false_positives: |- + Authorized administrators and infrastructure automation may stop instances and update their user data. + Review the IAM principal, instance, change window, and approved automation before escalating. +references: + - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html + - https://stratus-red-team.cloud/attack-techniques/AWS/aws.execution.ec2-user-data/ +finding: + title: The IAM principal [$user_arn$] modified user data on stopped EC2 instance [$instance_id$] + entity: + field: user_arn + type: user + score: 50 +threat_objects: [] +analytic_story: + - Suspicious Cloud User Activities +asset_type: AWS Account +mitre_attack_id: + - T1578.005 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: cloud +security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1578.005/aws_ec2_startup_script_modification/aws_ec2_startup_script_modification.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + test_type: unit diff --git a/detections/cloud/aws_iam_role_created_with_external_trust.yml b/detections/cloud/aws_iam_role_created_with_external_trust.yml new file mode 100644 index 00000000000..2cd85111165 --- /dev/null +++ b/detections/cloud/aws_iam_role_created_with_external_trust.yml @@ -0,0 +1,122 @@ +name: AWS IAM Role Created with External Trust +id: 6b7f646b-5ddc-48c9-baa3-fd66ac202c18 +version: 1 +creation_date: '2026-10-13' +modification_date: '2026-10-13' +author: Maria Jose Erquiaga, Splunk +status: production +type: TTP +description: |- + Detects a successful AWS IAM CreateRole event whose trust policy allows sts:AssumeRole by a principal in another AWS account or by a wildcard + principal. + This configuration may provide persistent access if the principal can assume the role. The event alone does not establish that the role was assumed or that its creation was unauthorized. +data_source: + - AWS CloudTrail +search: |- + `cloudtrail` + eventSource="iam.amazonaws.com" + eventName="CreateRole" + + | where isnull(errorCode) OR errorCode="" OR lower(errorCode)="success" + + | eval policy_raw='requestParameters.assumeRolePolicyDocument', + role_name='requestParameters.roleName', + role_arn='responseElements.role.arn', + user_arn=coalesce(user_arn, 'userIdentity.arn'), + src=coalesce(src, sourceIPAddress) + + | where isnotnull(policy_raw) + + | eval policy=if(match(policy_raw, "(?i)^%7b"), urldecode(policy_raw), policy_raw) + + | rex field=role_arn "^arn:[^:]+:iam::(?[0-9]{12}):role/" + + | eval role_account_id=coalesce(account_from_role_arn, recipientAccountId) + | eval statements_json=json_extract(policy, "Statement") + | eval statements=if(match(statements_json, "^\s*\["), json_array_to_mv(statements_json), statements_json) + + | mvexpand statements + + | eval effect=json_extract(statements, "Effect"), + actions_json=json_extract(statements, "Action"), + principal_json=json_extract(statements, "Principal") + + | eval actions=if(match(actions_json, "^\s*\["), json_array_to_mv(actions_json, true()), actions_json) + + | mvexpand actions + | mvexpand actions + + | eval trust_action=actions + | eval action_pattern=replace(replace(lower(trust_action), "[*]", "%"), "[?]", "_") + + | where effect="Allow" AND like("sts:assumerole", action_pattern) + | eval aws_json=json_extract(principal_json, "AWS") + + | eval principals=case( + match(aws_json, "^\s*\["), json_array_to_mv(aws_json, true()), + isnotnull(aws_json), aws_json, + principal_json="*", "*" + ) + + | mvexpand principals + + | eval trust_principal=principals + + | rex field=trust_principal "^arn:[^:]+:iam::(?[0-9]{12}):" + + | eval principal_account_id=if( + match(trust_principal, "^[0-9]{12}$"), + trust_principal, + principal_account_from_arn + ) + + | eval trust_type=case( + trust_principal="*", "wildcard", + isnotnull(role_account_id) AND isnotnull(principal_account_id) + AND principal_account_id!=role_account_id, "external" + ) + + | where trust_type="wildcard" OR trust_type="external" + + | eval event_key=coalesce(eventID, md5(_raw)) + + | dedup event_key trust_principal + + | table _time eventID user_arn src role_name role_arn role_account_id + trust_type trust_principal principal_account_id trust_action + + | `aws_iam_role_created_with_external_trust_filter` +how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. +known_false_positives: |- + Approved cross-account integrations and deliberately configured wildcard trust may match. + Review the role owner, trust-policy conditions, role permissions, and whether the principal is expected. +references: + - https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateRole.html + - https://stratus-red-team.cloud/attack-techniques/aws/aws.persistence.iam-backdoor-role/ +finding: + title: The AWS IAM role [$role_name$] created with [$trust_type$] trust + entity: + field: user_arn + type: user + score: 50 +threat_objects: + - field: src + type: ip_address +analytic_story: + - AWS IAM Privilege Escalation +asset_type: AWS Account +mitre_attack_id: + - T1098.003 +product: + - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security +category: cloud +security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/aws_iam_role_created_with_external_trust/aws_iam_role_created_with_external_trust.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + test_type: unit From 16978b0714436c8955b4ed48e8b6567f5dee2707 Mon Sep 17 00:00:00 2001 From: themaryjo Date: Mon, 19 Oct 2026 02:03:27 +0200 Subject: [PATCH 159/162] Add AWS CloudTrail behavioral detections (#4297) --- ...malous_secrets_manager_batch_retrieval.yml | 111 ++++++++++++++++++ 1 file changed, 111 insertions(+) create mode 100644 detections/cloud/aws_anomalous_secrets_manager_batch_retrieval.yml diff --git a/detections/cloud/aws_anomalous_secrets_manager_batch_retrieval.yml b/detections/cloud/aws_anomalous_secrets_manager_batch_retrieval.yml new file mode 100644 index 00000000000..9243a8a30d0 --- /dev/null +++ b/detections/cloud/aws_anomalous_secrets_manager_batch_retrieval.yml @@ -0,0 +1,111 @@ +name: AWS Anomalous Secrets Manager Batch Retrieval +id: 93646bda-291b-4a59-a926-19f08e26f7cd +version: 1 +creation_date: '2026-09-29' +modification_date: '2026-09-29' +author: Maria Jose Erquiaga, Splunk +status: production +type: TTP +description: >- + The following analytic detects an AWS principal making more than 10 distinct successful Secrets Manager BatchGetSecretValue API calls within + one hour. + It groups calls by AWS account and user identity ARN and deduplicates CloudTrail events by event ID. + Repeated batch retrieval may indicate bulk access to secrets using a compromised identity, although legitimate automation can produce similar activity. +data_source: + - AWS CloudTrail +search: |- + `cloudtrail` + eventName="BatchGetSecretValue" + eventSource="secretsmanager.amazonaws.com" + + | eval user_arn='userIdentity.arn', + vendor_account=recipientAccountId + + | where isnotnull(user_arn) AND isnotnull(vendor_account) + AND (isnull(errorCode) OR errorCode="" OR lower(errorCode)="success") + + | eval event_key=coalesce(eventID, md5(_raw)) + + | dedup event_key + + | eval event_time=_time + + | sort 0 + _time + + | streamstats time_window=1h count AS rolling_batch_request_count + min(event_time) AS window_start + BY vendor_account user_arn + + | eventstats max(eval(if(rolling_batch_request_count>10, event_time, null()))) AS qualifying_end + BY vendor_account user_arn + + | eventstats min(eval(if(event_time=qualifying_end, window_start, null()))) AS qualifying_start + BY vendor_account user_arn + + | where isnotnull(qualifying_start) + AND event_time>=qualifying_start + AND event_time<=qualifying_end + + | stats count AS batch_request_count + values(sourceIPAddress) AS src + values(userAgent) AS user_agent + values(awsRegion) AS vendor_region + earliest(event_time) AS firstTime + latest(event_time) AS lastTime + + BY vendor_account user_arn + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `aws_anomalous_secrets_manager_batch_retrieval_filter` +how_to_implement: |- + Ingest AWS CloudTrail management events into Splunk using the aws:cloudtrail sourcetype. +known_false_positives: |- + Legitimate administrators, deployment systems, credential-rotation services, incident-response tooling, or newly deployed applications may use BatchGetSecretValue for the first time. + A principal may trigger the detection again when it has not used the API during the preceding seven days. + Review the principal, source IP address, user agent, account, region, requested secret identifiers, and surrounding CloudTrail activity to determine whether the request was authorized. +references: + - https://attack.mitre.org/techniques/T1555/006/ + - https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_BatchGetSecretValue.html + - https://docs.aws.amazon.com/secretsmanager/latest/userguide/cloudtrail_log_entries.html + - https://www.elastic.co/guide/en/security/8.19/aws-secrets-manager-rapid-secrets-retrieval.html +drilldown_searches: + - name: View detection results for - "$user_arn$" + search: '%original_detection_search% | search user_arn="$user_arn$" vendor_account="$vendor_account$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View Secrets Manager activity for the last 7 days for - "$user_arn$" + search: '`cloudtrail` eventSource="secretsmanager.amazonaws.com" | eval user_arn=''userIdentity.arn'', vendor_account=recipientAccountId | where (isnull(errorCode) OR errorCode="" OR lower(errorCode)="success") | search user_arn="$user_arn$" vendor_account="$vendor_account$" | table _time user_arn vendor_account eventName sourceIPAddress userAgent awsRegion requestParameters' + earliest_offset: 7d + latest_offset: "0" + - name: View risk events for the last 7 days for - "$user_arn$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object="$user_arn$" | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: The identity [$user_arn$] made [$batch_request_count$] successful AWS Secrets Manager BatchGetSecretValue requests within one hour + entity: + field: user_arn + type: user + score: 40 +threat_objects: + - field: src + type: ip_address +analytic_story: + - AWS Identity and Access Management Account Takeover +asset_type: AWS Account +mitre_attack_id: + - T1555.006 +product: + - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security +category: cloud +security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.json + source: aws_cloudtrail + sourcetype: aws:cloudtrail + test_type: unit From 12d9cd55a32f225b45c51a50ab8a18c901addd49 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 19 Oct 2026 11:58:56 +0200 Subject: [PATCH 160/162] Add New Dashboard Leveraging AI Defense Data/Content (#4350) --- app_template/default/data/ui/nav/default.xml | 1 + .../cisco_ai_defense_threat_operations.json | 1010 +++++++++++++++++ .../cisco_ai_defense_threat_operations.yml | 9 + 3 files changed, 1020 insertions(+) create mode 100644 dashboards/cisco_ai_defense_threat_operations.json create mode 100644 dashboards/cisco_ai_defense_threat_operations.yml diff --git a/app_template/default/data/ui/nav/default.xml b/app_template/default/data/ui/nav/default.xml index 1738ee90689..c4aeaca59d4 100644 --- a/app_template/default/data/ui/nav/default.xml +++ b/app_template/default/data/ui/nav/default.xml @@ -4,6 +4,7 @@ + diff --git a/dashboards/cisco_ai_defense_threat_operations.json b/dashboards/cisco_ai_defense_threat_operations.json new file mode 100644 index 00000000000..3f12be5c234 --- /dev/null +++ b/dashboards/cisco_ai_defense_threat_operations.json @@ -0,0 +1,1010 @@ +{ + "title": "Cisco AI Defense Threat Operations", + "description": "Monitor Cisco AI Defense enforcement activity, risky prompts and responses, sensitive data detections, application and model activity, and related security detections.\n\nThis dashboard uses the `cisco_ai_defense` macro to find Cisco AI Defense events; configure it for your index, source, and sourcetype before use.", + "dataSources": { + "ds_filter_applications": { + "type": "ds.search", + "name": "Available AI applications", + "options": { + "query": "`cisco_ai_defense`\n| spath path=\"genai_application.application_name\" output=Application\n| eval Application=if(isnull(Application) OR len(trim(Application))=0,if(isnull(application_id) OR len(trim(application_id))=0,\"Unknown application\",application_id),Application)\n| eval application_key=if(isnull(application_id) OR len(trim(application_id))=0,Application,application_id)\n| stats count as event_count values(Application) as application_names values(application_id) as application_id by application_key\n| eval Application=mvjoin(application_names,\" / \")\n| table Application application_key application_id event_count\n| sort 0 Application" + } + }, + "ds_filter_models": { + "type": "ds.search", + "name": "Available AI models", + "options": { + "query": "`cisco_ai_defense` | search model.model_name!=\"\" | stats count as event_count by model.model_name | rename model.model_name as model_name | table model_name event_count | sort 0 model_name" + } + }, + "ds_ai_events_base": { + "type": "ds.search", + "name": "Cisco AI Defense normalized event base", + "options": { + "query": "`cisco_ai_defense`\n| eval action=lower(event_action), direction=lower(event_message_type)\n| spath path=\"genai_application.application_name\" output=application_name\n| spath path=\"connection.connection_name\" output=connection_name\n| spath path=\"policy.policy_name\" output=policy_name\n| spath path=\"event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type\" output=guardrails\n| spath path=\"event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail.guardrails_type\" output=guardrail_categories\n| spath path=\"event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name\" output=entities\n| spath path=\"event_messages{}.event_conversation.event_messages{}.metadata{}.standards{}\" output=standards\n| eval application_name=if(isnull(application_name) OR len(trim(application_name))=0,if(isnull(application_id) OR application_id=\"\",\"Unknown application\",application_id),application_name), connection_name=if(isnull(connection_name) OR len(trim(connection_name))=0,if(isnull(connection_id) OR connection_id=\"\",\"Unknown connection\",connection_id),connection_name), model_name=if(isnull('model.model_name') OR len(trim('model.model_name'))=0,\"Unknown model\",'model.model_name'), policy_name=if(isnull(policy_name) OR len(trim(policy_name))=0,\"Unknown policy\",policy_name), application_key=if(isnull(application_id) OR len(trim(application_id))=0,application_name,application_id), connection_key=if(isnull(connection_id) OR len(trim(connection_id))=0,connection_name,connection_id)\n| where (application_key IN ($application_tok|s$) OR \"*\" IN ($application_tok|s$)) AND ('model.model_name' IN ($model_tok|s$) OR \"*\" IN ($model_tok|s$))\n| fields _time event_id application_id application_name application_key connection_id connection_name connection_key model_name policy_name action direction resource_type guardrails guardrail_categories entities standards" + } + }, + "ds_total_events": { + "type": "ds.chain", + "name": "Total observed events", + "options": { + "extend": "ds_ai_events_base", + "query": "| stats dc(event_id) as count" + } + }, + "ds_blocked_events": { + "type": "ds.chain", + "name": "Blocked events", + "options": { + "extend": "ds_ai_events_base", + "query": "| stats dc(eval(if(action=\"block\",event_id,null()))) as count" + } + }, + "ds_allowed_highrisk": { + "type": "ds.chain", + "name": "Allowed high-risk events", + "options": { + "extend": "ds_ai_events_base", + "query": "| eval is_highrisk=if(mvfind(guardrails,\"(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0,1,0)\n| stats dc(eval(if(action=\"allow\" AND is_highrisk=1,event_id,null()))) as count" + } + }, + "ds_allowed_sensitive_responses": { + "type": "ds.chain", + "name": "Allowed sensitive responses", + "options": { + "extend": "ds_ai_events_base", + "query": "| eval is_privacy=if(mvfind(guardrails,\"(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0,1,0)\n| stats dc(eval(if(action=\"allow\" AND direction=\"response\" AND is_privacy=1,event_id,null()))) as count" + } + }, + "ds_redacted_events": { + "type": "ds.chain", + "name": "Redacted events", + "options": { + "extend": "ds_ai_events_base", + "query": "| stats dc(eval(if(action=\"redact\",event_id,null()))) as count" + } + }, + "ds_runtime_actions": { + "type": "ds.chain", + "name": "Runtime actions over time", + "options": { + "extend": "ds_ai_events_base", + "query": "| timechart span=1h dc(event_id) as events by action" + } + }, + "ds_sensitive_entities": { + "type": "ds.chain", + "name": "Sensitive entities by action", + "options": { + "extend": "ds_ai_events_base", + "query": "| where mvfind(guardrails,\"(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| mvexpand entities\n| where isnotnull(entities) AND len(trim(entities))>0\n| chart dc(event_id) over entities by action\n| fillnull value=0" + } + }, + "ds_sensitive_event_details": { + "type": "ds.chain", + "name": "Sensitive match review", + "options": { + "extend": "ds_ai_events_base", + "query": "| where mvfind(guardrails,\"(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| eval rulesets=mvjoin(guardrails,\", \"), detected_entities=mvjoin(entities,\", \")\n| sort 0 - _time\n| table _time action direction application_name application_id connection_name model_name policy_name rulesets detected_entities event_id\n| head 100" + } + }, + "ds_applications_by_action": { + "type": "ds.chain", + "name": "Observed applications by event volume", + "options": { + "extend": "ds_ai_events_base", + "query": "| stats dc(event_id) as events values(application_name) as application_names values(application_id) as application_ids values(action) as actions values(model_name) as models by application_key\n| eval application_name=mvjoin(application_names,\" / \"), application_id=mvjoin(application_ids,\", \")\n| eval actions=mvjoin(mvsort(actions),\", \"), models=mvjoin(mvsort(models),\", \")\n| sort 0 - events\n| head 15\n| rename application_name as Application application_id as \"Application ID\" events as Events actions as Actions models as \"Models observed\"\n| table Application \"Application ID\" Events Actions \"Models observed\"" + } + }, + "ds_models_by_action": { + "type": "ds.chain", + "name": "Observed events by model and action", + "options": { + "extend": "ds_ai_events_base", + "query": "| stats dc(event_id) as events by model_name action\n| chart max(events) over model_name by action\n| fillnull value=0" + } + }, + "ds_ai_detection_readiness": { + "type": "ds.search", + "name": "ESCU AI Defense detection readiness", + "options": { + "query": "| makeresults\n| eval detection_name=split(\"Cisco AI Defense Security Alerts by Application Name|Cisco AI Defense Repeated High Risk Activity|Cisco AI Defense Allowed Sensitive Response|Cisco AI Defense Allowed Sensitive Prompt\",\"|\")\n| mvexpand detection_name\n| eval expected_savedsearch=\"ESCU - \".detection_name.\" - Rule\", ai_system=\"Cisco AI Defense\", mapped=1, data_sources=\"Cisco AI Defense Alerts\"\n| fields ai_system detection_name expected_savedsearch mapped data_sources\n| append\n [ | rest /servicesNS/-/-/saved/searches splunk_server=local\n | where title IN (\"ESCU - Cisco AI Defense Security Alerts by Application Name - Rule\",\"ESCU - Cisco AI Defense Repeated High Risk Activity - Rule\",\"ESCU - Cisco AI Defense Allowed Sensitive Response - Rule\",\"ESCU - Cisco AI Defense Allowed Sensitive Prompt - Rule\")\n | rename title as expected_savedsearch\n | eval savedsearch_present=1\n | eval enabled=if(disabled==0 OR disabled==\"0\",\"Enabled\",\"Disabled\")\n | eval scheduled=if(is_scheduled==1 OR is_scheduled==\"1\",\"Scheduled\",\"Not scheduled\")\n | eval finding_output=case(match(actions,\"(^|,)risk(,|$)\") OR 'action.risk'==1 OR 'action.risk'==\"1\",\"Risk\", match(actions,\"(^|,)notable(,|$)\") OR 'action.notable'==1 OR 'action.notable'==\"1\",\"Notable\", true(),\"No risk/notable\")\n | eval schedule=coalesce(cron_schedule,\"\"), window=coalesce('dispatch.earliest_time',\"\").\" to \".coalesce('dispatch.latest_time',\"\"), app_name=coalesce('eai:acl.app','eai:appName',\"\")\n | fields expected_savedsearch savedsearch_present enabled scheduled finding_output schedule window app_name ]\n| stats max(mapped) as mapped values(ai_system) as ai_system values(data_sources) as data_sources values(detection_name) as detection_name max(savedsearch_present) as savedsearch_present values(enabled) as enabled values(scheduled) as scheduled values(finding_output) as finding_output values(schedule) as schedule values(window) as window values(app_name) as app_name by expected_savedsearch\n| where mapped==1\n| eval present=if(savedsearch_present==1,\"Present\",\"Missing\")\n| eval enabled=coalesce(mvindex(enabled,0),\"Missing\"), scheduled=coalesce(mvindex(scheduled,0),\"Missing\"), finding_output=coalesce(mvindex(finding_output,0),\"Missing\")\n| eval readiness=case(present==\"Missing\",\"Missing saved search\",enabled!=\"Enabled\",\"Disabled\",scheduled!=\"Scheduled\",\"Not scheduled\",finding_output==\"No risk/notable\",\"No risk/notable action\",true(),\"Ready\")\n| eval data_sources=mvjoin(mvsort(data_sources),\", \"), schedule=coalesce(mvindex(schedule,0),\"\"), window=coalesce(mvindex(window,0),\"\"), app_name=coalesce(mvindex(app_name,0),\"\")\n| sort readiness detection_name\n| rename detection_name as Detection expected_savedsearch as \"Saved Search\" readiness as Readiness finding_output as \"Finding Output\" schedule as Schedule window as Window app_name as App data_sources as \"Data Sources\"\n| table Detection \"Saved Search\" Readiness \"Finding Output\" Schedule Window App \"Data Sources\"", + "queryParameters": { + "earliest": "0", + "latest": "now" + } + } + }, + "ds_live_ai_findings_base": { + "type": "ds.search", + "name": "Cisco AI Defense ESCU risk and notable results", + "options": { + "query": "search (index=risk OR index=notable)\n [ | makeresults\n | eval savedsearch_title=mvappend(\"ESCU - Cisco AI Defense Security Alerts by Application Name - Rule\", \"ESCU - Cisco AI Defense Repeated High Risk Activity - Rule\", \"ESCU - Cisco AI Defense Allowed Sensitive Response - Rule\", \"ESCU - Cisco AI Defense Allowed Sensitive Prompt - Rule\")\n | mvexpand savedsearch_title\n | stats values(savedsearch_title) as savedsearch_title dc(savedsearch_title) as savedsearch_count\n | eval quoted=\"\\\"\".mvjoin(savedsearch_title,\"\\\",\\\"\").\"\\\"\"\n | eval search=if(savedsearch_count>0,\"(source IN (\".quoted.\") OR search_name IN (\".quoted.\") OR savedsearch_name IN (\".quoted.\") OR orig_source IN (\".quoted.\") OR rule_name IN (\".quoted.\"))\",\"source=\\\"__cisco_ai_defense_no_match__\\\"\")\n | return $search ]\n| eval finding_source=case(index=\"risk\",\"Risk event\",index=\"notable\",\"Notable\",true(),index)\n| eval savedsearch_title=coalesce(if(match(search_name,\"^ESCU - Cisco AI Defense .+ - Rule$\"),search_name,null()),if(match(source,\"^ESCU - Cisco AI Defense .+ - Rule$\"),source,null()),if(match(savedsearch_name,\"^ESCU - Cisco AI Defense .+ - Rule$\"),savedsearch_name,null()),if(match(orig_source,\"^ESCU - Cisco AI Defense .+ - Rule$\"),orig_source,null()),if(match(rule_name,\"^ESCU - Cisco AI Defense .+ - Rule$\"),rule_name,null()))\n| where savedsearch_title IN (\"ESCU - Cisco AI Defense Security Alerts by Application Name - Rule\",\"ESCU - Cisco AI Defense Repeated High Risk Activity - Rule\",\"ESCU - Cisco AI Defense Allowed Sensitive Response - Rule\",\"ESCU - Cisco AI Defense Allowed Sensitive Prompt - Rule\")\n| eval detection=replace(replace(savedsearch_title,\"^ESCU - \",\"\"),\" - Rule$\",\"\")\n| eval risk_numeric=tonumber(coalesce(calculated_risk_score,risk_score))\n| eval severity=case(finding_source=\"Risk event\",lower(coalesce(severity,case(risk_numeric>=80,\"critical\",risk_numeric>=50,\"high\",risk_numeric>=20,\"medium\",risk_numeric>0,\"low\",true(),\"unknown\"))),finding_source=\"Notable\",lower(coalesce(severity,urgency,\"unknown\")),true(),lower(coalesce(severity,\"unknown\")))\n| eval entity=case(finding_source=\"Risk event\",coalesce(risk_object,normalized_risk_object,user,dest,src,host,\"unknown\"),finding_source=\"Notable\",coalesce(risk_object,normalized_risk_object,user,dest,src,host,rule_name,\"unknown\"),true(),coalesce(risk_object,normalized_risk_object,user,dest,src,host,\"unknown\"))\n| eval detail=case(finding_source=\"Risk event\",coalesce(risk_message,source,search_name,detection,\"\"),finding_source=\"Notable\",coalesce(rule_description,description,rule_name,detection,\"\"),true(),coalesce(risk_message,rule_description,source,detection,\"\"))\n| eval detail=substr(detail,1,500), event_key=coalesce(event_id,source_event_id,sid,_cd,tostring(_time).\"|\".savedsearch_title.\"|\".entity.\"|\".coalesce(detail,\"\"))\n| dedup event_key detection\n| fields _time finding_source detection severity risk_numeric entity detail savedsearch_title" + } + }, + "ds_live_findings_by_detection": { + "type": "ds.chain", + "name": "ESCU finding counts by detection", + "options": { + "extend": "ds_live_ai_findings_base", + "query": "| stats count as Findings dc(entity) as Entities by detection finding_source\n| appendpipe [ | stats count as result_count | where result_count==0 | eval detection=\"No matching detection results\", finding_source=\"Status\", Findings=0, Entities=0 | fields - result_count ]\n| sort 0 - Findings" + } + }, + "ds_live_findings_over_time": { + "type": "ds.chain", + "name": "ESCU findings over time", + "options": { + "extend": "ds_live_ai_findings_base", + "query": "| timechart span=1d count by finding_source\n| appendpipe [ | stats count as result_count | where result_count==0 | eval _time=now(), \"No detection results\"=0 | fields _time \"No detection results\" ]\n| fillnull value=0" + } + }, + "ds_live_findings_detail": { + "type": "ds.chain", + "name": "Recent ESCU AI Defense Findings", + "options": { + "extend": "ds_live_ai_findings_base", + "query": "| eval eventTime=strftime(_time,\"%Y-%m-%d %H:%M:%S\")\n| sort 0 -_time\n| table eventTime finding_source severity detection entity risk_numeric detail\n| appendpipe [ | stats count as result_count | where result_count==0 | eval eventTime=\"\", finding_source=\"Status\", severity=\"info\", detection=\"No matching detection results\", entity=\"No risk/notable events in selected time window\", risk_numeric=0, detail=\"This table populates when one of the four Cisco AI Defense ESCU detections produces risk or notable output.\" | fields - result_count ]" + } + }, + "ds_attack_outcomes": { + "type": "ds.chain", + "name": "High-risk activity by enforcement outcome", + "options": { + "extend": "ds_ai_events_base", + "query": "| where mvfind(guardrails,\"(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| stats dc(eval(if(action=\"allow\",event_id,null()))) as count" + } + }, + "ds_blocked_attack_outcomes": { + "type": "ds.chain", + "name": "Blocked high-risk activity", + "options": { + "extend": "ds_ai_events_base", + "query": "| where action=\"block\" AND mvfind(guardrails,\"(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| stats dc(event_id) as count" + } + }, + "ds_allowed_sensitive_response_count": { + "type": "ds.chain", + "name": "Allowed sensitive responses", + "options": { + "extend": "ds_ai_events_base", + "query": "| where action=\"allow\" AND direction=\"response\" AND mvfind(guardrails,\"(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| stats dc(event_id) as count" + } + }, + "ds_repeated_event_ids": { + "type": "ds.chain", + "name": "Repeated high-risk event IDs", + "options": { + "extend": "ds_ai_events_base", + "query": "| where isnotnull(event_id) AND len(trim(event_id))>0 AND mvfind(guardrails,\"(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| bin _time span=10m\n| stats count as Occurrences values(application_name) as application_names values(application_id) as application_ids values(connection_name) as connection_names values(connection_id) as connection_ids values(action) as Actions values(direction) as Directions values(guardrails) as Guardrails values(model_name) as Models by _time application_key connection_key event_id\n| eval application_name=mvjoin(application_names,\" / \"), connection_name=mvjoin(connection_names,\" / \"), application_id=mvjoin(application_ids,\", \"), connection_id=mvjoin(connection_ids,\", \")\n| where Occurrences>=3\n| eval Window=strftime(_time,\"%Y-%m-%d %H:%M:%S\")\n| rename application_name as Application connection_name as Connection event_id as \"Event ID\"\n| table Window Application Connection \"Event ID\" Occurrences Actions Directions Guardrails Models\n| sort 0 - Occurrences\n| head 100" + } + }, + "ds_attack_paths": { + "type": "ds.search", + "name": "Risky behavior by direction and policy outcome", + "options": { + "query": "`cisco_ai_defense`\n| eval action=lower(event_action), direction=lower(event_message_type)\n| spath path=\"genai_application.application_name\" output=application_name\n| spath path=\"connection.connection_name\" output=connection_name\n| spath path=\"policy.policy_name\" output=policy_name\n| spath path=\"event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type\" output=guardrails\n| spath path=\"event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail.guardrails_type\" output=guardrail_categories\n| spath path=\"event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name\" output=entities\n| spath path=\"event_messages{}.event_conversation.event_messages{}.metadata{}.standards{}\" output=standards\n| eval application_name=if(isnull(application_name) OR len(trim(application_name))=0,if(isnull(application_id) OR application_id=\"\",\"Unknown application\",application_id),application_name), connection_name=if(isnull(connection_name) OR len(trim(connection_name))=0,if(isnull(connection_id) OR connection_id=\"\",\"Unknown connection\",connection_id),connection_name), model_name=if(isnull('model.model_name') OR len(trim('model.model_name'))=0,\"Unknown model\",'model.model_name'), policy_name=if(isnull(policy_name) OR len(trim(policy_name))=0,\"Unknown policy\",policy_name), application_key=if(isnull(application_id) OR len(trim(application_id))=0,application_name,application_id), connection_key=if(isnull(connection_id) OR len(trim(connection_id))=0,connection_name,connection_id)\n| where (application_key IN ($application_tok|s$) OR \"*\" IN ($application_tok|s$)) AND ('model.model_name' IN ($model_tok|s$) OR \"*\" IN ($model_tok|s$))\n| fields _time event_id application_id application_name application_key connection_id connection_name connection_key model_name policy_name action direction resource_type guardrails guardrail_categories entities standards\n| mvexpand guardrails\n| eval attack_class=case(match(guardrails,\"(?i)prompt injection\"),\"Prompt injection\",match(guardrails,\"(?i)code detection\"),\"Code generation or abuse\",match(guardrails,\"(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\"),\"Sensitive data (PII/PCI)\",true(),null())\n| where isnotnull(attack_class)\n| eval attack_path=attack_class.\" / \".coalesce(direction,\"unknown\")\n| stats dc(event_id) as events by attack_path action\n| chart max(events) over attack_path by action\n| fillnull value=0\n| sort 0 attack_path" + } + }, + "ds_allowed_risk_cases": { + "type": "ds.chain", + "name": "Allowed high-risk paths for review", + "options": { + "extend": "ds_ai_events_base", + "query": "| where action=\"allow\" AND mvfind(guardrails,\"(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0\n| eval attack_class=case(mvfind(guardrails,\"(?i)prompt injection\")>=0,\"Prompt injection\",mvfind(guardrails,\"(?i)code detection\")>=0,\"Code generation or abuse\",mvfind(guardrails,\"(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry\")>=0,\"Sensitive data (PII/PCI)\",true(),\"Other high-risk\")\n| stats dc(event_id) as Events values(application_id) as application_ids values(application_name) as application_names values(direction) as Directions values(guardrails) as Guardrails values(entities) as Entities values(policy_name) as Policies values(connection_name) as Connections by application_key model_name attack_class\n| eval application_id=mvjoin(application_ids,\", \")\n| eval Application=mvjoin(application_names,\" / \"), \"Application ID\"=mvjoin(application_ids,\", \")\n| eval Directions=mvjoin(Directions,\", \"), Guardrails=mvjoin(Guardrails,\", \"), Entities=mvjoin(Entities,\", \"), Policies=mvjoin(Policies,\", \"), Connections=mvjoin(Connections,\", \")\n| rename model_name as Model attack_class as \"Attack class\"\n| sort 0 - Events\n| head 100\n| table Application \"Application ID\" Model \"Attack class\" Events Directions Guardrails Entities Policies Connections" + } + } + }, + "visualizations": { + "viz_threat_header": { + "type": "splunk.markdown", + "options": { + "markdown": "## Cisco AI Defense | Threat Overview\nRuntime enforcement, allowed high-risk activity, and sensitive response signals. Use Application and Model filters to focus event telemetry." + } + }, + "viz_total_events": { + "type": "splunk.singlevalue", + "title": "Events Observed", + "description": "Distinct Cisco AI Defense event IDs in the selected time range.", + "dataSources": { + "primary": "ds_total_events" + }, + "options": { + "majorFontSize": 30, + "sparklineDisplay": "off", + "trendDisplay": "off" + } + }, + "viz_blocked_events": { + "type": "splunk.singlevalue", + "title": "Blocked Events", + "description": "Distinct events blocked by AI Defense.", + "dataSources": { + "primary": "ds_blocked_events" + }, + "options": { + "majorFontSize": 30, + "sparklineDisplay": "off", + "trendDisplay": "off" + } + }, + "viz_allowed_highrisk": { + "type": "splunk.singlevalue", + "title": "Allowed High-Risk Events", + "description": "Allowed events matching prompt-injection, code, PII, or PCI guardrails.", + "dataSources": { + "primary": "ds_allowed_highrisk" + }, + "options": { + "majorFontSize": 30, + "sparklineDisplay": "off", + "trendDisplay": "off" + } + }, + "viz_allowed_sensitive_responses": { + "type": "splunk.singlevalue", + "title": "Sensitive Responses Allowed", + "description": "Allowed responses matching PII or PCI privacy guardrails.", + "dataSources": { + "primary": "ds_allowed_sensitive_responses" + }, + "options": { + "majorFontSize": 30, + "sparklineDisplay": "off", + "trendDisplay": "off" + } + }, + "viz_repeat_window_count": { + "type": "splunk.singlevalue", + "title": "Redacted Events", + "description": "Distinct events redacted by AI Defense in the selected time range.", + "dataSources": { + "primary": "ds_redacted_events" + }, + "options": { + "majorFontSize": 30, + "sparklineDisplay": "off", + "trendDisplay": "off" + } + }, + "viz_risk_timeline": { + "type": "splunk.line", + "title": "Runtime Enforcement Over Time", + "description": "Hourly volume by observed action. This includes all events, not only high-risk matches.", + "dataSources": { + "primary": "ds_runtime_actions" + }, + "options": { + "legendDisplay": "bottom", + "xAxisTitleText": "Time", + "yAxisTitleText": "Events", + "seriesColorsByField": { + "block": "#D64545", + "allow": "#3B82F6", + "redact": "#F59E0B", + "monitor": "#2F9E76" + } + } + }, + "viz_sensitive_entities": { + "type": "splunk.bar", + "title": "Sensitive Entities by Action", + "description": "PII/PCI entity categories observed in events; message content is not shown.", + "dataSources": { + "primary": "ds_sensitive_entities" + }, + "options": { + "legendDisplay": "bottom", + "xAxisTitleVisibility": "hide", + "yAxisTitleText": "Distinct events", + "stackMode": "stacked", + "seriesColorsByField": { + "allow": "#F59E0B", + "block": "#D64545", + "redact": "#2F9E76" + } + } + }, + "viz_repeat_windows": { + "type": "splunk.table", + "title": "Sensitive Match Review", + "description": "Event-level PII/PCI matches with application, model, policy, and entity metadata. Prompt and response text is omitted.", + "dataSources": { + "primary": "ds_sensitive_event_details" + }, + "options": { + "headerVisibility": "fixed", + "count": 50, + "wrap": true + } + }, + "viz_priority_queue": { + "type": "splunk.table", + "title": "Recent ESCU AI Defense Findings", + "description": "Actual risk or notable records attributed to the four Cisco AI Defense ESCU detections. The empty state is informational, not a synthetic finding.", + "dataSources": { + "primary": "ds_live_findings_detail" + }, + "options": { + "headerVisibility": "fixed", + "count": 50, + "wrap": true + } + }, + "viz_header_attack_activity": { + "type": "splunk.markdown", + "options": { + "markdown": "## Attack Activity\n\n### Prompt or Response → Guardrail Match → Policy Action\n\nCompare risky behavior with enforcement outcomes, then review allowed paths and repeated event IDs. Counts describe observed events; the dashboard does not infer a successful compromise." + } + }, + "viz_header_data_exposure": { + "type": "splunk.markdown", + "options": { + "markdown": "## Data Exposure\nReview PII/PCI entities and affected applications, models, policies, and event direction. Payload text is intentionally excluded." + } + }, + "viz_apps_activity": { + "type": "splunk.table", + "title": "Most Active Observed Applications", + "dataSources": { + "primary": "ds_applications_by_action" + }, + "options": { + "count": 15, + "drilldown": "none", + "wrap": true + }, + "description": "Applications observed in Cisco AI Defense runtime events." + }, + "viz_models_activity": { + "type": "splunk.bar", + "title": "Observed Activity by Model and Action", + "dataSources": { + "primary": "ds_models_by_action" + }, + "options": { + "legendDisplay": "bottom", + "seriesColorsByField": { + "allow": "#3B82F6", + "block": "#D64545", + "redact": "#F59E0B", + "monitor": "#2F9E76" + } + }, + "description": "Model names are taken from runtime events; unknown means the model field was not present." + }, + "viz_detection_readiness": { + "type": "splunk.table", + "title": "Configured Detection Status", + "dataSources": { + "primary": "ds_ai_detection_readiness" + }, + "options": { + "count": 10, + "drilldown": "none", + "wrap": true, + "columnFormat": { + "Readiness": { + "rowBackgroundColors": "> table | seriesByName(\"Readiness\") | matchValue(ReadinessColorConfig)" + } + } + }, + "description": "Shows whether each expected saved search is present, enabled, scheduled, and configured for risk/notable output. Requires saved-search REST visibility.", + "context": { + "ReadinessColorConfig": [ + { + "match": "Ready", + "value": "#4C8B5B" + }, + { + "match": "Disabled", + "value": "#B5432F" + }, + { + "match": "Missing saved search", + "value": "#B5432F" + }, + { + "match": "Not scheduled", + "value": "#C99A3B" + }, + { + "match": "No risk/notable action", + "value": "#C99A3B" + } + ] + } + }, + "viz_findings_by_detection": { + "type": "splunk.bar", + "title": "Generated Findings by Detection and Source", + "dataSources": { + "primary": "ds_live_findings_by_detection" + }, + "options": { + "legendDisplay": "bottom", + "stackMode": "stacked", + "seriesColorsByField": { + "Risk event": "#C99A3B", + "Notable": "#B5432F" + } + }, + "description": "Risk and notable events attributed to the Cisco AI Defense detections." + }, + "viz_findings_over_time": { + "type": "splunk.line", + "title": "Detection Output Over Time", + "dataSources": { + "primary": "ds_live_findings_over_time" + }, + "options": { + "legendDisplay": "bottom", + "seriesColorsByField": { + "Risk event": "#C99A3B", + "Notable": "#B5432F", + "No detection results": "#C9CDD1" + } + }, + "description": "Daily risk and notable events generated by these detections." + }, + "viz_header_app_model": { + "type": "splunk.markdown", + "options": { + "markdown": "## Application and Model Activity\nExplore Cisco AI Defense runtime event volume across observed applications and models." + } + }, + "viz_header_detection_activity": { + "type": "splunk.markdown", + "options": { + "markdown": "## Detection Coverage and Outcomes\nReview configured Cisco AI Defense detections and the risk or notable events they generate." + } + }, + "viz_allowed_risk_count": { + "type": "splunk.singlevalue", + "title": "Allowed High-Risk Events", + "description": "Distinct allowed events matching prompt injection, code, PII, or PCI guardrails.", + "dataSources": { + "primary": "ds_attack_outcomes" + }, + "options": { + "majorFontSize": 34, + "sparklineDisplay": "off", + "trendDisplay": "off", + "backgroundColor": "> majorValue | rangeValue(valueColor)" + }, + "context": { + "valueColor": [ + { + "to": 0, + "value": "#2B755C" + }, + { + "from": 1, + "value": "#A33D3D" + } + ] + } + }, + "viz_blocked_risk_count": { + "type": "splunk.singlevalue", + "title": "Blocked High-Risk Events", + "description": "Distinct high-risk events blocked by AI Defense.", + "dataSources": { + "primary": "ds_blocked_attack_outcomes" + }, + "options": { + "majorFontSize": 34, + "sparklineDisplay": "off", + "trendDisplay": "off", + "backgroundColor": "> majorValue | rangeValue(valueColor)" + }, + "context": { + "valueColor": [ + { + "to": 0, + "value": "#263B46" + }, + { + "from": 1, + "value": "#197B72" + } + ] + } + }, + "viz_allowed_sensitive_response_count": { + "type": "splunk.singlevalue", + "title": "Sensitive Responses Allowed", + "description": "Distinct allowed responses matching PII or PCI guardrails.", + "dataSources": { + "primary": "ds_allowed_sensitive_response_count" + }, + "options": { + "majorFontSize": 34, + "sparklineDisplay": "off", + "trendDisplay": "off", + "backgroundColor": "> majorValue | rangeValue(valueColor)" + }, + "context": { + "valueColor": [ + { + "to": 0, + "value": "#263B46" + }, + { + "from": 1, + "value": "#A33D3D" + } + ] + } + }, + "viz_attack_paths": { + "type": "splunk.bar", + "title": "Risky Behavior by Direction and Policy Outcome", + "description": "Distinct events classified from prompt-injection, code, and PII/PCI guardrails.", + "dataSources": { + "primary": "ds_attack_paths" + }, + "options": { + "legendDisplay": "bottom", + "stackMode": "stacked", + "seriesColorsByField": { + "allow": "#D96C5F", + "block": "#47B8AE", + "monitor": "#D6A443", + "redact": "#8D7BD6" + } + } + }, + "viz_allowed_risk_cases": { + "type": "splunk.table", + "title": "Allowed High-Risk Paths Requiring Review", + "description": "Allowed events grouped by application, model, guardrail, and message direction. Message content is excluded.", + "dataSources": { + "primary": "ds_allowed_risk_cases" + }, + "options": { + "headerVisibility": "fixed", + "count": 25, + "wrap": true + } + }, + "viz_repeated_event_ids": { + "type": "splunk.table", + "title": "Repeated High-Risk Event IDs", + "description": "Event IDs with three or more high-risk occurrences in a ten-minute bucket, matching the repeated-activity detection threshold.", + "dataSources": { + "primary": "ds_repeated_event_ids" + }, + "options": { + "headerVisibility": "fixed", + "count": 25, + "wrap": true + } + } + }, + "inputs": { + "input_global_time": { + "type": "input.timerange", + "title": "Time range", + "options": { + "token": "global_time", + "defaultValue": "-7d@d,now" + } + }, + "input_application": { + "type": "input.multiselect", + "title": "Application", + "options": { + "items": ">frame(label, value) | prepend(formattedStatics) | objects()", + "token": "application_tok", + "defaultValue": "*", + "clearDefaultOnSelection": true + }, + "dataSources": { + "primary": "ds_filter_applications" + }, + "context": { + "formattedConfig": { + "number": { + "prefix": "" + } + }, + "formattedStatics": ">statics | formatByType(formattedConfig)", + "statics": [ + [ + "All" + ], + [ + "*" + ] + ], + "label": ">primary | seriesByName(\"Application\") | renameSeries(\"label\") | formatByType(formattedConfig)", + "value": ">primary | seriesByName(\"application_key\") | renameSeries(\"value\") | formatByType(formattedConfig)" + } + }, + "input_model": { + "type": "input.multiselect", + "title": "Model", + "options": { + "items": ">frame(label, value) | prepend(formattedStatics) | objects()", + "token": "model_tok", + "defaultValue": "*", + "clearDefaultOnSelection": true + }, + "dataSources": { + "primary": "ds_filter_models" + }, + "context": { + "formattedConfig": { + "number": { + "prefix": "" + } + }, + "formattedStatics": ">statics | formatByType(formattedConfig)", + "statics": [ + [ + "All" + ], + [ + "*" + ] + ], + "label": ">primary | seriesByName(\"model_name\") | renameSeries(\"label\") | formatByType(formattedConfig)", + "value": ">primary | seriesByName(\"model_name\") | renameSeries(\"value\") | formatByType(formattedConfig)" + } + } + }, + "layout": { + "tabs": { + "items": [ + { + "layoutId": "layout_overview", + "label": "Threat Overview" + }, + { + "layoutId": "layout_attack_activity", + "label": "Attack Activity" + }, + { + "layoutId": "layout_data_exposure", + "label": "Data Exposure" + }, + { + "layoutId": "layout_app_model", + "label": "Applications & Models" + }, + { + "layoutId": "layout_detection_activity", + "label": "ESCU Detection Coverage" + } + ] + }, + "layoutDefinitions": { + "layout_overview": { + "type": "absolute", + "options": { + "height": 900, + "width": 1440, + "display": "auto-scale", + "gutterSize": 10 + }, + "structure": [ + { + "item": "viz_threat_header", + "type": "block", + "position": { + "x": 0, + "y": 0, + "w": 1440, + "h": 80 + } + }, + { + "item": "viz_total_events", + "type": "block", + "position": { + "x": 0, + "y": 90, + "w": 288, + "h": 130 + } + }, + { + "item": "viz_blocked_events", + "type": "block", + "position": { + "x": 288, + "y": 90, + "w": 288, + "h": 130 + } + }, + { + "item": "viz_allowed_highrisk", + "type": "block", + "position": { + "x": 576, + "y": 90, + "w": 288, + "h": 130 + } + }, + { + "item": "viz_allowed_sensitive_responses", + "type": "block", + "position": { + "x": 864, + "y": 90, + "w": 288, + "h": 130 + } + }, + { + "item": "viz_repeat_window_count", + "type": "block", + "position": { + "x": 1152, + "y": 90, + "w": 288, + "h": 130 + } + }, + { + "item": "viz_risk_timeline", + "type": "block", + "position": { + "x": 0, + "y": 230, + "w": 1440, + "h": 600 + } + } + ] + }, + "layout_attack_activity": { + "type": "absolute", + "options": { + "height": 1050, + "width": 1440, + "display": "auto-scale", + "gutterSize": 10 + }, + "structure": [ + { + "item": "viz_header_attack_activity", + "type": "block", + "position": { + "x": 0, + "y": 0, + "w": 1440, + "h": 110 + } + }, + { + "item": "viz_allowed_risk_count", + "type": "block", + "position": { + "x": 0, + "y": 120, + "w": 480, + "h": 135 + } + }, + { + "item": "viz_blocked_risk_count", + "type": "block", + "position": { + "x": 480, + "y": 120, + "w": 480, + "h": 135 + } + }, + { + "item": "viz_allowed_sensitive_response_count", + "type": "block", + "position": { + "x": 960, + "y": 120, + "w": 480, + "h": 135 + } + }, + { + "item": "viz_attack_paths", + "type": "block", + "position": { + "x": 0, + "y": 265, + "w": 1440, + "h": 360 + } + }, + { + "item": "viz_allowed_risk_cases", + "type": "block", + "position": { + "x": 0, + "y": 635, + "w": 720, + "h": 390 + } + }, + { + "item": "viz_repeated_event_ids", + "type": "block", + "position": { + "x": 720, + "y": 635, + "w": 720, + "h": 390 + } + } + ] + }, + "layout_data_exposure": { + "type": "absolute", + "options": { + "height": 980, + "width": 1440, + "display": "auto-scale", + "gutterSize": 10 + }, + "structure": [ + { + "item": "viz_header_data_exposure", + "type": "block", + "position": { + "x": 0, + "y": 0, + "w": 1440, + "h": 80 + } + }, + { + "item": "viz_sensitive_entities", + "type": "block", + "position": { + "x": 0, + "y": 90, + "w": 1440, + "h": 350 + } + }, + { + "item": "viz_repeat_windows", + "type": "block", + "position": { + "x": 0, + "y": 450, + "w": 1440, + "h": 480 + } + } + ] + }, + "layout_app_model": { + "type": "absolute", + "options": { + "height": 1120, + "width": 1440, + "display": "auto-scale", + "gutterSize": 10 + }, + "structure": [ + { + "item": "viz_header_app_model", + "type": "block", + "position": { + "x": 0, + "y": 0, + "w": 1440, + "h": 80 + } + }, + { + "item": "viz_apps_activity", + "type": "block", + "position": { + "x": 0, + "y": 90, + "w": 1440, + "h": 470 + } + }, + { + "item": "viz_models_activity", + "type": "block", + "position": { + "x": 0, + "y": 570, + "w": 1440, + "h": 470 + } + } + ] + }, + "layout_detection_activity": { + "type": "absolute", + "options": { + "height": 1350, + "width": 1440, + "display": "auto-scale", + "gutterSize": 10 + }, + "structure": [ + { + "item": "viz_header_detection_activity", + "type": "block", + "position": { + "x": 0, + "y": 0, + "w": 1440, + "h": 100 + } + }, + { + "item": "viz_detection_readiness", + "type": "block", + "position": { + "x": 0, + "y": 110, + "w": 1440, + "h": 300 + } + }, + { + "item": "viz_findings_by_detection", + "type": "block", + "position": { + "x": 0, + "y": 420, + "w": 720, + "h": 340 + } + }, + { + "item": "viz_findings_over_time", + "type": "block", + "position": { + "x": 720, + "y": 420, + "w": 720, + "h": 340 + } + }, + { + "item": "viz_priority_queue", + "type": "block", + "position": { + "x": 0, + "y": 770, + "w": 1440, + "h": 520 + } + } + ] + } + }, + "globalInputs": [ + "input_global_time", + "input_application", + "input_model" + ], + "options": { + "submitButton": true, + "submitOnDashboardLoad": true, + "showTitleAndDescription": true + } + }, + "defaults": { + "dataSources": { + "ds.search": { + "options": { + "queryParameters": { + "earliest": "$global_time.earliest$", + "latest": "$global_time.latest$" + } + } + } + } + } +} diff --git a/dashboards/cisco_ai_defense_threat_operations.yml b/dashboards/cisco_ai_defense_threat_operations.yml new file mode 100644 index 00000000000..a86c953ba73 --- /dev/null +++ b/dashboards/cisco_ai_defense_threat_operations.yml @@ -0,0 +1,9 @@ +name: Cisco AI Defense Threat Operations +id: 7b8213d0-61e3-46ec-9c8b-b6ab5820b849 +version: 1 +creation_date: '2026-10-18' +modification_date: '2026-10-18' +author: Nasreddine Bencherchali, Splunk +description: |- + Monitor Cisco AI Defense enforcement activity, risky prompts and responses, sensitive data detections, application and model activity, and related security detections. + This dashboard uses the cisco_ai_defense macro to find Cisco AI Defense events; configure it for your index, source, and sourcetype before use. From e7633b08c836c40ea8a8ce6d738c87e9c95610bf Mon Sep 17 00:00:00 2001 From: Radka Viskova Date: Mon, 19 Oct 2026 12:29:11 +0200 Subject: [PATCH 161/162] Fix AWS CreateAccessKey cross-user filter for IAMUser events (#4351) --------- Co-authored-by: Nasreddine Bencherchali --- detections/cloud/aws_createaccesskey.yml | 67 ++++++++++++++++++------ 1 file changed, 50 insertions(+), 17 deletions(-) diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml index 3bf1241d2db..9b8530cbb5c 100644 --- a/detections/cloud/aws_createaccesskey.yml +++ b/detections/cloud/aws_createaccesskey.yml @@ -1,28 +1,61 @@ name: AWS CreateAccessKey id: 2a9b80d3-6340-4345-11ad-212bf3d0d111 -version: 11 +version: 12 creation_date: '2021-03-02' -modification_date: '2026-05-13' -author: Bhavin Patel, Splunk +modification_date: '2026-10-19' +author: Bhavin Patel, Radka Viskova, Splunk status: production type: Hunting -description: The following analytic identifies the creation of AWS IAM access keys by a user for another user, which can indicate privilege escalation. It leverages AWS CloudTrail logs to detect instances where the user creating the access key is different from the user for whom the key is created. This activity is significant because unauthorized access key creation can allow attackers to establish persistence or exfiltrate data via AWS APIs. If confirmed malicious, this could lead to unauthorized access to AWS services, data exfiltration, and long-term persistence in the environment. +description: |- + This hunting query identifies successful AWS IAM access key creation events where a named IAM user creates a key for a different named IAM user. + Such activity may indicate persistence or privilege escalation, particularly when the target user has elevated permissions. The query compares the caller and target usernames; it does not assess the target user's permissions. + Hunting queries are designed to be run manually during threat hunting activities. data_source: - AWS CloudTrail CreateAccessKey search: |- - `cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success - | eval match=if(match(userIdentity.userName,requestParameters.userName),1,0) - | search match=0 - | rename user_name as user - | stats count min(_time) as firstTime max(_time) as lastTime - BY signature dest user - user_agent src vendor_account - vendor_region vendor_product - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `aws_createaccesskey_filter` -how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. -known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. + `cloudtrail` + eventName = CreateAccessKey + + | where (isnull(errorCode) OR errorCode="success") + AND 'userIdentity.type'="IAMUser" + AND isnotnull('userIdentity.userName') + AND isnotnull('requestParameters.userName') + AND 'userIdentity.userName'!='requestParameters.userName' + + | eval + caller_arn='userIdentity.arn', + caller_principal_id='userIdentity.principalId', + caller_user='userIdentity.userName', + dest=coalesce(dest,eventSource), + signature=coalesce(signature,eventName), + src=coalesce(src,sourceIPAddress), + target_user='requestParameters.userName', + user_agent=coalesce(user_agent,userAgent), + user_arn=coalesce(user_arn,caller_arn), + vendor_account=coalesce(vendor_account,recipientAccountId), + vendor_product=coalesce(vendor_product,"AWS"), + vendor_region=coalesce(vendor_region,awsRegion) + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(dest) as dest + values(eventID) as eventIDs + values(signature) as signature + values(src) as src + values(user_agent) as user_agent + values(user_arn) as user_arn + values(vendor_product) as vendor_product + values(vendor_region) as vendor_region + + by vendor_account caller_user caller_principal_id target_user + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `aws_createaccesskey_filter` +how_to_implement: |- + You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. +known_false_positives: |- + While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user. references: - https://bishopfox.com/blog/privilege-escalation-in-aws - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/ From 139141764d9a437fddcd8bcf86e6c90f9f28a017 Mon Sep 17 00:00:00 2001 From: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com> Date: Mon, 19 Oct 2026 13:45:03 +0200 Subject: [PATCH 162/162] Revamp Cisco FTD and its Dependent Detections (#4328) --- ...tect_remote_access_software_usage_file.yml | 63 +- ..._remote_access_software_usage_fileinfo.yml | 66 +- ...t_remote_access_software_usage_process.yml | 68 +- ..._remote_access_software_usage_registry.yml | 83 +- ...___communication_over_suspicious_ports.yml | 70 +- ...ll___connection_to_file_sharing_domain.yml | 56 +- ...__remote_access_software_usage_traffic.yml | 70 +- ...etect_remote_access_software_usage_dns.yml | 49 +- ...t_remote_access_software_usage_traffic.yml | 44 +- ...http_post_request_with_encoded_payload.yml | 45 +- ...etect_remote_access_software_usage_url.yml | 49 +- lookups/csv/file_sharing_domains_lookup.csv | 103 + lookups/csv/file_sharing_domains_lookup.yml | 11 + lookups/csv/remote_access_software.csv | 3114 +++++++++++++---- lookups/csv/remote_access_software.yml | 12 +- 15 files changed, 3091 insertions(+), 812 deletions(-) create mode 100644 lookups/csv/file_sharing_domains_lookup.csv create mode 100644 lookups/csv/file_sharing_domains_lookup.yml diff --git a/detections/endpoint/detect_remote_access_software_usage_file.yml b/detections/endpoint/detect_remote_access_software_usage_file.yml index 0746d33835a..55f0f5265f2 100644 --- a/detections/endpoint/detect_remote_access_software_usage_file.yml +++ b/detections/endpoint/detect_remote_access_software_usage_file.yml @@ -1,9 +1,9 @@ name: Detect Remote Access Software Usage File id: 3bf5541a-6a45-4fdc-b01d-59b899fff961 -version: 17 +version: 18 creation_date: '2024-03-06' -modification_date: '2026-09-22' -author: Steven Dick +modification_date: '2026-10-08' +author: Steven Dick, Onur Mustafa Erdogan, Splunk status: production type: Anomaly description: | @@ -21,31 +21,52 @@ search: | count min(_time) as firstTime, max(_time) as lastTime values(Filesystem.file_path) as file_path - from datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ( - "*.app", - "*.exe", - "*.msi", - "*.pkg", - "*echoware.dll", - "*Idrive.*", - "*rdp2tcp.py" - ) - by Filesystem.action Filesystem.dest Filesystem.file_access_time + + FROM datamodel=Endpoint.Filesystem WHERE + + [ + | inputlookup remote_access_software + | search file_name!="" + | rename file_name as Filesystem.file_name + | table Filesystem.file_name + ] + OR + [ + | inputlookup remote_access_software + | search file_path!="" + | rename file_path as Filesystem.file_path + | table Filesystem.file_path + ] + + BY Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product + + | `drop_dm_object_name(Filesystem)` + + | lookup local=t remote_access_software file_name OUTPUT app as signature, category, reference, description + | lookup local=t remote_access_software file_path OUTPUT app as signature, category, reference, description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `drop_dm_object_name(Filesystem)` - | lookup local=t remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category - | search isutility = TRUE + | `remote_access_software_usage_exceptions` + | `detect_remote_access_software_usage_file_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. -known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to + provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest + logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate + Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The + "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" + that lets you track and maintain device-based exceptions for this set of detections. +known_false_positives: |- + Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the + remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -68,11 +89,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: A file for known a remote access software [$file_name$] was created on $dest$ by $user$. + message: A file [$file_name$] known to be associated with a remote access software [$signature$] was created on [$dest$] by [$user$]. - field: user type: user score: 20 - message: A file for known a remote access software [$file_name$] was created on $dest$ by $user$. + message: A file [$file_name$] known to be associated with a remote access software [$signature$] was created on [$dest$] by [$user$]. threat_objects: - field: file_name type: file_name diff --git a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml index b7e8eb806bb..30aabcc494c 100644 --- a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml +++ b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml @@ -1,30 +1,56 @@ name: Detect Remote Access Software Usage FileInfo id: ccad96d7-a48c-4f13-8b9c-9f6a31cba454 -version: 16 +version: 17 creation_date: '2024-03-06' -modification_date: '2026-09-22' -author: Steven Dick +modification_date: '2026-10-08' +author: Steven Dick, Onur Mustafa Erdogan, Splunk status: production type: Anomaly -description: The following analytic detects the execution of processes with file or code signing attributes from known remote access software within the environment. It leverages Sysmon EventCode 1 data and cross-references a lookup table of remote access utilities such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these tools to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration or further compromise of the network. +description: |- + The following analytic detects the execution of processes with file or code signing attributes from known remote access software within + the environment. It leverages Sysmon EventCode 1 data and cross-references a lookup table of remote access utilities such as AnyDesk, + GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these tools to maintain unauthorized remote access. + If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration or further + compromise of the network. data_source: - Sysmon EventID 1 search: |- `sysmon` EventCode=1 - | stats count min(_time) as firstTime max(_time) as lastTime, values(Company) as Company values(Product) as Product - BY action dest original_file_name - parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path - process process_exec process_guid - process_hash process_id process_integrity_level - process_name process_path user - user_id vendor_product - | lookup local=t remote_access_software remote_utility_fileinfo AS Product OUTPUT isutility, description as signature, comment_reference as desc, category - | search isutility = True - | `remote_access_software_usage_exceptions` - | `detect_remote_access_software_usage_fileinfo_filter` -how_to_implement: This analytic relies on Sysmon to be properly installed and utilized in the environment. Ensure that proper logging is setup for Sysmon and data is being ingested into Splunk. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection named "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. -known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content + [ + | inputlookup remote_access_software + | search file_info!="" + | rename file_info as Product + | table Product + ] + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(Company) as Company + values(Product) as Product + + BY action dest original_file_name + parent_process parent_process_exec parent_process_guid + parent_process_id parent_process_name parent_process_path + process process_exec process_guid + process_hash process_id process_integrity_level + process_name process_path user + user_id vendor_product + + | lookup local=t remote_access_software file_info as Product OUTPUT app as signature, category, reference, description + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + + | `remote_access_software_usage_exceptions` + + | `detect_remote_access_software_usage_fileinfo_filter` +how_to_implement: |- + This analytic relies on Sysmon to be properly installed and utilized in the environment. Ensure that proper logging is setup for + Sysmon and data is being ingested into Splunk. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a + KVStore collection named "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. +known_false_positives: |- + Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the + remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -47,11 +73,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: A file attributes for known a remote access software [$process_name$] was detected on $dest$ + message: Known remote access software [$signature$] was observed through file attributes of [$process_name$] process on [$dest$] by [$user$]. - field: user type: user score: 20 - message: A file attributes for known a remote access software [$process_name$] was detected on $dest$ + message: Known remote access software [$signature$] was observed through file attributes of [$process_name$] process on [$dest$] by [$user$]. threat_objects: - field: process_name type: process_name diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml index b579e35a226..955d943bbb8 100644 --- a/detections/endpoint/detect_remote_access_software_usage_process.yml +++ b/detections/endpoint/detect_remote_access_software_usage_process.yml @@ -1,35 +1,63 @@ name: Detect Remote Access Software Usage Process id: ffd5e001-2e34-48f4-97a2-26dc4bb08178 -version: 18 +version: 19 creation_date: '2024-03-06' -modification_date: '2026-10-09' -author: Steven Dick, Sebastian Wurl, Splunk Community +modification_date: '2026-10-08' +author: Steven Dick, Sebastian Wurl, Onur Mustafa Erdogan, Splunk status: production type: Anomaly -description: The following analytic detects the execution of known remote access software within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data model. We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security. +description: |- + The following analytic detects the execution of known remote access software within the environment. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data model. We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: | - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.parent_process) as parent_process - from datamodel=Endpoint.Processes - where - [| inputlookup remote_access_software where isutility=TRUE - | rename remote_utility AS Processes.process_name - | fields Processes.process_name] - AND Processes.dest!="unknown" - AND Processes.user!="unknown" - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + values(Processes.parent_process) as parent_process + + FROM datamodel=Endpoint.Processes WHERE + + [ + | inputlookup remote_access_software + | search file_name!="" + | rename file_name as Processes.process_name + | table Processes.process_name + ] + + Processes.dest!="unknown" + Processes.user!="unknown" + + BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | lookup local=t remote_access_software file_name OUTPUT app as signature, category, reference, description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `drop_dm_object_name(Processes)` - | lookup local=t remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category - | search isutility = TRUE + | `remote_access_software_usage_exceptions` + | `detect_remote_access_software_usage_process_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections. -known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, + and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology + Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common + Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities + lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections. +known_false_positives: |- + It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional + remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup + to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -63,11 +91,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: A process for a known remote access software $process_name$ was identified on $dest$. + message: A process [$process_name$] for a known remote access software [$signature$] was identified on [$dest$] by [$user$]. - field: user type: user score: 20 - message: A process for a known remote access software $process_name$ was identified on $dest$. + message: A process [$process_name$] for a known remote access software [$signature$] was identified on [$dest$] by [$user$]. threat_objects: - field: process_name type: process_name diff --git a/detections/endpoint/detect_remote_access_software_usage_registry.yml b/detections/endpoint/detect_remote_access_software_usage_registry.yml index f000f5d3d43..11022e88779 100644 --- a/detections/endpoint/detect_remote_access_software_usage_registry.yml +++ b/detections/endpoint/detect_remote_access_software_usage_registry.yml @@ -1,17 +1,82 @@ name: Detect Remote Access Software Usage Registry id: 33804986-25dd-43cf-bb6b-dc14956c7cbc -version: 14 +version: 15 creation_date: '2024-12-28' -modification_date: '2026-09-22' -author: Steven Dick +modification_date: '2026-10-08' +author: Steven Dick, Onur Mustafa Erdogan, Splunk status: production type: Anomaly -description: The following analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others. +description: |- + The following analytic detects when a known remote access software is added to common persistence locations on a device within the environment. + Adversaries use these utilities to retain remote access capabilities to the environment. + Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` latest(Registry.process_guid) as process_guid count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*" OR (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" AND Registry.registry_value_name="ImagePath")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rex field=registry_value_data "(\")?.+\\\(?[^\"=]+\.[^\" ]{1,5})(\")?" | rex field=registry_value_data "(?[^\.]+\.[^\" ]{1,5}$)" | eval file_name = coalesce(file_name_1,file_name_2) | lookup local=t remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_registry_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Registry` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. -known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + latest(Registry.process_guid) as process_guid + + FROM datamodel=Endpoint.Registry WHERE + + ( + Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*" + OR + ( + Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" + Registry.registry_value_name="ImagePath" + ) + ) + ( + [ + | inputlookup remote_access_software + | search file_name!="" + | eval file_name="*".file_name."*" + | rex mode=sed field=file_name "s/\*\*/\*/g" + | rename file_name as Registry.registry_value_data + | table Registry.registry_value_data + ] + OR + [ + | inputlookup remote_access_software + | search file_path!="" + | eval file_path="*".file_path."*" + | rex mode=sed field=file_path "s/\*\*/\*/g" + | rename file_path as Registry.registry_value_data + | table Registry.registry_value_data + ] + ) + + BY Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + + | `drop_dm_object_name(Registry)` + + | rex field=registry_value_data "(?i)(?:^|\\)(?[^\\\/\'\"]+\.\w{2,5})\b" + | rex field=registry_value_data "(?i)(?\w\:[\\](?:[^\\\/\'\"]+\\)+[^\\\/\'\"]+\.\w{2,5})\b" + + | lookup local=t remote_access_software file_name OUTPUT app as signature, category, reference, description + | lookup local=t remote_access_software file_path OUTPUT app as signature, category, reference, description + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + + | `remote_access_software_usage_exceptions` + + | `detect_remote_access_software_usage_registry_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. + These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. + To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. + These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. + The logs must also be mapped to the `Registry` node of the `Endpoint` data model. + Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. + The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. +known_false_positives: |- + Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the + remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -34,11 +99,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: A process for a known remote access software [$signature$] was detected on $dest$ + message: Known remote access software [$signature$] was detected on [$dest$] by [$user$], via the registry path [$registry_path$]. - field: user type: user score: 20 - message: A process for a known remote access software [$signature$] was detected on $dest$ + message: Known remote access software [$signature$] was detected on [$dest$] by [$user$], via the registry path [$registry_path$]. threat_objects: - field: registry_path type: registry_path diff --git a/detections/network/cisco_secure_firewall___communication_over_suspicious_ports.yml b/detections/network/cisco_secure_firewall___communication_over_suspicious_ports.yml index e107f64a16a..3f3e554f1be 100644 --- a/detections/network/cisco_secure_firewall___communication_over_suspicious_ports.yml +++ b/detections/network/cisco_secure_firewall___communication_over_suspicious_ports.yml @@ -1,32 +1,68 @@ name: Cisco Secure Firewall - Communication Over Suspicious Ports id: d85c05c8-42c0-4e4a-87e7-4e1bb3e844e3 -version: 8 +version: 9 creation_date: '2025-04-03' -modification_date: '2026-05-13' -author: Nasreddine Bencherchali, Splunk +modification_date: '2026-10-08' +author: Nasreddine Bencherchali, Onur Mustafa Erdogan, Splunk status: production type: Anomaly description: | - The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios. Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444, 2222, or 51820 to bypass standard monitoring and firewall rules. If confirmed malicious, this activity may represent command and control (C2) tunneling, lateral movement, or unauthorized remote access. + The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. + It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios. + Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444 or 2222 to bypass standard monitoring and firewall rules. data_source: - Cisco Secure Firewall Threat Defense Connection Event search: | - `cisco_secure_firewall` EventType=ConnectionEvent dest_port IN ("888", "999", "2200", "2222", "4000", "4444", "6789", "8531", "50501", "51820") | fillnull value="unknown" url - | stats min(_time) as firstTime max(_time) as lastTime - values(src_port) as src_port - values(url) as url - values(rule) as rule - count by src, dest, dest_port, transport, action + `cisco_secure_firewall` + EventType=ConnectionEvent + dest_port>1024 + dest_port<49151 + + | where ( + ```Same digit ports, i.e 4444, 55555``` + ( + isint(dest_port/1111) + AND dest_port<10000 + ) + OR + isint(dest_port/11111) + + ```Ports with sequentially increasing digits, i.e 1234, 12345``` + OR + ( + isint((dest_port-123)/1111) + AND dest_port<7000 + ) + OR + isint((dest_port-1234)/11111) + + ```Ports with sequentially decreasing digits, i.e 4321``` + OR + ( + isint((dest_port+123)/1111) + AND dest_port>4000 + AND dest_port<10000 + ) + ) + + | fillnull value="unknown" url + + | stats min(_time) as firstTime + max(_time) as lastTime + values(src_port) as src_port + values(url) as url + values(rule) as rule + + count by src dest dest_port transport action + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___communication_over_suspicious_ports_filter` how_to_implement: | - This search requires Cisco Secure Firewall Threat Defense Logs, which - includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition - with configurations for your Splunk environment. The search also uses a post-filter - macro designed to filter out known false positives. + This search requires Cisco Secure Firewall Threat Defense Logs, which includes the ConnectionEvent EventType. + This search uses an input macro named `cisco_secure_firewall`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. + Replace the macro definition with configurations for your Splunk environment. + The search also uses a post-filter macro designed to filter out known false positives. The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404). The access policy must also enable logging. The search uses a hardcoded list of suspicious ports, you might want to tune those according to your environment @@ -50,7 +86,7 @@ intermediate_findings: - field: src type: system score: 20 - message: Suspicious communication detected from $src$ to $dest$ over port $dest_port$. + message: Suspicious communication detected from [$src$] to [$dest$] over port [$dest_port$]. threat_objects: - field: url type: url diff --git a/detections/network/cisco_secure_firewall___connection_to_file_sharing_domain.yml b/detections/network/cisco_secure_firewall___connection_to_file_sharing_domain.yml index d485b736f6d..0f2e4a336e8 100644 --- a/detections/network/cisco_secure_firewall___connection_to_file_sharing_domain.yml +++ b/detections/network/cisco_secure_firewall___connection_to_file_sharing_domain.yml @@ -1,35 +1,51 @@ name: Cisco Secure Firewall - Connection to File Sharing Domain id: f7e5e792-d907-46c1-a58e-4ff974dc462a -version: 10 +version: 11 creation_date: '2025-04-03' -modification_date: '2026-05-13' +modification_date: '2026-10-08' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly description: | - The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. It leverages Cisco Secure Firewall Threat Defense logs and focuses on allowed connections (action=Allow) where the url field matches a list of known data hosting or temporary storage services. While many of these platforms serve legitimate purposes, they are frequently leveraged by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads. This analytic is valuable for identifying potential abuse of legitimate infrastructure as part of an attacker's kill chain. If confirmed malicious, this activity may indicate tool staging, credential dumping, or outbound data leaks over HTTP(S). + The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. + It leverages Cisco Secure Firewall Threat Defense logs and focuses on allowed connections (action=Allow) where the url field matches a list of known data hosting or temporary storage services. + While many of these platforms serve legitimate purposes, they are frequently leveraged by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads. + This analytic is valuable for identifying potential abuse of legitimate infrastructure as part of an attacker's kill chain. data_source: - Cisco Secure Firewall Threat Defense Connection Event -search: | - `cisco_secure_firewall` action IN ("Trust", "Allow", "allowed") EventType=ConnectionEvent url IN ("*//objects.githubusercontent.com*", "*anonfiles.com*", "*cdn.discordapp.com*", "*ddns.net*", "*dl.dropboxusercontent.com*", "*ghostbin.co*", "*glitch.me*", "*gofile.io*", "*hastebin.com*", "*mediafire.com*", "*mega.nz*", "*onrender.com*", "*pages.dev*", "*paste.ee*", "*pastebin.com*", "*pastebin.pl*", "*pastetext.net*", "*privatlab.com*", "*privatlab.net*", "*send.exploit.in*", "*sendspace.com*", "*storage.googleapis.com*", "*storjshare.io*", "*supabase.co*", "*temp.sh*", "*transfer.sh*", "*trycloudflare.com*", "*ufile.io*", "*w3spaces.com*", "*workers.dev*") - | stats count min(_time) as firstTime max(_time) as lastTime - Values(src_port) as src_port - Values(dest) as dest - Values(dest_port) as dest_port - Values(rule) as rule - Values(url) as url - Values(EVE_Process) as EVE_Process - by src, transport, action +search: |- + `cisco_secure_firewall` + action IN ("Trust", "Allow", "allowed") + EventType=ConnectionEvent + [ + | inputlookup file_sharing_domains_lookup + | table domain + | rename domain as url + ] + + | lookup local=t file_sharing_domains_lookup domain as url OUTPUT description + + | where match(url, "(?i)\b".description."\b") + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(src_port) as src_port + values(dest) as dest + values(dest_port) as dest_port + values(rule) as rule + values(url) as url + values(EVE_Process) as EVE_Process + + by src transport action + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_secure_firewall___connection_to_file_sharing_domain_filter` how_to_implement: | - This search requires Cisco Secure Firewall Threat Defense Logs, which - includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition - with configurations for your Splunk environment. The search also uses a post-filter - macro designed to filter out known false positives. + This search requires Cisco Secure Firewall Threat Defense Logs, which includes the ConnectionEvent EventType. + This search uses an input macro named `cisco_secure_firewall`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition + with configurations for your Splunk environment. + The search also uses a post-filter macro designed to filter out known false positives. The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404). The access policy must also enable logging. known_false_positives: | @@ -52,7 +68,7 @@ intermediate_findings: - field: src type: system score: 20 - message: The host $src$ initiated a connection to the file sharing or pastebin domain $url$. + message: The host [$src$] initiated a connection to a file sharing or pastebin domain [$url$]. threat_objects: - field: url type: url diff --git a/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml b/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml index 8b32c0275e8..2c00e8715b1 100644 --- a/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml +++ b/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml @@ -1,48 +1,56 @@ name: Cisco Secure Firewall - Remote Access Software Usage Traffic id: ac54d39e-a75d-4f42-971d-006db3a0423a -version: 10 +version: 11 creation_date: '2025-05-28' -modification_date: '2026-09-22' -author: Nasreddine Bencherchali, Splunk +modification_date: '2026-10-08' +author: Nasreddine Bencherchali, Onur Mustafa Erdogan, Splunk status: production type: Anomaly -description: | - The following analytic detects network traffic associated with known remote access software applications - that are covered by Cisco Secure Firewall Application Detectors, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. +description: |- + The following analytic detects network traffic associated with known remote access software applications that are covered by Cisco Secure Firewall Application Detectors, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. It leverages Cisco Secure Firewall Threat Defense Connection Event. - This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments. - If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate - data, or deploy additional malware, posing a severe threat to the organization's security. data_source: - Cisco Secure Firewall Threat Defense Connection Event search: | - `cisco_secure_firewall` EventType=ConnectionEvent - | stats min(_time) as firstTime max(_time) as lastTime - values(dest_port) as dest_port - values(dest) as dest - values(transport) as transport - values(url) as url - values(rule) as rule - count by src ClientApplication action + `cisco_secure_firewall` + EventType=ConnectionEvent + + [ + | inputlookup remote_access_software + | search match_pattern!="" + | rename match_pattern as ClientApplication + | table ClientApplication + ] + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(dest_port) as dest_port + values(dest) as dest + values(transport) as transport + values(url) as url + values(rule) as rule + + by src ClientApplication action + + | lookup local=t remote_access_software match_pattern AS ClientApplication OUTPUT app as signature, category, reference, description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup local=t cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools appName AS ClientApplication OUTPUT category, appDescription as Description - | search category IN ("remote administration", "remote desktop control") + | `remote_access_software_usage_exceptions` + | `cisco_secure_firewall___remote_access_software_usage_traffic_filter` -how_to_implement: | - This search requires Cisco Secure Firewall Threat Defense Logs, which - includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition - with configurations for your Splunk environment. The search also uses a post-filter - macro designed to filter out known false positives. +how_to_implement: |- + This search requires Cisco Secure Firewall Threat Defense Logs, which includes the ConnectionEvent EventType. + This search uses an input macro named `cisco_secure_firewall`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition + with configurations for your Splunk environment. + The search also uses a post-filter macro designed to filter out known false positives. The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404). The access policy must also enable logging. - The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" - that lets you track and maintain device- based exceptions for this set of detections. -known_false_positives: | - It is possible that legitimate remote access software is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content + The "remote_access_software_usage_exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. +known_false_positives: |- + It is possible that legitimate remote access software is used within the environment. Known false positives can be added to the + remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -61,7 +69,7 @@ intermediate_findings: - field: src type: system score: 20 - message: Traffic to known remote access software [$ClientApplication$] was detected from $src$. + message: Traffic associated with known remote access software [$ClientApplication$] was detected from [$src$]. threat_objects: - field: ClientApplication type: signature diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml index dc927f67a6f..350fabadeb0 100644 --- a/detections/network/detect_remote_access_software_usage_dns.yml +++ b/detections/network/detect_remote_access_software_usage_dns.yml @@ -1,35 +1,54 @@ name: Detect Remote Access Software Usage DNS id: a16b797d-e309-41bd-8ba0-5067dae2e4be -version: 15 +version: 16 creation_date: '2024-03-06' -modification_date: '2026-09-22' -author: Steven Dick +modification_date: '2026-10-08' +author: Steven Dick, Onur Mustafa Erdogan, Splunk status: production type: Anomaly -description: The following analytic detects DNS queries to domains associated with known remote access software such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This detection is crucial as adversaries often use these tools to maintain access and control over compromised environments. Identifying such behavior is vital for a Security Operations Center (SOC) because unauthorized remote access can lead to data breaches, ransomware attacks, and other severe impacts if these threats are not mitigated promptly. +description: |- + The following analytic detects DNS queries to domains associated with known remote access software such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. data_source: - Sysmon EventID 22 search: | | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - from datamodel=Network_Resolution where - DNS.query=* - NOT DNS.query IN ("-", "unknown") - by DNS.answer DNS.answer_count DNS.query + + FROM datamodel=Network_Resolution WHERE + + [ + | inputlookup remote_access_software + | search domain!="" + | rename domain as DNS.query + | table DNS.query + ] + + BY DNS.answer DNS.answer_count DNS.query DNS.query_count DNS.reply_code_id DNS.src DNS.vendor_product + | `drop_dm_object_name("DNS")` + + | lookup local=t remote_access_software domain AS query OUTPUT app as signature, category, reference, description + | eval dest = query + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup local=t remote_access_software remote_domain AS query OUTPUT isutility, description as signature, - comment_reference as desc, category - | eval dest = query - | search isutility = True + | `remote_access_software_usage_exceptions` + | `detect_remote_access_software_usage_dns_filter` -how_to_implement: To implement this search, you must ingest logs that contain the DNS query and the source of the query. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the DNS logs. The logs must also be mapped to the `Network_Resolution` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. -known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content +how_to_implement: |- + To implement this search, you must ingest logs that contain the DNS query and the source of the query. + These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the DNS logs. + The logs must also be mapped to the `Network_Resolution` data model. + Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. + The "remote_access_software_usage_exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. +known_false_positives: |- + It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with + any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv + lookup to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -52,7 +71,7 @@ intermediate_findings: - field: src type: system score: 20 - message: A domain for a known remote access software $query$ was contacted by $src$. + message: A domain [$query$] for a known remote access software [$signature$] was contacted by [$src$]. threat_objects: - field: query type: domain diff --git a/detections/network/detect_remote_access_software_usage_traffic.yml b/detections/network/detect_remote_access_software_usage_traffic.yml index f0883920752..ae4856160ec 100644 --- a/detections/network/detect_remote_access_software_usage_traffic.yml +++ b/detections/network/detect_remote_access_software_usage_traffic.yml @@ -1,15 +1,14 @@ name: Detect Remote Access Software Usage Traffic id: 885ea672-07ee-475a-879e-60d28aa5dd42 -version: 17 +version: 18 creation_date: '2024-03-06' -modification_date: '2026-09-22' -author: Steven Dick +modification_date: '2026-10-08' +author: Steven Dick, Onur Mustafa Erdogan, Splunk status: production type: Anomaly -description: | +description: |- The following analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. It leverages Palo Alto traffic logs mapped to the Network_Traffic data model in Splunk. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments. - If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security. data_source: - Palo Alto Network Traffic search: | @@ -18,24 +17,39 @@ search: | max(_time) as lastTime values(All_Traffic.dest_port) as dest_port latest(All_Traffic.user) as user - from datamodel=Network_Traffic where - All_Traffic.app=* - NOT All_Traffic.app IN ("-", "unknown") - by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in + + FROM datamodel=Network_Traffic + WHERE + [ + | inputlookup remote_access_software + | search match_pattern!="" + | rename match_pattern as All_Traffic.app + | table All_Traffic.app + ] + + BY All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product | `drop_dm_object_name("All_Traffic")` + + | lookup local=t remote_access_software match_pattern AS app OUTPUT app as signature, category, reference, description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup local=t remote_access_software remote_appid AS app OUTPUT isutility, description as signature, comment_reference as desc, category - | search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_traffic_filter` -how_to_implement: The following analytic was developed with Palo Alto traffic logs. Ensure that the logs are being ingested into Splunk and mapped to the Network_Traffic data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections. -known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content +how_to_implement: |- + The following analytic was developed with Palo Alto traffic logs. Ensure that the logs are being ingested into Splunk and mapped to the Network_Traffic + data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro + leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain + device- based exceptions for this set of detections. +known_false_positives: |- + It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional + remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup + to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -59,11 +73,11 @@ intermediate_findings: - field: src type: system score: 20 - message: Application traffic for a known remote access software [$signature$] was detected from $src$. + message: Application traffic for a known remote access software [$signature$] was detected from [$src$] by [$user$]. - field: user type: user score: 20 - message: Application traffic for a known remote access software [$signature$] was detected from $src$. + message: Application traffic for a known remote access software [$signature$] was detected from [$src$] by [$user$]. threat_objects: - field: signature type: signature diff --git a/detections/network/http_post_request_with_encoded_payload.yml b/detections/network/http_post_request_with_encoded_payload.yml index f05fb1a082d..61d787aa4d7 100644 --- a/detections/network/http_post_request_with_encoded_payload.yml +++ b/detections/network/http_post_request_with_encoded_payload.yml @@ -2,14 +2,14 @@ name: HTTP POST Request with Encoded Payload id: 0590881d-7b81-48dd-9674-1f23f7db5d40 version: 1 creation_date: '2026-10-12' -modification_date: '2026-10-12' -author: Raven Tait, Splunk +modification_date: '2026-10-13' +author: Raven Tait, Nasreddine Bencherchali, Onur Mustafa Erdogan, Splunk status: production type: Anomaly description: |- - The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex-encoded bytes or base64-encoded strings. - It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex escape sequences or sixteen or more consecutive base64 character groups. - This activity is significant as adversaries commonly use hex or base64 encoding to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads. + The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex, base64, URL, XML, Unicode, or Octal encoded strings. + It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex, URL, XML, Unicode, or Octal escape sequences or sixteen or more consecutive base64 character groups. + This activity is significant as adversaries commonly use various encoding schemes to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads. data_source: - Zeek HTTP search: |- @@ -17,23 +17,37 @@ search: |- method="POST" post_body="*" - | eval dest_port=coalesce(dest_port, 'id.resp_p'), - dest=coalesce(dest, dest_ip, 'id.resp_h'), - src=coalesce(src, src_ip, 'id.orig_h') + NOT orig_mime_type_first_stated IN ( + "application/x-www-form-urlencoded", + "application/ocsp-request" + ) + + NOT user_agent IN ( + "MicroMessenger Client", + "Dalvik*", + "AliPayWallet*" + ) - | eval _hex=if(match(post_body, "(?:\\\\x[0-9a-fA-F]{2}){8,}|(?:%[0-9a-fA-F]{2}){8,}"), 1, 0) - | eval _b64=if(match(post_body, "(?:[A-Za-z0-9+/]{4}){16,}={0,2}"), 1, 0) + | eval dest_port=coalesce(dest_port, 'id.resp_p'), + dest=coalesce(dest, dest_ip, 'id.resp_h'), + src=coalesce(src, src_ip, 'id.orig_h') - | where _hex=1 OR _b64=1 + | eval encoding=ltrim(if(match(post_body, "^(?:\\\\x[0-9a-fA-F]{2}){8,}|(?:%[0-9a-fA-F]{2}){8,}"), "Hexadecimal", ""), " + ") + | eval encoding=ltrim(if(match(post_body, "^(?:[A-Za-z0-9+\\/]{4}){16,}={0,2}"), encoding." + Base64", encoding), " + ") + | eval encoding=ltrim(if(match(post_body, "^(?:0x[A-Fa-f0-9]{2}){8,}"), encoding." + URL Encoding", encoding), " + ") + | eval encoding=ltrim(if(match(post_body, "^(?:\\&\\#x?[A-Za-z0-9]{2,3}\;?){8,}"), encoding." + XML Encoding", encoding), " + ") + | eval encoding=ltrim(if(match(post_body, "^(?:\\\\u[A-Fa-f0-9]{4}|\\\\u\{[A-Fa-f0-9]+\}){8,}"), encoding." + Unicode", encoding), " + ") + | eval encoding=ltrim(if(match(post_body, "^(?:\\\\\\d{3}){8,}"), encoding." + Octal", encoding), " + ") - | eval encoding_type=case(_hex=1 AND _b64=1, "Hexadecimal + Base64", _hex=1, "Hexadecimal", _b64=1, "Base64") + | where encoding!="" | stats count min(_time) as firstTime max(_time) as lastTime - values(encoding_type) as encoding_type + values(uri) as uri + values(encoding) as encoding values(post_body) as post_body - by src dest dest_port uri method status_code + by src dest dest_port method status_code | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -49,6 +63,7 @@ references: - https://attack.mitre.org/techniques/T1071/001/ - https://attack.mitre.org/techniques/T1132/001/ - https://docs.zeek.org/en/master/logs/http.html + - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/README.md drilldown_searches: - name: View the detection results for - "$src$" search: '%original_detection_search% | search src = "$src$"' @@ -63,7 +78,7 @@ intermediate_findings: - field: src type: system score: 20 - message: An HTTP POST request with an encoded body of type [$encoding_type$] was detected from [$src$] to [$dest$] over port [$dest_port$] to URI - [$uri$]. + message: An HTTP POST request with an encoded body of type [$encoding$] was detected from [$src$] to [$dest$] over port [$dest_port$] to URI - [$uri$]. threat_objects: - field: uri type: uri diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml index 228dd2e6a28..74856edc8cf 100644 --- a/detections/web/detect_remote_access_software_usage_url.yml +++ b/detections/web/detect_remote_access_software_usage_url.yml @@ -1,18 +1,17 @@ name: Detect Remote Access Software Usage URL id: 9296f515-073c-43a5-88ec-eda5a4626654 -version: 17 +version: 18 creation_date: '2024-03-06' -modification_date: '2026-09-22' -author: Steven Dick +modification_date: '2026-10-08' +author: Steven Dick, Onur Mustafa Erdogan, Splunk status: production type: Anomaly -description: | +description: |- The following analytic detects the execution of known remote access software within the environment. It leverages network logs mapped to the Web data model, identifying specific URLs and user agents associated with remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. - This activity is significant as adversaries often use these utilities to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or further compromise the network, posing a severe security risk. data_source: - Palo Alto Network Threat -search: | +search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime @@ -22,28 +21,42 @@ search: | latest(Web.user) as user latest(Web.dest) as dest - from datamodel=Web where + FROM datamodel=Web WHERE Web.url_domain=* NOT Web.url_domain IN ( - "-", - "unknown" + "-", + "unknown" ) - by Web.action Web.src Web.category + [ + | inputlookup remote_access_software + | search domain!="" + | rename domain as Web.url_domain + | table Web.url_domain + ] + + BY Web.action Web.src Web.category Web.url_domain Web.url_length + | `drop_dm_object_name("Web")` + + | lookup local=t remote_access_software domain AS url_domain OUTPUT app as signature, category, reference, description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `drop_dm_object_name("Web")` - | lookup local=t remote_access_software remote_domain AS url_domain OUTPUT isutility, description as signature, comment_reference - as desc, category - | search isutility = True + | `remote_access_software_usage_exceptions` + | `detect_remote_access_software_usage_url_filter` how_to_implement: | - The detection is based on data that originates from network logs. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the network logs. The logs must also be mapped to the `Web` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections. + The detection is based on data that originates from network logs. These logs must be processed using the appropriate Splunk Technology Add-ons + that are specific to the network logs. The logs must also be mapped to the `Web` data model. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well + as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. known_false_positives: | - It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content + It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional + remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup + to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -66,11 +79,11 @@ intermediate_findings: - field: src type: system score: 20 - message: A domain for a known remote access software $url_domain$ was contacted by $src$. + message: A domain for a known remote access software [$url_domain$] was contacted by [$src$]. - field: user type: user score: 20 - message: A domain for a known remote access software $url_domain$ was contacted by $src$. + message: A domain for a known remote access software [$url_domain$] was contacted by [$src$]. threat_objects: - field: signature type: signature diff --git a/lookups/csv/file_sharing_domains_lookup.csv b/lookups/csv/file_sharing_domains_lookup.csv new file mode 100644 index 00000000000..cda6d83921b --- /dev/null +++ b/lookups/csv/file_sharing_domains_lookup.csv @@ -0,0 +1,103 @@ +domain,description +*0bin.net*,0bin.net +*1ty.me*,1ty.me +*235523.xyz*,235523.xyz +*8n1.org*,8n1.org +*99paste.com*,99paste.com +*anonfiles.com*,anonfiles.com +*apaste.info*,apaste.info +*beanpaste.fun*,beanpaste.fun +*bin.bloerg.net*,bin.bloerg.net +*bin.jarkon.fi*,bin.jarkon.fi +*bin.lysator.liu.se*,bin.lysator.liu.se +*bpa.st*,bpa.st +*cl1p.net*,cl1p.net +*clbin.com*,clbin.com +*codebeautify.org*,codebeautify.org +*codeshare.io*,codeshare.io +*commie.io*,commie.io +*controlc.com*,controlc.com +*crypticbin.com*,crypticbin.com +*cutapaste.net*,cutapaste.net +*defuse.ca*,defuse.ca +*dotnetfiddle.net*,dotnetfiddle.net +*dpaste.com*,dpaste.com +*everfall.com*,everfall.com +*filebin.net*,filebin.net +*fragbin.com*,fragbin.com +*friendpaste.com*,friendpaste.com +*ghostbin.co*,ghostbin.co +*gistpad.com*,gistpad.com +*glitch.me*,glitch.me +*gofile.io*,gofile.io +*hastebin.com*,hastebin.com +*hastebin.dev*,hastebin.dev +*ideone.com*,ideone.com +*ivpaste.com*,ivpaste.com +*jaw.gg*,jaw.gg +*jpst.it*,jpst.it +*jsbin.com*,jsbin.com +*jsfiddle.net*,jsfiddle.net +*jsitor.com*,jsitor.com +*justpaste.it*,justpaste.it +*justpaste.me*,justpaste.me +*kpaste.net*,kpaste.net +*lesma.eu*,lesma.eu +*mediafire.com*,mediafire.com +*mega.nz*,mega.nz +*modernpaste.com*,modernpaste.com +*n0paste.tk*,n0paste.tk +*nekobin.com*,nekobin.com +*nopaste.net*,nopaste.net +*notes.io*,notes.io +*p.ip.fi*,p.ip.fi +*paste-bin.xyz*,paste-bin.xyz +*paste.ax*,paste.ax +*paste.centos.org*,paste.centos.org +*paste.debian.net*,paste.debian.net +*paste.ee*,paste.ee +*paste.jp*,paste.jp +*paste.js.org*,paste.js.org +*paste.monster*,paste.monster +*paste.myst.rs*,paste.myst.rs +*paste.ofcode.org*,paste.ofcode.org +*paste.opensuse.org*,paste.opensuse.org +*paste.org.ru*,paste.org.ru +*paste.rohitab.com*,paste.rohitab.com +*paste.sh*,paste.sh +*paste.strictfp.com*,paste.strictfp.com +*paste2.org*,paste2.org +*pastebin*,pastebin +*pastecn.com*,pastecn.com +*pastecode.io*,pastecode.io +*pastecode.ru*,pastecode.ru +*pasted.co*,pasted.co +*pastee.dev*,pastee.dev +*pastejustit.com*,pastejustit.com +*pastelink.net*,pastelink.net +*pastes.io*,pastes.io +*pastesio.com*,pastesio.com +*pastetext.net*,pastetext.net +*pastey.gg*,pastey.gg +*pastie.org*,pastie.org +*primenotepad.com*,primenotepad.com +*privatebin.net*,privatebin.net +*privatlab*,privatlab +*privnote.com*,privnote.com +*quickhighlighter.com*,quickhighlighter.com +*rentry.co*,rentry.co +*send.exploit.in*,send.exploit.in +*sendspace.com*,sendspace.com +*snippet.host*,snippet.host +*storjshare.io*,storjshare.io +*temp.sh*,temp.sh +*termbin.com*,termbin.com +*textbin.net*,textbin.net +*tny.cz*,tny.cz +*transfer.sh*,transfer.sh +*tutpaste.com*,tutpaste.com +*ufile.io,ufile.io +*vpaste.net*,vpaste.net +*xi.pe*,xi.pe +*zerobin.net*,zerobin.net +*zigbin.io*,zigbin.io \ No newline at end of file diff --git a/lookups/csv/file_sharing_domains_lookup.yml b/lookups/csv/file_sharing_domains_lookup.yml new file mode 100644 index 00000000000..7d199cea231 --- /dev/null +++ b/lookups/csv/file_sharing_domains_lookup.yml @@ -0,0 +1,11 @@ +name: file_sharing_domains_lookup +id: 325e53a9-50be-4b00-be34-7925063b4278 +version: 1 +creation_date: '2019-10-06' +modification_date: '2026-10-06' +author: Splunk Threat Research Team +lookup_type: csv +description: A list of file sharing domains and pastebin-style hosting domains that can be modified +match_type: + - WILDCARD(domain) +case_sensitive_match: false diff --git a/lookups/csv/remote_access_software.csv b/lookups/csv/remote_access_software.csv index f8b86194277..632afe450c6 100644 --- a/lookups/csv/remote_access_software.csv +++ b/lookups/csv/remote_access_software.csv @@ -1,606 +1,2508 @@ -description,remote_domain,remote_utility,remote_utility_fileinfo,remote_appid,isutility,category,comment_reference,last_update -Absolute (Computrace),*search.namequery.com,rpcnet.exe,Absolute Software*,absolute-manage,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024 -Absolute (Computrace),*server.absolute.com,ctes.exe,Absolute Persistence*,,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024 -Absolute (Computrace),,ctespersitence.exe,CTES*,,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024 -Absolute (Computrace),,cteshostsvc.exe,,,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024 -Absolute (Computrace),,rpcld.exe,,,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024 -Ivanti Remote Control,*.ivanticloud.com,IvantiRemoteControl.exe,,,TRUE,RMM,https://rc1.ivanticloud.com/,2/9/2024 -Ivanti Remote Control,,ArcUI.exe,,,TRUE,RMM,https://rc1.ivanticloud.com/,2/9/2024 -Ivanti Remote Control,,AgentlessRC.exe,,,TRUE,RMM,https://rc1.ivanticloud.com/,2/9/2024 -Jump Desktop,*.jumpdesktop.com,jumpclient.exe,,jumpdesktop,TRUE,RMM,https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect,2/9/2024 -Microsoft Quick Assist,remoteassistance.support.services.microsoft.com*,quickassist.exe,Quick Assist,ms-quick-assist,TRUE,Built-in,https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca,2/9/2024 -MioNet (WD Anywhere Access),,mionet.exe,,,TRUE,RMM,https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016,2/9/2024 -MioNet (WD Anywhere Access),,mionetmanager.exe,,,TRUE,RMM,https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016,2/9/2024 -mRemoteNG,user_managed,mRemoteNG.exe,,,TRUE,RMM,https://github.com/mRemoteNG/mRemoteNG,2/9/2024 -MSP360,*.cloudberrylab.com,Online Backup.exe,MSP360*,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,*.msp360.com,CBBackupPlan.exe,Cloud.Ra*,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,*.mspbackups.com,Cloud.Backup.Scheduler.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,Cloud.Backup.RM.Service.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,cbb.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,CloudRaService.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,CloudRaSd.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,CloudRaCmd.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,CloudRaUtilities.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,Remote Desktop.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,Connect.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MyIVO,,myivomgr.exe,,,TRUE,RMM,myivo.com - DOA as of 2024,2/9/2024 -MyIVO,,myivomanager.exe,,,TRUE,RMM,myivo.com - DOA as of 2024,2/9/2024 -N-Able Advanced Monitoring Agent,*remote.management,Agent_*_RW.exe,N-Able*,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*.logicnow.com,BASEClient.exe,Remote Monitoring*,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*systemmonitor.us,BASupApp.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*systemmonitor.eu.com,BASupSrvc.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*system-monitor.com,BASupSrvcCnfg.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,systemmonitor.us.cdn.cloudflare.net,BASupTSHelper.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*cloudbackup.management,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*systemmonitor.co.uk,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*.n-able.com,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*.beanywhere.com,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*.swi-tc.com,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -NateOn-desktop sharing,*.nate.com,nateon*.exe,,,TRUE,RMM,http://rsupport.nate.com/rview/r8/main/index.aspx,2/9/2024 -NateOn-desktop sharing,,nateon.exe,,,TRUE,RMM,http://rsupport.nate.com/rview/r8/main/index.aspx,2/9/2024 -NateOn-desktop sharing,,nateonmain.exe,,,TRUE,RMM,http://rsupport.nate.com/rview/r8/main/index.aspx,2/9/2024 -Naverisk,user_managed,AgentSetup-*.exe,naverisk*,,TRUE,RMM,http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents,2/9/2024 -Naverisk,,,NavMK1 Limited*,,TRUE,RMM,http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents,2/9/2024 -Netop Remote Control (Impero Connect),*.connect.backdrop.cloud,nhostsvc.exe,Impero Solutions*,netop-remote-control,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),*.netop.com,nhstw32.exe,Impero Connect*,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),,ngstw32.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),,Netop Ondemand.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),,nldrw32.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),,rmserverconsolemediator.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),,ImperoInit.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),,Connect.Backdrop.cloud*.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netreo,charon.netreo.net,,,,TRUE,RMM,https://solutions.netreo.com/docs/firewall-requirements,2/9/2024 -Netreo,activation.netreo.net,,,,TRUE,RMM,https://solutions.netreo.com/docs/firewall-requirements,2/9/2024 -Netreo,*.api.netreo.com,,,,TRUE,RMM,https://solutions.netreo.com/docs/firewall-requirements,2/9/2024 -NetSupport Manager,*.netsupportmanager.com,pcictlui.exe,netsupport,netsupport-manager,TRUE,RMM,https://www.netsupportmanager.com/resources/,2/9/2024 -NetSupport Manager,,pcicfgui.exe,,,TRUE,RMM,https://www.netsupportmanager.com/resources/,2/9/2024 -NetSupport Manager,,client32.exe,,,TRUE,RMM,https://www.netsupportmanager.com/resources/,2/9/2024 -Neturo,neturo.uplus.co.kr,neturo*.exe,,,TRUE,RMM,"Obscure, located an older copy here: http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2",2/9/2024 -Neturo,,ntrntservice.exe,,,TRUE,RMM,"Obscure, located an older copy here: http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2",2/9/2024 -Netviewer (GoToMeet),,nvClient.exe,Algorius*,netviewer,TRUE,RMM,Obsolute - found copy here: https://www.enviolet.com/en/service/online-consultant.html,2/9/2024 -Netviewer (GoToMeet),,netviewer.exe,,,TRUE,RMM,Obsolute - found copy here: https://www.enviolet.com/en/service/online-consultant.html,2/9/2024 -ngrok,user_managed,ngrok.exe,,,TRUE,Developer Utility,https://ngrok.com/docs/guides/running-behind-firewalls/,2/9/2024 -NinjaRMM,*.ninjaone.com,ninjarmmagent.exe,NinjaRMM*,,TRUE,RMM,https://www.ninjaone.com/faq/,2/9/2024 -NinjaRMM,*.ninjarmm.com,NinjaRMMAgentPatcher.exe,Ninja MSP*,,TRUE,RMM,https://www.ninjaone.com/faq/,4/4/2025 -NoMachine,user_managed,nomachine*.exe,NoMachine*,nomachine,TRUE,RMM,https://kb.nomachine.com/AR04S01122,2/9/2024 -NoMachine,,nxservice*.exe,,,TRUE,RMM,https://kb.nomachine.com/AR04S01122,4/4/2025 -NoMachine,,nxd.exe,,,TRUE,RMM,https://kb.nomachine.com/AR04S01122,2/9/2024 -OCS inventory,user_managed,ocsinventory.exe,Ocs Inventory*,,TRUE,RMM,https://ocsinventory-ng.org/?page_id=878&lang=en,2/9/2024 -OCS inventory,,ocsservice.exe,OcsPackager*,,TRUE,RMM,https://ocsinventory-ng.org/?page_id=878&lang=en,2/9/2024 -Panorama9,trusted.panorama9.com,p9agent*.exe,Panorama9*,,TRUE,RMM,https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with,2/9/2024 -Panorama9,changes.panorama9.com,,,,TRUE,RMM,https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with,2/9/2024 -Parallels Access,*.parallels.com,prl_deskctl_agent.exe,Parallels Access*,parallels-access,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024 -Parallels Access,,prl_deskctl_wizard.exe,,,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024 -Parallels Access,,prl_pm_service.exe,,,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024 -Parallels Access,,parallelsaccess-*.exe,,,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024 -pcAnywhere,user_managed,awhost32.exe,,pcanywhere,TRUE,RMM,https://en.wikipedia.org/wiki/PcAnywhere,2/9/2024 -pcAnywhere,,pcaquickconnect.exe,,pcanywhere-remote-control,TRUE,RMM,https://en.wikipedia.org/wiki/PcAnywhere,2/9/2024 -pcAnywhere,,winaw32.exe,,pcanywhere-base,TRUE,RMM,https://en.wikipedia.org/wiki/PcAnywhere,2/9/2024 -Pcnow,,mwcliun.exe,,,TRUE,RMM,http://pcnow.webex.com/ - DOA as of 2024,2/9/2024 -Pcnow,,pcnmgr.exe,,,TRUE,RMM,http://pcnow.webex.com/ - DOA as of 2024,2/9/2024 -Pcnow,,webexpcnow.exe,,,TRUE,RMM,http://pcnow.webex.com/ - DOA as of 2024,2/9/2024 -Pcvisit,*.pcvisit.de,pcvisit.exe,pcvisit*,pcvisit,TRUE,RMM,https://www.pcvisit.de/,2/9/2024 -Pcvisit,,pcvisit_client.exe,,,TRUE,RMM,https://www.pcvisit.de/,2/9/2024 -Pcvisit,,pcvisit-easysupport.exe,,,TRUE,RMM,https://www.pcvisit.de/,2/9/2024 -Pcvisit,,pcvisit_service_client.exe,,,TRUE,RMM,https://www.pcvisit.de/,2/9/2024 -Pilixo,*.pilixo.com,Pilixo_Installer*.exe,Pilixo*,,TRUE,RMM,https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls,2/9/2024 -Pilixo,pilixo.com,rdp.exe,,,TRUE,RMM,https://pilixo.freshdesk.com/support/solutions/articles/9000141862-pilixo-anti-virus-and-anti-malware-exclusion-recommendations,2/9/2024 -Pilixo,download.pilixo.com,,,,TRUE,RMM,pilixo domain DOA as of 2024,2/9/2024 -Pocket Cloud (Wyse),,pocketcloud*.exe,PocketCloud*,pocket-cloud,TRUE,RMM,https://wyse-pocketcloud.informer.com/2.1/,2/9/2024 -Pocket Cloud (Wyse),,pocketcloudservice.exe,,,TRUE,RMM,https://wyse-pocketcloud.informer.com/2.1/,2/9/2024 -Pocket Controller (Soti Xsight),*soti.net,pocketcontroller.exe,Pocket Controller*,pocket-controller,TRUE,RMM,https://pulse.soti.net/support/soti-xsight/help/,2/9/2024 -Pocket Controller (Soti Xsight),,wysebrowser.exe,,,TRUE,RMM,https://pulse.soti.net/support/soti-xsight/help/,2/9/2024 -Pocket Controller (Soti Xsight),,XSightService.exe,,,TRUE,RMM,https://pulse.soti.net/support/soti-xsight/help/,2/9/2024 -PSEXEC,user_managed,psexec.exe,Sysinternals PsExec,psexec,TRUE,Remote Access,https://learn.microsoft.com/en-us/sysinternals/downloads/psexec,2/9/2024 -PSEXEC,,psexecsvc.exe,PsExec*,,TRUE,Remote Access,https://learn.microsoft.com/en-us/sysinternals/downloads/psexec,2/9/2024 -PSEXEC (Clone),user_managed,paexec.exe,Power Admin*,,TRUE,Remote Access,https://www.poweradmin.com/paexec/,2/9/2024 -PSEXEC (Clone),,PAExec-*.exe,PAExec*,,TRUE,Remote Access,https://www.poweradmin.com/paexec/,2/9/2024 -PSEXEC (Clone),,csexec.exe,,,TRUE,Remote Access,https://github.com/malcomvetter/CSExec,2/9/2024 -PSEXEC (Clone),,remcom.exe,Remote System Deployment*,,TRUE,Remote Access,https://support.alertlogic.com/hc/en-us/articles/360034494351-Windows-Server-RemCom-Tool-Remote-Shell,2/9/2024 -PSEXEC (Clone),,remcomsvc.exe,Remote Command Executor*,,TRUE,Remote Access,https://support.alertlogic.com/hc/en-us/articles/360034494351-Windows-Server-RemCom-Tool-Remote-Shell,2/9/2024 -PSEXEC (Clone),,xcmd.exe,,,TRUE,Remote Access,https://docs.bmc.com/docs/display/public/baob201204/xCmd+utility,2/9/2024 -PSEXEC (Clone),,xcmdsvc.exe,,,TRUE,Remote Access,https://docs.bmc.com/docs/display/public/baob201204/xCmd+utility,2/9/2024 -PulseWay,user_managed,pcmonitorsrv.exe,Pulseway*,,TRUE,RMM,https://intercom.help/pulseway/en/,2/9/2024 -Pulseway,,PCMonitorManager.exe,MMSoft Design*,,TRUE,RMM,https://intercom.help/pulseway/en/,2/9/2024 -QQ IM-remote assistance,*.mdt.qq.com,qq.exe,Tencent*,qq,TRUE,RMM,https://en.wikipedia.org/wiki/Tencent_QQ,2/9/2024 -QQ IM-remote assistance,*.desktop.qq.com,QQProtect.exe,QQ*,qq-rdp,TRUE,RMM,https://en.wikipedia.org/wiki/Tencent_QQ,2/9/2024 -QQ IM-remote assistance,upload_data.qq.com,qqpcmgr.exe,,,TRUE,RMM,https://en.wikipedia.org/wiki/Tencent_QQ,2/9/2024 -Quest KACE Agent (formerly Dell KACE),*.kace.com,konea.exe,KACE Agent*,,TRUE,RMM,https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function,2/9/2024 -RAdmin,user_managed,radmin.exe,famatech*,radmin,TRUE,RMM,https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,2/9/2024 -RAdmin,,famitrfc.exe,radmin*,,TRUE,RMM,https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,2/9/2024 -RAdmin,,radmin3.exe,,,TRUE,RMM,https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,2/9/2024 -rdp2tcp,user_managed,tdp2tcp.exe,,,TRUE,RMM,github.com/V-E-O/rdp2tcp,2/9/2024 -rdp2tcp,,rdp2tcp.py,,,TRUE,RMM,github.com/V-E-O/rdp2tcp,2/9/2024 -RDPView,user_managed,dwrcs.exe,,,TRUE,RMM,systemmanager.ru/dntu.en/rdp_view.htm - Same as Damware,2/9/2024 -rdpwrap,user_managed,RDPWInst.exe,,,TRUE,Utility,github.com/stascorp/rdpwrap,2/9/2024 -rdpwrap,,RDPCheck.exe,,,TRUE,Utility,github.com/stascorp/rdpwrap,2/9/2024 -rdpwrap,,RDPConf.exe,,,TRUE,Utility,github.com/stascorp/rdpwrap,2/9/2024 -Remobo,user_managed,remobo.exe,,,TRUE,RMM,https://www.remobo.com - DOA as of 2024,2/9/2024 -Remobo,,remobo_client.exe,,,TRUE,RMM,https://www.remobo.com - DOA as of 2024,2/9/2024 -Remobo,,remobo_tracker.exe,,,TRUE,RMM,https://www.remobo.com - DOA as of 2024,2/9/2024 -Remote Desktop Plus,,rdp.exe,Remote Desktop Plus*,,TRUE,Utility,https://www.donkz.nl/,2/9/2024 -Remote Manipulator System,*.internetid.ru,rfusclient.exe,,,TRUE,RMM,https://rmansys.ru/files/,2/9/2024 -Remote Manipulator System,,rutserv.exe,,,TRUE,RMM,https://rmansys.ru/files/,2/9/2024 -Remote Utilities,*.internetid.ru,rutview.exe,Remote Utilities*,,TRUE,RMM,https://www.remoteutilities.com/download/,2/9/2024 -Remote Utilities,,rutserv.exe,,,TRUE,RMM,https://www.remoteutilities.com/download/,2/9/2024 -Remote.it,auth.api.remote.it,remote-it-installer.exe,,,TRUE,RMM,https://docs.remote.it/introduction/get-started,2/9/2024 -Remote.it,api.remote.it,remote.it.exe,,,TRUE,RMM,https://docs.remote.it/introduction/get-started,2/9/2024 -Remote.it,,remoteit.exe,,,TRUE,RMM,https://docs.remote.it/introduction/get-started,2/9/2024 -RemoteCall,*.remotecall.com,rcengmgru.exe,RSUPPORT*,remotecall,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemoteCall,*.startsupport.com,rcmgrsvc.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemoteCall,,rxstartsupport.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemoteCall,,rcstartsupport.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemoteCall,,raautoup.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemoteCall,,agentu.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemoteCall,,remotesupportplayeru.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemotePass Access,,remotepass-access.exe,,,TRUE,RMM,https://www.remotepass.com/rpaccess.html - DOA as of 2024,2/9/2024 -RemotePass Access,,rpaccess.exe,,,TRUE,RMM,https://www.remotepass.com/rpaccess.html - DOA as of 2024,2/9/2024 -RemotePass Access,,rpwhostscr.exe,,,TRUE,RMM,https://www.remotepass.com/rpaccess.html - DOA as of 2024,2/9/2024 -RemotePC,*.remotepc.com,remotepcservice.exe,remotedesktop*,remotepc,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024 -RemotePC,remotepc.com,rpcsuite.exe,remotepc*,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024 -RemotePC,*.remotedesktop.com,Idrive.File-Transfer,,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024 -RemotePC,,idrive.RemotePCAgent,,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024 -RemotePC,,remotepchost.exe,,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024 -RemoteView,*content.rview.com,remoteview.exe,RemoteView*,remoteview,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024 -RemoteView,*.rview.com,rv.exe,RsDoctor*,,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024 -RemoteView,,rvagent.exe,,,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024 -RemoteView,,rvagtray.exe,,,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024 -RES Automation Manager,user_managed,wisshell*.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024 -RES Automation Manager,,wmc.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024 -RES Automation Manager,,wmc_deployer.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024 -RES Automation Manager,,wmcsvc.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024 -Royal Apps,user_managed,royalserver.exe,,,TRUE,RMM,https://www.royalapps.com/ts/win/download,2/9/2024 -Royal Apps,,royalts.exe,,,TRUE,RMM,https://www.royalapps.com/ts/win/download,2/9/2024 -RPort,user_managed,rport.exe,,,TRUE,RMM,https://kb.rport.io/using-the-remote-access,2/9/2024 -RuDesktop,*.rudesktop.ru,rd.exe,,rudesktop-remote-desktop,TRUE,RMM,https://rudesktop.ru,2/9/2024 -RuDesktop,,rudesktop*.exe,,,TRUE,RMM,https://asec.ahnlab.com/en/40263/,2/9/2024 -RustDesk,user_managed,rustdesk.exe,rustdesk*,rustdesk-remote-desktop,TRUE,RMM,https://rustdesk.com/docs/en/,2/9/2024 -RustDesk,,rustdesk*.exe,,,TRUE,RMM,https://rustdesk.com/docs/en/,2/9/2024 -Senso.cloud,*.senso.cloud,SensoClient.exe,,,TRUE,RMM,https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration,2/9/2024 -Senso.cloud,,SensoService.exe,,,TRUE,RMM,https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration,2/9/2024 -Senso.cloud,,aadg.exe,,,TRUE,RMM,https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration,2/9/2024 -ServerEye,*.server-eye.de,servereye*.exe,ServerEye*,,TRUE,RMM,https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf,2/9/2024 -ServerEye,,ServiceProxyLocalSys.exe,Server-Eye*,,TRUE,RMM,https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf,2/9/2024 -ServerEye,,,,,TRUE,RMM,https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf,2/9/2024 -ShowMyPC,showmypc.com,showmypc*.exe,ShowMyPC*,showmypc,TRUE,RMM,https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf,2/9/2024 -ShowMyPC,*.showmypc.com,showmypc.exe,,,TRUE,RMM,https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf,2/9/2024 -ShowMyPC,,SMPCSetup.exe,,,TRUE,RMM,https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf,2/9/2024 -SimpleHelp,user_managed,simplehelpcustomer.exe,SimpleHelp*,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024 -SimpleHelp,,simpleservice.exe,,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024 -SimpleHelp,,simplegatewayservice.exe,,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024 -SimpleHelp,,remote access.exe,,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024 -SkyFex,skyfex.com,Deskroll.exe,DeskRoll Remote Desktop*,,TRUE,RMM,https://skyfex.com/,2/9/2024 -SkyFex,deskroll.com,DeskRollUA.exe,,,TRUE,RMM,https://skyfex.com/,2/9/2024 -SkyFex,*.deskroll.com,,,,TRUE,RMM,https://skyfex.com/,2/9/2024 -Sophos-Remote Management System,*.sophos.com,clientmrinit.exe,,,TRUE,RMM,community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system,2/9/2024 -Sophos-Remote Management System,*.sophosupd.com,mgntsvc.exe,,,TRUE,RMM,community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system,2/9/2024 -Sophos-Remote Management System,*.sophosupd.net,routernt.exe,,,TRUE,RMM,community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system,2/9/2024 -Sorillus,*.sorillus.com,Sorillus-Launcher*.exe,,,TRUE,RMM,https://sorillus.com/,2/9/2024 -Sorillus,sorillus.com,Sorillus Launcher.exe,,,TRUE,RMM,https://sorillus.com/,2/9/2024 -Splashtop Remote,splashtop.com,strwinclt.exe,Splashtop*,splashtop-remote,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -Splashtop Remote,*.api.splashtop.com,Splashtop_Streamer_Windows*.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -Splashtop Remote,*.relay.splashtop.com,SplashtopSOS.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -Splashtop Remote,*.api.splashtop.eu,sragent.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -Splashtop Remote,,srmanager.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -Splashtop Remote,,srserver.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -Splashtop Remote,,srservice.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -SpyAnywhere,*.spytech-web.com,sysdiag.exe,,,TRUE,RMM,https://www.spyanywhere.com/support.shtml,2/9/2024 -247ithelp.com (ConnectWise),*.247ithelp.com,Remote Workforce Client.exe,,,TRUE,RMM,Simlar / replaced by ScreenConnect,2/8/2024 -Connectwise Automate (LabTech),*.hostedrmm.com,ltsvc.exe,,,TRUE,RMM,https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate,2/8/2024 -Connectwise Automate (LabTech),,ltsvcmon.exe,,,TRUE,RMM,https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate,2/8/2024 -Connectwise Automate (LabTech),,lttray.exe,,,TRUE,RMM,https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate,2/8/2024 -Distant Desktop,*.distantdesktop.com,distant-desktop.exe,Distant Software*,,TRUE,RMM,https://www.distantdesktop.com/manual/first-start.htm,2/8/2024 -Distant Desktop,*signalserver.xyz,dd.exe,Distant Desktop*,,TRUE,RMM,https://www.distantdesktop.com/manual/first-start.htm,2/8/2024 -Distant Desktop,,ddsystem.exe,German Gorodokuplya*,,TRUE,RMM,https://www.distantdesktop.com/manual/first-start.htm,2/8/2024 -GotoHTTP,gotohttp.com,gotohttp.exe,GotoHTTP*,,TRUE,RMM,https://gotohttp.com/goto/help.12x,2/8/2024 -GotoHTTP,*.gotohttp.com,GotoHTTP_x64.exe,Pingbo*,,TRUE,RMM,https://gotohttp.com/goto/help.12x,2/8/2024 -GoToMyPC,*.GoToMyPC.com,g2file*.exe,GoTo Opener,gotomypc,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2quick.exe,GoToOpener,gotomypc-base,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2svc.exe,,gotomypc-desktop-sharing,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2tray.exe,,gotomypc-remote-control,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2svc.exe,,gotomypc-printing,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2printh.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2fileh.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2tray.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,gopcsrv.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2host.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2comm.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2mainh.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -Goverlan,user_managed,goverrmc.exe,Goverlan*,goverlan,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024 -Goverlan,,govsrv*.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024 -Goverlan,,GovAgentInstallHelper.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024 -Goverlan,,GovAgentx64.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024 -Goverlan,,GovReachClient.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024 -Guacamole,user_managed,guacd.exe,,,TRUE,RMM,guacamole.apache.org,2/8/2024 -HelpBeam,,helpbeam*.exe,,,TRUE,RMM,https://www.helpbeam.com domain for sale in 2024,2/8/2024 -HelpU,helpu.co.kr,helpu_install.exe,helpU*,helpu,TRUE,RMM,https://helpu.co.kr/,2/8/2024 -HelpU,*.helpu.co.kr,HelpuUpdater.exe,Help Manager Program,,TRUE,RMM,https://helpu.co.kr/,2/8/2024 -HelpU,,HelpuManager.exe,,,TRUE,RMM,https://helpu.co.kr/,2/8/2024 -I'm InTouch,*.01com.com,iit.exe,I'm InTouch*,,TRUE,RMM,https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/,2/8/2024 -I'm InTouch,,intouch.exe,,,TRUE,RMM,https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/,2/8/2024 -I'm InTouch,,I'm InTouch Go Installer.exe,,,TRUE,RMM,https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/,2/8/2024 -Instant Housecall,*.instanthousecall.com,hsloader.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024 -Instant Housecall,*.instanthousecall.net,ihcserver.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024 -Instant Housecall,instanthousecall.com,instanthousecall.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024 -Instant Housecall,secure.instanthousecall.com,instanthousecall.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024 -IntelliAdmin Remote Control,user_managed,iadmin.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024 -IntelliAdmin Remote Control,*.intelliadmin.com,intelliadmin.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024 -IntelliAdmin Remote Control,,agent32.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024 -IntelliAdmin Remote Control,,agent64.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024 -IntelliAdmin Remote Control,,agent_setup_5.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024 -Iperius Remote,*.iperiusremote.com,iperius.exe,Enter Srl*,,TRUE,RMM,https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx,2/8/2024 -Iperius Remote,*.iperius.com,iperiusremote.exe,Enter S.R.L*,,TRUE,RMM,https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx,2/8/2024 -Iperius Remote,*.iperius-rs.com,,Iperius Remote*,,TRUE,RMM,https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx,2/8/2024 -ISL Online,*.islonline.com,islalwaysonmonitor.exe,ISL Online*,isl-light,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024 -ISL Online,*.islonline.net,isllight.exe,ISL Light*,,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024 -ISL Online,,isllightservice.exe,,,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024 -ISL Online,,ISLLightClient.exe,,,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024 -Itarian,*.itsm-us1.comodo.com,ITSMAgent.exe,Itarian*,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,mdmsupport.comodo.com,ItsmRsp.exe,RMM*,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,*.cmdm.comodo.com,ITSMService.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,remoteaccess.itarian.com,RDesktop.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,servicedesk.itarian.com,RHost.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,,RmmService.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,,ComodoRemoteControl.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,,RAccess.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,,RViewer.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,,ITarianRemoteAccessSetup.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -ITSupport247 (ConnectWise),*.itsupport247.net,saazapsc.exe,,,TRUE,RMM,https://control.itsupport247.net/,2/8/2024 -Jump Desktop,jumpdesktop.com,jumpdesktop.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024 -Jump Desktop,jumpto.me,jumpservice.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024 -Jump Desktop,*.jumpto.me,jumpconnect.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024 -Jump Desktop,,jumpupdater.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024 -Kabuto,*.kabuto.io,Kabuto.App.Runner.exe,,,TRUE,RMM,https://www.repairtechsolutions.com/documentation/kabuto/,2/8/2024 -Kaseya (VSA),deploy01.kaseya.com,agentmon.exe,Kaseya*,,TRUE,RMM,https://helpdesk.kaseya.com/hc/en-gb/articles/229012608-Software-Deployment-URL-Port-Requirements,2/8/2024 -Kaseya (VSA),*managedsupport.kaseya.net,KaUpdHlp.exe,,,TRUE,RMM,https://helpdesk.kaseya.com/hc/en-gb/articles/229012608-Software-Deployment-URL-Port-Requirements,2/8/2024 -Kaseya (VSA),*.kaseya.net,KaUsrTsk.exe,,,TRUE,RMM,https://helpdesk.kaseya.com/hc/en-gb/articles/229012608-Software-Deployment-URL-Port-Requirements,2/8/2024 -KickIdler,kickidler.com,grabberEM.*msi,,,TRUE,RMM,https://www.kickidler.com/for-it/faq/,2/8/2024 -KickIdler,my.kickidler.com,grabberTT*.msi,,,TRUE,RMM,https://www.kickidler.com/for-it/faq/,2/8/2024 -LANDesk,*.ivanticloud.com,issuser.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024 -LANDesk,*.ivanti.com,landeskagentbootstrap.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024 -LANDesk,,LANDeskPortalManager.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024 -LANDesk,,ldinv32.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024 -LANDesk,,ldsensors.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024 -Laplink Everywhere,everywhere.laplink.com,laplink.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024 -Laplink Everywhere,le.laplink.com,laplink-everywhere-setup*.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024 -Laplink Everywhere,atled.syspectr.com,laplinkeverywhere.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024 -Laplink Everywhere,,llrcservice.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024 -Laplink Everywhere,,serverproxyservice.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024 -Laplink Everywhere,,OOSysAgent.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024 -Laplink Gold,user_managed,tsircusr.exe,,,TRUE,RMM,wen.laplink.com/product/laplink-gold,2/8/2024 -Level.io,level.io,level-windows-amd64.exe,Level*,,TRUE,RMM,https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues,2/8/2024 -Level.io,*.level.io,level.exe,,,TRUE,RMM,https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues,2/8/2024 -Level.io,,level-remote-control-ffmpeg.exe,,,TRUE,RMM,https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues,2/8/2024 -LiteManager,*.litemanager.ru,romfusclient.exe,Yakhnovets Denis*,litemanager,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024 -LiteManager,*.litemanager.com,romviewer.exe,ROMServer*,,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024 -LiteManager,,romserver.exe,ROMViewer*,,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024 -LiteManager,,lmnoipserver.exe,LiteManager*,,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024 -LogMeIn,*logmein.eu,lmiguardiansvc.exe,LogMeIn*,logmein,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024 -LogMeIn,*.logmeininc.com,lmiignition.exe,RemotelyAnywhere*,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024 -LogMeIn,*.logmein.com,logmein.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024 -LogMeIn,,logmeinsystray.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024 -LogMeIn,,logmein*.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024 -LogMeIn,,lmiignition.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024 -LogMeIn rescue,*.logmeinrescue.com,support-logmeinrescue*.exe,,logmeinrescue,TRUE,RMM,https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue,2/8/2024 -LogMeIn rescue,*.logmeinrescue.eu,support-logmeinrescue.exe,,,TRUE,RMM,https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue,2/8/2024 -LogMeIn rescue,,lmi_rescue.exe,,,TRUE,RMM,https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue,2/8/2024 -Manage Engine (Desktop Central),desktopcentral.manageengine.com,dcagentservice.exe,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024 -Manage Engine (Desktop Central),desktopcentral.manageengine.com.eu,dcagentregister.exe,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024 -Manage Engine (Desktop Central),desktopcentral.manageengine.cn,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024 -Manage Engine (Desktop Central),*.dms.zoho.com,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024 -Manage Engine (Desktop Central),*.dms.zoho.com.eu,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024 -Manage Engine (Desktop Central),*.-dms.zoho.com.cn,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024 -MeshCentral,user_managed,meshcentral*.exe,meshcentral,,TRUE,RMM,https://ylianst.github.io/MeshCentral/meshcentral/,2/8/2024 -Microsoft RDP,,mstsc.exe,,ms-rdp,TRUE,Built-in,https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/windows,2/8/2024 -Microsoft TSC,,termsrv.exe,,,TRUE,Built-in,https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/terminal-server-startup-connection-application,2/8/2024 -Netop Remote Control (Impero Connect),,ImperoClientSVC.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/8/2024 -Access Remote PC,,rpcgrab.exe,,,TRUE,RMM,,2/7/2024 -Access Remote PC,,rpcsetup.exe,,,TRUE,RMM,,2/7/2024 -Action1,*.action1.com,action1_agent.exe,Action1*,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024 -Action1,action1.com,action1_remote.exe,,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024 -Action1,a1-backend-packages.s3.amazonaws.com,action1_connector.exe,,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024 -Action1,server.action1.com,action1_update.exe,,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024 -AeroAdmin,auth*.aeroadmin.com,aeroadmin.exe,AeroAdmin*,aeroadmin,TRUE,RMM,https://support.aeroadmin.com/kb/faq.php?id=58,2/7/2024 -AeroAdmin,aeroadmin.com,,Aero Admin*,,TRUE,RMM,https://support.aeroadmin.com/kb/faq.php?id=58,2/7/2024 -AliWangWang-remote-control,wangwang.taobao.com,alitask.exe,AliWangWang*,ali-wangwang,TRUE,RMM,https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale,2/7/2024 -AliWangWang-remote-control,,,,ali-wangwang-remote-control,TRUE,RMM,https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale,2/7/2024 -Alpemix,*.alpemix.com,alpemix.exe,Alpemix*,alpemix,TRUE,RMM,https://www.alpemix.com/en/remote-access,2/7/2024 -Alpemix,*.teknopars.com,,Teknopars*,,TRUE,RMM,https://www.alpemix.com/en/remote-access,2/7/2024 -Ammyy Admin,*ammyy.com,aa_v*.exe,Ammyy*,ammyy-admin,TRUE,RMM,https://www.ammyy.com/en/admin_security.html,2/7/2024 -Ammyy Admin,,AMMYY_Admin.exe,,,TRUE,RMM,https://www.ammyy.com/en/admin_security.html,2/7/2024 -AnyDesk,*net.anydesk.com,anydesk.exe,anydesk*,anydesk,TRUE,RMM,https://support.anydesk.com/knowledge/firewall,2/7/2024 -AnyDesk,,,philandro Software*,anydesk,TRUE,RMM,https://support.anydesk.com/knowledge/firewall,2/7/2024 -Anyplace Control,anyplace-control.com,apc_host.exe,Anyplace*,anyplace-remote-control,TRUE,RMM,http://www.anyplace-control.com/anyplace-control/help/faq.htm,2/7/2024 -AnyViewer,controlserver.anyviewer.com,AnyViewerSetup.exe,AOMEI*,,TRUE,RMM,https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,2/7/2024 -AnyViewer,*.aomeisoftware.com,RCClient.exe,Anyviewer*,,TRUE,RMM,https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,2/7/2024 -AnyViewer,aomeisoftware.com,RCService.exe,,,TRUE,RMM,https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,2/7/2024 -Atera RMM,agent-api.atera.com,atera_agent.exe,Atera Networks,,TRUE,RMM,https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,2/7/2024 -Atera RMM,pubsub.atera.com,ateraagent.exe,AteraAgent,,TRUE,RMM,https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,2/7/2024 -Atera RMM,,syncrosetup.exe,,,TRUE,RMM,https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,2/7/2024 -Auvik,*.my.auvik.com,auvik.engine.exe,,,TRUE,RMM,https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use,2/7/2024 -Auvik,*.auvik.com,auvik.agent.exe,,,TRUE,RMM,https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use,2/7/2024 -AweRay,asapi*.aweray.net,aweray_remote*.exe,AweRay*,awesun,TRUE,RMM,https://sun.aweray.com/help,2/7/2024 -AweRay,client-api.aweray.com,AweSun.exe,AweSun*,,TRUE,RMM,https://sun.aweray.com/help,2/7/2024 -Barracuda,*.islonline.net,,Barracuda MSP,,TRUE,RMM,https://help.islonline.com/19799/166125,2/7/2024 -Barracuda,rmm.barracudamsp.com,,Barracuda Networks,,TRUE,RMM,https://help.islonline.com/19799/166125,2/7/2024 -Barracuda,,,LPI Level Platforms,,TRUE,RMM,https://help.islonline.com/19799/166125,2/7/2024 -Basecamp,,,,,TRUE,RMM,basecamp.com - No specific RMM tool listed,2/7/2024 -BeamYourScreen,beamyourscreen.com,beamyourscreen.exe,BeamYourScreen*,,TRUE,RMM,beamyourscreen redirects to https://www.mikogo.com/,2/7/2024 -BeamYourScreen,*.beamyourscreen.com,beamyourscreen-host.exe,,,TRUE,RMM,beamyourscreen redirects to https://www.mikogo.com/,2/7/2024 -BeAnyWhere,beanywhere.com,BASupConHelper.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,*.beanywhere.com,BASupSrvc.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupSrvcCnfg.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupSrvcUpdater.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupSysInf.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupAppSrvc.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupAppElev.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupApp.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,TakeControl.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupApp.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeyondTrust (Bomgar),*.beyondtrustcloud.com,bomgar-scc-*.exe,BeyondTrust*,beyond-trust-remote-support,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024 -BeyondTrust (Bomgar),*.bomgarcloud.com,bomgar-scc.exe,Bomgar*,bomgar,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024 -BeyondTrust (Bomgar),bomgarcloud.com,bomgar-pac-*.exe,,,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024 -BeyondTrust (Bomgar),,bomgar-pac.exe,,,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024 -BeyondTrust (Bomgar),,bomgar-rdp.exe,,,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024 -CentraStage (Now Datto),*.rmm.datto.com,CagService.exe,Datto*,,TRUE,RMM,https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm,2/7/2024 -CentraStage (Now Datto),*cc.centrastage.net,AEMAgent.exe,,,TRUE,RMM,https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm,2/7/2024 -Centurion,centuriontech.com,ctiserv.exe,,,TRUE,RMM,https://data443.atlassian.net/servicedesk/customer/portal/20,2/7/2024 -Chrome Remote Desktop,*remotedesktop.google.com,remote_host.exe,Chrome Remote Desktop,chrome-remote-desktop,TRUE,RMM,https://support.google.com/chrome/a/answer/2799701?hl=en,2/7/2024 -Chrome Remote Desktop,*remotedesktop-pa.googleapis.com,remoting_host.exe,,,TRUE,RMM,https://support.google.com/chrome/a/answer/2799701?hl=en,2/7/2024 -CloudFlare Tunnel,,cloudflared.exe,,,TRUE,Remote Access,cloudflare.com/products/tunnel/,2/7/2024 -Comodo RMM,*.itsm-us1.comodo.com,itsmagent.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/7/2024 -Comodo RMM,*mdmsupport.comodo.com,rviewer.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/7/2024 -CrossLoop,*.crossloop.com,crossloopservice.exe,Crossloop*,crossloop,TRUE,RMM,www.CrossLoop.com -> redirects to avast.com,2/7/2024 -CrossLoop,,CrossLoopConnect.exe,,,TRUE,RMM,www.CrossLoop.com -> redirects to avast.com,2/7/2024 -CrossLoop,,WinVNCStub.exe,,,TRUE,RMM,www.CrossLoop.com -> redirects to avast.com,2/7/2024 -CrossTec Remote Control,user_managed,PCIVIDEO.EXE,CrossTec,,TRUE,RMM,www.crosstecsoftware.com/supporthome.html - domain DOA 2/1/2024,2/7/2024 -CrossTec Remote Control,,supporttool.exe,,,TRUE,RMM,www.crosstecsoftware.com/supporthome.html - domain DOA 2/1/2024,2/7/2024 -CruzControl,,,,,TRUE,RMM,https://resources.doradosoftware.com/cruz-rmm,2/7/2024 -Dameware,user_managed,dntus*.exe,DameWare*,dameware-mini-remote,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024 -Dameware,,dwrcs.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024 -Dameware,,DameWare Remote Support.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024 -Dameware,,SolarWinds-Dameware-MRC*.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024 -Dameware,,DameWare Mini Remote Control*.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024 -Dameware,,SolarWinds-Dameware-DRS*.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024 -DeskDay,deskday.ai,ultimate_*.exe,,,TRUE,RMM,https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate,2/7/2024 -DeskDay,app.deskday.ai,,,,TRUE,RMM,https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate,2/7/2024 -Domotz,*.domotz.co,domotz*.exe,Domotz*,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024 -Domotz,*cell-1.domotz.com,domotz_bash.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024 -Domotz,domotz.com,domotz-windows*.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024 -Domotz,,Domotz Pro Desktop App.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024 -Domotz,,Domotz Pro Desktop App Setup*.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024 -Domotz,,domotz.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024 -DW Service,*.dwservice.net,dwagsvc.exe,DWSNET*,dws-remote-control,TRUE,RMM,https://news.dwservice.net/dwservice-security-infrastructure/,2/7/2024 -DW Service,,dwagent.exe,,,TRUE,RMM,https://news.dwservice.net/dwservice-security-infrastructure/,2/7/2024 -DW Service,,dwagsvc.exe,,,TRUE,RMM,https://news.dwservice.net/dwservice-security-infrastructure/,2/7/2024 -Echoware,,echoserver*.exe,,echoware,TRUE,RMM,,2/7/2024 -Echoware,,echoware.dll,,,TRUE,RMM,,2/7/2024 -Electric AI (Kaseya),,,,,TRUE,RMM,https://www.electric.ai/product/device-management-solutions - Usess Kaseya/jamf,2/7/2024 -EMCO Remote Console,user_managed,remoteconsole.exe,,,TRUE,RMM,,2/7/2024 -Encapto,,,,,TRUE,RMM,https://www.encapto.com - used to manage Cisco services,2/7/2024 -Ericom AccessNow,user_managed,accessserver*.exe,,,TRUE,RMM,https://www.ericom.com/connect-accessnow/,2/7/2024 -Ericom Connect,user_managed,EricomConnectRemoteHost*.exe,,,TRUE,RMM,https://www.ericom.com/connect-accessnow/,2/7/2024 -Ericom Connect,,ericomconnnectconfigurationtool.exe,,,TRUE,RMM,https://www.ericom.com/connect-accessnow/,2/7/2024 -ESET Remote Administrator,user_managed,era.exe,ESET Management*,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024 -ESET Remote Administrator,,einstaller.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024 -ESET Remote Administrator,,ezhelp*.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024 -ESET Remote Administrator,,eratool.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024 -ESET Remote Administrator,,ERAAgent.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024 -ezHelp,*.ezhelp.co.kr,ezhelpclientmanager.exe,Mastersoft Corp*,ezhelp,TRUE,RMM,https://www.exhelp.co.kr,2/7/2024 -ezHelp,,ezHelpManager.exe,,,TRUE,RMM,https://www.exhelp.co.kr,2/7/2024 -ezHelp,,ezhelpclient.exe,,,TRUE,RMM,https://www.exhelp.co.kr,2/7/2024 -FastViewer,*.fastviewer.com,fastclient.exe,Fastviewer*,fastviewer,TRUE,RMM,https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf,2/7/2024 -FastViewer,,fastmaster.exe,,,TRUE,RMM,https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf,2/7/2024 -FastViewer,,FastViewer.exe,,,TRUE,RMM,https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf,2/7/2024 -FixMe.it,*.fixme.it,FixMeit Unattended Access Setup.exe,FixMe*,techinline,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,*.techinline.net,TiExpertStandalone.exe,SetMe*,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,fixme.it,FixMeitClient*.exe,FixMe.IT Helper,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,*set.me,FixMeit Client.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,*setme.net,FixMeit Expert Setup.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,,TiExpertCore.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,,fixmeitclient.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,,TiClientCore.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,,TiClientHelper*.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FleetDesk.io,*.fleetdeck.io,fleetdeck_agent_svc.exe,FleetDeck*,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024 -FleetDesk.io,cognito-idp.us-west-2.amazonaws.com,fleetdeck_commander_svc.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024 -FleetDesk.io,fleetdeck.io,fleetdeck_installer.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024 -FleetDesk.io,,fleetdeck_agent.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024 -FleetDesk.io,,fleetdeck_commander_launcher.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024 -Fortra,,,,,TRUE,RMM,https://www.fortra.com - No free/cloud RMM softwars listed,2/7/2024 -GatherPlace-desktop sharing,*.gatherplace.com,gp3.exe,Gatherworks*,,TRUE,RMM,https://www.gatherplace.com/kb?id=136377,2/7/2024 -GatherPlace-desktop sharing,*.gatherplace.net,gp4.exe,,,TRUE,RMM,https://www.gatherplace.com/kb?id=136377,2/7/2024 -GatherPlace-desktop sharing,,gp5.exe,,,TRUE,RMM,https://www.gatherplace.com/kb?id=136377,2/7/2024 -GetScreen,*.getscreen.me,getscreen.exe,getscreen.me*,,TRUE,RMM,https://docs.getscreen.me/self-hosted/system-requirements/,2/7/2024 -GetScreen,getscreen.me,,Point B Ltd*,,TRUE,RMM,https://docs.getscreen.me/self-hosted/system-requirements/,2/7/2024 -GoToAssist,goto.com,gotoassist.exe,GoToAssist*,gotoassist,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,*.getgo.com,g2a*.exe,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,*.fastsupport.com,GoTo Assist Opener.exe,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,*.gotoassist.com,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,helpme.net,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,*.gotoassist.me,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,*.gotoassist.at,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,*.desktopstreaming.com,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -Mikogo,*.real-time-collaboration.com,mikogo.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024 -Mikogo,*.mikogo4.com,mikogo-starter.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024 -Mikogo,*.mikogo.com,mikogo-service.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024 -Mikogo,,mikogolauncher.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024 -Pandora RC (eHorus),portal.ehorus.com,ehorus standalone.exe,eHorus*,,TRUE,RMM,https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction,2/7/2024 -Pandora RC (eHorus),,ehorus_agent.exe,,,TRUE,RMM,https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction,2/7/2024 -Pandora RC (eHorus),,ehorus_launcher.exe,,,TRUE,RMM,https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction,2/7/2024 -Pandora RC (eHorus),,ehorus_display.exe,,,TRUE,RMM,https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction,2/7/2024 -ScreenConnect (ConnectWise),*.connectwise.com,Remote Workforce Client.exe,ConnectWise*,screenconnect,TRUE,RMM,https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,2/7/2024 -ScreenConnect (ConnectWise),*.screenconnect.com,screenconnect*.exe,ScreenConnect*,,TRUE,RMM,https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,2/7/2024 -ScreenConnect (ConnectWise),,ConnectWiseControl*.exe,CONTINUUM MANAGED*,,TRUE,RMM,https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,2/7/2024 -ScreenConnect (ConnectWise),,connectwise*.exe,,,TRUE,RMM,https://cybir.com/2022/cve/bypasssing-connectwise-and-endpoint-controls/,2/7/2024 -ScreenConnect (ConnectWise),,screenconnect.windowsclient.exe,,,TRUE,RMM,https://cybir.com/2022/cve/bypasssing-connectwise-and-endpoint-controls/,2/7/2024 -ScreenConnect (ConnectWise),,screenconnect.clientservice.exe,,,TRUE,RMM,https://cybir.com/2022/cve/bypasssing-connectwise-and-endpoint-controls/,2/7/2024 -ScreenMeet,*.screenmeet.com,ScreenMeetSupport.exe,ScreenMeet*,,TRUE,RMM,https://docs.screenmeet.com/docs/firewall-white-list,2/7/2024 -ScreenMeet,*.scrn.mt,ScreenMeet.Support.exe,,,TRUE,RMM,https://docs.screenmeet.com/docs/firewall-white-list,2/7/2024 -Seetrol,seetrol.co.kr,seetrolcenter.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024 -Seetrol,,seetrolclient.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024 -Seetrol,,seetrolmyservice.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024 -Seetrol,,seetrolremote.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024 -Seetrol,,seetrolsetting.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024 -SuperOps,superops.ai,superopsticket.exe,SuperOps*,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024 -SuperOps,*.superops.ai,superops.exe,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024 -SuperOps,serv.superopsalpha.com,,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024 -SuperOps,*.superopsalpha.com,,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024 -SuperOps,*.superopsbeta.com,,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024 -Visual Studio Dev Tunnel,global.rel.tunnels.api.visualstudio.com,,,,TRUE,Developer Utility,https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security,2/7/2024 -Visual Studio Dev Tunnel,*.rel.tunnels.api.visualstudio.com,,,,TRUE,Developer Utility,https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security,2/7/2024 -Visual Studio Dev Tunnel,*.devtunnels.ms,,,,TRUE,Developer Utility,https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security,2/7/2024 -Addigy,prod.addigy.com,addigy-*.pkg,Addigy*,,TRUE,RMM,https://addigy.com/,2/27/2024 -Addigy,grtmprod.addigy.com,,,,TRUE,RMM,https://addigy.com/,2/27/2024 -Addigy,agents.addigy.com,,,,TRUE,RMM,https://addigy.com/,2/27/2024 -Adobe Connect,*.adobeconnect.com,ConnectAppSetup*.exe,Adobe Connect,adobe-connect,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024 -Adobe Connect,,ConnectShellSetup*.exe,,adobe-meeting-remote-control,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024 -Adobe Connect,,Connect.exe,,adobe-connectnow,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024 -Adobe Connect,,ConnectDetector.exe,,adobe-connectnow-remote-control,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024 -Any Support,*.anysupport.net,ManualLauncher.exe,AnySupport*,anysupport,TRUE,RMM,https://www.anysupport.net/introduce_howto.php,2/27/2024 -Any Support,,,"Koino Co., Ltd.",,TRUE,RMM,https://www.anysupport.net/introduce_howto.php,2/27/2024 -Acronic Cyber Protect (Remotix),cloud.acronis.com,AcronisCyberProtectConnectQuickAssist*.exe,Acronis Cyber Protect Connect Quick Assist,remotix,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024 -Acronic Cyber Protect (Remotix),agents*-cloud.acronis.com,AcronisCyberProtectConnectAgent.exe,Acronis Cyber Protect Connect Agent,,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024 -Acronic Cyber Protect (Remotix),gw.remotix.com,,,,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024 -Acronic Cyber Protect (Remotix),connect.acronis.com,,,,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024 -BeInSync,*.beinsync.net,Beinsync*.exe,BeInSync,beinsync,TRUE,RMM,https://en.wikipedia.org/wiki/Phoenix_Technologies,2/26/2024 -BeInSync,*.beinsync.com,,BeInSync Client GUI,,TRUE,RMM,https://en.wikipedia.org/wiki/Phoenix_Technologies,2/26/2024 -DeskNets,,,,desknets,TRUE,RMM,https://www.desknets.com/en/download.html,2/26/2024 -DeskShare,user_managed,TeamTaskManager.exe,Team Task Manager*,deskshare,TRUE,RMM,https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx,2/26/2024 -DeskShare,,DSGuest.exe,DeskShare*,,TRUE,RMM,https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx,2/26/2024 -DesktopNow,*.nchuser.com,desktopnow.exe,DesktopNow*,,TRUE,RMM,https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US,2/26/2024 -DesktopNow,,,NCH Software*,,TRUE,RMM,https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US,2/26/2024 -Jump Cloud,*.api.jumpcloud.com,JumpCloud*.exe,JumpCloud*,,TRUE,RMM,https://jumpcloud.com/support/understand-remote-assist-agent,2/26/2024 -Jump Cloud,*.assist.jumpcloud.com,,,,TRUE,RMM,https://jumpcloud.com/support/understand-remote-assist-agent,2/26/2024 -KHelpDesk,*.khelpdesk.com.br,KHelpDesk.exe,KHELPDESK*,khelpdesk-remote-control,TRUE,RMM,https://www.khelpdesk.com.br/en-us,2/26/2024 -KHelpDesk,,,Ferramenta de Acesso Remoto,,TRUE,RMM,https://www.khelpdesk.com.br/en-us,2/26/2024 -MyGreenPC,*mygreenpc.com,mygreenpc.exe,,mygreenpc,TRUE,RMM,http://www.mygreenpc.com/,2/26/2024 -NTR Remote,*.ntrsupport.com,NTRsupportPro_EN.exe,Net Transmit & Receive SL,ntr-remote,TRUE,RMM,DOA as of 2024,2/26/2024 -OptiTune,*.optitune.us,OTService.exe,Bravura Software*,,TRUE,RMM,https://www.bravurasoftware.com/optitune/support/faq.aspx,2/26/2024 -OptiTune,*.opti-tune.com,OTPowerShell.exe,OptiTune*,,TRUE,RMM,https://www.bravurasoftware.com/optitune/support/faq.aspx,2/26/2024 -PDQ Connect,app.pdq.com,pdq-connect*.exe,PDQ.com*,,TRUE,RMM,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements,2/26/2024 -PDQ Connect,cfcdn.pdq.com,,PDQConnectAgent*,,TRUE,RMM,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements,2/26/2024 -SunLogin,sunlogin.oray.com,OrayRemoteShell.exe,Shanghai Best Oray*,sunlogin-remote-control,TRUE,RMM,https://sunlogin.oray.com/en/embed/software.html,2/26/2024 -SunLogin,client.oray.net,OrayRemoteService.exe,Remote control service,,TRUE,RMM,https://sunlogin.oray.com/en/embed/software.html,2/26/2024 -SunLogin,,sunlogin*.exe,,,TRUE,RMM,https://sunlogin.oray.com/en/embed/software.html,2/26/2024 -Synergy,user_managed,,,synergy,TRUE,RMM,https://symless.com/synergy,2/26/2024 -Syspectr,atled.syspectr.com,oo-syspectr*.exe,O&O Syspectr*,,TRUE,RMM,https://www.syspectr.com/en/installation-in-a-network,2/26/2024 -Syspectr,app.syspectr.com,OOSysAgent.exe,,,TRUE,RMM,https://www.syspectr.com/en/installation-in-a-network,2/26/2024 -TigerVNC,user_managed,tigervnc*.exe,TigerVNC*,,TRUE,RMM,https://github.com/TigerVNC/tigervnc/releases,2/26/2024 -TigerVNC,,winvnc4.exe,,,TRUE,RMM,https://github.com/TigerVNC/tigervnc/releases,2/26/2024 -Apple Remote Desktop,user_managed,ARDAgent.app,,apple-remote-desktop,TRUE,RMM,https://support.apple.com/guide/remote-desktop/install-and-set-up-remote-desktop-apdf49e03a4/mac,2/24/2024 -Rapid7,*.analytics.insight.rapid7.com,ir_agent.exe,Insight Agent*,,TRUE,RMM,https://docs.rapid7.com/insightvm/configure-communications-with-the-insight-platform/,2/14/2024 -Rapid7,*.endpoint.ingress.rapid7.com,rapid7_agent_core.exe,Rapid7 Insight Agent*,,TRUE,RMM,https://docs.rapid7.com/insightvm/configure-communications-with-the-insight-platform/,2/14/2024 -Rapid7,,rapid7_endpoint_broker.exe,,,TRUE,RMM,https://docs.rapid7.com/insightvm/configure-communications-with-the-insight-platform/,2/14/2024 -Tactical RMM,login.tailscale.com,tacticalrmm.exe,AmidaWare*,,TRUE,RMM,docs.tacticalrmm.com,2/14/2024 -Tactical RMM,login.tailscale.com,tacticalrmm.exe,Tactical Techs*,,TRUE,RMM,docs.tacticalrmm.com,2/14/2024 -Tailscale,*.tailscale.com,tailscale-*.exe,Tailscale*,,TRUE,Remote Access,https://tailscale.com/kb/1023/troubleshooting,2/14/2024 -Tailscale,*.tailscale.io,tailscaled.exe,,,TRUE,Remote Access,https://tailscale.com/kb/1023/troubleshooting,2/14/2024 -Tailscale,,tailscale-ipn.exe,,,TRUE,Remote Access,https://tailscale.com/kb/1023/troubleshooting,2/14/2024 -Tanium,cloud.tanium.com,TaniumClient.exe,Tanium*,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024 -Tanium,*.cloud.tanium.com,TaniumCX.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024 -Tanium,,TaniumExecWrapper.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024 -Tanium,,TaniumFileInfo.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024 -Tanium,,TPowerShell.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024 -TeamViewer,*.teamviewer.com,teamviewer*.exe,TeamViewer*,teamviewer,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024 -TeamViewer,,teamviewerqs.exe,,teamviewer-remote-control,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024 -TeamViewer,,tv_w32.exe,,teamviewer-sharing,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024 -TeamViewer,,tv_w64.exe,,teamviewer-base,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024 -TeamViewer,,teamviewer.exe,,teamviewer-web,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024 -TeleDesktop,user_managed,pstlaunch.exe,,,TRUE,RMM,http://potomacsoft.com/ - DOA as of 2024,2/14/2024 -TeleDesktop,,ptdskclient.exe,,,TRUE,RMM,http://potomacsoft.com/ - DOA as of 2024,2/14/2024 -TeleDesktop,,ptdskhost.exe,,,TRUE,RMM,http://potomacsoft.com/ - DOA as of 2024,2/14/2024 -TightVNC,user_managed,tvnviewer.exe,TightVNC*,,TRUE,RMM,https://www.tightvnc.com/doc/win/TightVNC_for_Windows-Installation_and_Getting_Started.pdf,2/14/2024 -TightVNC,,TightVNCViewerPortable*.exe,,,TRUE,RMM,https://www.tightvnc.com/doc/win/TightVNC_for_Windows-Installation_and_Getting_Started.pdf,2/14/2024 -TightVNC,,tvnserver.exe,,,TRUE,RMM,https://www.tightvnc.com/doc/win/TightVNC_for_Windows-Installation_and_Getting_Started.pdf,2/14/2024 -ToDesk,todesk.com,todesk.exe,ToDesk*,,TRUE,RMM,https://www.todesk.com/,2/14/2024 -ToDesk,*.todesk.com,ToDesk_Service.exe,,,TRUE,RMM,https://www.todesk.com/,2/14/2024 -ToDesk,*.todesk.com,ToDesk_Setup.exe,,,TRUE,RMM,https://www.todesk.com/,2/14/2024 -TurboMeeting,user_managed,pcstarter.exe,,,TRUE,RMM,http://sourcing.rhubcom.com/v5/faqs.html#collapsetwentysix2-topdiv,2/14/2024 -TurboMeeting,,turbomeeting.exe,,,TRUE,RMM,http://sourcing.rhubcom.com/v5/faqs.html#collapsetwentysix2-topdiv,2/14/2024 -TurboMeeting,,turbomeetingstarter.exe,,,TRUE,RMM,http://sourcing.rhubcom.com/v5/faqs.html#collapsetwentysix2-topdiv,2/14/2024 -UltraViewer,* .ultraviewer.net,UltraViewer_Service.exe,UltraViewer*,ultraviewer,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024 -UltraViewer,,UltraViewer_setup*,DucFabulous*,,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024 -UltraViewer,,UltraViewer_Desktop.exe,,,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024 -UltraViewer,,ultraviewer.exe,,,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024 -UltraVNC,user_managed,UltraVNC*.exe,,,TRUE,Remote Access,https://uvnc.com/docs/uvnc-server/49-UltraVNC-server-configuration.html,2/14/2024 -VNC,user_managed,vncserver.exe,realvnc*,vnc,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -VNC,,winvnc*.exe,,vnc-clipboard,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -VNC,,vncviewer.exe,,vnc-print,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -VNC,,vncserverui.exe,,vnc-encrypted,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -VNC,,winwvc.exe,,vnc-filetransfer,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -VNC,,winvncsc.exe,,vnc-base,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -VNC,,,,vnc-http,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -WebEx (Remote Access),,,,,TRUE,Remote Access,https://help.webex.com/en-us/article/nyc3q0b/Set-Up-a-Computer-for-Remote-Access,2/14/2024 -WebRDP,user_managed,webrdp.exe,,,TRUE,RMM,github.com/Mikej81/WebRDP,2/14/2024 -Weezo,*.weezo.me,weezohttpd.exe,Peer 2 World,,TRUE,RMM,weezo.en.softonic.com,2/14/2024 -Weezo,weezo.net,weezo.exe,Weezo*,,TRUE,RMM,weezo.en.softonic.com,2/14/2024 -Weezo,*.weezo.net,weezo setup*.exe,,,TRUE,RMM,weezo.en.softonic.com,2/14/2024 -Xeox,xeox.com,xeox-agent_*.exe,,,TRUE,RMM,https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW,2/14/2024 -Xeox,*.xeox.com,xeox_service_windows.exe,,,TRUE,RMM,https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW,2/14/2024 -Zabbix Agent,user_managed,zabbix_agent*.exe,Zabbix*,,TRUE,RMM,https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent,2/14/2024 -ZeroTier,zerotier.com,zerotier*.msi,ZeroTier*,,TRUE,RMM,https://my.zerotier.com/,2/14/2024 -ZeroTier,*.zerotier.com,zerotier*.exe,zero-powesrhell*,,TRUE,RMM,https://my.zerotier.com/,2/14/2024 -ZeroTier,,zero-powershell.exe,,,TRUE,RMM,https://my.zerotier.com/,2/14/2024 -Zoho Assist,*.zoho.com,za_connect.exe,Zoho*,zoho-assist,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zoho.eu,zaservice.exe,,zoho-assist-base,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zoho.in,zohotray.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zoho.com.au,ZohoMeeting.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zoho.com.cn,Zohours.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zohoassist.com,ZohoURSService.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zohoassist.jp,ZMAgent.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zohoassist.com.cn,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,downloads.zohodl.com.cn,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,downloads.zohocdn.com,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,gateway.zohoassist.com,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Site24x7,plus*.site24x7.com,MEAgentHelper.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024 -Site24x7,plus*.site24x7.eu,MonitoringAgent.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024 -Site24x7,plus*.site24x7.in,Site24x7WindowsAgentTrayIcon.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024 -Site24x7,plus*.site24x7.cn,Site24x7PluginAgent.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024 -Site24x7,plus*.site24x7.net.au,,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024 -Supremo,supremocontrol.com,supremo.exe,SupRemo*,supremo,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Supremo,*.supremocontrol.com,supremohelper.exe,NanoSystems*,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Supremo,*.nanosystems.it,supremoservice.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Supremo,,supremosystem.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Supremo,,supremohelper.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Supremo,,supremo.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Supremo,,supremosystem.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Syncro,app.kabuto.io,Kabuto.App.Runner.exe,Servably*,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,*.syncromsp.com,Kabuto.Service.Runner.exe,Syncro*,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,*.syncroapi.com,Kabuto.Installer.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,*.kabutoservices.com,KabutoSetup.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,ld.aurelius.host,Syncro.Overmind.Service.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,attachments.servably.com,SyncroLive.Service.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,,SyncroLive.Agent.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,,Syncro.App.Runner.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,,Syncro.Installer.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,,Syncro.Service.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Devolutions Remote Desktop Manager,*cloud.devolutions.net,RemoteDesktopManager*.exe,Devolutions inc,,TRUE,RMM,https://docs.devolutions.net/server/kb/knowledge-base/internet-endpoints-server/,2/10/2025 -Devolutions Remote Desktop Manager,*api.devolutions.com,Devolutions.Updater.exe,Remote Desktop Manager,,TRUE,RMM,https://docs.devolutions.net/server/kb/knowledge-base/internet-endpoints-server/,2/10/2025 -Devolutions Remote Desktop Manager,*telemetry2.devolutions.net,,,,TRUE,RMM,https://docs.devolutions.net/server/kb/knowledge-base/internet-endpoints-server/,2/10/2025 -Koofr,*app.koofr.net,storagegui.exe,koofr*,,TRUE,FileSync,https://app.koofr.net/dl/apps/win,2/10/2025 -Koofr,,storagechrome.exe,,,TRUE,FileSync,https://app.koofr.net/dl/apps/win,2/10/2025 -MEGA Sync,*mega.co.nz,MEGAsyncSetup*.exe,MEGA Limited,mega-base,TRUE,FileSync,https://help.mega.io/security/data-protection/official-domains,2/10/2025 -MEGA Sync,*api.mega.co.nz,Megasync.exe,MEGAsync,mega-chat,TRUE,FileSync,https://help.mega.io/security/data-protection/official-domains,2/10/2025 -MEGA Sync,*mega.nz,MegaUpdater.exe,,,TRUE,FileSync,https://help.mega.io/security/data-protection/official-domains,2/10/2025 -NordLocker,*cloud.nordlocker.com,nordlockersetup*.exe,nordvpn*,,TRUE,FileSync,https://support.nordlocker.com/hc/en-us/articles/360015151597-Guide-for-NordLocker-Windows,2/10/2025 -NordLocker,*.nordcdn.com,NordLocker.exe,NordLocker,,TRUE,FileSync,https://support.nordlocker.com/hc/en-us/articles/360015151597-Guide-for-NordLocker-Windows,2/10/2025 -NordLocker,*auth.nordlocker.com,NordUpdateService.exe,NordSec Update Service,,TRUE,FileSync,https://support.nordlocker.com/hc/en-us/articles/360015151597-Guide-for-NordLocker-Windows,2/10/2025 -Total Software Deployment,*.softinventive.com,tsd-setup.exe,SoftInventive Lab,,TRUE,RMM,https://docs.softinventive.com/tsd/faq/,2/10/2025 -Total Software Deployment,,tsd.exe,Total Software Deployment,,TRUE,RMM,https://docs.softinventive.com/tsd/faq/,2/10/2025 -Yandex Disk,*disk.yandex.run,YandexDisk*Setup.exe,Yandex LLC,,TRUE,FileSync,https://yandex.com/support/search-results/?service=yandex-360,2/10/2025 -Yandex Disk,*cloud-api.yandex.net,YandexDisk2.exe,Yandex.Disk,,TRUE,FileSync,https://yandex.com/support/search-results/?service=yandex-360,2/10/2025 -Yandex Disk,*yastatic.net,YandexNotes.exe,Yandex,,TRUE,FileSync,https://yandex.com/support/search-results/?service=yandex-360,2/10/2025 -Yandex Disk,passport.yandex.com,,,,TRUE,FileSync,https://yandex.com/support/search-results/?service=yandex-360,2/10/2025 -Glance,screenshare-location.glance.net,GlanceSetup*.exe,GlanceClient*,,TRUE,RMM,https://help.glance.cx/security/security_qa/,11/20/2024 -Glance,s*.glance.net,GlanceGuestSetup*.exe,GlanceLauncher*,,TRUE,RMM,https://help.glance.cx/security/security_qa/,11/20/2024 -Glance,pr*.glance.net,Glance.exe,Glance Setup*,,TRUE,RMM,https://help.glance.cx/security/security_qa/,11/20/2024 -Glance,,GlanceLauncher.exe,Glance Launcher*,,TRUE,RMM,https://help.glance.cx/security/security_qa/,11/20/2024 -Glance,,GProtocolHandler.exe,Glance Networks*,,TRUE,RMM,https://help.glance.cx/security/security_qa/,11/20/2024 -Microsoft SCCM Remote Control,user_managed,sccmrdpsystem.exe,SCCM RDP System,,TRUE,RMM,https://learn.microsoft.com/en-us/mem/configmgr/core/clients/manage/remote-control/introduction-to-remote-control,1/29/2025 -Microsoft SCCM Remote Control,,sccmrdpuser.exe,Microsoft Configuration Manager Remote Control,,TRUE,RMM,https://learn.microsoft.com/en-us/mem/configmgr/core/clients/manage/remote-control/introduction-to-remote-control,1/29/2025 -Microsoft SCCM Remote Control,,cmrcservice.exe,Configuration Manager Remote Control Service,,TRUE,RMM,https://learn.microsoft.com/en-us/mem/configmgr/core/clients/manage/remote-control/introduction-to-remote-control,1/29/2025 -Microsoft SCCM Remote Control,,cmrcviewer.exe,ConfigMgr Remote Control Viewer,,TRUE,RMM,https://learn.microsoft.com/en-us/mem/configmgr/core/clients/manage/remote-control/introduction-to-remote-control,1/29/2025 -NexThink,*.data.us.nexthink.cloud,nxtsvc.exe,Nexthink Collector*,,TRUE,RMM,https://docs.nexthink.com/platform/getting-started/planning-your-installation/techical-requirements/connectivity-requirements,1/24/2025 -NexThink,*.data.eu.nexthink.cloud,nxtcod.exe,Nexthink Coordinator*,,TRUE,RMM,https://docs.nexthink.com/platform/getting-started/planning-your-installation/techical-requirements/connectivity-requirements,1/24/2025 -NexThink,*.data.pac.nexthink.cloud,nxtcoordinator.exe,,,TRUE,RMM,https://docs.nexthink.com/platform/getting-started/planning-your-installation/techical-requirements/connectivity-requirements,1/24/2025 -NexThink,*.data.meta.nexthink.cloud,nxtupdater.exe,,,TRUE,RMM,https://docs.nexthink.com/platform/getting-started/planning-your-installation/techical-requirements/connectivity-requirements,1/24/2025 +app,"match_pattern",domain,"file_path","file_name","file_info",category,reference,description +"247ithelp.com (ConnectWise)","247ithelp.com*",,,,,RMM,"","247ithelp.com (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"247ithelp.com (ConnectWise)","ConnectWise*",,,,,RMM,"","247ithelp.com (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"247ithelp.com (ConnectWise)",,"*.247ithelp.com",,,,RMM,"","247ithelp.com (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"247ithelp.com (ConnectWise)",,,,"Remote Workforce Client.exe",,RMM,"","247ithelp.com (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)","Absolute*",,,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)","Computrace*",,,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,"*.search.namequery.com",,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,"*.server.absolute.com",,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,"search.namequery.com",,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,"server.absolute.com",,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,"ctes.exe",,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,"cteshostsvc.exe",,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,"ctespersistence.exe",,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,"rpcld.exe",,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,"rpcnet.exe",,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,,"Absolute Persistence*",RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,,"CTES*",RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,,"Absolute Software*",RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Access Remote PC","Access Remote PC*",,,,,RMM,"","Access Remote PC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Access Remote PC","AccessRemotePC*",,,,,RMM,"","Access Remote PC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Access Remote PC",,,"C:\Program Files (x86)\RemotePC\*",,,RMM,"","Access Remote PC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)","Acronis Cyber Protect*",,,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)","AcronisCyberProtect*",,,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)","Remotix*",,,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,"agents*-cloud.acronis.com",,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,"cloud.acronis.com",,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,"connect.acronis.com",,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,"gw.remotix.com",,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,,,"AcronisCyberProtectConnectAgent.exe",,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,,,"AcronisCyberProtectConnectQuickAssist*.exe",,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,,,,"Acronis Cyber Protect Connect Agent",RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,,,,"Acronis Cyber Protect Connect Quick Assist",RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Action1,"Action1*",,,,,RMM,"https://www.action1.com/documentation/firewall-configuration/,https://www.action1.com/documentation/,https://twitter.com/Kostastsale/status/1646256901506605063?s=20,https://ruler-project.github.io/ruler-project/RULER/remote/Action1/","Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed." +Action1,,"*.action1.com",,,,RMM,"https://www.action1.com/documentation/firewall-configuration/,https://www.action1.com/documentation/,https://twitter.com/Kostastsale/status/1646256901506605063?s=20,https://ruler-project.github.io/ruler-project/RULER/remote/Action1/","Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed." +Action1,,"a1-backend-packages.s3.amazonaws.com",,,,RMM,"https://www.action1.com/documentation/firewall-configuration/,https://www.action1.com/documentation/,https://twitter.com/Kostastsale/status/1646256901506605063?s=20,https://ruler-project.github.io/ruler-project/RULER/remote/Action1/","Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed." +Action1,,,"C:\Windows\Action1\*",,,RMM,"https://www.action1.com/documentation/firewall-configuration/,https://www.action1.com/documentation/,https://twitter.com/Kostastsale/status/1646256901506605063?s=20,https://ruler-project.github.io/ruler-project/RULER/remote/Action1/","Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed." +Action1,,,,,"Action1*",RMM,"https://www.action1.com/documentation/firewall-configuration/,https://www.action1.com/documentation/,https://twitter.com/Kostastsale/status/1646256901506605063?s=20,https://ruler-project.github.io/ruler-project/RULER/remote/Action1/","Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed." +Addigy,"Addigy*",,,,,RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Addigy,,"agents.addigy.com",,,,RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Addigy,,"grtmprod.addigy.com",,,,RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Addigy,,"prod.addigy.com",,,,RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Addigy,,,,"addigy-*.pkg",,RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Addigy,,,,,"Addigy*",RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,"AeroAdmin*",,,,,RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,,"aeroadmin.com",,,,RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,,"auth*.aeroadmin.com",,,,RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,,,,"AeroAdmin.exe",,RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,,,,"aeroadmin.exe",,RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,,,,,"Aero Admin*",RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,,,,,"AeroAdmin*",RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"AliWangWang-remote-control","AliWangWang-remote-control*",,,,,RMM,"https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale","AliWangWang-remote-control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"AliWangWang-remote-control",,"wangwang.taobao.com",,,,RMM,"https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale","AliWangWang-remote-control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"AliWangWang-remote-control",,,,"alitask.exe",,RMM,"https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale","AliWangWang-remote-control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"AliWangWang-remote-control",,,,,"AliWangWang*",RMM,"https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale","AliWangWang-remote-control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Allocentra,"Allocentra*",,,,,RMM,"https://allocentra.co.za/,https://docs.allocentra.co.za/agent-installation,https://docs.allocentra.co.za/remote-control,https://docs.allocentra.co.za/scripts,https://docs.allocentra.co.za/patches","Allocentra is an endpoint remote monitoring and management (RMM) and PSA platform. Vendor documentation describes agents for Windows, Linux, and macOS that provide endpoint telemetry, patch management, remote commands, scripts, and MeshCentral-backed remote-control sessions." +Allocentra,,"api.allocentra.co.za",,,,RMM,"https://allocentra.co.za/,https://docs.allocentra.co.za/agent-installation,https://docs.allocentra.co.za/remote-control,https://docs.allocentra.co.za/scripts,https://docs.allocentra.co.za/patches","Allocentra is an endpoint remote monitoring and management (RMM) and PSA platform. Vendor documentation describes agents for Windows, Linux, and macOS that provide endpoint telemetry, patch management, remote commands, scripts, and MeshCentral-backed remote-control sessions." +Allocentra,,,"C:\Program Files\Allocentra\Agent\allocentra-agent.exe",,,RMM,"https://allocentra.co.za/,https://docs.allocentra.co.za/agent-installation,https://docs.allocentra.co.za/remote-control,https://docs.allocentra.co.za/scripts,https://docs.allocentra.co.za/patches","Allocentra is an endpoint remote monitoring and management (RMM) and PSA platform. Vendor documentation describes agents for Windows, Linux, and macOS that provide endpoint telemetry, patch management, remote commands, scripts, and MeshCentral-backed remote-control sessions." +Allocentra,,,,"allocentra-agent.exe",,RMM,"https://allocentra.co.za/,https://docs.allocentra.co.za/agent-installation,https://docs.allocentra.co.za/remote-control,https://docs.allocentra.co.za/scripts,https://docs.allocentra.co.za/patches","Allocentra is an endpoint remote monitoring and management (RMM) and PSA platform. Vendor documentation describes agents for Windows, Linux, and macOS that provide endpoint telemetry, patch management, remote commands, scripts, and MeshCentral-backed remote-control sessions." +Alpemix,"Alpemix*",,,,,RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Alpemix,,"*.alpemix.com",,,,RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Alpemix,,"*.teknopars.com",,,,RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Alpemix,,,"C:\AlpemixService.exe",,,RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Alpemix,,,"C:\AlpemixSrvc\",,,RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Alpemix,,,,,"Teknopars*",RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Alpemix,,,,,"Alpemix*",RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support","Any Support*",,,,,RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support","AnySupport*",,,,,RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support",,"*.anysupport.net",,,,RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support",,,,"ManualLauncher.exe",,RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support",,,,,"Koino Co.",RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support",,,,,"Ltd.",RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support",,,,,"AnySupport*",RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AnyDesk,"AnyDesk*",,,,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,"*.net.anydesk.com",,,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,"boot.net.anydesk.com",,,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,"relay-*.net.anydesk.com",,,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"/Applications/AnyDesk.app",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"C:\Program Files (x86)\AnyDesk-*\*",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"C:\Program Files (x86)\AnyDesk-*\AnyDesk-*.exe",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"C:\Program Files (x86)\AnyDesk\*",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"C:\Program Files (x86)\AnyDesk\AnyDesk.exe",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"C:\Program Files\AnyDesk-*\AnyDesk-*.exe",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"C:\Program Files\AnyDesk\*",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,,,"philandro Software*",RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,,,"anydesk*",RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyViewer,"AnyViewer*",,,,,RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AnyViewer,,"*.anyviewer.com",,,,RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AnyViewer,,"*.aomeisoftware.com",,,,RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AnyViewer,,,"C:\Program Files (x86)\AnyViewer\*",,,RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AnyViewer,,,,,"Anyviewer*",RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AnyViewer,,,,,"AOMEI*",RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Anyplace Control","Anyplace Control*",,,,,RMM,"http://www.anyplace-control.com/anyplace-control/help/faq.htm","Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Anyplace Control","AnyplaceControl*",,,,,RMM,"http://www.anyplace-control.com/anyplace-control/help/faq.htm","Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Anyplace Control",,"anyplace-control.com",,,,RMM,"http://www.anyplace-control.com/anyplace-control/help/faq.htm","Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Anyplace Control",,,,"apc_host.exe",,RMM,"http://www.anyplace-control.com/anyplace-control/help/faq.htm","Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Anyplace Control",,,,,"Anyplace*",RMM,"http://www.anyplace-control.com/anyplace-control/help/faq.htm","Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Aspia,"Aspia*",,,,,RMM,"https://ics-cert.kaspersky.com/publications/reports/2025/06/05/ttps-of-cyber-partisans-activity-aimed-at-espionage-and-disruption/,https://www.aspia.org/,https://github.com/dchapyshev/aspia","Aspia is an open-source Remote Desktop, file transfer and system information tool." +Aspia,,,"*\aspia_client.exe",,,RMM,"https://ics-cert.kaspersky.com/publications/reports/2025/06/05/ttps-of-cyber-partisans-activity-aimed-at-espionage-and-disruption/,https://www.aspia.org/,https://github.com/dchapyshev/aspia","Aspia is an open-source Remote Desktop, file transfer and system information tool." +Aspia,,,"C:\Program Files (x86)\Aspia\",,,RMM,"https://ics-cert.kaspersky.com/publications/reports/2025/06/05/ttps-of-cyber-partisans-activity-aimed-at-espionage-and-disruption/,https://www.aspia.org/,https://github.com/dchapyshev/aspia","Aspia is an open-source Remote Desktop, file transfer and system information tool." +Aspia,,,"C:\Program Files\Aspia\",,,RMM,"https://ics-cert.kaspersky.com/publications/reports/2025/06/05/ttps-of-cyber-partisans-activity-aimed-at-espionage-and-disruption/,https://www.aspia.org/,https://github.com/dchapyshev/aspia","Aspia is an open-source Remote Desktop, file transfer and system information tool." +Atera,"Atera*",,,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"agent-api.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"agenthb.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"agentreporting.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"agentreportingstore.blob.core.windows.net",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"app.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"appcdn.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"atera-agent-heartbeat.servicebus.windows.net",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"atera.pubnubapi.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"getalphacontrol.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"packagesstore.blob.core.windows.net",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"ps.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"pubsub.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"*\ATERA Networks\AteraAgent\*",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"*\AgentPackageNetworkDiscovery.exe",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"*\AgentPackageTaskScheduler.exe",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"*\AteraAgent.exe",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"C:\Program Files (x86)\Atera Networks",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"C:\Program Files\ATERA Networks\AteraAgent\*",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"C:\Program Files\Atera Networks",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,,"atera_agent.exe",,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,,"ateraagent.exe",,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,,"syncrosetup.exe",,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,,,AteraAgent,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,,,"Atera Networks",RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Auvik,"Auvik*",,,,,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Auvik,,"*.auvik.com",,,,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Auvik,,"*.my.auvik.com",,,,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Auvik,,"auvik.com",,,,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Auvik,,,,"auvik.agent.exe",,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Auvik,,,,"auvik.engine.exe",,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,"AweRay*",,,,,RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,,"asapi*.aweray.net",,,,RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,,"client-api.aweray.com",,,,RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,,,,"AweSun.exe",,RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,,,,"aweray_remote*.exe",,RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,,,,,"AweSun*",RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,,,,,"AweRay*",RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,"Barracuda*",,,,,RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,,"*.islonline.net",,,,RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,,"barracudamsp.com",,,,RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,,"rmm.barracudamsp.com",,,,RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,,,,,"Barracuda Networks",RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,,,,,"LPI Level Platforms",RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,,,,,"Barracuda MSP",RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Basecamp,"Basecamp*",,,,,RAT,"","Basecamp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Basecamp,,"basecamp.com",,,,RAT,"","Basecamp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Basic RMM Agent","Basic RMM Agent*",,,,,RMM,"","Basic RMM Agent is an unattributed Windows remote monitoring and management agent. Static analysis shows endpoint inventory, patch management, remote interactive desktop control, shell access, file transfer, and endpoint administration functions. The same binary also includes keylogging, vault scanning, webcam and audio functions, and hidden virtual desktop support. No independent vendor, official distribution source, or publisher signature was established; use the product identity, hash, and behavior rather than the generic agent.exe filename for triage." +"Basic RMM Agent","BasicRMMAgent*",,,,,RMM,"","Basic RMM Agent is an unattributed Windows remote monitoring and management agent. Static analysis shows endpoint inventory, patch management, remote interactive desktop control, shell access, file transfer, and endpoint administration functions. The same binary also includes keylogging, vault scanning, webcam and audio functions, and hidden virtual desktop support. No independent vendor, official distribution source, or publisher signature was established; use the product identity, hash, and behavior rather than the generic agent.exe filename for triage." +BeAnyWhere,"BeAnyWhere*",,,,,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,"beanywhere.com",,,,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"BASupApp.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"BASupAppElev.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"BASupAppSrvc.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"BASupSysInf.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"TakeControl.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"basupsrvc.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"basupsrvcupdate.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"basuptshelper.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeInSync,"BeInSync*",,,,,RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeInSync,,"*.beinsync.com",,,,RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeInSync,,"*.beinsync.net",,,,RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeInSync,,,,"Beinsync*.exe",,RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeInSync,,,,,"BeInSync Client GUI",RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeInSync,,,,,BeInSync,RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Beacon (Synertek)","Beacon*",,,,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)","Synertek*",,,,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/Library/Application Support/Beacon/agent.log",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/Library/Application Support/Beacon/credential.json",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/Library/LaunchDaemons/com.beacon.agent.plist",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/etc/beacon/agent.log",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/etc/beacon/credential.json",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/etc/systemd/system/beacon-agent.service",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/usr/local/bin/beacon-agent",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/var/log/beacon-agent.log",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"C:\Program Files\Beacon\beacon-agent.exe",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"C:\ProgramData\Beacon\agent.log",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"C:\ProgramData\Beacon\credential.json",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +BeamYourScreen,"BeamYourScreen*",,,,,RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeamYourScreen,,"*.beamyourscreen.com",,,,RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeamYourScreen,,"beamyourscreen.com",,,,RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeamYourScreen,,,,"beamyourscreen-host.exe",,RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeamYourScreen,,,,"beamyourscreen.exe",,RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeamYourScreen,,,,,"BeamYourScreen*",RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeyondTrust,"BeyondTrust*",,,,,RMM,"","BeyondTrust is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)","BeyondTrust*",,,,,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)","Bomgar*",,,,,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,"*.beyondtrustcloud.com",,,,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,"*.bomgarcloud.com",,,,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,"bomgarcloud.com",,,,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,"bomgar-pac-*.exe",,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,"bomgar-pac.exe",,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,"bomgar-rdp.exe",,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,"bomgar-scc-*.exe",,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,"bomgar-scc.exe",,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,,"Bomgar*",RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,,"BeyondTrust*",RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BlackCrypt RMM Agent","BlackCrypt RMM Agent*",,,,,RMM,"","BlackCrypt RMM Agent is a custom Windows endpoint-management agent whose compiled code implements registration, heartbeats, WebSocket job dispatch, interactive terminal sessions, remote command and script execution, inventory collection, and endpoint-management actions. The inspected sample self-identifies as a BlackCrypt Labs Inc product, but no independently verifiable publisher or product source was identified. Its signing certificate subject is C&P Global Investors LLC and local certificate validation reported that certificate as revoked. This entry documents the agent's confirmed functionality and observed host/network artifacts; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"BlackCrypt RMM Agent","BlackCryptRMMAgent*",,,,,RMM,"","BlackCrypt RMM Agent is a custom Windows endpoint-management agent whose compiled code implements registration, heartbeats, WebSocket job dispatch, interactive terminal sessions, remote command and script execution, inventory collection, and endpoint-management actions. The inspected sample self-identifies as a BlackCrypt Labs Inc product, but no independently verifiable publisher or product source was identified. Its signing certificate subject is C&P Global Investors LLC and local certificate validation reported that certificate as revoked. This entry documents the agent's confirmed functionality and observed host/network artifacts; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"BlackCrypt RMM Agent",,"blackcryptknight.com",,,,RMM,"","BlackCrypt RMM Agent is a custom Windows endpoint-management agent whose compiled code implements registration, heartbeats, WebSocket job dispatch, interactive terminal sessions, remote command and script execution, inventory collection, and endpoint-management actions. The inspected sample self-identifies as a BlackCrypt Labs Inc product, but no independently verifiable publisher or product source was identified. Its signing certificate subject is C&P Global Investors LLC and local certificate validation reported that certificate as revoked. This entry documents the agent's confirmed functionality and observed host/network artifacts; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +Borealis,"Borealis*",,,,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"/etc/systemd/system/borealis-agent-updater.service",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"/etc/systemd/system/borealis-agent-watchdog.service",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"/etc/systemd/system/borealis-agent.service",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"/opt/Borealis/Agent/Agent",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"/opt/Borealis/Agent/Logs/Agent/agent.log",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"/opt/Borealis/Agent/agent.json",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"C:\Borealis\*",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"C:\Borealis\Logs\Agent\agent.log",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"C:\Borealis\agent.json",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +BreezeRMM,"BreezeRMM*",,,,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,"breeze.app",,,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,"breezermm.com",,,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,"eu.2breeze.app",,,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,"us.2breeze.app",,,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/Library/Application Support/Breeze/*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/Library/LaunchAgents/com.breeze.desktop-helper-loginwindow.plist",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/Library/LaunchAgents/com.breeze.desktop-helper-user.plist",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/Library/LaunchDaemons/com.breeze.agent.plist",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/Library/LaunchDaemons/com.breeze.watchdog.plist",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/Library/Logs/Breeze/*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/etc/breeze/*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/etc/systemd/system/breeze-agent.service",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/usr/local/bin/breeze-agent",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/usr/local/bin/breeze-backup",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/usr/local/bin/breeze-desktop-helper",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/usr/local/bin/breeze-watchdog",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/var/lib/breeze/*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/var/log/breeze/*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"C:\Program Files\Breeze\*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"C:\ProgramData\Breeze\*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,,"PixoIT-agent.exe",,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +"CHAOS RAT","CHAOS RAT*",,,,,RAT,"https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/README.md,https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/services/client/client_service.go,https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/client/app/infrastructure/websocket/client.go,https://www.acronis.com/en/tru/posts/from-open-source-to-open-threat-tracking-chaos-rats-evolution/","CHAOS RAT is an open-source Go remote-access framework with a self-hosted controller that creates configured Windows and Linux clients. Its client connects to an operator-selected controller for remote command handling. Acronis has documented malicious CHAOS RAT Linux samples; the upstream project itself is dual-use." +"CHAOS RAT","CHAOSRAT*",,,,,RAT,"https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/README.md,https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/services/client/client_service.go,https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/client/app/infrastructure/websocket/client.go,https://www.acronis.com/en/tru/posts/from-open-source-to-open-threat-tracking-chaos-rats-evolution/","CHAOS RAT is an open-source Go remote-access framework with a self-hosted controller that creates configured Windows and Linux clients. Its client connects to an operator-selected controller for remote command handling. Acronis has documented malicious CHAOS RAT Linux samples; the upstream project itself is dual-use." +"CentraStage (Datto)","CentraStage*",,,,,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)","Datto*",,,,,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)",,"*.cc.centrastage.net",,,,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)",,"*.rmm.datto.com",,,,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)",,"cc.centrastage.net",,,,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)",,,,"AEMAgent.exe",,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)",,,,"CagService.exe",,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)",,,,,"Datto*",RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Centurion,"Centurion*",,,,,RMM,"https://data443.atlassian.net/servicedesk/customer/portal/20","Centurion is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Centurion,,"centuriontech.com",,,,RMM,"https://data443.atlassian.net/servicedesk/customer/portal/20","Centurion is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Centurion,,,,"ctiserv.exe",,RMM,"https://data443.atlassian.net/servicedesk/customer/portal/20","Centurion is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Chicken (of the VNC)","Chicken*",,,,,RAT,"https://github.com/flit/cotvnc","Chicken (of the VNC) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Chrome Remote Desktop","Chrome Remote Desktop*",,,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop","ChromeRemoteDesktop*",,,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"*.remotedesktop-pa.googleapis.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"*.remotedesktop.google.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"chromoting-client.talkgadget.google.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"chromoting-host.talkgadget.google.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"chromoting-oauth.talkgadget.google.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"remotedesktop-pa.googleapis.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"remotedesktop.google.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"*\Google\Chrome Remote Desktop\*",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"*\remoting_host.exe",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"/Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/remoting_me2me_host",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"/Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/remoting_me2me_host_service",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"/opt/google/chrome-remote-desktop/chrome-remote-desktop",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"/opt/google/chrome-remote-desktop/chrome-remote-desktop-host",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"C:\Program Files (x86)\Google\Chrome Remote Desktop\*",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,,"remoting_host.exe",,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,,,"Chrome Remote Desktop",RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome SSH Extension","Chrome SSH Extension*",,,,,RAT,"","Chrome SSH Extension is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Chrome SSH Extension","ChromeSSHExtension*",,,,,RAT,"","Chrome SSH Extension is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Chrome SSH Extension",,,"*Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\iodihamcpbpeioajjeobimgagajmlibd*",,,RAT,"","Chrome SSH Extension is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Chrome SSH Extension",,,"C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\iodihamcpbpeioajjeobimgagajmlibd*",,,RAT,"","Chrome SSH Extension is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CloudFlare Tunnel","CloudFlare Tunnel*",,,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel","CloudFlareTunnel*",,,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"*.cfargotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"*.trycloudflare.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"_v2-origintunneld._tcp.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"api.cloudflare.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"cftunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"h2.cftunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"quic.cftunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"region1.v2.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"region2.v2.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"update.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"us-region1.v2.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"us-region2.v2.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,,"C:\Program Files (x86)\cloudflared\cloudflared.exe",,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,,"C:\Program Files\cloudflared\cloudflared.exe",,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,,,"cloudflared.exe",,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"Comodo RMM","Comodo RMM*",,,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM","ComodoRMM*",,,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM",,"*.itsm-us1.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM",,"*.mdmsupport.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM",,"mdmsupport.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM",,"one.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM",,,,"itsmagent.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM",,,,"rviewer.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ConnectWise,"ConnectWise*",,,,,RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ConnectWise,,,"*\ScreenConnect*Client*\*",,,RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ConnectWise,,,"C:\Program Files (x86)\ScreenConnect Client ()\*",,,RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ConnectWise,,,,,"CONTINUUM MANAGED*",RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ConnectWise,,,,,"ScreenConnect*",RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ConnectWise,,,,,"ConnectWise*",RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control","ConnectWise Control*",,,,,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control","ConnectWiseControl*",,,,,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,"control.connectwise.com",,,,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,"live.screenconnect.com",,,,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,,,"connectwisechat-customer.exe",,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,,,"connectwisecontrol.client.exe",,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,,,"screenconnect.windowsclient.exe",,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,,,,"CONTINUUM MANAGED*",RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,,,,"ScreenConnect*",RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,,,,"ConnectWise*",RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)","Connectwise Automate*",,,,,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)","ConnectwiseAutomate*",,,,,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)","LabTech*",,,,,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)",,"*.hostedrmm.com",,,,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)",,,,"ltsvc.exe",,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)",,,,"ltsvcmon.exe",,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)",,,,"lttray.exe",,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ControlR,"ControlR*",,,,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,"demo.controlr.app",,,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"/Applications/ControlR.*.app",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"/Applications/ControlR.app",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"/Library/Application Support/ControlR/*",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"/usr/local/bin/ControlR/*",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"C:\Program Files\ControlR\*\ControlR.Agent.exe",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"C:\Program Files\ControlR\*\DesktopClient\ControlR.DesktopClient.dll",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"C:\Program Files\ControlR\*\DesktopClient\ControlR.DesktopClient.exe",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"C:\ProgramData\ControlR\",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +Controlio,"Controlio*",,,,,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,"C:\ProgramData\{E0E95C6C-F194-4846-928D-E5538022226D}\",,,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"bbl.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"libeay32.dll",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"ssleay32.dll",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"weCliboardListener.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"weInstSvc.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"wec_launcher_[a-Z0-9]*_.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"wec_launcher_[a-Z0-9]*_.pkg",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"wemonc.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"weprtct.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"wesvc.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +CrossLoop,"CrossLoop*",,,,,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +CrossLoop,,"*.crossloop.com",,,,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +CrossLoop,,"crossloop.en.softonic.com",,,,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +CrossLoop,,,,"CrossLoopConnect.exe",,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +CrossLoop,,,,"WinVNCStub.exe",,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +CrossLoop,,,,"crossloopservice.exe",,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +CrossLoop,,,,,"Crossloop*",RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CrossTec Remote Control","CrossTec Remote Control*",,,,,RMM,"https://www.crosstecsoftware.com/supporthome.html","CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only." +"CrossTec Remote Control","CrossTecRemoteControl*",,,,,RMM,"https://www.crosstecsoftware.com/supporthome.html","CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only." +"CrossTec Remote Control",,,,"PCIVIDEO.EXE",,RMM,"https://www.crosstecsoftware.com/supporthome.html","CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only." +"CrossTec Remote Control",,,,"supporttool.exe",,RMM,"https://www.crosstecsoftware.com/supporthome.html","CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only." +"CrossTec Remote Control",,,,,CrossTec,RMM,"https://www.crosstecsoftware.com/supporthome.html","CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only." +CruzControl,"CruzControl*",,,,,RMM,"https://resources.doradosoftware.com/cruz-rmm","CruzControl is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service","DW Service*",,,,,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service","DWService*",,,,,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service",,"*.dwservice.net",,,,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service",,,,"dwagent.exe",,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service",,,,"dwaglnc.exe",,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service",,,,"dwagsvc.exe",,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service",,,,,"DWSNET*",RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,"DameWare*",,,,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,"dameware.com",,,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,"*\dwrcs\*",,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,"*\dwrcst.exe",,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,"C:\Program Files\SolarWinds\Dameware Mini Remote Control\*",,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,"C:\Windows\dwrcs\*",,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,"DameWare Mini Remote Control*.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,"DameWare Remote Support.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,"SolarWinds-Dameware-DRS*.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,"SolarWinds-Dameware-MRC*.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,"dntus*.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,"dwrcs.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,,"DameWare*",RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Dataplicity,"Dataplicity*",,,,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,"*.dataplicity.com",,,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,"*.wormhole.dataplicity.com",,,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,"dataplicity.com",,,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,"www.dataplicity.com",,,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,,"/etc/init.d/dataplicity",,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,,"/etc/systemd/system/dataplicity.service",,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,,"/opt/dataplicity/*",,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,,"/opt/dataplicity/tuxtunnel/*",,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,,"/usr/local/bin/dataplicity",,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +DeskDay,"DeskDay*",,,,,RMM,"https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate","DeskDay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskDay,,"app.deskday.ai",,,,RMM,"https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate","DeskDay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskDay,,"deskday.ai",,,,RMM,"https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate","DeskDay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskDay,,,,"ultimate_*.exe",,RMM,"https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate","DeskDay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskNets,"DeskNets*",,,,,RMM,"https://www.desknets.com/en/download.html","DeskNets is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskShare,"DeskShare*",,,,,RMM,"https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx","DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskShare,,,,"DSGuest.exe",,RMM,"https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx","DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskShare,,,,"TeamTaskManager.exe",,RMM,"https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx","DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskShare,,,,,"DeskShare*",RMM,"https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx","DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskShare,,,,,"Team Task Manager*",RMM,"https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx","DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DesktopNow,"DesktopNow*",,,,,RMM,"https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US","DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DesktopNow,,"*.nchuser.com",,,,RMM,"https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US","DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DesktopNow,,,,"desktopnow.exe",,RMM,"https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US","DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DesktopNow,,,,,"NCH Software*",RMM,"https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US","DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DesktopNow,,,,,"DesktopNow*",RMM,"https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US","DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Dev Tunnels (aka Visual Studio Dev Tunnel)","Dev Tunnels*",,,,,RAT,"","Dev Tunnels (aka Visual Studio Dev Tunnel) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Dev Tunnels (aka Visual Studio Dev Tunnel)","DevTunnels*",,,,,RAT,"","Dev Tunnels (aka Visual Studio Dev Tunnel) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Dev Tunnels (aka Visual Studio Dev Tunnel)","aka Visual Studio Dev Tunnel*",,,,,RAT,"","Dev Tunnels (aka Visual Studio Dev Tunnel) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Devolutions Remote Desktop Manager","Devolutions Remote Desktop Manager*",,,,,RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Devolutions Remote Desktop Manager","DevolutionsRemoteDesktopManager*",,,,,RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Devolutions Remote Desktop Manager",,,"*\RemoteDesktopManager.exe",,,RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Devolutions Remote Desktop Manager",,,"C:\Program Files\Devolutions\Remote Desktop Manager",,,RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Devolutions Remote Desktop Manager",,,,,"Remote Desktop Manager",RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Devolutions Remote Desktop Manager",,,,,"Devolutions inc",RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop","Distant Desktop*",,,,,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop","DistantDesktop*",,,,,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,"*.distantdesktop.com",,,,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,"*.signalserver.xyz",,,,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,"signalserver.xyz",,,,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,,,"dd.exe",,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,,,"ddsystem.exe",,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,,,"distant-desktop.exe",,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,,,,"Distant Desktop*",RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,,,,"German Gorodokuplya*",RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,,,,"Distant Software*",RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,"Domotz*",,,,,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,"*.cell-1.domotz.com",,,,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,"*.domotz.co",,,,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,"cell-1.domotz.com",,,,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,"domotz.com",,,,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,"Domotz Pro Desktop App Setup*.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,"Domotz Pro Desktop App.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,"domotz*.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,"domotz-windows*.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,"domotz.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,"domotz_bash.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,,"Domotz*",RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DragonDisk,"DragonDisk*",,,,,RAT,"","DragonDisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DragonDisk,,,"*\Almageste\DragonDisk\*",,,RAT,"","DragonDisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DragonDisk,,,"*\DragonDisk.exe",,,RAT,"","DragonDisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DragonDisk,,,"C:\Program Files (x86)\Almageste\DragonDisk\*",,,RAT,"","DragonDisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Duet Display","Duet Display*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display","DuetDisplay*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,"*.duetdisplay.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,"*.itagent.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,"duetdisplay.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,"itagent.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,"rdp.duetdisplay.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,,,"DuetDisp.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,,,"DuetSetup.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,,,"duet.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +Duplicati,"Duplicati*",,,,,RAT,"","Duplicati is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Duplicati,,,"*\*\Duplicati.Server.exe",,,RAT,"","Duplicati is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Duplicati,,,"c:\Program Files\*\Duplicati.Server.exe",,,RAT,"","Duplicati is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"EMCO Remote Console","EMCO Remote Console*",,,,,RMM,"","EMCO Remote Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"EMCO Remote Console","EMCORemoteConsole*",,,,,RMM,"","EMCO Remote Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"EMCO Remote Console",,"emcosoftware.com",,,,RMM,"","EMCO Remote Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"EMCO Remote Console",,,,"remoteconsole.exe",,RMM,"","EMCO Remote Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator","ESET Remote Administrator*",,,,,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator","ESETRemoteAdministrator*",,,,,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator",,,,"ERAAgent.exe",,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator",,,,"einstaller.exe",,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator",,,,"era.exe",,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator",,,,"eratool.exe",,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator",,,,"ezhelp*.exe",,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator",,,,,"ESET Management*",RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Echoware,"Echoware*",,,,,RMM,"","Echoware is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Echoware,,,,"echoserver*.exe",,RMM,"","Echoware is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Echoware,,,,"echoware.dll",,RMM,"","Echoware is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Electric AI (Kaseya)","Electric AI*",,,,,RMM,"https://www.electric.ai/product/device-management-solutions - Usess Kaseya/jamf","Electric AI (Kaseya) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Electric AI (Kaseya)","ElectricAI*",,,,,RMM,"https://www.electric.ai/product/device-management-solutions - Usess Kaseya/jamf","Electric AI (Kaseya) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Electric AI (Kaseya)",,"electric.ai",,,,RMM,"https://www.electric.ai/product/device-management-solutions - Usess Kaseya/jamf","Electric AI (Kaseya) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Encapto,"Encapto*",,,,,RMM,"https://www.encapto.com - used to manage Cisco services","Encapto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Encapto,,"encapto.com",,,,RMM,"https://www.encapto.com - used to manage Cisco services","Encapto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Endar,"Endar*",,,,,RMM,"https://github.com/tomkeene/endar,https://github.com/tomkeene/endar/blob/359a4495cd13711c82419e944abee14cb5c04979/README.md,https://github.com/tomkeene/endar/blob/359a4495cd13711c82419e944abee14cb5c04979/app/agent_api_v1/views.py,https://github.com/tomkeene/endar/releases/tag/1.0.0,https://github.com/tomkeene/endar/releases/download/1.0.0/endar.exe","Endar is an open-source, self-hosted RMM platform focused on endpoint monitoring and compliance policies. Its controller source exposes agent registration, policy retrieval, compliance-result, and data-collection endpoints. Static extraction of the sole GitHub 1.0.0 release asset identifies a Linux x86-64 PyInstaller endpoint agent with registration, policy, data-collection, and compliance-task code. The source for that agent is not in the repository, and the asset does not establish a default installation directory or service; this entry records only supported release evidence." +"Ericom AccessNow","Ericom AccessNow*",,,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom AccessNow","EricomAccessNow*",,,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom AccessNow",,"ericom.com",,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom AccessNow",,,,"accessserver*.exe",,RMM,"https://www.ericom.com/connect-accessnow/","Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom AccessNow",,,,"accessserver.exe",,RMM,"https://www.ericom.com/connect-accessnow/","Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom Connect","Ericom Connect*",,,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom Connect","EricomConnect*",,,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom Connect",,"ericom.com",,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom Connect",,,,"EricomConnectRemoteHost*.exe",,RMM,"https://www.ericom.com/connect-accessnow/","Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom Connect",,,,"ericomconnectconfigurationtool.exe",,RMM,"https://www.ericom.com/connect-accessnow/","Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ExtraPuTTY,"ExtraPuTTY*",,,,,RAT,"","ExtraPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ExtraPuTTY,,,"*Users\*\ExtraPuTTY-0.30-2016-01-28-installer.exe",,,RAT,"","ExtraPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ExtraPuTTY,,,"*\ExtraPuTTY-0.30-2016-01-28-installer.exe",,,RAT,"","ExtraPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ExtraPuTTY,,,"C:\Users\*\ExtraPuTTY-0.30-2016-01-28-installer.exe",,,RAT,"","ExtraPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Faronics Core","Faronics Core*",,,,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core","FaronicsCore*",,,,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,"faronics.com",,,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,"upd.faronicslabs.com",,,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,"www.faronics.com",,,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"*\Faronics\Faronics Core\Workstation Agent\CoreAgentService.exe",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"*\Faronics\Faronics Core\Workstation Agent\FaronicsCoreAgent.exe",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"C:\Program Files (x86)\Faronics\Faronics Core\*",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"C:\Program Files\Faronics\Core\Console\*",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"C:\Program Files\Faronics\Faronics Core\*",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"C:\Program Files\Faronics\Faronics Core\Workstation Agent\*",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"C:\ProgramData\Faronics\FCAForStartupMonitor.msi",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,,"CoreAgentService.exe",,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,,"FaronicsCoreAgent.exe",,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze","Faronics Deep Freeze*",,,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze","FaronicsDeepFreeze*",,,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"cloud.faronics.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"deepfreeze.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"faronics.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"faronicscloud.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"upd.faronicslabs.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"www.deepfreeze.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"www.faronics.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"*\Faronics\Deep Freeze\DFC.exe",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"*\Faronics\Deep Freeze\DFServ.exe",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"*\Faronics\Deep Freeze\DFServEx.exe",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"*\Faronics\Deep Freeze\DFWks.exe",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"C:\Program Files (x86)\Faronics\Deep Freeze\*",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\*",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"C:\Program Files (x86)\Faronics\Deep Freeze\Install C-1\*",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"C:\Program Files\Faronics Corporation\Deep Freeze 7.00\*",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"C:\Program Files\Faronics\Deep Freeze\*",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"CloudWksInstall.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFC.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFInst.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFServ.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFServEx.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFStd.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFStdInstall.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFWks.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deploy","Faronics Deploy*",,,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy","FaronicsDeploy*",,,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"1wuccjc4a3.execute-api.eu-west-1.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"29qoj3q0yf.execute-api.us-west-2.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"8z5x4rqbxi.execute-api.eu-west-1.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"deploy.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"docs.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"faronics-deploy-int-production-installers.s3.eu-west-1.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"faronics-deploy-na-production-installers.s3.us-west-2.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"faronicscloud.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"nv0mddxkh7.execute-api.us-west-2.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"remotepro-ap-southeast-1.faronicsdeploy.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"remotepro-ca-central-1.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"remotepro-eu-west-1.faronicsdeploy.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"remotepro-sa-east-1.faronicsdeploy.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"remotepro-us-east-1.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"remotepro-us-west-2.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"support.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"upd.faronicslabs.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"www.faronicsdeploy.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\*",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FRCServer.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FSSInstaller.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsDeployAgent.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsSA.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_32.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_64.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\NotificationHelper.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\UserNotificationHelper.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\ProgramData\Faronics\StorageSpace\FWA\*",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,,"CloudWksInstall.exe",,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,,"FWAService.exe",,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,,"FWAWebInstaller_*.exe",,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,,"FWA_UI_Agent.exe",,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,,"FaronicsDeployAgent.exe",,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Insight","Faronics Insight*",,,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight","FaronicsInsight*",,,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,"docs.faronics.com",,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,"faronics.com",,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,"support.faronics.com",,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,"www.faronics.com",,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"*\Faronics\Insight Student\FIStudentAgent.exe",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"*\Faronics\Insight Student\FIStudentSvc.exe",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"*\Faronics\Insight Student\FIStudentUI.exe",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"*\Faronics\Insight Student\STAHelper.exe",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"*\Faronics\Insight Teacher\STAHelper.exe",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"C:\Program Files (x86)\Faronics\Insight Student\*",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"C:\Program Files (x86)\Faronics\Insight Teacher\*",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"C:\Program Files\Faronics\Insight Student\*",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"C:\Program Files\Faronics\Insight Teacher\*",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"FIStudentAgent.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"FIStudentSvc.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"FIStudentUI.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"InsightInstaller.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"InsightInstallerStudent.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"InsightInstallerTeacher.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"InsightSetup.msi",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"STAHelper.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"StudentSvc.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +FastViewer,"FastViewer*",,,,,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FastViewer,,"*.fastviewer.com",,,,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FastViewer,,"fastviewer.com",,,,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FastViewer,,,,"FastViewer.exe",,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FastViewer,,,,"fastclient.exe",,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FastViewer,,,,"fastmaster.exe",,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FastViewer,,,,,"Fastviewer*",RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it","FixMe.it*",,,,,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,"*.fixme.it",,,,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,"*.techinline.net",,,,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,"fixme.it",,,,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,9380CC75B872221A7425D7503565B67580407F60,,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"FixMeit Client.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"FixMeit Expert Setup.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"FixMeit Unattended Access Setup.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"FixMeitClient*.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"TiClientCore.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"TiClientHelper*.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"TiExpertCore.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"TiExpertStandalone.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"fixmeitclient.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,,"FixMe.IT Helper",RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,,"SetMe*",RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,,"FixMe*",RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FleetDeck.io","FleetDeck.io*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,"*.fleetdeck.io",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,"agentmqtt.fleetdeck.io",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,"checkip.zmazonaws.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,"fleetdeck.io",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,"C:\Program Files (x86)\FleetDeck Agent\*\fd_agent.dll",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,"C:\Program Files (x86)\FleetDeck Agent\*\fleetdeck_agent.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,"C:\Windows\Temp\FleetDeck\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck-agent.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck-agent.msi",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck-agent.mst",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck_agent.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck_agent_svc.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck_commander_launcher.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck_commander_svc.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck_installer.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,,"FleetDeck*",RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +Fortra,"Fortra*",,,,,RMM,"https://www.fortra.com - No free/cloud RMM softwars listed","Fortra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Fortra,,"fortra.com",,,,RMM,"https://www.fortra.com - No free/cloud RMM softwars listed","Fortra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Ping Tool","Free Ping Tool*",,,,,RAT,"","Free Ping Tool is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Ping Tool","FreePingTool*",,,,,RAT,"","Free Ping Tool is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Ping Tool",,,,"can't find this one",,RAT,"","Free Ping Tool is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Tools Launcher","Free Tools Launcher*",,,,,RMM,"","Free Tools Launcher is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Tools Launcher","FreeToolsLauncher*",,,,,RMM,"","Free Tools Launcher is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Tools Launcher",,,"*\ManageEngine\*",,,RMM,"","Free Tools Launcher is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Tools Launcher",,,"C:\Program Files\ManageEngine\ManageEngine Free Tools\Launcher\*",,,RMM,"","Free Tools Launcher is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FreeNX,"FreeNX*",,,,,RAT,"","FreeNX is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FreeNX,,,"*\nxplayer.exe",,,RAT,"","FreeNX is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FreeNX,,,"C:\*\nxplayer.exe",,,RAT,"","FreeNX is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Freshservice,"Freshservice*",,,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.fdcollab.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshchat.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshcloud.io",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshconnect.io",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshdev.io",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshservice.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshworks.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshworksapi.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.in-freshbots.ai",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.myfreshworks.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.rtschannel.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.webpush.freshchat.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"api.fdcollab.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"apicdn-wchat.freshchat.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"freshasset.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"freshservice.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"fstools.freshasset.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"fstools.freshservice.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"static.freshdev.io",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"www.freshservice.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"*\FSAgentAutoUpdate.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"*\FSAgentService.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"*\FSWmiScanner.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"*\Freshservice.DiscoveryProbe.ScanService.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"*\Freshservice.DiscoveryProbe.Window.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshdesk\Freshservice Discovery Agent\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshdesk\Freshservice Discovery Agent\FSAgentAutoUpdate.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshdesk\Freshservice Discovery Agent\FSAgentService.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshdesk\Freshservice Discovery Agent\bin\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshdesk\Freshservice Discovery Agent\conf\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\bin\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\bin\Freshservice.DiscoveryProbe.ScanService.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\bin\Freshservice.DiscoveryProbe.Window.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\bin\plink.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\conf\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\db\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\nmap\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\tools\ssh\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,,"FSAgent.msi",,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,,"fs-probe-*.msi",,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,,"fs-windows-agent-*.msi",,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,,"win-installer-*.msi",,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +"GLPI Agent","GLPI Agent*",,,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent","GLPIAgent*",,,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"forum.glpi-project.org",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"glpi-network.com",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"glpi-project.org",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"nightly.glpi-project.org",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"services.glpi-network.com",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"www.glpi-project.org",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"/Applications/GLPI-Agent/*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"/Applications/GLPI-Agent/etc/*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"/etc/glpi-agent/*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"/usr/bin/glpi-agent",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"/usr/local/bin/glpi-agent",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"/var/lib/glpi-agent/*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"C:\Program Files\GLPI-Agent\*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"C:\Program Files\GLPI-Agent\etc\*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"C:\Program Files\GLPI-Agent\logs\*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"C:\Program Files\GLPI-Agent\perl\bin\*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"C:\Program Files\GLPI-Agent\var\*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GO RMM","GO RMM*",,,,,RMM,"","GO RMM is a custom Windows management console that builds and controls remote agents. The inspected Go/Wails console includes agent enrollment and build controls, WebSocket command handling, remote desktop and input, shell, file, inventory, process, and session-management workflows. Its embedded interface also exposes high-risk modules such as webcam, microphone, and keylogging, as well as disruptive operations including a forced system crash. This entry records the console's statically demonstrated remote-administration functions; it does not establish a verified publisher, commercial vendor, malware classification, or observed abuse." +"GO RMM","GORMM*",,,,,RMM,"","GO RMM is a custom Windows management console that builds and controls remote agents. The inspected Go/Wails console includes agent enrollment and build controls, WebSocket command handling, remote desktop and input, shell, file, inventory, process, and session-management workflows. Its embedded interface also exposes high-risk modules such as webcam, microphone, and keylogging, as well as disruptive operations including a forced system crash. This entry records the console's statically demonstrated remote-administration functions; it does not establish a verified publisher, commercial vendor, malware classification, or observed abuse." +"GatherPlace-desktop sharing","GatherPlace-desktop sharing*",,,,,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing","GatherPlace-desktopsharing*",,,,,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,"*.gatherplace.com",,,,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,"*.gatherplace.net",,,,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,"gatherplace.com",,,,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,,,"gp3.exe",,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,,,"gp4.exe",,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,,,"gp5.exe",,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,,,,"Gatherworks*",RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GetScreen,"GetScreen*",,,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,"*.getscreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,"GetScreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,"getscreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,"go.getscreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,"image.getscreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,"px-*.getscreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,"C:\Program Files\Getscreen.me\",,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,"C:\ProgramData\Getscreen.me\",,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,"C:\Users\*\AppData\Local\Getscreen.me\",,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,"C:\Users\*\Downloads\getscreen-x86.exe",,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,"C:\Users\*\Downloads\getscreen.upd.exe",,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,,,"Point B Ltd*",RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,,,"getscreen.me*",RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +"Go Mini RMM","Go Mini RMM*",,,,,RMM,"https://github.com/cevrimxe/go-mini-rmm,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/README.md,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/web/templates/install.ps1,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/web/templates/install.sh,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/internal/agent/executor/executor.go,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/internal/server/api/router.go","Go Mini RMM is an open-source Go management server and endpoint agent. The agent sends heartbeats, connects to a controller WebSocket, executes remote commands, transfers files, lists and terminates processes, and checks for updates. The repository supplies a Linux systemd installer and a Windows scheduled-task installer. It is distinct from LOLRMM's existing Mini RMM entry, which documents a different .NET product." +"Go Mini RMM","GoMiniRMM*",,,,,RMM,"https://github.com/cevrimxe/go-mini-rmm,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/README.md,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/web/templates/install.ps1,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/web/templates/install.sh,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/internal/agent/executor/executor.go,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/internal/server/api/router.go","Go Mini RMM is an open-source Go management server and endpoint agent. The agent sends heartbeats, connects to a controller WebSocket, executes remote commands, transfers files, lists and terminates processes, and checks for updates. The repository supplies a Linux systemd installer and a Windows scheduled-task installer. It is distinct from LOLRMM's existing Mini RMM entry, which documents a different .NET product." +"GoTo Opener","GoTo Opener*",,,,,RMM,"","GoTo Opener is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoTo Opener","GoToOpener*",,,,,RMM,"","GoTo Opener is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoTo Opener",,,"*\GoTo Opener",,,RMM,"","GoTo Opener is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoTo Opener",,,"C:\Program Files (x86)\GoTo Opener",,,RMM,"","GoTo Opener is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,"GoToAssist*",,,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.cdn.getgo.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.desktopstreaming.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.fastsupport.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.getgo.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.gotoassist.at",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.gotoassist.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.gotoassist.me",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"goto.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"helpme.net",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"GoTo Assist Opener.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"g2a*.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"g2ax_comm_customer.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"g2mcomm.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"g2mupdate.com",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"goto opener.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"gotoassist.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,,"GoToAssist*",RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoToAssist (GoTo Resolve)","GoTo Resolve*",,,,,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)","GoToAssist*",,,,,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,"C:\Program Files (x86)\GoTo Resolve Unattended\*",,,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,"C:\Program Files\GoTo Resolve Unattended\*",,,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveExternalModuleHandler.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveFileManager.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveLoggerProcess.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveNetworkChecker.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveProcessChecker.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveQuickView.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveRegistryEditor.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveRemoteControl.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveService.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveServiceManager.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveTerminal.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveTools32.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveTools64.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveUi.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveUnattended.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveUnattendedRemover.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveUnattendedUi.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,,"GoToAssist*",RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist Agent Desktop Console","GoToAssist Agent Desktop Console*",,,,,RMM,"","GoToAssist Agent Desktop Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoToAssist Agent Desktop Console","GoToAssistAgentDesktopConsole*",,,,,RMM,"","GoToAssist Agent Desktop Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoToAssist Agent Desktop Console",,,"*\G2RDesktopConsole-x64.msi",,,RMM,"","GoToAssist Agent Desktop Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoToAssist Agent Desktop Console",,,"C:\*\G2RDesktopConsole-x64.msi",,,RMM,"","GoToAssist Agent Desktop Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,"GoToMyPC*",,,,,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,,"*.GoToMyPC.com",,,,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,,,"%APPDATA%\GoToMeeting\G2M.exe",,,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,,,"C:\Program Files (x86)\GoToMyPC\*",,,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,,,,"G2M.exe",,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,,,,,GoToOpener,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,,,,,"GoTo Opener",RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Gorelo RMM","Gorelo RMM*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM","GoreloRMM*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"app.gorelo.io",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"gorelo-rmm.azurewebsites.net",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"gw.usw.gorelo.tech",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"lr.rmm.pod1.usw.gorelo.tech",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"public.rmm.pod1.usw.gorelo.tech",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"r1.rmm.uw.gorelo.tech",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"sr.rmm.pod1.usw.gorelo.tech",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +GotoHTTP,"GotoHTTP*",,,,,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,"*.gotohttp.com",,,,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,"gotohttp.com",,,,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,,,"GotoHTTP*.exe",,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,,,"GotoHTTP_x64.exe",,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,,,"gotohttp.exe",,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,,,,"Pingbo*",RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,,,,"GotoHTTP*",RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,"Goverlan*",,,,,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,"goverlan.com",,,,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,"*\GovSrv.exe",,,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,"*\PJ Technologies\GOVsrv\*",,,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,"C:\Program Files (x86)\PJ Technologies\GOVsrv\*",,,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,,"GovAgentInstallHelper.exe",,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,,"GovAgentx64.exe",,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,,"GovReachClient.exe",,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,,"goverrmc.exe",,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,,"govsrv*.exe",,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,,,"Goverlan*",RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Guacamole,"Guacamole*",,,,,RAT,"https://guacamole.apache.org","Guacamole is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Guacamole,,"guacamole.apache.org",,,,RAT,"https://guacamole.apache.org","Guacamole is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Guacamole,,,,"guacd.exe",,RAT,"https://guacamole.apache.org","Guacamole is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GxM RMM Agent","GxM RMM Agent*",,,,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign." +"GxM RMM Agent","GxMRMMAgent*",,,,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign." +"GxM RMM Agent",,,"*\ProgramData\GxM\agent\GxM.Agent.exe",,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign." +"GxM RMM Agent",,,"*\ProgramData\GxM\enrollment.json",,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign." +"GxM RMM Agent",,,"*\ProgramData\GxM\install.log",,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign." +"GxM RMM Agent",,,"C:\GxM\agent",,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign." +HeartbeatRM,"HeartbeatRM*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,"*.heartbeatrm.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,"heartbeatrm.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,,"*\HeartbeatRM\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,,"C:\Program Files (x86)\HeartbeatRM\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,,"C:\Program Files\HeartbeatRM\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,,,"agent-installer-any.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,,,"hbrm-updater-x64.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,,,"hbrm-x64.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HelpBeam,"HelpBeam*",,,,,RMM,"https://www.helpbeam.com domain for sale in 2024","HelpBeam is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpBeam,,"helpbeam.software.informer.com",,,,RMM,"https://www.helpbeam.com domain for sale in 2024","HelpBeam is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpBeam,,,,"helpbeam*.exe",,RMM,"https://www.helpbeam.com domain for sale in 2024","HelpBeam is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,"HelpU*",,,,,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,"*.helpu.co.kr",,,,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,"helpu.co.kr",,,,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,,,"HelpuManager.exe",,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,,,"HelpuUpdater.exe",,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,,,"helpu_install.exe",,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,,,,"Help Manager Program",RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,,,,"helpU*",RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpWire,"HelpWire*",,,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"account.flexihub.com",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"api.helpwire.app",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"get.helpwire.app",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"helpwire.app",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"staging.helpwire.app",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"stun.helpwire.app",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"stunserver.stunprotocol.org",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,"/Applications/HelpWire Operator.app",,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,"/lib/systemd/system/helpwire-unattended.service",,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,"helpwire-operator/bin/helpwire-operator",,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,,"HelpWire Quick.exe",,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,,"HelpWire Unattended Access.lnk",,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,,"HelpWire.lnk",,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,,"helpwire.exe",,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HopToDesk,"HopToDesk*",,,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,"api.hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,"download.hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,"hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,"signal.hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,"turn.hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,"www.hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,,"C:\Program Files (x86)\HopToDesk\HopToDesk.exe",,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,,,"HopToDesk-Standalone.exe",,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,,,"HopToDesk.exe",,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +"I'm InTouch","I'm InTouch*",,,,,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"I'm InTouch","I'mInTouch*",,,,,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"I'm InTouch",,"*.01com.com",,,,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"I'm InTouch",,,,"I'm InTouch Go Installer.exe",,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"I'm InTouch",,,,"iit.exe",,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"I'm InTouch",,,,"intouch.exe",,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"I'm InTouch",,,,,"I'm InTouch*",RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Light","ISL Light*",,,,,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Light","ISLLight*",,,,,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Light",,"islonline.com",,,,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Light",,,,"islalwaysonmonitor.exe",,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Light",,,,"isllight.exe",,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Light",,,,"isllightservice.exe",,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online","ISL Online*",,,,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online","ISLOnline*",,,,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,"*.islonline.com",,,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,"*.islonline.net",,,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,"*\ISL Online\ISL Light*",,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,"*\ISLLight.exe",,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,"C:\Program Files (x86)\ISL Online\ISL Light*",,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,"ISLLight.exe",,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,"ISLLightClient.exe",,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,"islalwaysonmonitor.exe",,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,"isllight.exe",,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,"isllightservice.exe",,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,,"ISL Light*",RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,,"ISL Online*",RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IT Agent","IT Agent*",,,,,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry." +"IT Agent","ITAgent*",,,,,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry." +"IT Agent",,,,"ITAgentRMMSender.exe",,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry." +"IT Agent",,,,"ITAgentRMMSenderSL.exe",,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry." +"IT Agent",,,,"ITAgentRMMSenderUpdater.exe",,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry." +"IT Agent",,,,"ITAgentSender.aiui",,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry." +"ITSupport247 (ConnectWise)","ConnectWise*",,,,,RMM,"https://control.itsupport247.net/","ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ITSupport247 (ConnectWise)","ITSupport247*",,,,,RMM,"https://control.itsupport247.net/","ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ITSupport247 (ConnectWise)",,"*.itsupport247.net",,,,RMM,"https://control.itsupport247.net/","ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ITSupport247 (ConnectWise)",,"itsupport247.net",,,,RMM,"https://control.itsupport247.net/","ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ITSupport247 (ConnectWise)",,,,"saazapsc.exe",,RMM,"https://control.itsupport247.net/","ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ImmyBot,"ImmyBot*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,"*.immy.bot",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,"immy.bot",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,"*\ImmyBot\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,"C:\Program Files (x86)\ImmyBot\ImmyAgent.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,"C:\Program Files (x86)\ImmyBot\ImmyUpdater.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,"C:\Program Files\ImmyBot\ImmyAgent.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,"C:\Program Files\ImmyBot\ImmyUpdater.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,"C:\Windows\Temp\ImmyBot\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,,"ImmyAgent.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,,"ImmyBot.Agent.Ephemeral.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,,"ImmyBot.msi",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,,"ImmyUpdater.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +"Impero Connect","Impero Connect*",,,,,RMM,"","Impero Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Impero Connect","ImperoConnect*",,,,,RMM,"","Impero Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Impero Connect",,"imperosoftware.com",,,,RMM,"","Impero Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Impero Connect",,,,"ImperoClientSVC.exe",,RMM,"","Impero Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall","Instant Housecall*",,,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall","InstantHousecall*",,,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,"*.instanthousecall.com",,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,"*.instanthousecall.net",,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,"instanthousecall.com",,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,"secure.instanthousecall.com",,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,,,"InstantHousecall.exe",,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,,,"hsloader.exe",,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,,,"ihcserver.exe",,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,,,"instanthousecall.exe",,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Insync,"Insync*",,,,,RAT,"","Insync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Insync,,,"*Users\*\AppData\Roaming\Insync\App\Insync.exe",,,RAT,"","Insync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Insync,,,"*\Insync.exe",,,RAT,"","Insync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Insync,,,"C:\Users\USERNAME\AppData\Roaming\Insync\App\Insync.exe",,,RAT,"","Insync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control","IntelliAdmin Remote Control*",,,,,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control","IntelliAdminRemoteControl*",,,,,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control",,"*.intelliadmin.com",,,,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control",,,,"agent32.exe",,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control",,,,"agent64.exe",,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control",,,,"agent_setup_5.exe",,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control",,,,"iadmin.exe",,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control",,,,"intelliadmin.exe",,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +InvGate,"InvGate*",,,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"*.invgate.net",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"docs.invgate.net",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"help.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"instances-info.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"instances-list.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"invgate.net",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"lb-insight-001.invgate.net",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"releases.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"trust-access.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"trust.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"www.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\*",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\DepHlp.exe",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\InvGate-ED.exe",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\Software Matt.dll",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\files\InvGateAssetsRD.exe",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\files\InvGateRD.exe",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\files\sas.dll",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +"Iperius Remote","Iperius Remote*",,,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote","IperiusRemote*",,,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,"*.iperius-rs.com",,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,"*.iperius.com",,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,"*.iperiusremote.com",,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,"iperiusremote.com",,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,,,"iperius.exe",,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,,,"iperiusremote.exe",,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,,,,"Enter S.R.L*",RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,,,,"Iperius Remote*",RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,,,,"Enter Srl*",RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,"Itarian*",,,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,"*.cmdm.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,"*.itsm-us1.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,"mdmsupport.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,"remoteaccess.itarian.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,"servicedesk.itarian.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"ComodoRemoteControl.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"ITSMAgent.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"ITSMService.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"ITarianRemoteAccessSetup.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"ItsmRsp.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"RAccess.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"RDesktop.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"RHost.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"RViewer.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"RmmService.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,,"RMM*",RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,,"Itarian*",RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ivanti Remote Control","Ivanti Remote Control*",,,,,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ivanti Remote Control","IvantiRemoteControl*",,,,,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ivanti Remote Control",,"*.ivanticloud.com",,,,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ivanti Remote Control",,,,"AgentlessRC.exe",,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ivanti Remote Control",,,,"ArcUI.exe",,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ivanti Remote Control",,,,"IvantiRemoteControl.exe",,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +JollysFastVNC,"JollysFastVNC*",,,,,RAT,"","JollysFastVNC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Cloud","Jump Cloud*",,,,,RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Cloud","JumpCloud*",,,,,RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Cloud",,"*.api.jumpcloud.com",,,,RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Cloud",,"*.assist.jumpcloud.com",,,,RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Cloud",,,,"JumpCloud*.exe",,RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Cloud",,,,,"JumpCloud*",RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop","Jump Desktop*",,,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop","JumpDesktop*",,,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,"*.jumpdesktop.com",,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,"*.jumpto.me",,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,"jumpdesktop.com",,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,"jumpto.me",,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,,,"jumpclient.exe",,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,,,"jumpconnect.exe",,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,,,"jumpdesktop.exe",,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,,,"jumpservice.exe",,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,,,"jumpupdater.exe",,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KHelpDesk,"KHelpDesk*",,,,,RMM,"https://www.khelpdesk.com.br/en-us","KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KHelpDesk,,"*.khelpdesk.com.br",,,,RMM,"https://www.khelpdesk.com.br/en-us","KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KHelpDesk,,,,"KHelpDesk.exe",,RMM,"https://www.khelpdesk.com.br/en-us","KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KHelpDesk,,,,,"Ferramenta de Acesso Remoto",RMM,"https://www.khelpdesk.com.br/en-us","KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KHelpDesk,,,,,"KHELPDESK*",RMM,"https://www.khelpdesk.com.br/en-us","KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Kabuto,"Kabuto*",,,,,RMM,"https://www.repairtechsolutions.com/documentation/kabuto/","Kabuto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Kabuto,,"*.kabuto.io",,,,RMM,"https://www.repairtechsolutions.com/documentation/kabuto/","Kabuto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Kabuto,,,,"Kabuto.App.Runner.exe",,RMM,"https://www.repairtechsolutions.com/documentation/kabuto/","Kabuto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KiTTY,"KiTTY*",,,,,RAT,"","KiTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KiTTY,,,"*\kitty.exe",,,RAT,"","KiTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KiTTY,,,"C:\*\kitty.exe",,,RAT,"","KiTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KickIdler,"KickIdler*",,,,,RMM,"https://www.kickidler.com/for-it/faq/","KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KickIdler,,"kickidler.com",,,,RMM,"https://www.kickidler.com/for-it/faq/","KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KickIdler,,"my.kickidler.com",,,,RMM,"https://www.kickidler.com/for-it/faq/","KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KickIdler,,,,"grabberEM.*msi",,RMM,"https://www.kickidler.com/for-it/faq/","KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KickIdler,,,,"grabberTT*.msi",,RMM,"https://www.kickidler.com/for-it/faq/","KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Komari,"Komari*",,,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,"ghcr.io",,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,"github.com",,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,"komari-document.pages.dev",,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,"raw.githubusercontent.com",,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,"www.komari.wiki",,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,,"/etc/systemd/system/komari-agent.service",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,,"/etc/systemd/system/komari.service",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,,"/opt/komari/*",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,,"/usr/local/komari/*",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,,"C:\Program Files\Komari\*",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,,"C:\komari\*",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Koofr,"Koofr*",,,,,RAT,"","Koofr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Koofr,,,,,"koofr*",RAT,"","Koofr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,"LANDesk*",,,,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,"*.ivanti.com",,,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,"*.ivanticloud.com",,,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,"ivanti.com",,,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,"*\LANDesk\*",,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,"*\issuser.exe",,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,"*\softmon.exe",,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,"*\tmcsvc.exe",,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,"C:\Program Files (x86)\LANDesk\*",,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,,"LANDeskPortalManager.exe",,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,,"issuser.exe",,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,,"landeskagentbootstrap.exe",,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,,"ldinv32.exe",,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,,"ldsensors.exe",,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LS RMM","LS RMM*",,,,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM","LSRMM*",,,,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM",,"webserv.logistical-software.co.uk",,,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM",,"www.logistical-software.co.uk",,,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM",,,"C:\Program Files (x86)\LS RMM\LS RMM Worker.exe",,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM",,,"C:\Program Files (x86)\LS RMM\LS RMM.exe",,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM",,,,"LS RMM Worker.exe",,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM",,,,"LS RMM.exe",,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LabTeach (Connectwise Automate)","Connectwise Automate*",,,,,RMM,"","LabTeach (Connectwise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTeach (Connectwise Automate)","LabTeach*",,,,,RMM,"","LabTeach (Connectwise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTeach (Connectwise Automate)",,,,"ltsvc.exe",,RMM,"","LabTeach (Connectwise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)","ConnectWise Automate*",,,,,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)","LabTech RMM*",,,,,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)","LabTech*",,,,,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)","LabTechRMM*",,,,,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)",,"connectwise.com",,,,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)",,,,"ltsvc.exe",,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)",,,,"ltsvcmon.exe",,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)",,,,"lttray.exe",,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere","Laplink Everywhere*",,,,,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere","LaplinkEverywhere*",,,,,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,"atled.syspectr.com",,,,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,"everywhere.laplink.com",,,,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,"le.laplink.com",,,,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,,,"OOSysAgent.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,,,"laplink-everywhere-setup*.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,,,"laplink.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,,,"laplinkeverywhere.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,,,"llrcservice.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,,,"serverproxyservice.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Gold","Laplink Gold*",,,,,RMM,"https://web.laplink.com/product/laplink-gold","Laplink Gold is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Gold","LaplinkGold*",,,,,RMM,"https://web.laplink.com/product/laplink-gold","Laplink Gold is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Gold",,,,"laplink.exe",,RMM,"https://web.laplink.com/product/laplink-gold","Laplink Gold is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Gold",,,,"tsircusr.exe",,RMM,"https://web.laplink.com/product/laplink-gold","Laplink Gold is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Lavawall,"Lavawall*",,,,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Lavawall,,"api-ca-1.lavawall.com",,,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Lavawall,,"caremote1.lavawall.com",,,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Lavawall,,"lavawinupdate.lavawall.com",,,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Lavawall,,,"C:\Lavawall\LavawallWin.exe",,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Lavawall,,,"C:\Program Files (x86)\Lavawall\LavawallWin.exe",,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Lavawall,,,"C:\Program Files\Lavawall\LavawallWin.exe",,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Level,"Level*",,,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +Level,,"agents.level.io",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +Level,,"builds.level.io",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +Level,,"downloads.level.io",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +Level,,"level.io",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +Level,,"online.level.io",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +Level,,,"C:\Program Files\Level\*",,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +"Level.io","Level.io*",,,,,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Level.io",,"*.level.io",,,,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Level.io",,"level.io",,,,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Level.io",,,,"level-remote-control-ffmpeg.exe",,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Level.io",,,,"level-windows-amd64.exe",,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Level.io",,,,"level.exe",,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Level.io",,,,,"Level*",RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LightRmmAgent,"LightRmmAgent*",,,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike","LightRmmAgent is an unattributed custom Windows service described as RMM-style tooling by Threat Hunting Labs. In the reported RVTools SEO poisoning intrusion, an operator used Level to install MonitoringPanel.msi, which deployed LightRmmAgent. The service stored a machine identifier and contacted an Azure-hosted endpoint. No command execution through this agent was observed. It is distinct from RemoteAgentAgent and RMMCRAT; no legitimate vendor or official distribution source was established." +LightRmmAgent,,"light-rmm-monitor-20260825.azurewebsites.net",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike","LightRmmAgent is an unattributed custom Windows service described as RMM-style tooling by Threat Hunting Labs. In the reported RVTools SEO poisoning intrusion, an operator used Level to install MonitoringPanel.msi, which deployed LightRmmAgent. The service stored a machine identifier and contacted an Azure-hosted endpoint. No command execution through this agent was observed. It is distinct from RemoteAgentAgent and RMMCRAT; no legitimate vendor or official distribution source was established." +LightRmmAgent,,,"C:\Program Files\LightRmmAgent\*",,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike","LightRmmAgent is an unattributed custom Windows service described as RMM-style tooling by Threat Hunting Labs. In the reported RVTools SEO poisoning intrusion, an operator used Level to install MonitoringPanel.msi, which deployed LightRmmAgent. The service stored a machine identifier and contacted an Azure-hosted endpoint. No command execution through this agent was observed. It is distinct from RemoteAgentAgent and RMMCRAT; no legitimate vendor or official distribution source was established." +"Lite Manager","Lite Manager*",,,,,RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager","LiteManager*",,,,,RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,"*\LMNoIpServer.exe",,,RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,"*\LiteManager Pro – Viewer\*",,,RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,"C:\Program Files\LiteManager Pro – Viewer\*",,,RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,,,"LiteManager*",RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,,,"ROMServer*",RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,,,"ROMViewer*",RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,,,"Yakhnovets Denis*",RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,"LiteManager*",,,,,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,"*.litemanager.com",,,,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,"*.litemanager.ru",,,,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,"litemanager.com",,,,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,"ROMFUSClient.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,"ROMServer.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,"lmnoipserver.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,"romfusclient.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,"romserver.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,"romviewer.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,,"LiteManager*",RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,,"ROMServer*",RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,,"ROMViewer*",RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,,"Yakhnovets Denis*",RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LocalXpose,"LocalXpose*",,,,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,"*.localxpose.io",,,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,"api.localxpose.io",,,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,"localxpose.io",,,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,,"%APPDATA%\loclx\*",,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,,"*\loclx.exe",,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,,"/usr/local/bin/loclx",,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,,"C:\Users\*\AppData\Local\Programs\loclx\loclx.exe",,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,,,loclx,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,,,"loclx.exe",,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LogMeIn,"LogMeIn*",,,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,"*.logmein.com",,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,"*.logmein.eu",,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,"*.logmeininc.com",,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,"logmein-gateway.com",,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,"logmeinrescue.com",,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,,,,"RemotelyAnywhere*",RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,,,,"LogMeIn*",RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue","LogMeIn rescue*",,,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue","LogMeInrescue*",,,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,"*.logmeinrescue.com",,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,"*.logmeinrescue.eu",,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,"logmeinrescue.com",,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,"rescue-data-cetner.logmein-gateway.com",,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,"rescue-list.*.logmein-gateway.com",,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,,"C:\Users\*\AppData\Local\LogMeIn Rescue Applet\LMIR*.tmp\lmi_rescue.exe",,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,,"C:\Users\*\AppData\Local\LogMeIn Rescue Applet\LMIR*.tmp\lmi_rescue_srv.exe",,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,,,"lmi_rescue.exe",,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,,,"support-logmeinrescue*.exe",,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,,,"support-logmeinrescue.exe",,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Lunixar,"Lunixar*",,,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"*.lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"app.lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"devrmm.lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"downloads.lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"mymeetinggoogle.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"socket.lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\Lunixar.Agent.Core.dll",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\Lunixar.dll",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\Lunixar.exe",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\LunixarRemote.dll",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\LunixarRemote.exe",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\LunixarUpdater.dll",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\LunixarUpdater.exe",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"C:\Program Files\Lunixar\*",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,,"Googlemeet.msi",,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,,"LunixarRMM*.msi",,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,,"eDocument-*.msi",,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +MEGAsync,"MEGAsync*",,,,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,"*ProgramData\MEGAsync\*",,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,"*Users\*\AppData\Local\MEGAsync\*",,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,"*\MEGAsyncSetup64.exe",,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,"*\MEGAupdater.exe",,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,"C:\Users\*\AppData\Local\MEGAsync\*",,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,,,MEGAsync,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,,,"MEGA Limited",RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,"MSP360*",,,,,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,"*.cloudberrylab.com",,,,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,"*.msp360.com",,,,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,"*.mspbackups.com",,,,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,"msp360.com",,,,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"CBBackupPlan.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"Cloud.Backup.RM.Service.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"Cloud.Backup.Scheduler.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"CloudRaCmd.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"CloudRaSd.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"CloudRaService.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"CloudRaUtilities.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"Connect.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"Online Backup.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"RMM.Agent.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"Remote Desktop.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"cbb.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,,"Cloud.Ra*",RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,,"MSP360*",RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)","Desktop Central*",,,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)","Manage Engine*",,,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)","ManageEngine*",,,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,"*.-dms.zoho.com.cn",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,"*.dms.zoho.com",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,"*.dms.zoho.com.eu",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,"desktopcentral.manageengine.cn",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,"desktopcentral.manageengine.com",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,"desktopcentral.manageengine.com.eu",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,,,"dcagentregister.exe",,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,,,"dcagentservice.exe",,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ManageEngine RMM Central","ManageEngine RMM Central*",,,,,RMM,"","ManageEngine RMM Central is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ManageEngine RMM Central","ManageEngineRMMCentral*",,,,,RMM,"","ManageEngine RMM Central is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ManageEngine ServiceDesk Plus","ManageEngine ServiceDesk Plus*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus","ManageEngineServiceDeskPlus*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus",,"*.manageengine.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus",,"manageengine.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus",,,"C:\Program Files (x86)\ManageEngine\ServiceDesk\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus",,,"C:\Program Files\ManageEngine\ServiceDesk\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus",,,,"ManageEngine_ServiceDesk_Plus.bin",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus",,,,"ManageEngine_ServiceDesk_Plus.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +MeshCentral,"MeshCentral*",,,,,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +MeshCentral,,"meshcentral.com",,,,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +MeshCentral,,,"/usr/local/mesh_services/meshagent/*",,,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +MeshCentral,,,"/usr/local/mesh_services/meshagent/meshagent/*",,,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +MeshCentral,,,,"meshagent*.exe",,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +MeshCentral,,,,"meshcentral*.exe",,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +MeshCentral,,,,,meshcentral,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +"Microsoft Quick Assist","Microsoft Quick Assist*",,,,,RAT,"https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca","Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Microsoft Quick Assist","MicrosoftQuickAssist*",,,,,RAT,"https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca","Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Microsoft Quick Assist",,"*.support.services.microsoft.com",,,,RAT,"https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca","Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Microsoft Quick Assist",,,,"quickassist.exe",,RAT,"https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca","Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Microsoft Quick Assist",,,,,"Quick Assist",RAT,"https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca","Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,"Mikogo*",,,,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,"*.mikogo.com",,,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,"*.mikogo4.com",,,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,"*.real-time-collaboration.com",,,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,"mikogo.com",,,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,"*Users\*\AppData\Roaming\Mikogo\*",,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,"*\Mikogo-Screen-Service.exe",,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,"*\Mikogo-Service.exe",,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,"C:\Users\*\AppData\Roaming\Mikogo\*",,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,,"mikogo-service.exe",,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,,"mikogo-starter.exe",,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,,"mikogo.exe",,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,,"mikogolauncher.exe",,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Minexus,"Minexus*",,,,,RMM,"https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/README.md,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/documentation/configuration.md,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/internal/web/webroot/templates/install_minion.sh,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/cmd/minion/minion.go","Minexus is an open-source, self-hosted remote management system composed of a Nexus server, Console, and Minion endpoint agent. The agent supports inventory, remote shell, and file-management functions. No public malicious deployment was established in this source-focused review." +Minexus,,,"/etc/systemd/system/minion.service",,,RMM,"https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/README.md,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/documentation/configuration.md,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/internal/web/webroot/templates/install_minion.sh,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/cmd/minion/minion.go","Minexus is an open-source, self-hosted remote management system composed of a Nexus server, Console, and Minion endpoint agent. The agent supports inventory, remote shell, and file-management functions. No public malicious deployment was established in this source-focused review." +"Mini RMM Agent","Mini RMM Agent*",,,,,RMM,"","Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"Mini RMM Agent","MiniRMMAgent*",,,,,RMM,"","Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"Mini RMM Agent",,,"C:\Program Files\MiniRMM\MiniRmmAgent.exe",,,RMM,"","Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"Mini RMM Agent",,,"C:\ProgramData\MiniRMM\Invoke-AVExclusions.ps1",,,RMM,"","Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"Mini RMM Agent",,,"C:\ProgramData\MiniRMM\SmartScreenTest.ps1",,,RMM,"","Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"MioNet (Also known as WD Anywhere Access)","Also known as WD Anywhere Access*",,,,,RMM,"","MioNet (Also known as WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (Also known as WD Anywhere Access)","MioNet*",,,,,RMM,"","MioNet (Also known as WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (Also known as WD Anywhere Access)",,,,"mionet.exe",,RMM,"","MioNet (Also known as WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (Also known as WD Anywhere Access)",,,,"mionetmanager.exe",,RMM,"","MioNet (Also known as WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (WD Anywhere Access)","MioNet*",,,,,RMM,"https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016","MioNet (WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (WD Anywhere Access)","WD Anywhere Access*",,,,,RMM,"https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016","MioNet (WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (WD Anywhere Access)",,,,"mionet.exe",,RMM,"https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016","MioNet (WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (WD Anywhere Access)",,,,"mionetmanager.exe",,RMM,"https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016","MioNet (WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Miradore,"Miradore*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +Miradore,,"*.miradore.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +Miradore,,"gateway.miradore.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +Miradore,,"gerwconline.blob.core.windows.net",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +Miradore,,"miradore.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +Miradore,,,"*\Miradore\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +Miradore,,,"C:\Program Files\Miradore\OnlineClient\bin\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +"Mocha VNC Lite","Mocha VNC Lite*",,,,,RAT,"","Mocha VNC Lite is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Mocha VNC Lite","MochaVNCLite*",,,,,RAT,"","Mocha VNC Lite is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Mocha VNC Lite",,,"*\RealVNC\VNC4\*",,,RAT,"","Mocha VNC Lite is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Mocha VNC Lite",,,,"This installs a modified VNC and cannot be blocked by path separate from VNC",,RAT,"","Mocha VNC Lite is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Monitic,"Monitic*",,,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,"api.monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,"app.monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,"devapi.monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,"monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,"turn.monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,"www.monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,,"C:\Program Files\Monitic\*",,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,,"C:\Program Files\Monitic\agent.exe",,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,,"C:\Program Files\Monitic\amon.exe",,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,,"C:\Program Files\Monitic\conf.json",,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +"Mouse Without Borders","Mouse Without Borders*",,,,,RAT,"https://www.microsoft.com/en-us/download/details.aspx?id=35460,https://learn.microsoft.com/windows/powertoys/mouse-without-borders,https://github.com/microsoft/PowerToys/issues/29700","Mouse Without Borders is a Microsoft Garage utility that lets you control up to four Windows computers with a single keyboard and mouse, with clipboard sharing and simple drag-and-drop file transfers. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only." +"Mouse Without Borders","MouseWithoutBorders*",,,,,RAT,"https://www.microsoft.com/en-us/download/details.aspx?id=35460,https://learn.microsoft.com/windows/powertoys/mouse-without-borders,https://github.com/microsoft/PowerToys/issues/29700","Mouse Without Borders is a Microsoft Garage utility that lets you control up to four Windows computers with a single keyboard and mouse, with clipboard sharing and simple drag-and-drop file transfers. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only." +"Mouse Without Borders",,,"C:\Program Files (x86)\Microsoft Garage\Mouse without Borders\*",,,RAT,"https://www.microsoft.com/en-us/download/details.aspx?id=35460,https://learn.microsoft.com/windows/powertoys/mouse-without-borders,https://github.com/microsoft/PowerToys/issues/29700","Mouse Without Borders is a Microsoft Garage utility that lets you control up to four Windows computers with a single keyboard and mouse, with clipboard sharing and simple drag-and-drop file transfers. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only." +MultCloud,"MultCloud*",,,,,RAT,"","MultCloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MultCloud,,,,"requires sign up",,RAT,"","MultCloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyGreenPC,"MyGreenPC*",,,,,RMM,"http://www.mygreenpc.com/","MyGreenPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyGreenPC,,"*.mygreenpc.com",,,,RMM,"http://www.mygreenpc.com/","MyGreenPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyGreenPC,,"mygreenpc.com",,,,RMM,"http://www.mygreenpc.com/","MyGreenPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyGreenPC,,,,"mygreenpc.exe",,RMM,"http://www.mygreenpc.com/","MyGreenPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyIVO,"MyIVO*",,,,,RMM,"https://myivo.com","MyIVO is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyIVO,,"myivo-server.software.informer.com",,,,RMM,"https://myivo.com","MyIVO is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyIVO,,,,"myivomanager.exe",,RMM,"https://myivo.com","MyIVO is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyIVO,,,,"myivomgr.exe",,RMM,"https://myivo.com","MyIVO is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-ABLE Remote Access Software","N-ABLE Remote Access Software*",,,,,RMM,"","N-ABLE Remote Access Software is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-ABLE Remote Access Software","N-ABLERemoteAccessSoftware*",,,,,RMM,"","N-ABLE Remote Access Software is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-ABLE Remote Access Software","N-able*",,,,,RMM,"","N-ABLE Remote Access Software is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-ABLE Remote Access Software",,"n-able.com",,,,RMM,"","N-ABLE Remote Access Software is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent","N-Able Advanced Monitoring Agent*",,,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent","N-AbleAdvancedMonitoringAgent*",,,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.beanywhere.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.cloudbackup.management",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.logicnow.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.n-able.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.remote.management",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.swi-tc.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.system-monitor.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.systemmonitor.co.uk",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.systemmonitor.eu.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.systemmonitor.us",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"beanywhere.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"cloudbackup.management",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"logicnow.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"n-able.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"remote.management",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"system-monitor.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"systemmonitor.co.uk",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"systemmonitor.eu.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"systemmonitor.us",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"systemmonitor.us.cdn.cloudflare.net",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"Agent_*_RW.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"BASEClient.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"BASupApp.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"BASupSrvc.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"BASupSrvcCnfg.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"BASupTSHelper.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"winagent.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,,"Remote Monitoring*",RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,,"N-Able*",RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-able N-central","N-able N-central*",,,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central","N-ableN-central*",,,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central","N-central*",,,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"*.prd.cdo.system-monitor.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"a33d8yamkwy4nx-ats.iot.ap-southeast-2.amazonaws.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"a33d8yamkwy4nx-ats.iot.eu-central-1.amazonaws.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"a33d8yamkwy4nx-ats.iot.eu-west-1.amazonaws.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"a33d8yamkwy4nx-ats.iot.us-west-2.amazonaws.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"comserver.eu1.mspa.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"comserver.global.mspa.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"comserver.us1.mspa.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"comserver.us2.mspa.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"eb.ap-southeast-2.prd.davinci.system-monitor.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"eb.eu-central-1.prd.davinci.system-monitor.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"eb.eu-west-1.prd.davinci.system-monitor.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"eb.us-west-2.prd.davinci.system-monitor.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"feeds.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"releases.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"sis.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"swi-rc.cdn-sw.net",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"update.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,"/Library/MspAgent/*",,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,"/opt/msp-agent/*",,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,"C:\Program Files (x86)\Msp Agent\*",,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,"C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\*",,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,"C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe",,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,,"AgentMaint.exe",,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,,"AgentMonitor.exe",,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,,"BASupTSHelper.exe",,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,,"msp-agent-core.exe",,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"NTR Remote","NTR Remote*",,,,,RMM,"","NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NTR Remote","NTRRemote*",,,,,RMM,"","NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NTR Remote",,"*.ntrsupport.com",,,,RMM,"","NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NTR Remote",,,,"NTRsupportPro_EN.exe",,RMM,"","NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NTR Remote",,,,,"Net Transmit & Receive SL",RMM,"","NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NVDA (Non-Visual Desktop Access)","NVDA*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)","Non-Visual Desktop Access*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,"*.nvaccess.org",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,"nvaccess.org",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,"C:\Program Files (x86)\NVDA\nvda.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,"C:\Program Files\NVDA\nvda.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,"C:\Users\*\AppData\Local\Temp\nvda_*\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,"C:\Users\*\AppData\Roaming\nvda\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,,"nvda.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,,"nvda_*.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,,"nvda_service.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +Naverisk,"Naverisk*",,,,,RMM,"http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents","Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Naverisk,,"naverisk.com",,,,RMM,"http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents","Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Naverisk,,,,"AgentSetup-*.exe",,RMM,"http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents","Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Naverisk,,,,,"NavMK1 Limited*",RMM,"http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents","Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Naverisk,,,,,"naverisk*",RMM,"http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents","Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Net Monitor for Employees","Net Monitor for Employees*",,,,,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees","NetMonitorforEmployees*",,,,,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,"C:\Program Files (x86)\Net Monitor for Employees Pro\*",,,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,"C:\Program Files\Net Monitor for Employees Pro\*",,,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,,"nmep_agtconfig.exe",,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,,"nmep_ctrlagent.exe",,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,,"nmep_ctrlagentsvc.exe",,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,,"winpty-agent.exe",,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,,"winpty-agent64.exe",,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +NetBird,"NetBird*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"*.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"192.3.95.152",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"198.46.178.135",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"api.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"app.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"cloud-233f9.firebaseapp.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"cloud-ed980.firebaseapp.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"googl-165a0.web.app",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"googl-6c11f.firebaseapp.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"googl-6c11f.web.app",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"login.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"my-sharepoint-inc.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"my1cloudlive.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"my2cloudlive.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"pkgs.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"relay.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"signal.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"web-16fe.app",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"/Applications/NetBird UI.app",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"/etc/netbird/install.conf",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"/opt/netbird/*",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"/usr/bin/netbird",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"/usr/local/bin/netbird",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\Program Files\Netbird\netbird-ui.exe",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\Program Files\Netbird\netbird.exe",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\ProgramData\Netbird\*",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\bin\OpenSSH.msi",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\bin\cis.vbs",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\bin\netbird.msi",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\bin\trm.zip",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\temper\trm",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,,netbird,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,,"netbird-ui.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,,"netbird.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +"NetLock RMM","NetLock RMM*",,,,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM","NetLockRMM*",,,,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"/Library/Application Support/0x101_Cyber_Security/*",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"/usr/0x101_Cyber_Security/Netlock_RMM/*",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"/usr/local/bin/0x101_Cyber_Security/Netlock_RMM/*",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"/var/0x101_Cyber_Security/*",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"C:\Program Files\0x101 Cyber Security\NetLock RMM\UserAgent\NetLock_RMM_User_Process.exe",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"C:\Program Files\0x101 Cyber Security\NetLock RMM\UserAgent\NetLock_RMM_User_UAC.exe",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"C:\ProgramData\0x101 Cyber Security\NetLock RMM\Comm Agent\*",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,,"NetLock_RMM_Agent_Installer",,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,,"NetLock_RMM_Agent_Installer.exe",,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +NetMaster,"NetMaster*",,,,,RMM,"https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/README.md,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/ClientInstaller/installer.bat,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Core.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Command.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Log.cpp","NetMaster is an open-source Windows remote-management project with a self-hosted PHP panel and a Windows service client. Its source implements command execution, screen sharing, file transfer/download, and RDP actions. No public malicious deployment was established in this source-focused review." +NetMaster,,,"C:\ProgramData\NetMaster\NetMaster_Client.exe",,,RMM,"https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/README.md,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/ClientInstaller/installer.bat,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Core.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Command.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Log.cpp","NetMaster is an open-source Windows remote-management project with a self-hosted PHP panel and a Windows service client. Its source implements command execution, screen sharing, file transfer/download, and RDP actions. No public malicious deployment was established in this source-focused review." +NetMaster,,,"C:\ProgramData\NetMaster\config.ini",,,RMM,"https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/README.md,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/ClientInstaller/installer.bat,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Core.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Command.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Log.cpp","NetMaster is an open-source Windows remote-management project with a self-hosted PHP panel and a Windows service client. Its source implements command execution, screen sharing, file transfer/download, and RDP actions. No public malicious deployment was established in this source-focused review." +"NetSupport Manager","NetSupport Manager*",,,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager","NetSupport*",,,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager","NetSupportManager*",,,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,"*.netsupportmanager.com",,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,"geo.netsupportsoftware.com",,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,"netsupportmanager.com",,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,,,"client32.exe",,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,,,"pcicfgui.exe",,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,,,"pcictlui.exe",,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,,,"remcmdstub.exe",,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,,,,netsupport,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +Netop,"Netop*",,,,,RMM,"","Netop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netop,,,"*\Danware Data\NetOp Packn Deploy\*",,,RMM,"","Netop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netop,,,"*\Netop Remote Control\*",,,RMM,"","Netop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netop,,,"C:\Program Files\Danware Data\NetOp Packn Deploy\*",,,RMM,"","Netop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)","Impero Connect*",,,,,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)","Netop Remote Control*",,,,,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)","NetopRemoteControl*",,,,,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,"*.connect.backdrop.cloud",,,,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,"*.netop.com",,,,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"Connect.Backdrop.cloud*.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"ImperoClientSVC.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"ImperoInit.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"Netop Ondemand.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"ngstw32.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"nhostsvc.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"nhstw32.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"nldrw32.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"rmserverconsolemediator.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,,"Impero Connect*",RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,,"Impero Solutions*",RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)","Netop Remote Control*",,,,,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)","NetopRemoteControl*",,,,,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)","aka Impero Connect*",,,,,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)",,,,"nhostsvc.exe",,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)",,,,"nhstw32.exe",,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)",,,,"nldrw32.exe",,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)",,,,"rmserverconsolemediator.exe",,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)",,,,,"Impero Connect*",RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)",,,,,"Impero Solutions*",RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netreo,"Netreo*",,,,,RMM,"https://solutions.netreo.com/docs/firewall-requirements","Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netreo,,"*.api.netreo.com",,,,RMM,"https://solutions.netreo.com/docs/firewall-requirements","Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netreo,,"activation.netreo.net",,,,RMM,"https://solutions.netreo.com/docs/firewall-requirements","Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netreo,,"charon.netreo.net",,,,RMM,"https://solutions.netreo.com/docs/firewall-requirements","Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netreo,,"netreo.com",,,,RMM,"https://solutions.netreo.com/docs/firewall-requirements","Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Neturo,"Neturo*",,,,,RMM,"http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2","Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Neturo,,"neturo.uplus.co.kr",,,,RMM,"http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2","Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Neturo,,,,"neturo*.exe",,RMM,"http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2","Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Neturo,,,,"neturo.exe",,RMM,"http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2","Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Neturo,,,,"ntrntservice.exe",,RMM,"http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2","Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netviewer,"Netviewer*",,,,,RMM,"","Netviewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netviewer,,,,"netviewer*.exe",,RMM,"","Netviewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netviewer,,,,"netviewer.exe",,RMM,"","Netviewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)","GoToMeet*",,,,,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)","Netviewer*",,,,,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)",,"*.netviewer.com",,,,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)",,"netviewer.com",,,,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)",,,,"NetViewer.exe",,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)",,,,"nvClient.exe",,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)",,,,"nvConsole.exe",,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)",,,,,"Algorius*",RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Nexus RMM (Scogo)","Nexus RMM*",,,,,RMM,"https://scogo.ai/,https://scogo.ai/blog/scogo-ai-is-now-available-on-microsoft-marketplace","Nexus RMM is Scogo's endpoint-management product. Scogo describes its platform as providing direct device intelligence, endpoint telemetry, patching, vulnerability detection, compliance enforcement, and remote management. This entry records the vendor-associated Windows Nexus RMM Agent metadata reviewed in the census. The census establishes product identity only; it does not establish delivery, abuse, victim impact, or actor attribution." +"Nexus RMM (Scogo)","NexusRMM*",,,,,RMM,"https://scogo.ai/,https://scogo.ai/blog/scogo-ai-is-now-available-on-microsoft-marketplace","Nexus RMM is Scogo's endpoint-management product. Scogo describes its platform as providing direct device intelligence, endpoint telemetry, patching, vulnerability detection, compliance enforcement, and remote management. This entry records the vendor-associated Windows Nexus RMM Agent metadata reviewed in the census. The census establishes product identity only; it does not establish delivery, abuse, victim impact, or actor attribution." +"Nexus RMM (Scogo)","Scogo*",,,,,RMM,"https://scogo.ai/,https://scogo.ai/blog/scogo-ai-is-now-available-on-microsoft-marketplace","Nexus RMM is Scogo's endpoint-management product. Scogo describes its platform as providing direct device intelligence, endpoint telemetry, patching, vulnerability detection, compliance enforcement, and remote management. This entry records the vendor-associated Windows Nexus RMM Agent metadata reviewed in the census. The census establishes product identity only; it does not establish delivery, abuse, victim impact, or actor attribution." +"Nexus RMM (Scogo)",,,,"nexusrmm.exe",,RMM,"https://scogo.ai/,https://scogo.ai/blog/scogo-ai-is-now-available-on-microsoft-marketplace","Nexus RMM is Scogo's endpoint-management product. Scogo describes its platform as providing direct device intelligence, endpoint telemetry, patching, vulnerability detection, compliance enforcement, and remote management. This entry records the vendor-associated Windows Nexus RMM Agent metadata reviewed in the census. The census establishes product identity only; it does not establish delivery, abuse, victim impact, or actor attribution." +Nezha,"Nezha*",,,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"c.mid.al",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"gd.bj2.xyz",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"github.com",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"nezha.wiki",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"nezhahq.github.io",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"raw.githubusercontent.com",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"rism.pages.dev",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"*\nezha-agent.exe",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"/etc/systemd/system/nezha-agent.service",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"/etc/systemd/system/nezha-dashboard.service",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"/opt/nezha/*",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"/opt/nezha/agent",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"/opt/nezha/agent/nezha-agent",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"/opt/nezha/dashboard",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"C:\Program Files\nezha\*",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"C:\nezha\*",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,,"dashboard-windows-amd64.exe",,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,,"nezha-agent",,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,,"nezha-agent.exe",,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,,"nezha_agent",,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +"NinjaOne (formerly NinjaRMM)","NinjaOne*",,,,,RMM,"","NinjaOne (formerly NinjaRMM) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NinjaOne (formerly NinjaRMM)","formerly NinjaRMM*",,,,,RMM,"","NinjaOne (formerly NinjaRMM) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NinjaOne (formerly NinjaRMM)",,,"*ProgramData\NinjaRMMAgent\*",,,RMM,"","NinjaOne (formerly NinjaRMM) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,"NinjaRMM*",,,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.ninja-backup.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.ninjaone.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.ninjarmm.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.ninjarmm.net",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.rmmservice.ca",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.rmmservice.com.au",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.rmmservice.eu",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"ninja-backup.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"ninjaone.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"ninjarmm.net",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"resources.ninjarmm.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"rmmservice.ca",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"rmmservice.com.au",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"rmmservice.eu",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,,,"NinjaRMMAgent.exe",,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,,,"NinjaRMMAgentPatcher.exe",,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,,,"ninjarmm-cli.exe",,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,,,,"Ninja MSP*",RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,,,,"NinjaRMM*",RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NoMachine,"NoMachine*",,,,,RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NoMachine,,"nomachine.com",,,,RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NoMachine,,,,"nomachine*.exe",,RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NoMachine,,,,"nxd.exe",,RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NoMachine,,,,"nxservice*.exe",,RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NoMachine,,,,,"NoMachine*",RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NordLocker,"NordLocker*",,,,,RAT,"","NordLocker is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NordLocker,,,,,NordLocker,RAT,"","NordLocker is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NordLocker,,,,,"NordSec Update Service",RAT,"","NordLocker is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NordLocker,,,,,"nordvpn*",RAT,"","NordLocker is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NoteOn-desktop sharing","NoteOn-desktop sharing*",,,,,RAT,"","NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NoteOn-desktop sharing","NoteOn-desktopsharing*",,,,,RAT,"","NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NoteOn-desktop sharing",,,,"nateon*.exe",,RAT,"","NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NoteOn-desktop sharing",,,,"nateon.exe",,RAT,"","NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NoteOn-desktop sharing",,,,"nateonmain.exe",,RAT,"","NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory","OCS inventory*",,,,,RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory","OCSinventory*",,,,,RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory",,"ocsinventory-ng.org",,,,RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory",,,,"ocsinventory.exe",,RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory",,,,"ocsservice.exe",,RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory",,,,,"OcsPackager*",RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory",,,,,"Ocs Inventory*",RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Obliance,"Obliance*",,,,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/Library/LaunchDaemons/com.obliance.agent.plist",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/etc/obliance-agent/config.json",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/etc/systemd/system/obliance-agent.service",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/etc/systemd/system/obliance-watchdog.service",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/opt/obliance-agent/obliance-agent",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/usr/local/bin/obliance-agent",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/var/log/obliance-agent.log",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"C:\Program Files\OblianceAgent\obliance-agent.exe",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"C:\Program Files\OblianceAgent\obliance-tray.exe",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"C:\Program Files\OblianceAgent\obliance-watchdog.exe",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"C:\ProgramData\OblianceAgent\agent.log",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"C:\ProgramData\OblianceAgent\config.json",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"C:\ProgramData\OblianceAgent\watchdog.json",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Onionshare,"Onionshare*",,,,,RAT,"","Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Onionshare,,,"*\OnionShare\*",,,RAT,"","Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Onionshare,,,"*\onionshare*.exe",,,RAT,"","Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Onionshare,,,"C:\Program Files (x86)\OnionShare\*",,,RAT,"","Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Onionshare,,,,"OnionShare-win*.msi",,RAT,"","Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Opale,"Opale*",,,,,RMM,"https://github.com/4rtefakt/opale,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/README.md,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/INSTALL.md,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/branding/branding.go,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/config.go,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/install.ps1","Opale is an open-source, self-hosted remote monitoring and management platform. Its documented deployment uses a controller hosted by the organization and a Go Windows agent that enrolls with that controller, reports inventory, executes dispatched scripts, and supports signed agent updates. The public repository contains Linux and macOS agent-service code and cross-platform release assets, but its current README says endpoint management is Windows-only; this entry therefore records Windows as the supported endpoint platform." +Opale,,,"C:\ProgramData\Opale\opale-agent.exe",,,RMM,"https://github.com/4rtefakt/opale,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/README.md,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/INSTALL.md,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/branding/branding.go,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/config.go,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/install.ps1","Opale is an open-source, self-hosted remote monitoring and management platform. Its documented deployment uses a controller hosted by the organization and a Go Windows agent that enrolls with that controller, reports inventory, executes dispatched scripts, and supports signed agent updates. The public repository contains Linux and macOS agent-service code and cross-platform release assets, but its current README says endpoint management is Windows-only; this entry therefore records Windows as the supported endpoint platform." +"OpenDesk RMM Agent","OpenDesk RMM Agent*",,,,,RMM,"https://github.com/nextcoreti/opendesk-rmm-agent,https://github.com/nextcoreti/opendesk-rmm-agent/releases/tag/v2.10.24,https://github.com/nextcoreti/opendesk-rmm-agent/releases/download/v2.10.24/OpenDesk-RMM-Agent.exe","OpenDesk RMM Agent is a remote monitoring and management agent from NextCore TI. Its first-party release repository documents Windows and Linux support; the reviewed Windows release is a signed OpenDesk RMM Agent binary." +"OpenDesk RMM Agent","OpenDeskRMMAgent*",,,,,RMM,"https://github.com/nextcoreti/opendesk-rmm-agent,https://github.com/nextcoreti/opendesk-rmm-agent/releases/tag/v2.10.24,https://github.com/nextcoreti/opendesk-rmm-agent/releases/download/v2.10.24/OpenDesk-RMM-Agent.exe","OpenDesk RMM Agent is a remote monitoring and management agent from NextCore TI. Its first-party release repository documents Windows and Linux support; the reviewed Windows release is a signed OpenDesk RMM Agent binary." +"OpenDesk RMM Agent",,,,"OpenDesk-RMM-Agent.exe",,RMM,"https://github.com/nextcoreti/opendesk-rmm-agent,https://github.com/nextcoreti/opendesk-rmm-agent/releases/tag/v2.10.24,https://github.com/nextcoreti/opendesk-rmm-agent/releases/download/v2.10.24/OpenDesk-RMM-Agent.exe","OpenDesk RMM Agent is a remote monitoring and management agent from NextCore TI. Its first-party release repository documents Windows and Linux support; the reviewed Windows release is a signed OpenDesk RMM Agent binary." +"OpenDesk RMM Agent",,,,"opendesk-rmm-agent.exe",,RMM,"https://github.com/nextcoreti/opendesk-rmm-agent,https://github.com/nextcoreti/opendesk-rmm-agent/releases/tag/v2.10.24,https://github.com/nextcoreti/opendesk-rmm-agent/releases/download/v2.10.24/OpenDesk-RMM-Agent.exe","OpenDesk RMM Agent is a remote monitoring and management agent from NextCore TI. Its first-party release repository documents Windows and Linux support; the reviewed Windows release is a signed OpenDesk RMM Agent binary." +OpenUEM,"OpenUEM*",,,,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +OpenUEM,,,"/Library/OpenUEMAgent/etc/openuem-agent/openuem.ini",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +OpenUEM,,,"/etc/openuem-agent/openuem.ini",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +OpenUEM,,,"/var/log/openuem-agent/openuem-agent.log",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +OpenUEM,,,"C:\Program Files\OpenUEM Agent\*",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +OpenUEM,,,"C:\Program Files\OpenUEM Agent\config\openuem.ini",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +OpenUEM,,,"C:\Program Files\OpenUEM Agent\logs\openuem-log.txt",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +"OpsBridge Agent","OpsBridge Agent*",,,,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name." +"OpsBridge Agent","OpsBridgeAgent*",,,,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name." +"OpsBridge Agent",,"opsbridge.digital",,,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name." +"OpsBridge Agent",,,"C:\Program Files\OpsBridge\OpsBridgeAgent.exe",,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name." +"OpsBridge Agent",,,"C:\ProgramData\OpsBridge\*",,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name." +"OpsBridge Agent",,,"C:\Windows\System32\Tasks\OpsBridge Agent",,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name." +OptiTune,"OptiTune*",,,,,RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +OptiTune,,"*.opti-tune.com",,,,RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +OptiTune,,"*.optitune.us",,,,RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +OptiTune,,,,"OTPowerShell.exe",,RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +OptiTune,,,,"OTService.exe",,RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +OptiTune,,,,,"OptiTune*",RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +OptiTune,,,,,"Bravura Software*",RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Overlord,"Overlord*",,,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,"*.ngrok-free.app",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,"*.ngrok.app",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,"*.ngrok.com",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,"*.ngrok.io",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,"pandoramods.top",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,"savaliyapriyal874-code.github.io",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Microsoft\DeviceSync\agent-*.tmp",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Microsoft\DeviceSync\ovd_*.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Microsoft\DeviceSync\svchost.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-*.tmp",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ovd_*.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Overlord\agent.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\agent-windows-amd64-*.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\svchost-windows-amd64-*.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,,"ovd_*.exe",,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +PChelpware,"PChelpware*",,,,,RMM,"https://uvnc.com/downloads/pchelpware/","PChelpware (also known as PCHelpWare) is a free and open-source remote support and remote desktop software developed by the UltraVNC team. Built on VNC technology and following the RFB protocol, PChelpware is designed specifically for remote technical support scenarios, virtual training, and helpdesk operations." +PChelpware,,,"*\PcHelpWare_viewer.exe",,,RMM,"https://uvnc.com/downloads/pchelpware/","PChelpware (also known as PCHelpWare) is a free and open-source remote support and remote desktop software developed by the UltraVNC team. Built on VNC technology and following the RFB protocol, PChelpware is designed specifically for remote technical support scenarios, virtual training, and helpdesk operations." +"PDQ Connect","PDQ Connect*",,,,,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect","PDQConnect*",,,,,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,"app.pdq.com",,,,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,"cfcdn.pdq.com",,,,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,"pdqinstallers.*.r2.cloudflarestorage.com",,,,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,,,"PDQConnectUpdater-*.msi",,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,,,"pdq-connect*.exe",,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,,,,"PDQConnectAgent*",RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,,,,"PDQ.com*",RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)","Pandora RC*",,,,,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)","PandoraRC*",,,,,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)","eHorus*",,,,,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)",,"portal.ehorus.com",,,,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)",,,,"ehorus standalone.exe",,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)",,,,"ehorus_agent.exe",,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)",,,,,"eHorus*",RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Panorama9,"Panorama9*",,,,,RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Panorama9,,"changes.panorama9.com",,,,RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Panorama9,,"panorama9.com",,,,RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Panorama9,,"trusted.panorama9.com",,,,RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Panorama9,,,,"p9agent*.exe",,RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Panorama9,,,,,"Panorama9*",RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Parsec,"Parsec*",,,,,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Parsec,,"*.parsec.app",,,,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Parsec,,"parsec.app",,,,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Parsec,,"parsec.gg",,,,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Parsec,,,"C:\Program Files\Parsec\*",,,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Parsec,,,,"parsecd.exe",,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Parsec,,,,"pservice.exe",,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Pcnow,"Pcnow*",,,,,RMM,"http://pcnow.webex.com/ - DOA as of 2024","Pcnow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcnow,,,,"mwcliun.exe",,RMM,"http://pcnow.webex.com/ - DOA as of 2024","Pcnow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcnow,,,,"pcnmgr.exe",,RMM,"http://pcnow.webex.com/ - DOA as of 2024","Pcnow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcnow,,,,"webexpcnow.exe",,RMM,"http://pcnow.webex.com/ - DOA as of 2024","Pcnow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,"Pcvisit*",,,,,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,"*.pcvisit.de",,,,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,"pcvisit.de",,,,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,,,"pcvisit-easysupport.exe",,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,,,"pcvisit.exe",,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,,,"pcvisit_client.exe",,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,,,"pcvisit_service_client.exe",,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,,,,"pcvisit*",RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,"Pilixo*",,,,,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,,"*.pilixo.com",,,,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,,"download.pilixo.com",,,,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,,"pilixo.com",,,,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,,,,"Pilixo_Installer*.exe",,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,,,,"rdp.exe",,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,,,,,"Pilixo*",RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Cloud (Wyse)","Pocket Cloud*",,,,,RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Cloud (Wyse)","PocketCloud*",,,,,RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Cloud (Wyse)","Wyse*",,,,,RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Cloud (Wyse)",,,,"pocketcloud*.exe",,RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Cloud (Wyse)",,,,"pocketcloudservice.exe",,RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Cloud (Wyse)",,,,,"PocketCloud*",RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller","Pocket Controller*",,,,,RMM,"","Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller","PocketController*",,,,,RMM,"","Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller",,,,"pocketcloudservice.exe",,RMM,"","Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller",,,,"pocketcontroller.exe",,RMM,"","Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller",,,,"wysebrowser.exe",,RMM,"","Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)","Pocket Controller*",,,,,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)","PocketController*",,,,,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)","Soti Xsight*",,,,,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)",,"*.soti.net",,,,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)",,"soti.net",,,,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)",,,,"XSightService.exe",,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)",,,,"pocketcontroller.exe",,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)",,,,"wysebrowser.exe",,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)",,,,,"Pocket Controller*",RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ProxiPort,"ProxiPort*",,,,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort." +ProxiPort,,,"/etc/proxiport/proxiport.conf",,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort." +ProxiPort,,,"/lib/systemd/system/proxiport.service",,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort." +ProxiPort,,,"/usr/bin/proxiport",,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort." +ProxiPort,,,"C:\Program Files\ProxiPort\proxiport.conf",,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort." +ProxiPort,,,"C:\Program Files\ProxiPort\proxiport.exe",,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort." +Pulseway,"Pulseway*",,,,,RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pulseway,,"pulseway.com",,,,RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pulseway,,,,"PCMonitorManager.exe",,RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pulseway,,,,"pcmonitorsrv.exe",,RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pulseway,,,,,"MMSoft Design*",RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pulseway,,,,,"Pulseway*",RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance","QQ IM-remote assistance*",,,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance","QQIM-remoteassistance*",,,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,"*.desktop.qq.com",,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,"*.mdt.qq.com",,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,"qq-messenger.en.softonic.com",,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,"upload_data.qq.com",,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,,,"QQProtect.exe",,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,,,"qq.exe",,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,,,"qqpcmgr.exe",,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,,,,"QQ*",RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,,,,"Tencent*",RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quest KACE Agent (formerly Dell KACE)","Quest KACE Agent*",,,,,RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quest KACE Agent (formerly Dell KACE)","QuestKACEAgent*",,,,,RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quest KACE Agent (formerly Dell KACE)","formerly Dell KACE*",,,,,RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quest KACE Agent (formerly Dell KACE)",,"*.kace.com",,,,RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quest KACE Agent (formerly Dell KACE)",,,,"konea.exe",,RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quest KACE Agent (formerly Dell KACE)",,,,,"KACE Agent*",RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quick Assist","Quick Assist*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/46","Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quick Assist","QuickAssist*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/46","Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quick Assist",,"*.support.services.microsoft.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/46","Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quick Assist",,,,"quickassist.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/46","Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,"RAdmin*",,,,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,"radmin.com",,,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,,"C:\Program Files (x86)\Radmin Viewer 3\Radmin.exe",,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,,"C:\Windows\SysWOW64\rserver30\FamItrf2",,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,,"C:\Windows\SysWOW64\rserver30\FamItrfc",,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,,"C:\Windows\SysWOW64\rserver30\rserver3.exe",,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,,,,"radmin*",RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,,,,"famatech*",RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RDCMan,"RDCMan*",,,,,RAT,"https://learn.microsoft.com/en-us/sysinternals/downloads/rdcman,https://dirteam.com/sander/2021/06/24/remote-desktop-connection-manager-rdcman-is-back/,https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-0765","Remote Desktop Connection Manager (RDCMan) is a free Microsoft tool developed by Julian Burger for managing multiple remote desktop connections from a single interface. Part of the Sysinternals suite, RDCMan enables IT administrators, system administrators, server lab managers, developers, and testers to organize, group, and control numerous RDP sessions efficiently. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only." +RDCMan,,,"*\RDCMan-x86.exe",,,RAT,"https://learn.microsoft.com/en-us/sysinternals/downloads/rdcman,https://dirteam.com/sander/2021/06/24/remote-desktop-connection-manager-rdcman-is-back/,https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-0765","Remote Desktop Connection Manager (RDCMan) is a free Microsoft tool developed by Julian Burger for managing multiple remote desktop connections from a single interface. Part of the Sysinternals suite, RDCMan enables IT administrators, system administrators, server lab managers, developers, and testers to organize, group, and control numerous RDP sessions efficiently. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only." +RDCMan,,,"*\RDCMan.exe",,,RAT,"https://learn.microsoft.com/en-us/sysinternals/downloads/rdcman,https://dirteam.com/sander/2021/06/24/remote-desktop-connection-manager-rdcman-is-back/,https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-0765","Remote Desktop Connection Manager (RDCMan) is a free Microsoft tool developed by Julian Burger for managing multiple remote desktop connections from a single interface. Part of the Sysinternals suite, RDCMan enables IT administrators, system administrators, server lab managers, developers, and testers to organize, group, and control numerous RDP sessions efficiently. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only." +RDPView,"RDPView*",,,,,RAT,"","RDPView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RDPView,,,,"dwrcs.exe",,RAT,"","RDPView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager","RES Automation Manager*",,,,,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager","RESAutomationManager*",,,,,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager",,"ivanti.com",,,,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager",,,,"wisshell*.exe",,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager",,,,"wmc.exe",,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager",,,,"wmc_deployer.exe",,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager",,,,"wmcsvc.exe",,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RG System (RG Supervision)","RG Supervision*",,,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)","RG System*",,,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)","RGSystem*",,,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)",,"api.rg-supervision.com",,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)",,"dashboard.rg-supervision.com",,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)",,"lisa.rg-supervision.com",,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)",,,"C:\Program Files (x86)\RG-Supervision\*",,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)",,,"C:\Program Files\RG-Supervision\*",,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +RMMCRAT,"RMMCRAT*",,,,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst,https://github.com/pandare9x/Yara-Rules/blob/main/SEOPoison/rmmcrat.yar","RMMCRAT is the researchers' name, also written RMMcRAT, for a custom Windows C++ remote-access payload masquerading as an RMM agent. Threat Hunting Labs and MalBear Labs documented it as rmm.exe in an RVTools SEO poisoning intrusion. It registers hosts, reports system inventory, receives package tasks, and accepts a remote stop command. It is malicious custom tooling, not an established legitimate RMM product, and is distinct from LightRmmAgent and RemoteAgentAgent." +RMMCRAT,,"softbymade.top",,,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst,https://github.com/pandare9x/Yara-Rules/blob/main/SEOPoison/rmmcrat.yar","RMMCRAT is the researchers' name, also written RMMcRAT, for a custom Windows C++ remote-access payload masquerading as an RMM agent. Threat Hunting Labs and MalBear Labs documented it as rmm.exe in an RVTools SEO poisoning intrusion. It registers hosts, reports system inventory, receives package tasks, and accepts a remote stop command. It is malicious custom tooling, not an established legitimate RMM product, and is distinct from LightRmmAgent and RemoteAgentAgent." +RMMCRAT,,,"C:\ProgramData\RMMAgent\*",,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst,https://github.com/pandare9x/Yara-Rules/blob/main/SEOPoison/rmmcrat.yar","RMMCRAT is the researchers' name, also written RMMcRAT, for a custom Windows C++ remote-access payload masquerading as an RMM agent. Threat Hunting Labs and MalBear Labs documented it as rmm.exe in an RVTools SEO poisoning intrusion. It registers hosts, reports system inventory, receives package tasks, and accepts a remote stop command. It is malicious custom tooling, not an established legitimate RMM product, and is distinct from LightRmmAgent and RemoteAgentAgent." +RMMmax,"RMMmax*",,,,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RMMmax,,"api.rmmmax.com",,,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RMMmax,,,"%ProgramData%\rmmmax\AgentService\RMMmaxAgentService.exe",,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RMMmax,,,"/Applications/RMMmax Agent.app/Contents/MacOS/RMMmax Agent",,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RMMmax,,,"/usr/local/bin/rmmmax-agent",,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RMMmax,,,"/var/rmmmax/agentservice/rmmmax_agent.py",,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RMMmax,,,,"RMMmaxAgentSetup.exe",,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RPort,"RPort*",,,,,RMM,"https://kb.rport.io/using-the-remote-access","RPort is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RPort,,"rport.io",,,,RMM,"https://kb.rport.io/using-the-remote-access","RPort is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RPort,,,,"rport.exe",,RMM,"https://kb.rport.io/using-the-remote-access","RPort is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RdClient,"RdClient*",,,,,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer." +RdClient,,,"C:\Program Files (x86)\RdClient\*",,,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer." +RdClient,,,"C:\Program Files\RdClient\*",,,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer." +RdClient,,,,"RdClientInstaller.exe",,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer." +RdClient,,,,"SupportTool.exe",,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer." +RdClient,,,,"rdclient.exe",,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer." +RealVNC,"RealVNC*",,,,,RAT,"","RealVNC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RealVNC,,,,,"realvnc*",RAT,"","RealVNC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemSupp,"RemSupp*",,,,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com." +RemSupp,,"api.remsupp.com",,,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com." +RemSupp,,"download.remsupp.com",,,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com." +RemSupp,,,"C:\Users\*\AppData\Local\Programs\RemSupp\RemSupp.exe",,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com." +RemSupp,,,"C:\Users\*\AppData\Local\Programs\RemSupp\Uninstall RemSupp.exe",,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com." +RemSupp,,,"C:\Users\*\AppData\Local\remsupp-updater\installer.exe",,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com." +Remcos,"Remcos*",,,,,RMM,"","Remcos is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remcos,,,,"remcos*.exe",,RMM,"","Remcos is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remmina,"Remmina*",,,,,RAT,"","Remmina is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remmon,"Remmon*",,,,,RMM,"https://remmon.hu","Remmon is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remmon,,"*.remmon.hu",,,,RMM,"https://remmon.hu","Remmon is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remmon,,"remmon.hu",,,,RMM,"https://remmon.hu","Remmon is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remmon,,,,"remmon.exe",,RMM,"https://remmon.hu","Remmon is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remobo,"Remobo*",,,,,RMM,"https://www.remobo.com - DOA as of 2024","Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remobo,,"remobo.en.softonic.com",,,,RMM,"https://www.remobo.com - DOA as of 2024","Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remobo,,,,"remobo.exe",,RMM,"https://www.remobo.com - DOA as of 2024","Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remobo,,,,"remobo_client.exe",,RMM,"https://www.remobo.com - DOA as of 2024","Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remobo,,,,"remobo_tracker.exe",,RMM,"https://www.remobo.com - DOA as of 2024","Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Manager (Devolutions)","Devolutions*",,,,,RAT,"","Remote Desktop Manager (Devolutions) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Manager (Devolutions)","Remote Desktop Manager*",,,,,RAT,"","Remote Desktop Manager (Devolutions) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Manager (Devolutions)","RemoteDesktopManager*",,,,,RAT,"","Remote Desktop Manager (Devolutions) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Plus","Remote Desktop Plus*",,,,,RAT,"https://www.donkz.nl/","Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Plus","RemoteDesktopPlus*",,,,,RAT,"https://www.donkz.nl/","Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Plus",,"donkz.nl",,,,RAT,"https://www.donkz.nl/","Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Plus",,,,"rdp.exe",,RAT,"https://www.donkz.nl/","Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Plus",,,,,"Remote Desktop Plus*",RAT,"https://www.donkz.nl/","Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Manipulator System","Remote Manipulator System*",,,,,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Manipulator System","RemoteManipulatorSystem*",,,,,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Manipulator System",,"*.internetid.ru",,,,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Manipulator System",,"rmansys.ru",,,,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Manipulator System",,,,"rfusclient.exe",,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Manipulator System",,,,"rutserv.exe",,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Ripple","Remote Ripple*",,,,,RMM,"https://remoteripple.com","Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control." +"Remote Ripple","RemoteRipple*",,,,,RMM,"https://remoteripple.com","Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control." +"Remote Ripple",,,"C:\Program Files (x86)\Remote Ripple\*",,,RMM,"https://remoteripple.com","Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control." +"Remote Ripple",,,"C:\Program Files\Remote Ripple\*",,,RMM,"https://remoteripple.com","Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control." +"Remote Ripple",,,,"RemoteRipple.exe",,RMM,"https://remoteripple.com","Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control." +"Remote Utilities","Remote Utilities*",,,,,RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Utilities","RemoteUtilities*",,,,,RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Utilities",,"*.internetid.ru",,,,RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Utilities",,,,"rutserv.exe",,RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Utilities",,,,"rutview.exe",,RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Utilities",,,,,"Remote Utilities*",RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it","Remote.it*",,,,,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it",,"api.remote.it",,,,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it",,"auth.api.remote.it",,,,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it",,"remote.it",,,,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it",,,,"remote-it-installer.exe",,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it",,,,"remote.it.exe",,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it",,,,"remoteit.exe",,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteAgentAgent,"RemoteAgentAgent*",,,,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst","RemoteAgentAgent is malicious custom Windows remote-management tooling documented in an RVTools SEO poisoning intrusion by Threat Hunting Labs and MalBear Labs. Its PyInstaller-packaged Python service registers a device, polls for tasks, runs server-supplied PowerShell commands, and returns output and exit status. It was installed through RemoteAgent.msi and NSSM as a SYSTEM service. No independent legitimate vendor was established. This agent is separate from LightRmmAgent, RMMCRAT, and unrelated products named RemoteAgent." +RemoteAgentAgent,,"app-af-agent-prod-009.azurewebsites.net",,,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst","RemoteAgentAgent is malicious custom Windows remote-management tooling documented in an RVTools SEO poisoning intrusion by Threat Hunting Labs and MalBear Labs. Its PyInstaller-packaged Python service registers a device, polls for tasks, runs server-supplied PowerShell commands, and returns output and exit status. It was installed through RemoteAgent.msi and NSSM as a SYSTEM service. No independent legitimate vendor was established. This agent is separate from LightRmmAgent, RMMCRAT, and unrelated products named RemoteAgent." +RemoteAgentAgent,,,"C:\Program Files\RemoteAgent\RemoteAgentAgent.exe",,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst","RemoteAgentAgent is malicious custom Windows remote-management tooling documented in an RVTools SEO poisoning intrusion by Threat Hunting Labs and MalBear Labs. Its PyInstaller-packaged Python service registers a device, polls for tasks, runs server-supplied PowerShell commands, and returns output and exit status. It was installed through RemoteAgent.msi and NSSM as a SYSTEM service. No independent legitimate vendor was established. This agent is separate from LightRmmAgent, RMMCRAT, and unrelated products named RemoteAgent." +RemoteCall,"RemoteCall*",,,,,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,"*.remotecall.com",,,,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,"*.startsupport.com",,,,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,"remotecall.com",,,,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"agentu.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"raautoup.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"rcengmgru.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"rcmgrsvc.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"rcstartsupport.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"remotesupportplayeru.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"rxstartsupport.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,,"RSUPPORT*",RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,"RemotePC*",,,,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,"*.remotedesktop.com",,,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,"*.remotepc.com",,,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,"remotepc.com",,,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,"www.remotepc.com",,,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,"*\RemotePCService.exe",,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,"*\RemotePC\*",,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,"C:\Program Files (x86)\RemotePC\*",,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"Idrive.File-Transfer",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"RemotePC.exe",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"RemotePCService.exe",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"idrive.RemotePCAgent",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"remotepchost.exe",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"remotepcservice.exe",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"rpcsuite.exe",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,,"remotepc*",RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,,"remotedesktop*",RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePass,"RemotePass*",,,,,RMM,"https://www.remotepass.com/rpaccess.html - DOA as of 2024","RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePass,,"remotepass.com",,,,RMM,"https://www.remotepass.com/rpaccess.html - DOA as of 2024","RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePass,,,,"remotepass-access.exe",,RMM,"https://www.remotepass.com/rpaccess.html - DOA as of 2024","RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePass,,,,"rpaccess.exe",,RMM,"https://www.remotepass.com/rpaccess.html - DOA as of 2024","RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePass,,,,"rpwhostscr.exe",,RMM,"https://www.remotepass.com/rpaccess.html - DOA as of 2024","RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePulse,"RemotePulse*",,,,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,"remotepulse.io",,,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,"www.remotepulse.io",,,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,,"C:\Program Files (x86)\RemotePulseAgent\InstallCore.exe",,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,,"C:\Program Files (x86)\RemotePulseAgent\agent.ps1",,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,,"C:\Program Files (x86)\RemotePulseAgent\defender-exclude.ps1",,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,,"C:\Program Files (x86)\RemotePulseAgent\install.cmd",,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,,"C:\Program Files (x86)\RemotePulseAgent\install.ps1",,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemoteUtilities,"RemoteUtilities*",,,,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,"remoteutilities.com",,,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,"*\Remote Manipulator System - Server\*",,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,"*\Remote Utilities\*",,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,"*\rutserv.exe",,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,"C:\Program Files\Remote Utilities\*",,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,,"rutserv.exe",,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,,"rutview.exe",,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,,,"Remote Utilities*",RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,"RemoteView*",,,,,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,"*.content.rview.com",,,,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,"*.rview.com",,,,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,"content.rview.com",,,,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,,,"remoteview.exe",,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,,,"rv.exe",,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,,,"rvagent.exe",,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,,,"rvagtray.exe",,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,,,,"RsDoctor*",RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,,,,"RemoteView*",RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remotely,"Remotely*",,,,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"/Library/LaunchDaemons/remotely-agent.plist",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"/etc/systemd/system/remotely-agent.service",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"/usr/local/bin/Remotely/ConnectionInfo.json",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"/usr/local/bin/Remotely/Desktop/Remotely_Desktop",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"/usr/local/bin/Remotely/Remotely_Agent",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"C:\Program Files\Remotely\ConnectionInfo.json",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"C:\Program Files\Remotely\Desktop\Remotely_Desktop.exe",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"C:\Program Files\Remotely\Remotely_Agent.exe",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"C:\Program Files\Remotely\etag.txt",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +"Rocket Remote Desktop","Rocket Remote Desktop*",,,,,RMM,"","Rocket Remote Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Rocket Remote Desktop","RocketRemoteDesktop*",,,,,RMM,"","Rocket Remote Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Rocket Remote Desktop",,,,"RDConsole.exe",,RMM,"","Rocket Remote Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Rocket Remote Desktop",,,,"RocketRemoteDesktop_Setup.exe",,RMM,"","Rocket Remote Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Rodex RMM","Rodex RMM*",,,,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM","RodexRMM*",,,,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,"",,,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,"rodex.cc",,,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,"www.rodex.cc",,,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,,"C:\Program Files\Rodex\RodexAgent.exe",,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,,"C:\Windows\.exe",,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,,,"RodexAgent.exe",,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,,,"rodexagent.exe",,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +Roster,"Roster*",,,,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"/Library/LaunchDaemons/com.roster.agent.plist",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"/etc/roster/agent.yaml",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"/etc/systemd/system/roster-agent.service",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"/usr/local/bin/roster-agent",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"/var/log/roster-agent.log",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"C:\Program Files\Roster\*",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"C:\ProgramData\Roster\agent-state.json",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"C:\ProgramData\Roster\agent.yaml",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +"Royal Apps","Royal Apps*",,,,,RMM,"https://www.royalapps.com/ts/win/download","Royal Apps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal Apps","RoyalApps*",,,,,RMM,"https://www.royalapps.com/ts/win/download","Royal Apps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal Apps",,,,"royalserver.exe",,RMM,"https://www.royalapps.com/ts/win/download","Royal Apps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal Apps",,,,"royalts.exe",,RMM,"https://www.royalapps.com/ts/win/download","Royal Apps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal Server","Royal Server*",,,,,RMM,"https://royalapps.com/server/main/features","Royal Server is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal Server","RoyalServer*",,,,,RMM,"https://royalapps.com/server/main/features","Royal Server is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal Server",,"royalapps.com",,,,RMM,"https://royalapps.com/server/main/features","Royal Server is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal TS","Royal TS*",,,,,RMM,"","Royal TS is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal TS","RoyalTS*",,,,,RMM,"","Royal TS is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal TS",,"royalapps.com",,,,RMM,"","Royal TS is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal TS",,,,"royalts.exe",,RMM,"","Royal TS is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RuDesktop,"RuDesktop*",,,,,RMM,"https://rudesktop.ru","RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RuDesktop,,"*.rudesktop.ru",,,,RMM,"https://rudesktop.ru","RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RuDesktop,,"rudesktop.ru",,,,RMM,"https://rudesktop.ru","RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RuDesktop,,,,"rd.exe",,RMM,"https://rudesktop.ru","RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RuDesktop,,,,"rudesktop*.exe",,RMM,"https://rudesktop.ru","RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RunSmart,"RunSmart*",,,,,RMM,"","RunSmart is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RunSmart,,"runsmart.io",,,,RMM,"","RunSmart is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RustDesk,"RustDesk*",,,,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,"api.rustdesk.com",,,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,"rs-ny.rustdesk.com",,,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,"rustdesk.com",,,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,"web.rustdesk.com",,,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,"C:\Program Files\RustDesk",,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,"C:\Program Files\RustDesk\RustDesk.exe",,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,"C:\Users\*\AppData\Local\rustdesk\*",,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,"C:\Users\*\AppData\Local\rustdesk\rustdesk.exe",,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,,"rustdesk*.exe",,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,,"rustdesk.exe",,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,,,"rustdesk*",RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +ScreenConnect,"ScreenConnect*",,,,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,"*.connectwise.com",,,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,"*.screenconnect.com",,,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,"control.connectwise.com",,,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,"instance-*-relay.screenconnect.com",,,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,"*\*\ScreenConnect.ClientService.exe",,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,"*\*\ScreenConnect.WindowsClient.exe",,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,"*\ScreenConnect Client*\*",,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,"C:\Program Files (x86)\ScreenConnect Client ()\*",,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,"C:\Program Files (x86)\ScreenConnect Client (Random)\ScreenConnect.ClientService.exe",,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,"ConnectWiseControl*.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,"Remote Workforce Client.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,"connectwise*.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,"screenconnect*.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,"screenconnect.clientservice.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,"screenconnect.windowsclient.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,,"CONTINUUM MANAGED*",RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,,"ScreenConnect*",RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,,"ConnectWise*",RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenMeet,"ScreenMeet*",,,,,RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenMeet,,"*.screenmeet.com",,,,RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenMeet,,"*.scrn.mt",,,,RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenMeet,,,,"ScreenMeet.Support.exe",,RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenMeet,,,,"ScreenMeetSupport.exe",,RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenMeet,,,,,"ScreenMeet*",RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SecureCRT,"SecureCRT*",,,,,RAT,"","SecureCRT is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SecureCRT,,,"*\SecureCRT.EXE",,,RAT,"","SecureCRT is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SecureCRT,,,"*\VanDyke Software\ClientPack\*",,,RAT,"","SecureCRT is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SecureCRT,,,"C:\*\SecureCRT.EXE",,,RAT,"","SecureCRT is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,"Seetrol*",,,,,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,,"seetrol.co.kr",,,,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,,,,"seetrolcenter.exe",,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,,,,"seetrolclient.exe",,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,,,,"seetrolmyservice.exe",,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,,,,"seetrolremote.exe",,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,,,,"seetrolsetting.exe",,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Senso.cloud","Senso.cloud*",,,,,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Senso.cloud",,"*.senso.cloud",,,,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Senso.cloud",,"senso.cloud",,,,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Senso.cloud",,,,"SensoClient.exe",,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Senso.cloud",,,,"SensoService.exe",,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Senso.cloud",,,,"aadg.exe",,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sentinel RMM","Sentinel RMM*",,,,,RMM,"https://github.com/codexX64/sentinel-rmm,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/README.md,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.py,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.spec","Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit." +"Sentinel RMM","SentinelRMM*",,,,,RMM,"https://github.com/codexX64/sentinel-rmm,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/README.md,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.py,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.spec","Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit." +"Sentinel RMM",,,"/opt/sentinel-agent/sentinel-agent",,,RMM,"https://github.com/codexX64/sentinel-rmm,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/README.md,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.py,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.spec","Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit." +"Sentinel RMM",,,"/usr/local/sentinel-agent/sentinel-agent",,,RMM,"https://github.com/codexX64/sentinel-rmm,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/README.md,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.py,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.spec","Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit." +"Sentinel RMM",,,"C:\ProgramData\SentinelAgent\sentinel-agent.exe",,,RMM,"https://github.com/codexX64/sentinel-rmm,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/README.md,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.py,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.spec","Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit." +ServerEye,"ServerEye*",,,,,RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ServerEye,,"*.server-eye.de",,,,RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ServerEye,,,,"ServiceProxyLocalSys.exe",,RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ServerEye,,,,"servereye*.exe",,RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ServerEye,,,,,"Server-Eye*",RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ServerEye,,,,,"ServerEye*",RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"SetMe PRO","SetMe PRO*",,,,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains." +"SetMe PRO","SetMePRO*",,,,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains." +"SetMe PRO",,"*.set.me",,,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains." +"SetMe PRO",,"set.me",,,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains." +"SetMe PRO",,,"C:\Program Files (x86)\Techinline Ltd\SetMe Unattended\Client\SetMe_Client.exe",,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains." +"SetMe PRO",,,"C:\Program Files (x86)\Techinline Ltd\SetMe Unattended\Module\*\tinUnattendedModule.exe",,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains." +ShellHub,"ShellHub*",,,,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,"*.shellhub.io",,,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,"cloud.shellhub.io",,,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,"shellhub.io",,,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,"www.shellhub.io",,,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,,"/etc/shellhub-agent/*",,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,,"/etc/systemd/system/shellhub-agent.service",,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,,"/usr/local/bin/shellhub-agent",,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,,"/var/lib/shellhub-agent/*",,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShowMyPC,"ShowMyPC*",,,,,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,"*.showmypc.com",,,,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,"showmypc.com",,,,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,,,"SMPCSetup.exe",,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,,,"showmypc*.exe",,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,,,"showmypc.exe",,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,,,"smpcsetup.exe",,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,,,,"ShowMyPC*",RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SimpleHelp,"SimpleHelp*",,,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"160.191.182.41",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"192.144.34.42",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"51.255.19.178",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"51.255.19.179",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"dronemaker.org",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"microuptime.com",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"simple-help.com",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"telesupportgroup.com",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,"%APPDATA%\JWrapper-SimpleSetup\*",,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,"C:\ProgramData\JWrapper-Remote Access\*",,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"remote access.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"serviceconfig.xml",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"simplegatewayservice.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"simplehelpcustomer.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"simpleservice.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"spsrv.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"vhost.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"windowslauncher.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,,"SimpleHelp*",RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +Site24x7,"Site24x7*",,,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,"plus*.site24x7.cn",,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,"plus*.site24x7.com",,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,"plus*.site24x7.eu",,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,"plus*.site24x7.in",,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,"plus*.site24x7.net.au",,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,,,"MEAgentHelper.exe",,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,,,"MonitoringAgent.exe",,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,,,"Site24x7PluginAgent.exe",,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,,,"Site24x7WindowsAgentTrayIcon.exe",,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,"SkyFex*",,,,,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,,"*.deskroll.com",,,,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,,"deskroll.com",,,,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,,"skyfex.com",,,,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,,,,"DeskRollUA.exe",,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,,,,"Deskroll.exe",,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,,,,,"DeskRoll Remote Desktop*",RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Solar-PuTTY","Solar-PuTTY*",,,,,RAT,"","Solar-PuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Solar-PuTTY",,,"*\Solar-PuTTY.exe",,,RAT,"","Solar-PuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Solar-PuTTY",,,"*\Solar-Putty-v4\*",,,RAT,"","Solar-PuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Solar-PuTTY",,,"C:\Program Files\Solar-Putty-v4\*",,,RAT,"","Solar-PuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System","Sophos-Remote Management System*",,,,,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System","Sophos-RemoteManagementSystem*",,,,,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System",,"*.sophos.com",,,,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System",,"*.sophosupd.com",,,,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System",,"*.sophosupd.net",,,,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System",,,,"clientmrinit.exe",,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System",,,,"mgntsvc.exe",,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System",,,,"routernt.exe",,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Sorillus,"Sorillus*",,,,,RMM,"https://sorillus.com/","Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Sorillus,,"*.sorillus.com",,,,RMM,"https://sorillus.com/","Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Sorillus,,"sorillus.com",,,,RMM,"https://sorillus.com/","Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Sorillus,,,,"Sorillus Launcher.exe",,RMM,"https://sorillus.com/","Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Sorillus,,,,"Sorillus-Launcher*.exe",,RMM,"https://sorillus.com/","Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SparkRAT,"SparkRAT*",,,,,RAT,"https://github.com/XZB-1248/Spark/blob/e2c8ce153d8494f7f1aa9999bfd86eef1bc6be79/README.md,https://github.com/XZB-1248/Spark/blob/e2c8ce153d8494f7f1aa9999bfd86eef1bc6be79/scripts/build.client.sh,https://github.com/XZB-1248/Spark/blob/e2c8ce153d8494f7f1aa9999bfd86eef1bc6be79/client/core/core.go,https://github.com/XZB-1248/Spark/blob/e2c8ce153d8494f7f1aa9999bfd86eef1bc6be79/server/handler/handler.go,https://www.sentinelone.com/labs/dragonspark-attacks-evade-detection-with-sparkrat-and-golang-source-code-interpretation/,https://hunt.io/blog/sparkrat-server-detection-macos-activity-and-malicious-connections","SparkRAT (Spark) is an open-source Go remote-access framework with a self-hosted controller that generates configured endpoint clients. It offers remote terminal, desktop, screenshot, file, and process functions. Public reporting has documented malicious SparkRAT deployments; that does not make every deployment of the upstream dual-use project malicious." +Splashtop,"Splashtop*",,,,,RMM,"https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html","Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Splashtop,,"*.splashtop.com",,,,RMM,"https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html","Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Splashtop,,,"*\Splashtop\Splashtop Remote\Client for RMM\*",,,RMM,"https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html","Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Splashtop,,,"C:\Program Files (x86)\Splashtop\*",,,RMM,"https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html","Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Splashtop,,,,"strwinclt.exe",,RMM,"https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html","Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)","Beta*",,,,,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)","Splashtop*",,,,,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)",,"splashtop.com",,,,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)",,,,"SRManager.exe",,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)",,,,"SRServer.exe",,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)",,,,"SplashtopSOS.exe",,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)",,,,"Splashtop_Streamer_Windows*.exe",,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote","Splashtop Remote*",,,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote","SplashtopRemote*",,,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,"*.api.splashtop.com",,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,"*.api.splashtop.eu",,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,"*.relay.splashtop.com",,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,"splashtop.com",,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"SplashtopSOS.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"Splashtop_Streamer_Windows*.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"sragent.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"srmanager.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"srserver.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"srservice.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"strwinclt.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,,"Splashtop*",RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SpyAnywhere,"SpyAnywhere*",,,,,RMM,"https://www.spyanywhere.com/support.shtml","SpyAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SpyAnywhere,,"*.spytech-web.com",,,,RMM,"https://www.spyanywhere.com/support.shtml","SpyAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SpyAnywhere,,"spyanywhere.com",,,,RMM,"https://www.spyanywhere.com/support.shtml","SpyAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SpyAnywhere,,,,"sysdiag.exe",,RMM,"https://www.spyanywhere.com/support.shtml","SpyAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,"SunLogin*",,,,,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,"client.oray.net",,,,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,"sunlogin.oray.com",,,,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,,,"OrayRemoteService.exe",,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,,,"OrayRemoteShell.exe",,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,,,"sunlogin*.exe",,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,,,,"Remote control service",RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,,,,"Shanghai Best Oray*",RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,"SuperOps*",,,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,"*.superops.ai",,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,"*.superopsalpha.com",,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,"*.superopsbeta.com",,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,"serv.superopsalpha.com",,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,"superops.ai",,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,,,"superops.exe",,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,,,"superopsticket.exe",,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,,,,"SuperOps*",RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperPuTTY,"SuperPuTTY*",,,,,RAT,"","SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperPuTTY,,,"*Downloads\SuperPuTTY\*",,,RAT,"","SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperPuTTY,,,"*\SuperPuTTY\*",,,RAT,"","SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperPuTTY,,,"*\superputty.exe",,,RAT,"","SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperPuTTY,,,"C:\Downloads\SuperPuTTY\*",,,RAT,"","SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,"Supremo*",,,,,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,"*.supremocontrol.com",,,,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,"%USERPROFILE%\\AppData\\Local\\Temp\\SupremoRemoteDesktop\\",,,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,"*\\supremoremotedesktop\\supremosystem.exe",,,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,"C:\\ProgramData\\SupremoRemoteDesktop\\",,,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,,"SupremoSystem.exe",,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,,"supremo.exe",,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,,"supremohelper.exe",,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,,"supremoservice.exe",,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,,,"NanoSystems*",RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,,,"SupRemo*",RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,"Syncro*",,,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"*.kabutoservices.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"*.syncroapi.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"*.syncromsp.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"app.kabuto.io",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"attachments.servably.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"kabuto.io",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"kabutoservices.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"ld.aurelius.host",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"repairshopr.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"servably.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"syncromsp.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Kabuto.App.Runner.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Kabuto.Installer.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Kabuto.Service.Runner.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"KabutoSetup.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Syncro.App.Runner.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Syncro.Installer.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Syncro.Overmind.Service.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Syncro.Service.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"SyncroLive.Agent.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"SyncroLive.Service.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,,"Syncro*",RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,,"Servably*",RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Synergy,"Synergy*",,,,,RAT,"https://symless.com/synergy","Synergy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SysAid,"SysAid*",,,,,RMM,"","SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SysAid,,,"*\IliAS.exe",,,RMM,"","SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SysAid,,,"*\SysAidServer\*",,,RMM,"","SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SysAid,,,"*\SysAid\*",,,RMM,"","SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SysAid,,,"C:\Program Files\SysAidServer\*",,,RMM,"","SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,"Syspectr*",,,,,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,,"*.syspectr.com",,,,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,,"syspectr.com",,,,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,,,,"oolocker.exe",,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,,,,"oosyspectr.exe",,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,,,,"syspectr.exe",,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,,,,,"O&O Syspectr*",RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM","Tactical RMM*",,,,,RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM","TacticalRMM*",,,,,RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM",,"docs.tacticalrmm.com",,,,RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM",,"login.tailscale.com",,,,RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM",,,,"tacticalrmm.exe",,RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM",,,,,"Tactical Techs*",RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM",,,,,"AmidaWare*",RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +TeamViewer,"TeamViewer*",,,,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,"*.teamviewer.com",,,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,"client.teamviewer.com",,,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,"router15.teamviewer.com",,,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,"taf.teamviewer.com",,,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,,"C:\Program Files\TeamViewer\",,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,,,"teamviewer_desktop.exe",,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,,,"teamviewer_service.exe",,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,,,teamviewerhost,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,,,,"TeamViewer*",RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeleDesktop,"TeleDesktop*",,,,,RMM,"http://potomacsoft.com/ - DOA as of 2024","TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +TeleDesktop,,"tele-desk.com",,,,RMM,"http://potomacsoft.com/ - DOA as of 2024","TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +TeleDesktop,,,,"pstlaunch.exe",,RMM,"http://potomacsoft.com/ - DOA as of 2024","TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +TeleDesktop,,,,"ptdskclient.exe",,RMM,"http://potomacsoft.com/ - DOA as of 2024","TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +TeleDesktop,,,,"ptdskhost.exe",,RMM,"http://potomacsoft.com/ - DOA as of 2024","TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Teleport Connect","Teleport Connect*",,,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect","TeleportConnect*",,,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,"*.teleport.sh",,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,"cdn.teleport.dev",,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,"reporting-connect.teleportinfra.sh",,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,"usage.teleport.dev",,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,,"/Applications/Teleport Connect.app/*",,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,,"/opt/Teleport Connect/*",,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,,"/usr/local/bin/tsh",,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,,"C:\Program Files\Teleport Connect\*",,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,,"C:\Users\*\AppData\Local\Programs\Teleport Connect\*",,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,,,"Teleport Connect Setup-*.exe",,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +Teramind,"Teramind*",,,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"*.teramind.co",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"rt.teramind.co",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"sentry.dev.teramind.co",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"teramind.co",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"www.teramind.co",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"/Applications/Teramind Agent.app",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"/Applications/tmagent.app",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"/usr/local/teramind/agent/bin/",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"/usr/local/teramind/agent/bin/tmsysd",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"/usr/local/teramind/agent/etc/",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\Package Cache\.unverified\agent",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\Teramind Agent\*",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\Teramind Agent\\{6D99445F-F40F-45CB-B433-06302DAE6C70}\*",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\Teramind Agent\\{6D99445F-F40F-45CB-B433-06302DAE6C70}\tmagentsvc.exe",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\Teramind Agent\config",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A}\*",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A}\config",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A}\updates\*",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +TiFLUX,"TiFLUX*",,,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"*.tiflux.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"agent.tiflux.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"app.tiflux.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"my.splashtop.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"tiflux.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"tiflux.com.br",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"www.tiflux.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"www.tiflux.com.br",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"%ProgramData%\Tiflux\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"/Applications/TiAgent.app",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\TiService.exe",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\TiUpdateService.exe",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\dependencies\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\dependencies\7zip\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\dependencies\tar\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\desktop\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\desktop\TiAgent.exe",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\si.exe",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +ToDesk,"ToDesk*",,,,,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ToDesk,,"*.todesk.com",,,,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ToDesk,,"todesk.com",,,,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ToDesk,,,,"ToDesk_Service.exe",,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ToDesk,,,,"ToDesk_Setup.exe",,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ToDesk,,,,"todesk.exe",,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ToDesk,,,,,"ToDesk*",RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment","Total Software Deployment*",,,,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment","TotalSoftwareDeployment*",,,,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment",,,"*\Total Software Deployment\*",,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment",,,"*\Tsdservice.exe",,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment",,,"*\tniwinagent.exe",,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment",,,"C:\ProgramData\Total Software Deployment\*",,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment",,,,,"Total Software Deployment",RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment",,,,,"SoftInventive Lab",RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +TrustConnect,"TrustConnect*",,,,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,"networkservice.cyou",,,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,"trustconnectsoftware.com",,,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,,"*\TrustConnectAgent.exe",,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,,"C:\Program Files\TrustConnect Agent\*",,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,,"C:\Program Files\TrustConnect Agent\TrustConnectAgent.exe",,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,,"C:\ProgramData\TrustConnect\*",,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,,,"DocConnect.Agent.exe",,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,,,"TrustConnectAgent.exe",,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +UltraViewer,"UltraViewer*",,,,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,"*.ultraviewer.net",,,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,"ultraviewer.net",,,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,"*\UltraViewer\",,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,"*\UltraViewer_Desktop.exe",,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,"C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe",,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,"UltraViewer_Desktop.exe",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,"UltraViewer_Service.exe",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,"UltraViewer_setup*",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,"ultraviewer.exe",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,"ultraviewer_desktop.exe",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,"ultraviewer_service.exe",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,,"DucFabulous*",RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,,"UltraViewer*",RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"UniSystem RMM","UniSystem RMM*",,,,,RMM,"https://xelvarunetio.pro/","UniSystem RMM is a Windows endpoint-management platform. Matching product-branded material describes a UniRMM agent with remote terminal access, RDP tunneling, remote script execution, and endpoint monitoring. This entry records matching UniRMM Windows sample metadata. The reviewed evidence establishes product identity and vendor-described capabilities only; it does not establish delivery, abuse, victim impact, or actor attribution." +"UniSystem RMM","UniSystemRMM*",,,,,RMM,"https://xelvarunetio.pro/","UniSystem RMM is a Windows endpoint-management platform. Matching product-branded material describes a UniRMM agent with remote terminal access, RDP tunneling, remote script execution, and endpoint monitoring. This entry records matching UniRMM Windows sample metadata. The reviewed evidence establishes product identity and vendor-described capabilities only; it does not establish delivery, abuse, victim impact, or actor attribution." +"UniSystem RMM",,,,"UniRMM.exe",,RMM,"https://xelvarunetio.pro/","UniSystem RMM is a Windows endpoint-management platform. Matching product-branded material describes a UniRMM agent with remote terminal access, RDP tunneling, remote script execution, and endpoint monitoring. This entry records matching UniRMM Windows sample metadata. The reviewed evidence establishes product identity and vendor-described capabilities only; it does not establish delivery, abuse, victim impact, or actor attribution." +"UniSystem RMM",,,,"UniRMM.msi",,RMM,"https://xelvarunetio.pro/","UniSystem RMM is a Windows endpoint-management platform. Matching product-branded material describes a UniRMM agent with remote terminal access, RDP tunneling, remote script execution, and endpoint monitoring. This entry records matching UniRMM Windows sample metadata. The reviewed evidence establishes product identity and vendor-described capabilities only; it does not establish delivery, abuse, victim impact, or actor attribution." +VIZOR,"VIZOR*",,,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"downloads.vector-networks.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"mail.metaquest.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"metaquest.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"vector-networks.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"vizor.cloud",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"www.metaquest.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"www.vector-networks.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"www.vizor.cloud",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,,"C:\Program Files (x86)\Vector\Asset Management Client\*",,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,,"C:\Program Files\Vector Networks Limited\LANutil32 Suite\*",,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,,"C:\Program Files\Vector\Asset Management Client\*",,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +"VNC Connect","VNC Connect*",,,,,RAT,"","VNC Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"VNC Connect","VNCConnect*",,,,,RAT,"","VNC Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"VNC Connect",,,"*\RealVNC\VNC Server\*",,,RAT,"","VNC Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"VNC Connect",,,"C:\Program Files\RealVNC\VNC Server\*",,,RAT,"","VNC Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Veyon,"Veyon*",,,,,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,"C:\Program Files (x86)\Veyon\*",,,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,"C:\Program Files\Veyon\*",,,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,,"veyon-master.exe",,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,,"veyon-server.exe",,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,,"veyon-service.exe",,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,,"veyon-wcli.exe",,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,,"veyon-worker.exe",,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +"Vicarius vRx","Vicarius vRx*",,,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx","VicariusvRx*",,,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"*.vicarius.cloud",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-ap-southeast-3-installer.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-ap-southeast-3-installer.s3.ap-southeast-3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-ap-southeast-3-patches.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-ap-southeast-3-patches.s3.ap-southeast-3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-ap-southeast-3-release.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-ap-southeast-3-release.s3.ap-southeast-3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-eu-central-1-installer.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-eu-central-1-installer.s3.eu-central-1.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-eu-central-1-patches.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-eu-central-1-patches.s3.eu-central-1.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-eu-central-1-release.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-eu-central-1-release.s3.eu-central-1.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-installer.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-patches.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-release.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-release.s3.us-east-1.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-static-organizationinstallations.vicarius-cdn.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,,"/Library/PrivilegedHelperTools/topiad",,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,,"/usr/share/vicarius/*",,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,,"C:\Program Files\Vicarius\Topia\*",,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,,,"topiad.exe",,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Visual Studio Dev Tunnel","Visual Studio Dev Tunnel*",,,,,RAT,"https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Visual Studio Dev Tunnel","VisualStudioDevTunnel*",,,,,RAT,"https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Visual Studio Dev Tunnel",,"*.devtunnels.ms",,,,RAT,"https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Visual Studio Dev Tunnel",,"*.rel.tunnels.api.visualstudio.com",,,,RAT,"https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Visual Studio Dev Tunnel",,"global.rel.tunnels.api.visualstudio.com",,,,RAT,"https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,"Weezo*",,,,,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,"*.weezo.me",,,,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,"*.weezo.net",,,,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,"weezo.en.softonic.com",,,,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,"weezo.net",,,,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,,,"weezo setup*.exe",,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,,,"weezo.exe",,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,,,"weezohttpd.exe",,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,,,,"Weezo*",RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,,,,"Peer 2 World",RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,"Xeox*",,,,,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,,"*.xeox.com",,,,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,,"xeox.com",,,,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,,,,"xeox-agent_*.exe",,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,,,,"xeox-agent_x64.exe",,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,,,,"xeox-agent_x86.exe",,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,,,,"xeox_service_windows.exe",,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xpra,"Xpra*",,,,,RAT,"","Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xpra,,,"*\Xpra-Launcher.exe",,,RAT,"","Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xpra,,,"*\Xpra-x86_64_Setup.exe",,,RAT,"","Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xpra,,,"*\Xpra\*",,,RAT,"","Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xpra,,,"C:\Program Files (x86)\Xpra\*",,,RAT,"","Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zabbix Agent","Zabbix Agent*",,,,,RMM,"https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent","Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zabbix Agent","ZabbixAgent*",,,,,RMM,"https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent","Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zabbix Agent",,"zabbix.com",,,,RMM,"https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent","Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zabbix Agent",,,,"zabbix_agent*.exe",,RMM,"https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent","Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zabbix Agent",,,,,"Zabbix*",RMM,"https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent","Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Zecurit,"Zecurit*",,,,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,"app.zecurit.com",,,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,"d1m8kha1zyjal6.cloudfront.net",,,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,"dms.zecurit.com",,,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/Library/zecurit_agent/bin/CommandProcessor",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/Library/zecurit_agent/bin/Installer",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/Library/zecurit_agent/bin/Service",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/Library/zecurit_agent/bin/ZecuritAccess.app/Contents/MacOS/ZecuritAccess",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/usr/local/zecurit_agent/bin/agentService",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/usr/local/zecurit_agent/bin/commandProcessor",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/usr/local/zecurit_agent/bin/installer",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritAgentAssetMgr.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritApplicationControlService.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritLiveNotifier.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritRemoteTools.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritScreenReaderApp.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritScreenReaderAppUI.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritScreenReaderService.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Windows\Temp\Zecurit\ZecuritAgentUpgrader.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +ZeroTier,"ZeroTier*",,,,,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,"*.zerotier.com",,,,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,"zerotier.com",,,,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,,,"zero-powershell.exe",,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,,,"zerotier*.exe",,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,,,"zerotier*.msi",,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,,,,"zero-powesrhell*",RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,,,,"ZeroTier*",RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist","Zoho Assist*",,,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist","ZohoAssist*",,,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zoho.com",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zoho.com.au",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zoho.com.cn",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zoho.eu",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zoho.in",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zohoassist.com",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zohoassist.com.cn",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zohoassist.jp",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"assist.zoho.com",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"downloads.zohocdn.com",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"downloads.zohodl.com.cn",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"gateway.zohoassist.com",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,"*\ZA_Access.exe",,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"ZMAgent.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"ZohoMeeting.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"ZohoURSService.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"Zohours.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"connect.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"toolsiq.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"za_connect.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"zaservice.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"zohotray.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,,"Zoho*",RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"baramundi Management Suite","baramundi Management Suite*",,,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite","baramundiManagementSuite*",,,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,"*.baramundi.com",,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,"docs.baramundi.com",,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,"isodownload.baramundi.com",,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,"www.baramundi.com",,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,,"C:\Program Files (x86)\bsag\*",,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,,"C:\Program Files (x86)\bsag\bma\*",,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,,"C:\Program Files\bsag\*",,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,,"C:\Program Files\bsag\bma\*",,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +eHorus,"eHorus*",,,,,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,"ehorus.com",,,,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,,"C:\Program Files\ehorus_agent\*",,,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,,,"ehorus standalone.exe",,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,,,"ehorus_agent.exe",,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,,,"ehorus_cmd.exe",,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,,,"ehorus_launcher.exe",,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,,,"ehorus_uit.exe",,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,"ezHelp*",,,,,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,,"*.ezhelp.co.kr",,,,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,,"ezhelp.co.kr",,,,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,,,,"ezHelpManager.exe",,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,,,,"ezhelpclient.exe",,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,,,,"ezhelpclientmanager.exe",,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,,,,,"Mastersoft Corp*",RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +pcAnywhere,"pcAnywhere*",,,,,RAT,"https://en.wikipedia.org/wiki/PcAnywhere","pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +pcAnywhere,,,,"awhost32.exe",,RAT,"https://en.wikipedia.org/wiki/PcAnywhere","pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +pcAnywhere,,,,"awrem32.exe",,RAT,"https://en.wikipedia.org/wiki/PcAnywhere","pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +pcAnywhere,,,,"pcaquickconnect.exe",,RAT,"https://en.wikipedia.org/wiki/PcAnywhere","pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +pcAnywhere,,,,"winaw32.exe",,RAT,"https://en.wikipedia.org/wiki/PcAnywhere","pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +rdp2tcp,"rdp2tcp*",,,,,RAT,"https://github.com/V-E-O/rdp2tcp","rdp2tcp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +rdp2tcp,,,,"rdp2tcp.exe",,RAT,"https://github.com/V-E-O/rdp2tcp","rdp2tcp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +rdp2tcp,,,,"rdp2tcp.py",,RAT,"https://github.com/V-E-O/rdp2tcp","rdp2tcp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +tmate,"tmate*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,"*.tmate.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,"tmate.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,,"/usr/bin/tmate",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,,"/usr/local/bin/tmate",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,,,tmate,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,,,"tmate-ready",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,,,"tmate.bashrc",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,,,"tmate.sock",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." diff --git a/lookups/csv/remote_access_software.yml b/lookups/csv/remote_access_software.yml index db897ef6ee9..b148e32ea67 100644 --- a/lookups/csv/remote_access_software.yml +++ b/lookups/csv/remote_access_software.yml @@ -1,15 +1,17 @@ name: remote_access_software id: f3b92ff9-667c-481f-b29d-458e10d48508 -version: 5 +version: 6 creation_date: '2022-08-22' -modification_date: '2026-05-13' +modification_date: '2026-10-08' author: Splunk Threat Research Team lookup_type: csv description: A list of Remote Access Software match_type: - - WILDCARD(remote_utility) - - WILDCARD(remote_domain) - - WILDCARD(remote_utility_fileinfo) + - WILDCARD(match_pattern) + - WILDCARD(domain) + - WILDCARD(file_path) + - WILDCARD(file_name) + - WILDCARD(file_info) min_matches: 1 max_matches: 1 case_sensitive_match: false