Updating Set of Nirsoft Detections

detections/endpoint/detection_of_tools_built_by_nirsoft.yml → detections/deprecated/detection_of_tools_built_by_nirsoft.yml

@@ -1,10 +1,10 @@
 name: Detection of tools built by NirSoft
 id: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0
-version: 11
+version: 12
 creation_date: '2020-04-29'
-modification_date: '2026-05-13'
+modification_date: '2026-10-01'
 author: Bhavin Patel, Splunk
-status: experimental
+status: deprecated
 type: Anomaly
 description: The following analytic identifies the execution of tools built by NirSoft by detecting specific command-line arguments such as "/stext" and "/scomma". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because NirSoft tools, while legitimate, can be exploited by attackers for malicious purposes such as credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further compromise of the affected system.
 data_source:
@@ -53,3 +53,8 @@ product:
     - Splunk Cloud
 category: endpoint
 security_domain: endpoint
+deprecation_info:
+    reason: Detection deprecated due to duplicated content already covered by other detections.
+    removed_in_version: 6.12.0
+    replacement_content:
+        - Windows NirSoft Utilities

detections/endpoint/possible_browser_pass_view_parameter.yml → detections/deprecated/possible_browser_pass_view_parameter.yml

@@ -1,10 +1,10 @@
 name: Possible Browser Pass View Parameter
 id: 8ba484e8-4b97-11ec-b19a-acde48001122
-version: 8
+version: 9
 creation_date: '2021-11-22'
-modification_date: '2026-05-13'
+modification_date: '2026-10-01'
 author: Teoderick Contreras, Splunk
-status: production
+status: deprecated
 type: Hunting
 description: The following analytic identifies processes with command-line parameters associated with web browser credential dumping tools, specifically targeting behaviors used by Remcos RAT malware. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and specific file paths. This activity is significant as it indicates potential credential theft, a common tactic in broader cyber-espionage campaigns. If confirmed malicious, attackers could gain unauthorized access to sensitive web credentials, leading to further system compromise and data breaches.
 data_source:
@@ -35,3 +35,8 @@ tests:
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
       test_type: unit
+deprecation_info:
+    reason: Detection deprecated due to duplicated content already covered by other detections.
+    removed_in_version: 6.12.0
+    replacement_content:
+        - Windows NirSoft Utilities

detections/endpoint/windows_nirsoft_advancedrun.yml → detections/deprecated/windows_nirsoft_advancedrun.yml

@@ -1,10 +1,10 @@
 name: Windows NirSoft AdvancedRun
 id: bb4f3090-7ae4-11ec-897f-acde48001122
-version: 12
+version: 13
 creation_date: '2022-01-24'
 modification_date: '2026-10-09'
 author: Michael Haag, Splunk
-status: production
+status: deprecated
 type: TTP
 description: The following analytic detects the execution of AdvancedRun.exe, a tool with capabilities similar to remote administration programs like PsExec. It identifies the process by its name or original file name and flags common command-line arguments. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. Monitoring this activity is crucial as AdvancedRun can be used for remote code execution and configuration-based automation. If malicious, this could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment.
 data_source:
@@ -85,3 +85,8 @@ tests:
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
       test_type: unit
+deprecation_info:
+    reason: Detection deprecated due to duplicated content already covered by other detections.
+    removed_in_version: 6.12.0
+    replacement_content:
+        - Windows NirSoft Utilities

detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml

@@ -1,14 +1,13 @@
 name: Windows NirSoft Tool Bundle File Created
 id: a2c8e8f8-18d6-4ad4-acf4-f58903bebe41
-version: 5
+version: 6
 creation_date: '2025-10-24'
-modification_date: '2026-05-13'
-author: Nasreddine Bencherchali, Splunk
+modification_date: '2026-10-01'
+author: Nasreddine Bencherchali, Onur Mustafa Erdogan, Splunk
 status: production
 type: Anomaly
 description: |
-    The following analytic detects the creation of files associated with the NirSoft
-    tool bundles on Windows endpoints.
+    The following analytic detects the creation of files associated with the NirSoft tool bundles on Windows endpoints.
     NirSoft is a well-known provider of free, portable utilities that can be used for various system and network tasks. However, threat actors often leverage these tools for malicious purposes, such as credential harvesting, network reconnaissance, and data exfiltration.
     The detection focuses on the creation of specific NirSoft tool bundle files, which may indicate that an attacker is preparing to use these utilities on a compromised system.
     Security teams should investigate any instances of these files being created, especially if they are found in unexpected locations or on systems that should not be using such tools.
@@ -20,23 +19,17 @@ search: |
             min(_time) as firstTime
             max(_time) as lastTime
 
-    from datamodel=Endpoint.Filesystem where
+    FROM datamodel=Endpoint.Filesystem WHERE
 
     ``` Increase coverage by adding additional Nirsoft tool bundle or tool filenames ```
+    [
+      | inputlookup nirsoft_utilities_lookup
+      | search original_file_name = "*.zip"
+      | table original_file_name
+      | rename original_file_name as Filesystem.file_name
+    ]
 
-    Filesystem.file_name IN (
-      "brtools.zip",
-      "mailpv.zip",
-      "networktools.zip",
-      "passreccommandline.zip",
-      "passrecenc.zip",
-      "progtools.zip",
-      "rdpv.zip",
-      "systools.zip",
-      "webbrowserpassview.zip"
-    )
-
-    by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time
+    BY Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time
        Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path
        Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id
        Filesystem.user Filesystem.vendor_product
@@ -71,7 +64,12 @@ intermediate_findings:
         - field: dest
           type: system
           score: 20
-          message: NirSoft tool bundle file $file_name$ created on host $dest$
+          message: NirSoft tool bundle file [$file_name$] created on host [$dest$].
+threat_objects:
+    - field: file_name
+      type: file_name
+    - field: file_path
+      type: file_path
 analytic_story:
     - Unusual Processes
     - Data Destruction
@@ -88,7 +86,7 @@ security_domain: endpoint
 tests:
     - name: True Positive Test
       attack_data:
-        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/nirsoft_tooling/nirsoft_file_bundle_created.log
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/nirsoft_tooling/nirsoft_file_bundle_created_new.log
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
       test_type: unit

detections/endpoint/windows_nirsoft_utilities.yml

@@ -1,47 +1,78 @@
 name: Windows NirSoft Utilities
 id: 5b2f4596-7d4c-11ec-88a7-acde48001122
-version: 11
+version: 12
 creation_date: '2022-01-24'
 modification_date: '2026-10-09'
 author: Michael Haag, Splunk
 status: production
-type: Hunting
+type: Anomaly
 description: |
     The following analytic identifies the execution of commonly used NirSoft utilities on Windows systems.
-    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution details such as process name, parent process, and command-line arguments.
     This activity is significant for a SOC because NirSoft utilities, while legitimate, can be used by adversaries for malicious purposes like credential theft or system reconnaissance.
     If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further system compromise.
     Note that this search does not use a where clause to filter out known benign paths, as NirSoft utilities can be executed from various locations. This might hinder performance in environments with high data volumes.
     Apply additional filtering as necessary to enhance this.
 data_source:
     - Sysmon EventID 1
-    - Windows Event Log Security 4688
-    - CrowdStrike ProcessRollup2
 search: |
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime FROM datamodel=Endpoint.Processes
-    by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
+    | tstats `security_content_summariesonly`
+      count min(_time) as firstTime
+            max(_time) as lastTime
+
+    FROM datamodel=Endpoint.Processes WHERE
+
+    [
+        | inputlookup nirsoft_utilities_lookup
+        | search original_file_name=*.exe
+        | table original_file_name
+        | rename original_file_name as Processes.original_file_name
+    ]
+
+    BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process
        Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
        Processes.parent_process_name Processes.parent_process_path Processes.process
        Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
        Processes.process_integrity_level Processes.process_name Processes.process_path
        Processes.user Processes.user_id Processes.vendor_product
+
     | `drop_dm_object_name("Processes")`
+
+    | lookup local=t nirsoft_utilities_lookup original_file_name OUTPUT description
+
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
-    | lookup local=t update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile
-    | search nirsoftFile=true
     | `windows_nirsoft_utilities_filter`
-how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+how_to_implement: |-
+    To successfully implement this search, ingest process creation events from your endpoints and normalize them to the Processes node of the Endpoint data model using the Splunk Common Information Model (CIM).
+    Ensure the normalized events populate the original_file_name field, which this search uses to identify NirSoft utilities. Supported sources might include Sysmon and CrowdStrike ProcessRollup2 when mapped to the data model.
 known_false_positives: False positives may be present. Filtering may be required before setting to alert.
 references:
     - https://www.cisa.gov/uscert/ncas/alerts/TA18-201A
     - http://www.nirsoft.net/
     - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
     - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L623
+drilldown_searches:
+    - name: View the detection results for - "$dest$"
+      search: '%original_detection_search% | search  dest = "$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+intermediate_findings:
+    entities:
+        - field: dest
+          type: system
+          score: 20
+          message: NirSoft tool [$process_name$] was executed on host [$dest$] with Command Line [$process$]. This utility [$description$].
+threat_objects:
+    - field: process_name
+      type: process_name
 analytic_story:
     - Data Destruction
     - WhisperGate
+    - Unusual Processes
 asset_type: Endpoint
 atomic_guid:
     - 81ce22fd-9612-4154-918e-8a1f285d214d