diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 058ddbe15f4..d51104e0810 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,3 +1,3 @@ -* @patel-bhavin @ljstella @nasbench @pyth0n1c @RavenTait @tccontre @rosplk @p4t12ick +* @patel-bhavin @ljstella @nasbench @pyth0n1c @RavenTait @tccontre @rosplk @p4t12ick @onurmerdogan /response_templates/ @kbouchardherjavecgroup @ccl0utier @henryy-splunk -/.github/workflows/response_templates/mcopenapi_public.yml @kbouchardherjavecgroup @ccl0utier @henryy-splunk \ No newline at end of file +/.github/workflows/response_templates/mcopenapi_public.yml @kbouchardherjavecgroup @ccl0utier @henryy-splunk diff --git a/.github/workflows/archived-ta-tracker.yml b/.github/workflows/archived-ta-tracker.yml new file mode 100644 index 00000000000..0f45898107d --- /dev/null +++ b/.github/workflows/archived-ta-tracker.yml @@ -0,0 +1,32 @@ +name: Archived TA tracker + +on: + workflow_dispatch: + schedule: + - cron: "17 7 * * *" + +permissions: + contents: read + issues: write + +jobs: + check-archived-tas: + runs-on: ubuntu-latest + steps: + - name: Check out repository + uses: actions/checkout@v7 + + - name: Set up Python + uses: actions/setup-python@v6 + with: + python-version: "3.12" + + - name: Install YAML parser + run: python -m pip install PyYAML==6.0.3 + + - name: Create or update archived TA issues + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_REPOSITORY: ${{ github.repository }} + GITHUB_REF_NAME: ${{ github.ref_name }} + run: python scripts/check_archived_tas.py diff --git a/.github/workflows/update_nist_ai_rmf_detection_map.yml b/.github/workflows/update_nist_ai_rmf_detection_map.yml new file mode 100644 index 00000000000..1d362f48781 --- /dev/null +++ b/.github/workflows/update_nist_ai_rmf_detection_map.yml @@ -0,0 +1,59 @@ +name: NIST AI RMF Detection Map Update + +on: + workflow_dispatch: + schedule: + - cron: '25 06 * * *' + +permissions: + contents: write + pull-requests: write + +jobs: + update-nist-ai-rmf-detection-map: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v7 + with: + ref: develop + persist-credentials: false + + - name: Set up Python + uses: actions/setup-python@v6 + with: + python-version: '3.14' + architecture: x64 + + - name: Install Python dependencies + run: | + pip install PyYAML==6.0.3 + + - name: Generate NIST AI RMF detection map + run: | + python scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py --modified-date "$(date -u +%F)" + echo "Changed NIST AI RMF lookup files:" + git status --short -- lookups/csv/detection_subcategory_map.csv lookups/csv/detection_subcategory_map.yml + + - name: Create NIST AI RMF detection map update pull request + uses: peter-evans/create-pull-request@v8 + with: + token: ${{ github.token }} + commit-message: Update NIST AI RMF detection map + branch: auto-nist-ai-rmf-detection-map-${{ github.run_number }} + base: develop + title: Automated NIST AI RMF lookup table update + body: | + This PR updates the generated NIST AI RMF detection-to-subcategory lookup. + + The workflow runs: + + ```bash + python scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py --modified-date "$(date -u +%F)" + ``` + + When `lookups/csv/detection_subcategory_map.csv` changes, the generator also bumps `lookups/csv/detection_subcategory_map.yml` by incrementing `version` and setting `modification_date`. + add-paths: | + lookups/csv/detection_subcategory_map.csv + lookups/csv/detection_subcategory_map.yml diff --git a/app_template/default/data/ui/nav/default.xml b/app_template/default/data/ui/nav/default.xml index 6357d847015..1738ee90689 100644 --- a/app_template/default/data/ui/nav/default.xml +++ b/app_template/default/data/ui/nav/default.xml @@ -2,7 +2,12 @@ - + + + + + + Docs Explore in ES diff --git a/build.yml b/build.yml index aee844016c1..90e9100bc51 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.5.0 +app_version: 6.9.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index b1f828f54ed..1d6537fc169 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.5.0 + version: 6.9.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU @@ -241,10 +241,10 @@ apps: version: 4.0.3 hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-vmware-indexes_403.tgz - uid: 1467 - title: Cisco Networks Add-on - appid: TA-cisco_ios - version: 2.7.9 - hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/add-on-for-cisco-network-data_279.tgz + title: Cisco Enterprise Networking Add-on for Splunk + appid: TA-cisco-enterprise-networking-add-on-for-splunk + version: 4.0.35 + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-enterprise-networking-add-on-for-splunk_4035.tgz - uid: 8024 title: TA-ollama appid: ta-ollama diff --git a/dashboards/nist_ai_rmf_control_coverage.json b/dashboards/nist_ai_rmf_control_coverage.json new file mode 100644 index 00000000000..1fc65b630cc --- /dev/null +++ b/dashboards/nist_ai_rmf_control_coverage.json @@ -0,0 +1,1032 @@ +{ + "visualizations": { + "viz_BQYxvvZQ": { + "type": "splunk.markdown", + "options": { + "markdown": "# Configuration\n\n## Required lookups\n- `nist_ai_rmf_subcategories`: NIST AI RMF reference rows.\n- `detection_subcategory_map`: ESCU detection-to-RMF mapping.\n\n## Macros\n- Configure the AI detection macros for your environment: `mcp_server`, `m365_exported_ediscovery_prompt_logs`, `aws_bedrock_claude`, `ollama_server`, `cisco_ai_defense`.\n- Put index, source, and sourcetype constraints in macros.\n\n## Live findings\n- The Finding Window controls only live risk/notable panels. Coverage, inventory, and QA panels are lookup based.\n- Live panels read `index=risk` and `index=notable`.\n- Enable and schedule mapped ESCU detections and enable risk or notable output.\n- Supported saved-search title format: `ESCU - - Rule`." + } + }, + "viz_QTxzlSCU": { + "type": "splunk.singlevalue", + "options": { + "unit": "%", + "numberPrecision": 1, + "backgroundColor": "> majorValue | rangeValue(convertedColorRange)" + }, + "context": { + "convertedColorRange": [ + { + "from": 75, + "value": "#4C8B5B" + }, + { + "from": 25, + "to": 75, + "value": "#C99A3B" + }, + { + "to": 25, + "value": "#B5432F" + } + ] + }, + "dataSources": { + "primary": "ds_BRlMOk7d" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Overall Coverage" + }, + "viz_cnGGAaf6": { + "type": "splunk.singlevalue", + "options": { + "backgroundColor": "> majorValue | rangeValue(convertedColorRange)" + }, + "context": { + "convertedColorRange": [ + { + "from": 1, + "value": "#4C8B5B" + }, + { + "to": 1, + "value": "#C9CDD1" + } + ] + }, + "dataSources": { + "primary": "ds_gt18ik5M" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Covered Subcategories" + }, + "viz_7wqkM9gb": { + "type": "splunk.singlevalue", + "options": { + "backgroundColor": "> majorValue | rangeValue(convertedColorRange)" + }, + "context": { + "convertedColorRange": [ + { + "from": 10, + "value": "#B5432F" + }, + { + "from": 1, + "to": 10, + "value": "#C99A3B" + }, + { + "to": 1, + "value": "#4C8B5B" + } + ] + }, + "dataSources": { + "primary": "ds_vZrhxFOJ" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Evidence Gaps" + }, + "viz_4Ftbhr59": { + "type": "splunk.singlevalue", + "options": { + "backgroundColor": "> majorValue | rangeValue(convertedColorRange)" + }, + "context": { + "convertedColorRange": [ + { + "from": 1, + "value": "#2F6E7A" + }, + { + "to": 1, + "value": "#C9CDD1" + } + ] + }, + "dataSources": { + "primary": "ds_2SqA5f9A" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Evidence Mappings" + }, + "viz_eW41wskU": { + "type": "splunk.pie", + "options": { + "seriesColorsByField": { + "Covered": "#4C8B5B", + "No Automated Evidence": "#C9CDD1" + } + }, + "dataSources": { + "primary": "ds_63nvtA3f" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Overall Subcategory Coverage" + }, + "viz_73j82pok": { + "type": "splunk.table", + "options": { + "count": 6, + "drilldown": "none", + "showInternalFields": false + }, + "dataSources": { + "primary": "ds_eLy1BISV" + }, + "title": "Current AI Data Sources" + }, + "viz_kKUYcPFZ": { + "type": "splunk.column", + "options": { + "yAxisAbbreviation": "off", + "y2AxisAbbreviation": "off", + "showRoundedY2AxisLabels": false, + "legendTruncation": "ellipsisMiddle", + "showY2MajorGridLines": true, + "yAxisTitleText": "Coverage %", + "yAxisMax": 100, + "seriesColorsByField": { + "coverage_pct": "#2F6E7A" + }, + "legendDisplay": "off" + }, + "dataSources": { + "primary": "ds_hS1OJKg4" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Coverage % by RMF Function" + }, + "viz_hnOFRoBD": { + "type": "splunk.table", + "options": { + "count": 6, + "drilldown": "none", + "showInternalFields": false, + "columnFormat": { + "Issues": { + "rowBackgroundColors": "> table | seriesByName(\"Issues\") | rangeValue(IssuesColumnColorConfig)" + } + } + }, + "context": { + "IssuesColumnColorConfig": [ + { + "to": 1, + "value": "#8FBC8F" + }, + { + "from": 1, + "to": 5, + "value": "#C99A3B" + }, + { + "from": 5, + "value": "#B5432F" + } + ] + }, + "dataSources": { + "primary": "ds_OrjFXleV" + }, + "title": "Lookup QA" + }, + "viz_rBY5q7BC": { + "type": "splunk.table", + "options": { + "count": 5, + "drilldown": "none", + "showInternalFields": false, + "columnFormat": { + "Gaps": { + "rowBackgroundColors": "> table | seriesByName(\"Gaps\") | rangeValue(GapsColumnColorConfig)" + } + } + }, + "context": { + "GapsColumnColorConfig": [ + { + "to": 2, + "value": "#C9CDD1" + }, + { + "from": 2, + "to": 5, + "value": "#C99A3B" + }, + { + "from": 5, + "value": "#B5432F" + } + ] + }, + "dataSources": { + "primary": "ds_7kk8BZgQ" + }, + "title": "Coverage Gaps by Category" + }, + "viz_6bpl5nqi": { + "type": "splunk.table", + "options": { + "count": 15, + "drilldown": "none", + "showInternalFields": false, + "columnFormat": { + "Coverage Score": { + "rowBackgroundColors": "> table | seriesByName(\"Coverage Score\") | rangeValue(CoverageScoreColumnColorConfig)" + }, + "Confidence": { + "rowBackgroundColors": "> table | seriesByName(\"Confidence\") | matchValue(ConfidenceColumnColorConfig)" + }, + "Status": { + "rowBackgroundColors": "> table | seriesByName(\"Status\") | matchValue(StatusColumnColorConfig)" + } + } + }, + "context": { + "CoverageScoreColumnColorConfig": [ + { + "to": 1, + "value": "#D3D3D3" + }, + { + "from": 1, + "to": 80, + "value": "#E8C66A" + }, + { + "from": 80, + "to": 100, + "value": "#8FBC8F" + }, + { + "from": 100, + "value": "#4C8B5B" + } + ], + "ConfidenceColumnColorConfig": [ + { + "match": "Production detection", + "value": "#8FBC8F" + }, + { + "match": "High-confidence mapping", + "value": "#CFE8D4" + }, + { + "match": "Mapped evidence", + "value": "#E8C66A" + }, + { + "match": "Gap", + "value": "#D3D3D3" + } + ], + "StatusColumnColorConfig": [ + { + "match": "Covered", + "value": "#8FBC8F" + }, + { + "match": "No Automated Evidence", + "value": "#D3D3D3" + } + ] + }, + "dataSources": { + "primary": "ds_Twm3TjaW" + }, + "title": "NIST AI RMF Coverage Matrix" + }, + "viz_DsBuvQrU": { + "type": "splunk.bar", + "options": { + "yAxisAbbreviation": "off", + "y2AxisAbbreviation": "off", + "showRoundedY2AxisLabels": false, + "legendTruncation": "ellipsisMiddle", + "showY2MajorGridLines": true, + "stackMode": "stacked", + "xAxisTitleText": "Detections", + "seriesColorsByField": { + "High confidence": "#4C8B5B", + "Medium confidence": "#C99A3B", + "Needs review": "#B5432F", + "Validated legacy": "#2F6E7A", + "Mapped": "#C9CDD1" + }, + "legendDisplay": "right" + }, + "dataSources": { + "primary": "ds_985blmZV" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Mapping Confidence by AI System" + }, + "viz_kSKQYeUh": { + "type": "splunk.column", + "options": { + "yAxisAbbreviation": "off", + "y2AxisAbbreviation": "off", + "showRoundedY2AxisLabels": false, + "legendTruncation": "ellipsisMiddle", + "showY2MajorGridLines": true, + "stackMode": "stacked", + "yAxisTitleText": "Findings", + "seriesColorsByField": { + "critical": "#7A1F1F", + "high": "#B5432F", + "medium": "#C99A3B", + "low": "#4C8B5B", + "info": "#C9CDD1" + }, + "legendDisplay": "right" + }, + "dataSources": { + "primary": "ds_GuKtVyMD" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Recent Finding Volume" + }, + "viz_xPLJvtKV": { + "type": "splunk.line", + "options": { + "yAxisAbbreviation": "off", + "y2AxisAbbreviation": "off", + "showRoundedY2AxisLabels": false, + "legendTruncation": "ellipsisMiddle", + "showY2MajorGridLines": true, + "yAxisTitleText": "Findings", + "seriesColorsByField": { + "MCP": "#2F6E7A", + "M365 Copilot": "#96702C", + "AWS Bedrock Claude": "#4C8B5B", + "Ollama": "#B5432F", + "No live findings": "#C9CDD1" + }, + "legendDisplay": "right" + }, + "dataSources": { + "primary": "ds_baqBk8nw" + }, + "eventHandlers": [ + { + "type": "drilldown.linkToSearch", + "options": { + "type": "auto", + "newTab": false + } + } + ], + "title": "Recent Findings Over Time" + }, + "viz_Rn9Wgakt": { + "type": "splunk.table", + "options": { + "count": 6, + "drilldown": "none", + "showInternalFields": false, + "columnFormat": { + "Findings": { + "rowBackgroundColors": "> table | seriesByName(\"Findings\") | rangeValue(FindingsColumnColorConfig)" + } + } + }, + "context": { + "FindingsColumnColorConfig": [ + { + "to": 2, + "value": "#C9CDD1" + }, + { + "from": 2, + "to": 5, + "value": "#C99A3B" + }, + { + "from": 5, + "value": "#B5432F" + } + ] + }, + "dataSources": { + "primary": "ds_dm3yXtFo" + }, + "title": "Top Active Entities" + }, + "viz_FSxVef4D": { + "type": "splunk.table", + "options": { + "count": 6, + "drilldown": "none", + "showInternalFields": false, + "columnFormat": { + "severity": { + "rowBackgroundColors": "> table | seriesByName(\"severity\") | matchValue(severityColumnColorConfig)" + } + } + }, + "context": { + "severityColumnColorConfig": [ + { + "match": "critical", + "value": "#7A1F1F" + }, + { + "match": "high", + "value": "#B5432F" + }, + { + "match": "medium", + "value": "#E8C66A" + }, + { + "match": "low", + "value": "#8FBC8F" + }, + { + "match": "info", + "value": "#C9CDD1" + } + ] + }, + "dataSources": { + "primary": "ds_zqqriYdp" + }, + "title": "Recent Findings Detail" + }, + "viz_liveReadiness": { + "type": "splunk.table", + "options": { + "count": 10, + "drilldown": "none", + "showInternalFields": false, + "columnFormat": { + "Readiness": { + "rowBackgroundColors": "> table | seriesByName(\"Readiness\") | matchValue(ReadinessColumnColorConfig)" + } + } + }, + "context": { + "ReadinessColumnColorConfig": [ + { + "match": "Ready", + "value": "#8FBC8F" + }, + { + "match": "Disabled", + "value": "#E8C66A" + }, + { + "match": "Not scheduled", + "value": "#E8C66A" + }, + { + "match": "No risk/notable action", + "value": "#C99A3B" + }, + { + "match": "Missing saved search", + "value": "#B5432F" + } + ] + }, + "dataSources": { + "primary": "ds_live_readiness" + }, + "title": "Live Findings Readiness" + } + }, + "dataSources": { + "ds_coverage_base": { + "type": "ds.search", + "options": { + "query": "| inputlookup nist_ai_rmf_subcategories\n| eval rmf_row=1\n| fields function category_id subcategory_id subcategory_text rmf_row\n| append\n [ | inputlookup detection_subcategory_map\n | eval selected_ai_system=case(len($ai_system_filter|s$)==0 OR $ai_system_filter|s$==\"*\" OR $ai_system_filter|s$==\"__all__\" OR match($ai_system_filter|s$, \"^\\$.*\\$$\"), \"*\", true(), $ai_system_filter|s$)\n | where selected_ai_system==\"*\" OR ai_system==selected_ai_system\n | eval subcategory_ids=split(coalesce(subcategory_ids,\"\"), \"|\")\n | mvexpand subcategory_ids\n | eval subcategory_id=trim(subcategory_ids)\n | where subcategory_id!=\"\"\n | eval mapped_detection=1\n | eval production_detection=if(lower(coalesce(detection_status,\"\"))==\"production\", 1, 0)\n | eval mapping_confidence=lower(coalesce(mapping_confidence,\"mapped\"))\n | eval mapping_state=case(\n mapping_confidence==\"validated\", \"Validated legacy evidence\",\n mapping_confidence==\"high\", \"High-confidence mapping\",\n mapping_confidence==\"medium\", \"Medium-confidence mapping\",\n mapping_confidence==\"review\", \"Review mapping\",\n mapping_confidence==\"mapped\", \"Mapped legacy evidence\",\n true(), \"Mapped evidence\")\n | fields subcategory_id detection_name ai_system mapped_detection production_detection mapping_confidence mapping_state mapping_source mapping_reason detection_status detection_type analytic_stories data_sources ]\n| stats values(function) as function values(category_id) as category_id values(subcategory_text) as subcategory_text values(detection_name) as detections values(ai_system) as ai_systems dc(detection_name) as detection_count sum(mapped_detection) as mapped_rows sum(production_detection) as production_detections values(mapping_confidence) as mapping_confidence values(mapping_state) as mapping_state values(mapping_source) as mapping_source values(detection_status) as detection_status by subcategory_id\n| eval function=mvindex(function,0), category_id=mvindex(category_id,0), subcategory_text=mvindex(subcategory_text,0)\n| where isnotnull(function) AND isnotnull(category_id)\n| eval detection_count=coalesce(detection_count,0), mapped_rows=coalesce(mapped_rows,0), production_detections=coalesce(production_detections,0)\n| eval status=if(detection_count>0,\"Covered\",\"No Automated Evidence\")\n| eval mapping_confidence_text=mvjoin(mapping_confidence,\"|\")\n| eval confidence=case(production_detections>0,\"Production detection\", match(mapping_confidence_text,\"high\"),\"High-confidence mapping\", detection_count>0,\"Mapped evidence\", true(),\"Gap\")\n| eval selected_function=case($function_filter|s$==\"GOVERN\" OR $function_filter|s$==\"MAP\" OR $function_filter|s$==\"MEASURE\" OR $function_filter|s$==\"MANAGE\", $function_filter|s$, true(), \"*\")\n| where selected_function==\"*\" OR function==selected_function\n| fields - selected_function\n| eval selected_status=case($status_filter|s$==\"Covered\" OR $status_filter|s$==\"No Automated Evidence\", $status_filter|s$, true(), \"*\")\n| where selected_status==\"*\" OR status==selected_status\n| fields - selected_status mapping_confidence_text\n| table function category_id subcategory_id subcategory_text status confidence detection_count production_detections detections ai_systems mapping_state mapping_source detection_status", + "queryParameters": { + "earliest": "0", + "latest": "now" + } + }, + "name": "ds_coverage_base" + }, + "ds_live_findings_base": { + "type": "ds.search", + "options": { + "query": "search (index=risk OR index=notable)\n [ | inputlookup detection_subcategory_map\n | eval selected_ai_system=$ai_system_filter|s$\n | eval selected_ai_system=case(len(selected_ai_system)==0 OR selected_ai_system==\"*\" OR selected_ai_system==\"__all__\" OR match(selected_ai_system, \"^\\$.*\\$$\"), \"*\", true(), selected_ai_system)\n | where selected_ai_system==\"*\" OR ai_system==selected_ai_system\n | eval savedsearch_title=if(match(detection_name,\"^ESCU - .+ - Rule$\"), detection_name, \"ESCU - \".detection_name.\" - Rule\")\n | eval savedsearch_title=trim(savedsearch_title)\n | where match(savedsearch_title,\"^ESCU - [A-Za-z0-9][A-Za-z0-9 _.\\-]{0,180} - Rule$\")\n | stats values(savedsearch_title) as savedsearch_title dc(savedsearch_title) as savedsearch_count\n | eval quoted=\"\\\"\".mvjoin(savedsearch_title,\"\\\",\\\"\").\"\\\"\"\n | eval search=if(savedsearch_count>0, \"(source IN (\".quoted.\") OR search_name IN (\".quoted.\") OR savedsearch_name IN (\".quoted.\") OR orig_source IN (\".quoted.\") OR rule_name IN (\".quoted.\"))\", \"source=\\\"__nist_ai_no_match__\\\"\")\n | return $search ]\n| eval finding_source=case(index=\"risk\",\"risk\", index=\"notable\",\"notable\", true(),index)\n| eval savedsearch_title=coalesce(if(match(search_name,\"^ESCU - .+ - Rule$\"),search_name,null()), if(match(source,\"^ESCU - .+ - Rule$\"),source,null()), if(match(savedsearch_name,\"^ESCU - .+ - Rule$\"),savedsearch_name,null()), if(match(rule_name,\"^ESCU - .+ - Rule$\"),rule_name,null()), if(match(orig_source,\"^ESCU - .+ - Rule$\"),orig_source,null()))\n| where isnotnull(savedsearch_title)\n| rex field=savedsearch_title \"^ESCU - (?.*?)(?: - Rule)?$\"\n| lookup detection_subcategory_map detection_name as detection OUTPUT ai_system subcategory_ids rmf_function analytic_stories\n| where isnotnull(ai_system)\n| eval nist_ai_finding_event_id=coalesce(event_id, source_event_id, sid, _cd, tostring(_time).\"|\".savedsearch_title.\"|\".coalesce(risk_object,\"\").\"|\".coalesce(dest,\"\").\"|\".coalesce(user,\"\").\"|\".coalesce(_raw,\"\"))\n| dedup nist_ai_finding_event_id detection\n| eval risk_numeric=tonumber(coalesce(calculated_risk_score, risk_score))\n| eval severity=case(\n finding_source=\"risk\", lower(coalesce(severity, case(risk_numeric>=80,\"critical\", risk_numeric>=50,\"high\", risk_numeric>=20,\"medium\", risk_numeric>0,\"low\", true(),\"unknown\"))),\n finding_source=\"notable\", lower(coalesce(severity, urgency, \"unknown\")),\n true(), lower(coalesce(severity,\"unknown\")))\n| eval entity=case(\n finding_source=\"risk\", coalesce(risk_object, normalized_risk_object, user, dest, src, host, \"unknown\"),\n finding_source=\"notable\", coalesce(risk_object, normalized_risk_object, user, dest, src, host, rule_name, \"unknown\"),\n true(), coalesce(risk_object, normalized_risk_object, user, dest, src, host, \"unknown\"))\n| eval target=case(\n finding_source=\"risk\", coalesce(risk_object_type, dest, src, user, host, \"\"),\n finding_source=\"notable\", coalesce(dest, src, user, host, \"\"),\n true(), coalesce(dest, src, user, host, \"\"))\n| eval detail=case(\n finding_source=\"risk\", coalesce(risk_message, source, search_name, detection, \"\"),\n finding_source=\"notable\", coalesce(rule_description, description, rule_name, detection, \"\"),\n true(), coalesce(risk_message, rule_description, source, detection, \"\"))\n| eval finding_type=case(finding_source=\"risk\", coalesce(analyticstories, rmf_function, \"Risk event\"), finding_source=\"notable\", coalesce(rmf_function, \"Notable event\"), true(), coalesce(rmf_function,\"Finding\"))\n| eval entity=coalesce(entity,\"unknown\")\n| eval source=coalesce(source, finding_source)\n| eval target=coalesce(target,\"\")\n| eval detail=substr(coalesce(detail,\"\"),1,500)\n| fields _time finding_source ai_system detection finding_type severity entity source target detail", + "queryParameters": { + "earliest": "$global_time.earliest$", + "latest": "$global_time.latest$" + } + }, + "name": "ds_live_findings_base" + }, + "ds_tvTy8Bkv": { + "type": "ds.search", + "options": { + "query": "| inputlookup detection_subcategory_map\n| where isnotnull(ai_system) AND ai_system!=\"\"\n| stats count by ai_system\n| sort ai_system", + "queryParameters": { + "earliest": "0", + "latest": "now" + } + }, + "name": "AI System search" + }, + "ds_BRlMOk7d": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| stats count as total count(eval(status==\"Covered\")) as covered\n| eval pct=if(total=0,0,round(100*covered/total,1))\n| fields pct" + }, + "name": "Overall Coverage - Single value search" + }, + "ds_gt18ik5M": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| stats count(eval(status==\"Covered\")) as covered\n| fields covered" + }, + "name": "Covered Subcategories - Single value search" + }, + "ds_vZrhxFOJ": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| stats count(eval(status==\"No Automated Evidence\")) as gaps\n| fields gaps" + }, + "name": "Evidence Gaps - Single value search" + }, + "ds_2SqA5f9A": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| stats sum(detection_count) as mapped_evidence\n| eval mapped_evidence=coalesce(mapped_evidence,0)\n| fields mapped_evidence" + }, + "name": "Evidence Mappings - Single value search" + }, + "ds_63nvtA3f": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| stats count by status\n| sort status" + }, + "name": "Overall Subcategory Coverage - Pie chart search" + }, + "ds_eLy1BISV": { + "type": "ds.search", + "options": { + "query": "| inputlookup detection_subcategory_map\n| eval selected_ai_system=case(len($ai_system_filter|s$)==0 OR $ai_system_filter|s$==\"*\" OR $ai_system_filter|s$==\"__all__\" OR match($ai_system_filter|s$, \"^\\$.*\\$$\"), \"*\", true(), $ai_system_filter|s$)\n| where selected_ai_system==\"*\" OR ai_system==selected_ai_system\n| where isnotnull(ai_system) AND ai_system!=\"\"\n| eval data_sources=coalesce(data_sources, ai_system)\n| eval data_source_list=split(data_sources,\"|\")\n| eval subcategory_ids=split(coalesce(subcategory_ids,\"\"), \"|\")\n| eval mapped_subcategories=mvcount(subcategory_ids)\n| eval production_detection=if(lower(coalesce(detection_status,\"\"))==\"production\", 1, 0)\n| eval mapping_confidence=lower(coalesce(mapping_confidence,\"mapped\"))\n| eval mapping_confidence=case(mapping_confidence==\"high\",\"High confidence\", mapping_confidence==\"medium\",\"Medium confidence\", mapping_confidence==\"review\",\"Needs review\", mapping_confidence==\"validated\",\"Validated legacy\", true(),\"Mapped\")\n| stats dc(detection_name) as detections values(data_source_list) as data_sources sum(mapped_subcategories) as mapped_subcategories sum(production_detection) as production_detections values(mapping_confidence) as mapping_confidence by ai_system\n| eval data_sources=mvjoin(mvsort(data_sources), \", \")\n| eval mapping_confidence=mvjoin(mvsort(mapping_confidence), \", \")\n| sort -detections ai_system\n| rename ai_system as \"AI System\", data_sources as \"Data Sources\", detections as \"Detections\", mapped_subcategories as \"Mapped Subcategories\", production_detections as \"Production Detections\", mapping_confidence as \"Mapping Confidence\"\n| table \"AI System\" \"Data Sources\" Detections \"Mapped Subcategories\" \"Production Detections\" \"Mapping Confidence\"", + "queryParameters": { + "earliest": "0", + "latest": "now" + } + }, + "name": "Current AI Data Sources - Table search" + }, + "ds_hS1OJKg4": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| stats count as total count(eval(status==\"Covered\")) as covered_n by function\n| eval coverage_pct=if(total=0,0,round(100*covered_n/total,1))\n| eval function_order=case(function=\"GOVERN\",1,function=\"MAP\",2,function=\"MEASURE\",3,function=\"MANAGE\",4,true(),99)\n| sort function_order\n| table function coverage_pct" + }, + "name": "Coverage % by RMF Function - Column chart search" + }, + "ds_OrjFXleV": { + "type": "ds.search", + "options": { + "query": "| makeresults\n| eval qa_check=\"Invalid subcategory IDs|Blank AI systems|Blank data sources|Duplicate mappings|Review mappings|Unexpected validated_count|Unsafe detection names\"\n| makemv delim=\"|\" qa_check\n| mvexpand qa_check\n| eval issue_count=0, examples=\"\"\n| append\n [ | inputlookup detection_subcategory_map\n | eval subcategory_ids=split(coalesce(subcategory_ids,\"\"),\"|\")\n | mvexpand subcategory_ids\n | eval subcategory_id=trim(subcategory_ids)\n | eval mapped=1\n | fields detection_name ai_system subcategory_id mapped\n | append\n [ | inputlookup nist_ai_rmf_subcategories\n | eval valid_rmf=1\n | fields subcategory_id valid_rmf ]\n | stats max(mapped) as mapped max(valid_rmf) as valid_rmf values(detection_name) as detections by subcategory_id\n | where mapped==1 AND isnull(valid_rmf)\n | eval qa_check=\"Invalid subcategory IDs\", examples=subcategory_id.\" / \".mvindex(detections,0), issue_count=1\n | fields qa_check issue_count examples ]\n| append\n [ | inputlookup detection_subcategory_map\n | where isnull(ai_system) OR trim(ai_system)==\"\"\n | eval qa_check=\"Blank AI systems\", issue_count=1, examples=coalesce(detection_name,\"\")\n | fields qa_check issue_count examples ]\n| append\n [ | inputlookup detection_subcategory_map\n | eval data_sources=coalesce(data_sources,\"\")\n | where isnull(data_sources) OR trim(data_sources)==\"\"\n | eval qa_check=\"Blank data sources\", issue_count=1, examples=coalesce(detection_name,\"\")\n | fields qa_check issue_count examples ]\n| append\n [ | inputlookup detection_subcategory_map\n | eval subcategory_ids=split(coalesce(subcategory_ids,\"\"),\"|\")\n | mvexpand subcategory_ids\n | eval subcategory_id=trim(subcategory_ids)\n | stats count as duplicate_count by detection_name ai_system subcategory_id\n | where duplicate_count>1\n | eval qa_check=\"Duplicate mappings\", issue_count=duplicate_count-1, examples=detection_name.\" / \".ai_system.\" / \".subcategory_id\n | fields qa_check issue_count examples ]\n| append\n [ | inputlookup detection_subcategory_map\n | eval mapping_confidence=lower(coalesce(mapping_confidence,\"\")), mapping_source=lower(coalesce(mapping_source,\"\"))\n | where mapping_confidence==\"review\" OR mapping_source==\"generated_review\"\n | eval qa_check=\"Review mappings\", issue_count=1, examples=coalesce(detection_name,\"\").\" / \".coalesce(mapping_reason,\"\")\n | fields qa_check issue_count examples ]\n| append\n [ | inputlookup detection_subcategory_map\n | where isnotnull(validated_count)\n | eval validated_count=trim(tostring(validated_count))\n | where validated_count!=\"\" AND lower(validated_count)!=\"null\" AND NOT match(validated_count,\"^[0-9]+$\")\n | eval qa_check=\"Unexpected validated_count\", issue_count=1, examples=coalesce(detection_name,\"\").\" / \".validated_count\n | fields qa_check issue_count examples ]\n| append\n [ | inputlookup detection_subcategory_map\n | eval expected_savedsearch=if(match(detection_name,\"^ESCU - .+ - Rule$\"), detection_name, \"ESCU - \".detection_name.\" - Rule\")\n | eval expected_savedsearch=trim(expected_savedsearch)\n | where NOT match(expected_savedsearch,\"^ESCU - [A-Za-z0-9][A-Za-z0-9 _.\\-]{0,180} - Rule$\")\n | eval qa_check=\"Unsafe detection names\", issue_count=1, examples=coalesce(detection_name,\"\")\n | fields qa_check issue_count examples ]\n| stats sum(issue_count) as Issues values(examples) as examples by qa_check\n| eval examples=mvfilter(examples!=\"\")\n| eval Examples=mvjoin(mvindex(examples,0,5), \"; \")\n| rename qa_check as \"QA Check\"\n| table \"QA Check\" Issues Examples\n| sort -Issues \"QA Check\"", + "queryParameters": { + "earliest": "0", + "latest": "now" + } + }, + "name": "Lookup QA - Table search" + }, + "ds_7kk8BZgQ": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| where status==\"No Automated Evidence\"\n| stats count as gaps values(subcategory_id) as subcategories by function category_id\n| rename function as Function, category_id as Category, gaps as Gaps, subcategories as Subcategories\n| sort -Gaps Function Category" + }, + "name": "Coverage Gaps by Category - Table search" + }, + "ds_Twm3TjaW": { + "type": "ds.chain", + "options": { + "extend": "ds_coverage_base", + "query": "| eval coverage_score=case(confidence==\"Production detection\",100, confidence==\"High-confidence mapping\",80, confidence==\"Mapped evidence\",60, true(),0)\n| eval function_order=case(function=\"GOVERN\",1,function=\"MAP\",2,function=\"MEASURE\",3,function=\"MANAGE\",4,true(),99)\n| sort function_order category_id subcategory_id\n| rename function as Function, category_id as Category, subcategory_id as Subcategory, coverage_score as \"Coverage Score\", confidence as Confidence, detection_count as Detections, production_detections as \"Production Detections\", ai_systems as \"AI Systems\", subcategory_text as \"Subcategory Text\", mapping_state as \"Mapping State\", detection_status as \"Detection Status\", status as Status\n| table Function Category Subcategory \"Coverage Score\" Confidence Detections \"Production Detections\" \"AI Systems\" \"Mapping State\" \"Detection Status\" \"Subcategory Text\" Status" + }, + "name": "NIST AI RMF Coverage Detail - Table search" + }, + "ds_985blmZV": { + "type": "ds.search", + "options": { + "query": "| inputlookup detection_subcategory_map\n| eval selected_ai_system=case(len($ai_system_filter|s$)==0 OR $ai_system_filter|s$==\"*\" OR $ai_system_filter|s$==\"__all__\" OR match($ai_system_filter|s$, \"^\\$.*\\$$\"), \"*\", true(), $ai_system_filter|s$)\n| where selected_ai_system==\"*\" OR ai_system==selected_ai_system\n| where isnotnull(ai_system) AND ai_system!=\"\"\n| eval mapping_confidence=lower(coalesce(mapping_confidence,\"mapped\"))\n| eval mapping_confidence=case(mapping_confidence==\"high\",\"High confidence\", mapping_confidence==\"medium\",\"Medium confidence\", mapping_confidence==\"review\",\"Needs review\", mapping_confidence==\"validated\",\"Validated legacy\", true(),\"Mapped\")\n| stats count as detections by ai_system mapping_confidence\n| chart sum(detections) over ai_system by mapping_confidence\n| fillnull value=0", + "queryParameters": { + "earliest": "0", + "latest": "now" + } + }, + "name": "Mapping Confidence by AI System - Bar chart search" + }, + "ds_GuKtVyMD": { + "type": "ds.chain", + "options": { + "extend": "ds_live_findings_base", + "query": "| chart count over ai_system by severity\n| appendpipe\n [ | stats count as result_count\n | where result_count==0\n | eval ai_system=\"No live findings\", info=0\n | fields - result_count ]\n| fillnull value=0" + }, + "name": "Recent Finding Volume - Column chart search" + }, + "ds_baqBk8nw": { + "type": "ds.chain", + "options": { + "extend": "ds_live_findings_base", + "query": "| timechart count by ai_system\n| appendpipe\n [ | stats count as result_count\n | where result_count==0\n | eval _time=now(), \"No live findings\"=0\n | fields _time \"No live findings\" ]\n| fillnull value=0" + }, + "name": "Recent Findings Over Time - Line chart search" + }, + "ds_dm3yXtFo": { + "type": "ds.chain", + "options": { + "extend": "ds_live_findings_base", + "query": "| stats count as findings dc(detection) as detection_types values(ai_system) as ai_systems values(severity) as severities values(finding_source) as finding_sources max(_time) as last_time by entity\n| eval lastSeen=strftime(last_time,\"%Y-%m-%d %H:%M:%S\")\n| rename entity as Entity, findings as Findings, detection_types as \"Detection Types\", ai_systems as \"AI Systems\", severities as Severities, finding_sources as \"Finding Sources\", lastSeen as \"Last Seen\"\n| sort -Findings\n| table Entity Findings \"Detection Types\" \"AI Systems\" Severities \"Finding Sources\" \"Last Seen\"\n| appendpipe\n [ | stats count as result_count\n | where result_count==0\n | eval Entity=\"No live findings\", Findings=0, \"Detection Types\"=\"Enable and schedule mapped AI detections\", \"AI Systems\"=\"Check Live Findings Readiness\", Severities=\"info\", \"Finding Sources\"=\"risk/notable\", \"Last Seen\"=\"No events in selected Finding Window\"\n | fields - result_count ]" + }, + "name": "Top Active Entities - Table search" + }, + "ds_zqqriYdp": { + "type": "ds.chain", + "options": { + "extend": "ds_live_findings_base", + "query": "| eval eventTime=strftime(_time,\"%Y-%m-%d %H:%M:%S\")\n| sort -_time\n| rename finding_source as source_type\n| table eventTime source_type ai_system severity entity detection target detail\n| appendpipe\n [ | stats count as result_count\n | where result_count==0\n | eval eventTime=\"\", source_type=\"Configuration\", ai_system=\"No live findings\", severity=\"info\", entity=\"No risk/notable events in selected window\", detection=\"Enable and schedule mapped AI detections\", target=\"\", detail=\"All mapped detections are disabled or no risk/notable output has been generated. Check Live Findings Readiness.\"\n | fields - result_count ]" + }, + "name": "Recent Findings Detail - Table search" + }, + "ds_live_readiness": { + "type": "ds.search", + "options": { + "query": "| inputlookup detection_subcategory_map\n| eval selected_ai_system=case(len($ai_system_filter|s$)==0 OR $ai_system_filter|s$==\"*\" OR $ai_system_filter|s$==\"__all__\" OR match($ai_system_filter|s$, \"^\\$.*\\$$\"), \"*\", true(), $ai_system_filter|s$)\n| where selected_ai_system==\"*\" OR ai_system==selected_ai_system\n| eval expected_savedsearch=if(match(detection_name,\"^ESCU - .+ - Rule$\"), detection_name, \"ESCU - \".detection_name.\" - Rule\")\n| eval expected_savedsearch=trim(expected_savedsearch)\n| where match(expected_savedsearch,\"^ESCU - [A-Za-z0-9][A-Za-z0-9 _.\\-]{0,180} - Rule$\")\n| eval mapped=1\n| fields ai_system data_sources detection_name expected_savedsearch mapped\n| append\n [ | rest /servicesNS/-/-/saved/searches splunk_server=local\n | rename title as expected_savedsearch\n | eval savedsearch_present=1\n | eval enabled=if(disabled==0 OR disabled==\"0\",\"Enabled\",\"Disabled\")\n | eval scheduled=if(is_scheduled==1 OR is_scheduled==\"1\",\"Scheduled\",\"Not scheduled\")\n | eval finding_output=case(match(actions,\"(^|,)risk(,|$)\") OR 'action.risk'==1 OR 'action.risk'==\"1\",\"Risk\", match(actions,\"(^|,)notable(,|$)\") OR 'action.notable'==1 OR 'action.notable'==\"1\",\"Notable\", true(),\"No risk/notable\")\n | eval schedule=coalesce(cron_schedule,\"\"), window=coalesce('dispatch.earliest_time',\"\").\" to \".coalesce('dispatch.latest_time',\"\")\n | fields expected_savedsearch savedsearch_present enabled scheduled finding_output schedule window ]\n| stats max(mapped) as mapped values(ai_system) as ai_system values(data_sources) as data_sources values(detection_name) as detection_name max(savedsearch_present) as savedsearch_present values(enabled) as enabled values(scheduled) as scheduled values(finding_output) as finding_output values(schedule) as schedule values(window) as window by expected_savedsearch\n| where mapped==1\n| eval present=if(savedsearch_present==1,\"Present\",\"Missing\")\n| eval enabled=coalesce(mvindex(enabled,0),\"Missing\")\n| eval scheduled=coalesce(mvindex(scheduled,0),\"Missing\")\n| eval finding_output=coalesce(mvindex(finding_output,0),\"Missing\")\n| eval readiness=case(present==\"Missing\",\"Missing saved search\", enabled!=\"Enabled\",\"Disabled\", scheduled!=\"Scheduled\",\"Not scheduled\", finding_output==\"No risk/notable\",\"No risk/notable action\", true(),\"Ready\")\n| eval data_sources=mvjoin(mvsort(data_sources),\", \")\n| eval schedule=coalesce(mvindex(schedule,0),\"\"), window=coalesce(mvindex(window,0),\"\")\n| sort readiness ai_system detection_name\n| rename ai_system as \"AI System\", detection_name as Detection, expected_savedsearch as \"Saved Search\", readiness as Readiness, finding_output as \"Finding Output\", schedule as Schedule, window as Window, data_sources as \"Data Sources\"\n| table \"AI System\" Detection \"Saved Search\" Readiness \"Finding Output\" Schedule Window \"Data Sources\"", + "queryParameters": { + "earliest": "0", + "latest": "now" + } + }, + "name": "Live Findings Readiness - Table search" + } + }, + "defaults": { + "dataSources": { + "ds.search": { + "options": { + "queryParameters": { + "latest": "$global_time.latest$", + "earliest": "$global_time.earliest$" + } + } + } + } + }, + "inputs": { + "input_JACuzsvA": { + "type": "input.timerange", + "options": { + "token": "global_time", + "defaultValue": "-90d@d,now" + }, + "title": "Finding Window" + }, + "input_3BYkUTy7": { + "type": "input.dropdown", + "options": { + "defaultValue": "*", + "items": [ + { + "value": "*", + "label": "All functions" + }, + { + "value": "GOVERN", + "label": "GOVERN" + }, + { + "value": "MAP", + "label": "MAP" + }, + { + "value": "MEASURE", + "label": "MEASURE" + }, + { + "value": "MANAGE", + "label": "MANAGE" + } + ], + "token": "function_filter" + }, + "title": "RMF Function" + }, + "input_rjZO3BZq": { + "type": "input.dropdown", + "options": { + "defaultValue": "*", + "items": [ + { + "value": "*", + "label": "All statuses" + }, + { + "value": "Covered", + "label": "Covered" + }, + { + "value": "No Automated Evidence", + "label": "No Automated Evidence" + } + ], + "token": "status_filter" + }, + "title": "Coverage Status" + }, + "input_jgTDQthW": { + "type": "input.dropdown", + "options": { + "defaultValue": "__all__", + "items": ">frame(label, value) | prepend(formattedStatics) | objects()", + "token": "ai_system_filter" + }, + "title": "AI System", + "context": { + "formattedConfig": { + "number": { + "prefix": "" + } + }, + "formattedStatics": ">statics | formatByType(formattedConfig)", + "statics": [ + [ + "All AI systems" + ], + [ + "__all__" + ] + ], + "label": ">primary | seriesByName(\"ai_system\") | renameSeries(\"label\") | formatByType(formattedConfig)", + "value": ">primary | seriesByName(\"ai_system\") | renameSeries(\"value\") | formatByType(formattedConfig)" + }, + "dataSources": { + "primary": "ds_tvTy8Bkv" + } + } + }, + "layout": { + "type": "grid", + "options": { + "submitButton": false, + "height": 4460, + "width": 1440, + "submitOnDashboardLoad": true + }, + "structure": [ + { + "item": "viz_BQYxvvZQ", + "type": "block", + "position": { + "x": 0, + "y": 0, + "w": 1440, + "h": 390 + } + }, + { + "item": "viz_QTxzlSCU", + "type": "block", + "position": { + "x": 0, + "y": 390, + "w": 360, + "h": 210 + } + }, + { + "item": "viz_cnGGAaf6", + "type": "block", + "position": { + "x": 360, + "y": 390, + "w": 360, + "h": 210 + } + }, + { + "item": "viz_7wqkM9gb", + "type": "block", + "position": { + "x": 720, + "y": 390, + "w": 360, + "h": 210 + } + }, + { + "item": "viz_4Ftbhr59", + "type": "block", + "position": { + "x": 1080, + "y": 390, + "w": 360, + "h": 210 + } + }, + { + "item": "viz_eW41wskU", + "type": "block", + "position": { + "x": 0, + "y": 600, + "w": 720, + "h": 300 + } + }, + { + "item": "viz_73j82pok", + "type": "block", + "position": { + "x": 720, + "y": 600, + "w": 720, + "h": 300 + } + }, + { + "item": "viz_kKUYcPFZ", + "type": "block", + "position": { + "x": 0, + "y": 900, + "w": 1440, + "h": 280 + } + }, + { + "item": "viz_hnOFRoBD", + "type": "block", + "position": { + "x": 0, + "y": 1180, + "w": 1440, + "h": 280 + } + }, + { + "item": "viz_rBY5q7BC", + "type": "block", + "position": { + "x": 0, + "y": 1460, + "w": 1440, + "h": 420 + } + }, + { + "item": "viz_6bpl5nqi", + "type": "block", + "position": { + "x": 0, + "y": 1880, + "w": 1440, + "h": 520 + } + }, + { + "item": "viz_DsBuvQrU", + "type": "block", + "position": { + "x": 0, + "y": 2400, + "w": 1440, + "h": 300 + } + }, + { + "item": "viz_kSKQYeUh", + "type": "block", + "position": { + "x": 0, + "y": 3060, + "w": 1440, + "h": 280 + } + }, + { + "item": "viz_liveReadiness", + "type": "block", + "position": { + "x": 0, + "y": 2700, + "w": 1440, + "h": 360 + } + }, + { + "item": "viz_xPLJvtKV", + "type": "block", + "position": { + "x": 0, + "y": 3340, + "w": 1440, + "h": 280 + } + }, + { + "item": "viz_Rn9Wgakt", + "type": "block", + "position": { + "x": 0, + "y": 3620, + "w": 1440, + "h": 420 + } + }, + { + "item": "viz_FSxVef4D", + "type": "block", + "position": { + "x": 0, + "y": 4040, + "w": 1440, + "h": 420 + } + } + ], + "globalInputs": [ + "input_JACuzsvA", + "input_3BYkUTy7", + "input_rjZO3BZq", + "input_jgTDQthW" + ] + }, + "description": "Maps AI-related ESCU detections and ESCU-generated risk/notable findings to NIST AI RMF subcategories for coverage review, gap analysis, and operational follow-up. Coverage is generated from detection metadata and configured AI data-source selectors; live findings are limited to standard ESCU rule saved-search output in the form ESCU - - Rule. The mapping is practitioner-maintained operational guidance and is not an official NIST or Splunk taxonomy.", + "title": "NIST AI RMF Control Coverage" +} diff --git a/dashboards/nist_ai_rmf_control_coverage.yml b/dashboards/nist_ai_rmf_control_coverage.yml new file mode 100644 index 00000000000..14cd65d6510 --- /dev/null +++ b/dashboards/nist_ai_rmf_control_coverage.yml @@ -0,0 +1,9 @@ +name: NIST AI RMF Control Coverage +id: 426d4e21-dace-4d38-b292-6cc49a376251 +version: 2 +creation_date: '2026-09-02' +modification_date: '2026-09-02' +author: Nasreddine Bencherchali, Rod Soto, Splunk +description: |- + Maps AI-related ESCU detections and ESCU-generated risk/notable findings to NIST AI RMF subcategories for coverage review, gap analysis, and operational follow-up. + Coverage is generated from detection metadata and configured AI data-source selectors; live findings are limited to standard ESCU rule saved-search output in the form "ESCU - - Rule". diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index ff54229c4ac..8cf3fced717 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 output_fields: - dest - user diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index dabaaa7d982..5ea501b2a51 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index 148ad9f53d6..3f30e5003c3 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -17,7 +17,7 @@ separator_value: Add member to role supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index 6a3682061cd..0d1814a1fb2 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -17,7 +17,7 @@ separator_value: Add owner to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index a89d51760a4..1056b51476a 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index 86ec0e593c7..05ae6170ff8 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -17,7 +17,7 @@ separator_value: Add unverified domain supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 2d3dddff8e8..9d099b746ff 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -17,7 +17,7 @@ separator_value: Consent to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index 10b5050e7b3..bb9c0cdbc0c 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -16,7 +16,7 @@ separator_value: Disable Strong Authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 2926d693c9a..8d5fac1a5e3 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -16,7 +16,7 @@ separator_value: Enable account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 5c989625b73..047ac126b8e 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -16,7 +16,7 @@ separator_value: Invite external user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml index 51cf097b188..00f450cc02e 100644 --- a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml +++ b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - _time example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}' diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml index 161a1d8a1a3..d945db01a4e 100644 --- a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml +++ b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - action - additional_details diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index bf82955119e..5290f93d7f3 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -16,7 +16,7 @@ separator_value: Reset password (by admin) supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 3b2864dfe1b..8e31d2ba706 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -16,7 +16,7 @@ separator_value: Set domain authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index ec07057d4d2..9512febc428 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -16,7 +16,7 @@ separator_value: Sign-in activity supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index 94311f56f83..68973cf9bf8 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -16,7 +16,7 @@ separator_value: Update application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index adb75dd369f..11b8c70a60a 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -16,7 +16,7 @@ separator_value: Update authorization policy supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index 81c651980d2..f68bb2e219f 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -15,7 +15,7 @@ separator_value: Update user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index 3b99c45001e..758efd25fa6 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -15,7 +15,7 @@ separator_value: User registered security info supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - _time - Level diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index c08a28064fa..26b38ab8856 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 6a5cb1015f4..fc2ceb32333 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation Runbook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index 0527fe91051..1b8fe4bbadc 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation webhook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - _time - authorization.action diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index c9824bf8650..8a57ac3379f 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.3.1 + version: 6.3.3 fields: - column - action diff --git a/data_sources/cisco_ai_defense_alerts.yml b/data_sources/cisco_ai_defense_alerts.yml index 1c672354b46..60efe8e519b 100644 --- a/data_sources/cisco_ai_defense_alerts.yml +++ b/data_sources/cisco_ai_defense_alerts.yml @@ -1,15 +1,72 @@ name: Cisco AI Defense Alerts id: cbb06880-9dd9-4542-ac60-bd6e1d3c3e4e -version: 2 +version: 3 creation_date: '2025-02-14' -modification_date: '2026-05-13' -author: Bhavin Patel +modification_date: '2026-10-15' +author: Bhavin Patel, Nasreddine Bencherchali, Splunk description: Data source object for Cisco AI Defense Alerts -source: cisco_ai_defense +source: not_applicable sourcetype: cisco:ai:defense separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: + - _time + - host + - app + - application_id + - connection_id + - connection.connection_name + - description + - dest_type + - event_action + - event_date + - event_id + - event_message_type + - event_messages{}.event_conversation.event_messages{}.content + - event_messages{}.event_conversation.event_messages{}.direction + - event_messages{}.event_conversation.event_messages{}.event_conversation_id + - event_messages{}.event_conversation.event_messages{}.event_ext_message_id + - event_messages{}.event_conversation.event_messages{}.event_ins_date + - event_messages{}.event_conversation.event_messages{}.event_message_id + - event_messages{}.event_conversation.event_messages{}.event_message_policy_assocs + - event_messages{}.event_conversation.event_messages{}.metadata{}.policy_guardrail_assoc_id + - event_messages{}.event_conversation.event_messages{}.metadata{}.standards{} + - event_messages{}.event_conversation.event_messages{}.related_event_message_id + - event_messages{}.event_conversation.event_messages{}.tenant_id + - event_messages{}.event_ext_message_id + - event_messages{}.event_message_id + - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name + - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type + - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail.guardrails_type + - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_subcategory.guardrail_rule_name + - event_policy_guardrail_assocs{}.policy_guardrail_assoc.pol_guardrail_assoc_id + - eventtype + - genai_application.application_name + - genai_application.connection_type + - hec_event_type + - id + - index + - linecount + - model.model_name + - model.model_provider_name + - Number + - policy_id + - policy.policy_name + - punct + - resource_type + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src_type + - tag + - tag::eventtype + - type + - user_id + - vendor_product +example_log: | + {"user_id":"82000000-0000-0000-c000-000000000000","version":"","application_id":"972cbcd1-acfe-4393-88bc-418f4d9a64ae","genai_application":{"application_name":"Bedrock testing"},"connection_id":"a6c87227-b321-49bf-80d9-f958385257ba","connection":{"connection_name":"bedrock testing"},"policy_id":"42ba067b-06c0-4e43-8002-2c6bce2663b4","policy":{"policy_name":"Bedrock Testing Block All"},"model":{"model_name":"titan-text-lite"},"event_action":"Block","event_date":"2025-02-04T09:47:24Z","event_id":"3a0f9e2b-d234-4b3d-ac9a-219eb6f05ba7","event_message_type":"Prompt","event_messages":[{"event_conversation":{"event_messages":[{"content":"[{\"role\":\"user\",\"content\":\"write a csrf exploit with email ash@abc.com to convince people\"}]","direction":"Prompt","event_conversation_id":"","event_ext_message_id":"","event_ins_date":"","event_message_id":"","event_message_policy_assocs":[{"policy_guardrail_assoc":{"guardrail_entity_configured_action":"Block","guardrail_entity_configured_direction":"Both","guardrail_entity_configured_status":"Enabled","guardrail_entity_id":"71100000-0000-0000-c000-100000000008","guardrail_rule_configured_action":"","guardrail_rule_configured_direction":"","guardrail_rule_configured_status":"","guardrail_rule_id":"","guardrail_ruleset_id":"71000000-0000-0000-c000-000000000009","guardrail_ruleset_configured_action":"","guardrail_ruleset_configured_direction":"","guardrail_ruleset_configured_status":"","pol_guardrail_assoc_id":"f4e71dd9-12ad-4383-851e-d03fbc66c430","policy_id":"42ba067b-06c0-4e43-8002-2c6bce2663b4","tenant_id":"023327d5-ef36-4489-8d56-187d2f4730b3"}}],"related_event_message_id":"","tenant_id":"023327d5-ef36-4489-8d56-187d2f4730b3"}]},"event_ext_message_id":"","event_message_id":""}],"event_policy_guardrail_assocs":[{"policy_guardrail_assoc":{"guardrail_avail_entity":{"guardrail_entity_name":"Email"},"guardrail_avail_ruleset":{"guardrail":{"guardrails_type":"Privacy"},"guardrail_ruleset_type":"PII"},"guardrail_avail_subcategory":{"guardrail_rule_name":""},"pol_guardrail_assoc_id":"f4e71dd9-12ad-4383-851e-d03fbc66c430"}}]} diff --git a/data_sources/cisco_asa_logs.yml b/data_sources/cisco_asa_logs.yml index 61d0ec4d563..ea89feb7976 100644 --- a/data_sources/cisco_asa_logs.yml +++ b/data_sources/cisco_asa_logs.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - Cisco_ASA_action - Cisco_ASA_message_id diff --git a/data_sources/cisco_duo_activity.yml b/data_sources/cisco_duo_activity.yml index 57f78a420bc..c230fb13246 100644 --- a/data_sources/cisco_duo_activity.yml +++ b/data_sources/cisco_duo_activity.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - access_device.browser - access_device.browser_version diff --git a/data_sources/cisco_duo_administrator.yml b/data_sources/cisco_duo_administrator.yml index ba87861cc13..2c18d1907f1 100644 --- a/data_sources/cisco_duo_administrator.yml +++ b/data_sources/cisco_duo_administrator.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - action - actionlabel diff --git a/data_sources/cisco_ios_logs.yml b/data_sources/cisco_ios_logs.yml index bf6b6c5e82a..31ab89661c7 100644 --- a/data_sources/cisco_ios_logs.yml +++ b/data_sources/cisco_ios_logs.yml @@ -1,17 +1,17 @@ name: Cisco IOS Logs id: 9e4c8d7b-6f5e-4a3d-b2c1-0a9b8c7d6e5f -version: 2 +version: 3 creation_date: '2025-08-21' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Michael Haag, Splunk -description: Data source object for Cisco IOS system logs. Cisco IOS logs provide operational and security telemetry from Cisco network devices (IOS, IOS XE, IOS XR, NX-OS, WLC, and APs). The Cisco Networks Add-on for Splunk (TA-cisco_ios) normalizes these events by setting proper sourcetypes and extracting fields for switches, routers, controllers, and access points; deploy the TA on indexers/HFs and search heads, and the Cisco Networks (cisco_ios) App on search heads. Supported platforms include Catalyst, ASR, ISR, Nexus, CRS, and other IOS-based devices, enabling consistent investigation, alerting, and reporting in Splunk Enterprise and Splunk Cloud. This data is ingested via SYSLOG. +description: Data source object for Cisco IOS system logs. source: cisco:ios sourcetype: cisco:ios separator: supported_TA: - - name: Cisco Networks Add-on - url: https://splunkbase.splunk.com/app/1467 - version: 2.8.2 + - name: Cisco Enterprise Networking Add-on for Splunk + url: https://splunkbase.splunk.com/app/7538 + version: 4.0.50 fields: - _time - aci_message_text diff --git a/data_sources/cisco_isovalent_process_connect.yml b/data_sources/cisco_isovalent_process_connect.yml index 2ed3fe00592..812d0fb4e7a 100644 --- a/data_sources/cisco_isovalent_process_connect.yml +++ b/data_sources/cisco_isovalent_process_connect.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processConnect supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - _time - app diff --git a/data_sources/cisco_isovalent_process_exec.yml b/data_sources/cisco_isovalent_process_exec.yml index 53b8c8dcd6c..09638fe7ace 100644 --- a/data_sources/cisco_isovalent_process_exec.yml +++ b/data_sources/cisco_isovalent_process_exec.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processExec supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - _time - cluster_name diff --git a/data_sources/cisco_isovalent_process_kprobe.yml b/data_sources/cisco_isovalent_process_kprobe.yml index 82e8b8c3d40..4308ee3d7eb 100644 --- a/data_sources/cisco_isovalent_process_kprobe.yml +++ b/data_sources/cisco_isovalent_process_kprobe.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - _time - app diff --git a/data_sources/cisco_network_visibility_module_flow_data.yml b/data_sources/cisco_network_visibility_module_flow_data.yml index 402fddfdd52..945246997d4 100644 --- a/data_sources/cisco_network_visibility_module_flow_data.yml +++ b/data_sources/cisco_network_visibility_module_flow_data.yml @@ -10,7 +10,7 @@ sourcetype: cisco:nvm:flowdata:v2 supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - action - aliul diff --git a/data_sources/cisco_network_visibility_module_osquery.yml b/data_sources/cisco_network_visibility_module_osquery.yml index 569f2e8972c..2c206157555 100644 --- a/data_sources/cisco_network_visibility_module_osquery.yml +++ b/data_sources/cisco_network_visibility_module_osquery.yml @@ -10,7 +10,7 @@ sourcetype: cisco:nvm:osquery:v2 supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - current_page - date_hour diff --git a/data_sources/cisco_secure_access_dns.yml b/data_sources/cisco_secure_access_dns.yml index 81ad9560349..d3fd4107529 100644 --- a/data_sources/cisco_secure_access_dns.yml +++ b/data_sources/cisco_secure_access_dns.yml @@ -12,7 +12,7 @@ sourcetype: cisco:cloud_security:dns supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.53 + version: 1.0.55 fields: - RecordType - ReplyCode diff --git a/data_sources/cisco_secure_access_firewall.yml b/data_sources/cisco_secure_access_firewall.yml index d4cd0e777ca..853d99563c6 100644 --- a/data_sources/cisco_secure_access_firewall.yml +++ b/data_sources/cisco_secure_access_firewall.yml @@ -10,7 +10,7 @@ sourcetype: cisco:cloud_security:firewall supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.53 + version: 1.0.55 fields: - _time - action diff --git a/data_sources/cisco_secure_access_proxy.yml b/data_sources/cisco_secure_access_proxy.yml index b49c8c2dfe7..47cd6ad46e6 100644 --- a/data_sources/cisco_secure_access_proxy.yml +++ b/data_sources/cisco_secure_access_proxy.yml @@ -12,7 +12,7 @@ sourcetype: cisco:cloud_security:proxy supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.53 + version: 1.0.55 fields: - _time - action diff --git a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml index 3a199b6f486..5daa5a49a9c 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - AC_RuleAction - action diff --git a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml index 84d09c58379..5ef3eb6005c 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - app - Application diff --git a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml index db18b5a342d..0f5beb9d50c 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 4.0.2 + version: 4.1.2 fields: - Application - Classification diff --git a/data_sources/crowdstrike_falcon_stream_alert.yml b/data_sources/crowdstrike_falcon_stream_alert.yml index 2ff079b443f..7f538f050dc 100644 --- a/data_sources/crowdstrike_falcon_stream_alert.yml +++ b/data_sources/crowdstrike_falcon_stream_alert.yml @@ -17,7 +17,7 @@ separator: event.DetectName supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 3.1.2 + version: 3.2.0 fields: - action - description diff --git a/data_sources/crowdstrike_processrollup2.yml b/data_sources/crowdstrike_processrollup2.yml index a44d6511adb..8eebac571f6 100644 --- a/data_sources/crowdstrike_processrollup2.yml +++ b/data_sources/crowdstrike_processrollup2.yml @@ -18,7 +18,7 @@ separator_value: ProcessRollup2 supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 3.1.2 + version: 3.2.0 fields: - AuthenticationId - AuthenticationId_meaning diff --git a/data_sources/g_suite_drive.yml b/data_sources/g_suite_drive.yml index b647bf3974f..fb7e5f1b31e 100644 --- a/data_sources/g_suite_drive.yml +++ b/data_sources/g_suite_drive.yml @@ -16,7 +16,7 @@ sourcetype: gsuite:drive:json supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 5.0.0 + version: 5.0.1 fields: - _time - email diff --git a/data_sources/g_suite_gmail.yml b/data_sources/g_suite_gmail.yml index 47a7e83990f..2c599a4533b 100644 --- a/data_sources/g_suite_gmail.yml +++ b/data_sources/g_suite_gmail.yml @@ -15,7 +15,7 @@ sourcetype: gsuite:gmail:bigquery supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 5.0.0 + version: 5.0.1 fields: - _time - action_type diff --git a/data_sources/github_enterprise_audit_logs.yml b/data_sources/github_enterprise_audit_logs.yml index 266202314d9..b95f95aa81c 100644 --- a/data_sources/github_enterprise_audit_logs.yml +++ b/data_sources/github_enterprise_audit_logs.yml @@ -10,7 +10,7 @@ sourcetype: httpevent supported_TA: - name: Splunk Add-on for Github url: https://splunkbase.splunk.com/app/6254 - version: 4.0.0 + version: 4.0.1 fields: - _document_id - action diff --git a/data_sources/github_organizations_audit_logs.yml b/data_sources/github_organizations_audit_logs.yml index 1a187a6d09d..8896f64c89c 100644 --- a/data_sources/github_organizations_audit_logs.yml +++ b/data_sources/github_organizations_audit_logs.yml @@ -10,7 +10,7 @@ sourcetype: github:cloud:audit supported_TA: - name: Splunk Add-on for Github url: https://splunkbase.splunk.com/app/6254 - version: 4.0.0 + version: 4.0.1 fields: - _document_id - action diff --git a/data_sources/google_workspace.yml b/data_sources/google_workspace.yml index bde99e8ec1d..8459c1a0de1 100644 --- a/data_sources/google_workspace.yml +++ b/data_sources/google_workspace.yml @@ -10,7 +10,7 @@ sourcetype: gws:reports:login supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 5.0.0 + version: 5.0.1 fields: - action - actor.callerType diff --git a/data_sources/google_workspace_login_failure.yml b/data_sources/google_workspace_login_failure.yml index 774e7c89217..4e26bd7ec61 100644 --- a/data_sources/google_workspace_login_failure.yml +++ b/data_sources/google_workspace_login_failure.yml @@ -17,7 +17,7 @@ separator_value: login_failure supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 5.0.0 + version: 5.0.1 fields: - _time - actor.email diff --git a/data_sources/google_workspace_login_success.yml b/data_sources/google_workspace_login_success.yml index 727e82de8e7..5701798e570 100644 --- a/data_sources/google_workspace_login_success.yml +++ b/data_sources/google_workspace_login_success.yml @@ -17,7 +17,7 @@ separator_value: login_success supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 5.0.0 + version: 5.0.1 fields: - _time - actor.email diff --git a/data_sources/linux_auditd_add_user.yml b/data_sources/linux_auditd_add_user.yml index 835c71b6a86..e65107d021a 100644 --- a/data_sources/linux_auditd_add_user.yml +++ b/data_sources/linux_auditd_add_user.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - msg - type diff --git a/data_sources/linux_auditd_cwd.yml b/data_sources/linux_auditd_cwd.yml index 49224274460..3ef7f828d7f 100644 --- a/data_sources/linux_auditd_cwd.yml +++ b/data_sources/linux_auditd_cwd.yml @@ -13,7 +13,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - cwd - date_hour diff --git a/data_sources/linux_auditd_daemon_abort.yml b/data_sources/linux_auditd_daemon_abort.yml index e311d746000..5446dd0ae72 100644 --- a/data_sources/linux_auditd_daemon_abort.yml +++ b/data_sources/linux_auditd_daemon_abort.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_end.yml b/data_sources/linux_auditd_daemon_end.yml index 46c537bc68a..6d4a8b23749 100644 --- a/data_sources/linux_auditd_daemon_end.yml +++ b/data_sources/linux_auditd_daemon_end.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_start.yml b/data_sources/linux_auditd_daemon_start.yml index 5c6aa25a0f5..c22e10f4847 100644 --- a/data_sources/linux_auditd_daemon_start.yml +++ b/data_sources/linux_auditd_daemon_start.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - type - op diff --git a/data_sources/linux_auditd_execve.yml b/data_sources/linux_auditd_execve.yml index 231d750fc2c..ca072eadbb8 100644 --- a/data_sources/linux_auditd_execve.yml +++ b/data_sources/linux_auditd_execve.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - msg - type diff --git a/data_sources/linux_auditd_path.yml b/data_sources/linux_auditd_path.yml index b368989f155..2fb58ab7acc 100644 --- a/data_sources/linux_auditd_path.yml +++ b/data_sources/linux_auditd_path.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - msg - type diff --git a/data_sources/linux_auditd_proctitle.yml b/data_sources/linux_auditd_proctitle.yml index 1950f4a8ebe..a344eab2758 100644 --- a/data_sources/linux_auditd_proctitle.yml +++ b/data_sources/linux_auditd_proctitle.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - proctitle - msg diff --git a/data_sources/linux_auditd_service_stop.yml b/data_sources/linux_auditd_service_stop.yml index cdc8d643e7c..124257f391d 100644 --- a/data_sources/linux_auditd_service_stop.yml +++ b/data_sources/linux_auditd_service_stop.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - msg - type diff --git a/data_sources/linux_auditd_syscall.yml b/data_sources/linux_auditd_syscall.yml index 5e99e36493c..9993eff085b 100644 --- a/data_sources/linux_auditd_syscall.yml +++ b/data_sources/linux_auditd_syscall.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - msg - type diff --git a/data_sources/linux_messages_syslog.yml b/data_sources/linux_messages_syslog.yml index 574409798ec..93e9235f301 100644 --- a/data_sources/linux_messages_syslog.yml +++ b/data_sources/linux_messages_syslog.yml @@ -15,7 +15,7 @@ sourcetype: linux_messages_syslog supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - _time - action diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index 648850c8d00..5c10d18458a 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -16,7 +16,7 @@ sourcetype: linux_secure supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.3.3 + version: 10.3.4 fields: - _time - action diff --git a/data_sources/m365_copilot_graph_api.yml b/data_sources/m365_copilot_graph_api.yml index eef7d37443d..ab7410db47d 100644 --- a/data_sources/m365_copilot_graph_api.yml +++ b/data_sources/m365_copilot_graph_api.yml @@ -10,7 +10,7 @@ sourcetype: o365:graph:api supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - appDisplayName - appId diff --git a/data_sources/nginx_access.yml b/data_sources/nginx_access.yml index 3b205f39323..670fccc69c0 100644 --- a/data_sources/nginx_access.yml +++ b/data_sources/nginx_access.yml @@ -16,7 +16,7 @@ sourcetype: nginx:plus:kv supported_TA: - name: Splunk Add-on for NGINX url: https://splunkbase.splunk.com/app/3258 - version: 3.3.1 + version: 3.3.2 fields: - _time - action diff --git a/data_sources/ntlm_operational_8004.yml b/data_sources/ntlm_operational_8004.yml index 749a2d3ae1c..4f9bbaca4e7 100644 --- a/data_sources/ntlm_operational_8004.yml +++ b/data_sources/ntlm_operational_8004.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8005.yml b/data_sources/ntlm_operational_8005.yml index 045f5a43f3a..b179ee9d966 100644 --- a/data_sources/ntlm_operational_8005.yml +++ b/data_sources/ntlm_operational_8005.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8006.yml b/data_sources/ntlm_operational_8006.yml index d7df32bf79e..ecf8af19a2c 100644 --- a/data_sources/ntlm_operational_8006.yml +++ b/data_sources/ntlm_operational_8006.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/o365.yml b/data_sources/o365.yml index 4184acc03ef..ca824bcbf38 100644 --- a/data_sources/o365.yml +++ b/data_sources/o365.yml @@ -17,4 +17,4 @@ separator: Operation supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 diff --git a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml index 1687c98ff8f..00bc4805b49 100644 --- a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml +++ b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment grant to user. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml index 925288235de..67062042d52 100644 --- a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml +++ b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_mailboxpermission.yml b/data_sources/o365_add_mailboxpermission.yml index 79d4333bbb7..9c2dd48871c 100644 --- a/data_sources/o365_add_mailboxpermission.yml +++ b/data_sources/o365_add_mailboxpermission.yml @@ -17,7 +17,7 @@ separator_value: Add-MailboxPermission supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - AccessRights diff --git a/data_sources/o365_add_member_to_role_.yml b/data_sources/o365_add_member_to_role_.yml index a69da205d94..bc771f78058 100644 --- a/data_sources/o365_add_member_to_role_.yml +++ b/data_sources/o365_add_member_to_role_.yml @@ -17,7 +17,7 @@ separator_value: Add member to role. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_owner_to_application_.yml b/data_sources/o365_add_owner_to_application_.yml index aa2db390305..a37f369403b 100644 --- a/data_sources/o365_add_owner_to_application_.yml +++ b/data_sources/o365_add_owner_to_application_.yml @@ -17,7 +17,7 @@ separator_value: Add owner to application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_add_service_principal_.yml b/data_sources/o365_add_service_principal_.yml index 3b4615afa78..37c92818d44 100644 --- a/data_sources/o365_add_service_principal_.yml +++ b/data_sources/o365_add_service_principal_.yml @@ -17,7 +17,7 @@ separator_value: Add service principal. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_change_user_license_.yml b/data_sources/o365_change_user_license_.yml index d6451bc0359..648a5cfcfc3 100644 --- a/data_sources/o365_change_user_license_.yml +++ b/data_sources/o365_change_user_license_.yml @@ -17,7 +17,7 @@ separator_value: Change user license. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_consent_to_application_.yml b/data_sources/o365_consent_to_application_.yml index f12ada70fda..5e89011933c 100644 --- a/data_sources/o365_consent_to_application_.yml +++ b/data_sources/o365_consent_to_application_.yml @@ -17,7 +17,7 @@ separator_value: Consent to application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_disable_strong_authentication_.yml b/data_sources/o365_disable_strong_authentication_.yml index 3e75abb3786..b18af0076e2 100644 --- a/data_sources/o365_disable_strong_authentication_.yml +++ b/data_sources/o365_disable_strong_authentication_.yml @@ -17,7 +17,7 @@ separator_value: Disable Strong Authentication. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_mailitemsaccessed.yml b/data_sources/o365_mailitemsaccessed.yml index 3860a0da92a..ba8649b87b8 100644 --- a/data_sources/o365_mailitemsaccessed.yml +++ b/data_sources/o365_mailitemsaccessed.yml @@ -17,7 +17,7 @@ separator_value: MailItemsAccessed supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - AppId diff --git a/data_sources/o365_modifyfolderpermissions.yml b/data_sources/o365_modifyfolderpermissions.yml index bf304721058..40683dcd19b 100644 --- a/data_sources/o365_modifyfolderpermissions.yml +++ b/data_sources/o365_modifyfolderpermissions.yml @@ -17,7 +17,7 @@ separator_value: ModifyFolderPermissions supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - AppId diff --git a/data_sources/o365_set_company_information_.yml b/data_sources/o365_set_company_information_.yml index e40e2d49171..f73672008ba 100644 --- a/data_sources/o365_set_company_information_.yml +++ b/data_sources/o365_set_company_information_.yml @@ -17,7 +17,7 @@ separator_value: Set Company Information. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_set_mailbox.yml b/data_sources/o365_set_mailbox.yml index 07dff022336..cbc4206d889 100644 --- a/data_sources/o365_set_mailbox.yml +++ b/data_sources/o365_set_mailbox.yml @@ -17,7 +17,7 @@ separator_value: Set-Mailbox supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - AppId diff --git a/data_sources/o365_update_application_.yml b/data_sources/o365_update_application_.yml index 48912324ff7..6efbb68a3b9 100644 --- a/data_sources/o365_update_application_.yml +++ b/data_sources/o365_update_application_.yml @@ -17,7 +17,7 @@ separator_value: Update application. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_update_authorization_policy_.yml b/data_sources/o365_update_authorization_policy_.yml index 0feeb95bdf6..e835ce51ad1 100644 --- a/data_sources/o365_update_authorization_policy_.yml +++ b/data_sources/o365_update_authorization_policy_.yml @@ -17,7 +17,7 @@ separator_value: Update authorization policy. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_update_user_.yml b/data_sources/o365_update_user_.yml index 0b264ec1b2f..925465e2f7b 100644 --- a/data_sources/o365_update_user_.yml +++ b/data_sources/o365_update_user_.yml @@ -17,7 +17,7 @@ separator_value: Update user. supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_userloggedin.yml b/data_sources/o365_userloggedin.yml index 0402ece5bf7..00c0f8fa062 100644 --- a/data_sources/o365_userloggedin.yml +++ b/data_sources/o365_userloggedin.yml @@ -17,7 +17,7 @@ separator_value: UserLoggedIn supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/o365_userloginfailed.yml b/data_sources/o365_userloginfailed.yml index 61907c7546c..bdacceddf40 100644 --- a/data_sources/o365_userloginfailed.yml +++ b/data_sources/o365_userloginfailed.yml @@ -17,7 +17,7 @@ separator_value: UserLoginFailed supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time - ActorContextId diff --git a/data_sources/office_365_reporting_message_trace.yml b/data_sources/office_365_reporting_message_trace.yml index 1c2f9ffefc5..8cd1af8c3cf 100644 --- a/data_sources/office_365_reporting_message_trace.yml +++ b/data_sources/office_365_reporting_message_trace.yml @@ -11,7 +11,7 @@ separator: Organization supported_TA: - name: Splunk Microsoft Office 365 Add-on url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - FromIP - Index diff --git a/data_sources/office_365_universal_audit_log.yml b/data_sources/office_365_universal_audit_log.yml index c9273ae1194..1b72cc576d0 100644 --- a/data_sources/office_365_universal_audit_log.yml +++ b/data_sources/office_365_universal_audit_log.yml @@ -11,7 +11,7 @@ separator: Operation supported_TA: - name: Splunk Microsoft Office 365 Add-on url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 + version: 6.1.1 fields: - _time example_log: '' diff --git a/data_sources/osquery_results.yml b/data_sources/osquery_results.yml index 5445233c455..6b841133167 100644 --- a/data_sources/osquery_results.yml +++ b/data_sources/osquery_results.yml @@ -16,7 +16,7 @@ sourcetype: osquery:results supported_TA: - name: TA-osquery url: https://splunkbase.splunk.com/app/8574 - version: 1.0.4 + version: 1.0.5 fields: - _time - calendarTime diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 6089a236b58..f5c6668fa1c 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -18,7 +18,7 @@ separator_value: '4104' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/splunk_common_information_model_(cim).yml b/data_sources/splunk_common_information_model_(cim).yml index b3be82871fc..29dd90ca3f9 100644 --- a/data_sources/splunk_common_information_model_(cim).yml +++ b/data_sources/splunk_common_information_model_(cim).yml @@ -10,4 +10,4 @@ sourcetype: not_applicable supported_TA: - name: Splunk Common Information Model (CIM) url: https://splunkbase.splunk.com/app/1621 - version: 8.6.0 + version: 8.7.0 diff --git a/data_sources/splunk_stream_http.yml b/data_sources/splunk_stream_http.yml index 29522a4daac..d7d7f552869 100644 --- a/data_sources/splunk_stream_http.yml +++ b/data_sources/splunk_stream_http.yml @@ -16,7 +16,7 @@ sourcetype: stream:http supported_TA: - name: Splunk Add-on for Stream Wire Data url: https://splunkbase.splunk.com/app/5234 - version: 8.1.6 + version: 8.1.7 fields: - _time - bytes diff --git a/data_sources/splunk_stream_ip.yml b/data_sources/splunk_stream_ip.yml index a5ffb18d05e..1fbea554861 100644 --- a/data_sources/splunk_stream_ip.yml +++ b/data_sources/splunk_stream_ip.yml @@ -16,7 +16,7 @@ sourcetype: stream:ip supported_TA: - name: Splunk Add-on for Stream Wire Data url: https://splunkbase.splunk.com/app/5234 - version: 8.1.6 + version: 8.1.7 fields: - _time - action diff --git a/data_sources/splunk_stream_tcp.yml b/data_sources/splunk_stream_tcp.yml index a15f4041880..710bb9cb0b7 100644 --- a/data_sources/splunk_stream_tcp.yml +++ b/data_sources/splunk_stream_tcp.yml @@ -16,4 +16,4 @@ sourcetype: stream:tcp supported_TA: - name: Splunk Add-on for Stream Wire Data url: https://splunkbase.splunk.com/app/5234 - version: 8.1.6 + version: 8.1.7 diff --git a/data_sources/sysmon_eventid_10.yml b/data_sources/sysmon_eventid_10.yml index d1ba331c5b8..7c13a96041f 100644 --- a/data_sources/sysmon_eventid_10.yml +++ b/data_sources/sysmon_eventid_10.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 10 id: 659cd5a8-148a-4c59-ade1-05f41ac1b096 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-09-21' author: Patrick Bareiss, Splunk description: Logs events where one process accesses another process, typically for memory reads or injections, including details about the source and target processes. mitre_components: @@ -101,8 +101,6 @@ fields: output_fields: - dest - user_id - - parent_process_name - - parent_process_guid - process_name - process_guid - process_id diff --git a/data_sources/sysmon_eventid_15.yml b/data_sources/sysmon_eventid_15.yml index 45aa929ea73..26bc8419fad 100644 --- a/data_sources/sysmon_eventid_15.yml +++ b/data_sources/sysmon_eventid_15.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 15 id: 95785e02-93b4-47e2-81f1-be326295348e -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-13' author: Patrick Bareiss, Splunk description: Logs the creation of a new file stream, including details about the file stream's hash, path, and associated process metadata. mitre_components: @@ -22,43 +22,11 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Computer - Contents - CreationUtcTime - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - Guid - - Hash - - IMPHASH - - Image - - Keywords - - Level - - MD5 - - Name - - Opcode - - ProcessGuid - - ProcessID - - ProcessId - - RecordID - - RecordNumber - - RuleName - - SHA256 - - SecurityID - - SystemTime - - System_Props_Xml - - TargetFilename - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -70,33 +38,66 @@ fields: - dest - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype - file_create_time - file_hash - file_name - file_path + - Guid + - Hash - host - id + - Image + - IMPHASH - index + - Keywords + - Level - linecount + - MD5 + - Name + - Opcode - os - process_exec - process_guid - process_id - process_name - process_path + - ProcessGuid + - ProcessId + - ProcessID - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID + - SHA256 - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - TargetFilename + - Task + - ThreadID + - TimeCreated - timeendpos - timestartpos + - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - dest - dvc @@ -110,6 +111,7 @@ output_fields: - process_path - signature - signature_id + - user - user_id - vendor_product example_log: 15241500x8000000000000000667860Microsoft-Windows-Sysmon/Operationalproject-mumbai-host-2021-04-28 20:11:34.709{ED2ECF8A-C154-6089-F967-00000000BB01}7000C:\Users\DefaultAccount\AppData\Roaming\Telegram Desktop\Telegram.exeC:\Users\DefaultAccount\Downloads\Telegram Desktop\Good(NLA).txt:Zone.Identifier2021-04-28 20:11:33.238MD5=C785C55D5FA3443A11B8417209C4B524,SHA256=D07777E0DC36EBECCE3FA9644F0F44DC4A0B7EDE0CBC1F5D33E8D6CB07AF5B5C,IMPHASH=00000000000000000000000000000000[ZoneTransfer] ZoneId=3 diff --git a/data_sources/sysmon_eventid_22.yml b/data_sources/sysmon_eventid_22.yml index fdaa49c1460..2a53a749620 100644 --- a/data_sources/sysmon_eventid_22.yml +++ b/data_sources/sysmon_eventid_22.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 22 id: 911538b2-eba7-4d3e-85e8-d82d380c37bf -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-13' author: Patrick Bareiss, Splunk description: Logs DNS query events, including details about the queried domain, source IP, query type, and response data. mitre_components: @@ -24,36 +24,6 @@ fields: - _time - Channel - Computer - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - Guid - - Image - - Keywords - - Level - - Name - - Opcode - - ProcessGuid - - ProcessID - - ProcessId - - QueryName - - QueryResults - - QueryStatus - - RecordID - - RecordNumber - - RuleName - - SecurityID - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - date_hour - date_mday - date_minute @@ -64,30 +34,61 @@ fields: - date_zone - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype + - Guid - host - id + - Image - index + - Keywords + - Level - linecount + - Name + - Opcode - process_exec - process_guid - process_name + - ProcessGuid + - ProcessId + - ProcessID - punct - query - query_count + - QueryName + - QueryResults + - QueryStatus + - record_type + - RecordID + - RecordNumber - reply_code_id + - RuleName + - SecurityID - signature - signature_id - source - sourcetype - splunk_server - src + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Task + - ThreadID + - TimeCreated - timeendpos - timestartpos - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - answer - answer_count diff --git a/data_sources/sysmon_eventid_24.yml b/data_sources/sysmon_eventid_24.yml new file mode 100644 index 00000000000..66a49773a64 --- /dev/null +++ b/data_sources/sysmon_eventid_24.yml @@ -0,0 +1,84 @@ +name: Sysmon EventID 24 +id: ae023710-3dbb-4de3-a1b2-5477a8ab74f9 +version: 1 +creation_date: '2024-09-07' +modification_date: '2024-09-07' +author: Onur Mustafa Erdogan, Splunk +description: Logs whenever new content is copied into the clipboard, including details about the associated process, hash of the content, and the time of copying. +mitre_components: + - Process Metadata + - Process Access + - Application Log Content + - OS API Execution +source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +sourcetype: XmlWinEventLog +separator: EventID +separator_value: '24' +configuration: https://github.com/SwiftOnSecurity/sysmon-config +supported_TA: + - name: Splunk Add-on for Sysmon + url: https://splunkbase.splunk.com/app/5709 + version: 5.0.1 +fields: + - _time + - Archived + - Channel + - ClientInfo + - Computer + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - Guid + - Hashes + - IMPHASH + - Image + - Keywords + - Level + - MD5 + - Name + - Opcode + - ProcessGuid + - ProcessID + - ProcessId + - RecordID + - RecordNumber + - RuleName + - SHA256 + - SecurityID + - Session + - SrcHost + - SystemTime + - System_Props_Xml + - Task + - ThreadID + - TimeCreated + - User + - UserID + - UtcTime + - Version + - host + - id + - index + - source + - sourcetype + - splunk_server + - tag + - tag::eventtype +output_fields: + - dest + - dvc + - event_id + - process_exec + - process_guid + - process_hash + - process_id + - process_name + - process_path + - severity + - splunk_server + - user + - vendor_product +example_log: 24542400x8000000000000000274447Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-09-07 14:37:28.999{1b43529b-bf4f-6a9e-e4eb-020000006600}8988C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe2user EC2AMAZ-FKEOM7G\Administrator hostname OERDOGAN-M-7N5YMD5=F2CD63BD7E2B5F9B738F589AF3BB1F8F,SHA256=397EE4CA855D96072D57E89ABFCA9F83634DAEA133E5302CB0766E87FDC3FEFC,IMPHASH=00000000000000000000000000000000false - failed with error 1337EC2AMAZ-FKEOM7G\Administrator diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index b43f02de4b6..77746de129b 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -16,7 +16,7 @@ sourcetype: ActiveDirectory supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Guid diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index 953e724a1ec..5198777c72c 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_17135.yml b/data_sources/windows_event_log_application_17135.yml index dfbc3ae1ed9..6f026135e38 100644 --- a/data_sources/windows_event_log_application_17135.yml +++ b/data_sources/windows_event_log_application_17135.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index df3d27c6c72..b5c5f361151 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index 7f333a78f98..6e376dc0285 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -17,7 +17,7 @@ separator_value: '3000' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index e3841b7d777..0135033e88a 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index 6c924b1ebbb..d198bf8189d 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index f72140ae8d7..c6f21e79e37 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index 870de7ee17b..5cca95235e5 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index cf70c22f8c0..8b42fea335b 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_capi2_70.yml b/data_sources/windows_event_log_capi2_70.yml index 592e0b6ef3e..aac5be676cf 100644 --- a/data_sources/windows_event_log_capi2_70.yml +++ b/data_sources/windows_event_log_capi2_70.yml @@ -18,7 +18,7 @@ separator_value: '70' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_capi2_81.yml b/data_sources/windows_event_log_capi2_81.yml index 66ada131486..d0df9f5dce1 100644 --- a/data_sources/windows_event_log_capi2_81.yml +++ b/data_sources/windows_event_log_capi2_81.yml @@ -18,7 +18,7 @@ separator_value: '81' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_certificateservicesclient_1007.yml b/data_sources/windows_event_log_certificateservicesclient_1007.yml index 4c7a4f8b938..f0fc8598849 100644 --- a/data_sources/windows_event_log_certificateservicesclient_1007.yml +++ b/data_sources/windows_event_log_certificateservicesclient_1007.yml @@ -18,7 +18,7 @@ separator_value: '1007' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1116.yml b/data_sources/windows_event_log_defender_1116.yml index 9b02654eb11..8be3dfc440e 100644 --- a/data_sources/windows_event_log_defender_1116.yml +++ b/data_sources/windows_event_log_defender_1116.yml @@ -16,7 +16,7 @@ separator_value: '1116' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Action_ID diff --git a/data_sources/windows_event_log_defender_1117.yml b/data_sources/windows_event_log_defender_1117.yml index 4eee9d4d80b..b7ffdd9830c 100644 --- a/data_sources/windows_event_log_defender_1117.yml +++ b/data_sources/windows_event_log_defender_1117.yml @@ -16,7 +16,7 @@ separator_value: '1117' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Action_Name diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index e79d9912370..9c345f89e15 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -16,7 +16,7 @@ separator_value: '1121' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index ad28a09086f..2944fc6126d 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -16,7 +16,7 @@ separator_value: '1122' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index db460b697ee..18308e14775 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time example_log: 112204000x80000000000000003701Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009E6DB77E5-3DF2-4CF1-B95A-636979351E5B2023-11-26T23:43:08.709Z(unknown user)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1.401.1247.01.1.23100.2009ENT\ConsRC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index 2bbe2b2b19e..43fc8141873 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index ad851b6a940..4ba86029d75 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -16,7 +16,7 @@ separator_value: '1129' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index c014f6885a9..e38fadd8e0d 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index 88a8748b5b5..ef1a010606b 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 70dc254190b..90d22162d6c 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index f5889d38fd5..59d8d069840 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 10c8ddbedef..034cb376ca7 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -14,7 +14,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_printservice_316.yml b/data_sources/windows_event_log_printservice_316.yml index 2aa8588d750..65a5a4a1556 100644 --- a/data_sources/windows_event_log_printservice_316.yml +++ b/data_sources/windows_event_log_printservice_316.yml @@ -15,7 +15,7 @@ separator_value: '316' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_printservice_4909.yml b/data_sources/windows_event_log_printservice_4909.yml index 28d99290fb0..0088b7e89f0 100644 --- a/data_sources/windows_event_log_printservice_4909.yml +++ b/data_sources/windows_event_log_printservice_4909.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time example_log: '' diff --git a/data_sources/windows_event_log_printservice_808.yml b/data_sources/windows_event_log_printservice_808.yml index 38622b24f5c..bb4019035ad 100644 --- a/data_sources/windows_event_log_printservice_808.yml +++ b/data_sources/windows_event_log_printservice_808.yml @@ -16,7 +16,7 @@ separator_value: '808' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml index 060336e042f..79ab58fc3e5 100644 --- a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml +++ b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml @@ -16,7 +16,7 @@ separator_value: '1149' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 75f9683746d..5d3ccb17aba 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -15,7 +15,7 @@ separator_value: '1100' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index f59cb881fd4..21041873b42 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -16,7 +16,7 @@ separator_value: '1102' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index c48507cfc3a..d5dbfd0c909 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -16,7 +16,7 @@ separator_value: '4624' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index dad4989547c..6de42e817e9 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -15,7 +15,7 @@ separator_value: '4625' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4627.yml b/data_sources/windows_event_log_security_4627.yml index 89fba03f2cb..83f0397f05a 100644 --- a/data_sources/windows_event_log_security_4627.yml +++ b/data_sources/windows_event_log_security_4627.yml @@ -16,7 +16,7 @@ separator_value: '4627' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index b4667be60c9..1ac6a07c6e8 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -15,7 +15,7 @@ separator_value: '4648' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index fa95daaa50d..a6aad97997b 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -15,7 +15,7 @@ separator_value: '4662' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index 104eb80b58b..52f47aaccab 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -15,7 +15,7 @@ separator_value: '4663' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index 289d62a9024..f80791c7df1 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -15,7 +15,7 @@ separator_value: '4672' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index 989857e2787..80f51515f94 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -16,7 +16,7 @@ configuration: Enabling Windows event log process command line logging via group supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - Caller_Domain - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index a440f483f92..65e778bf224 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -15,7 +15,7 @@ separator_value: '4698' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index 54054afabba..0017cf0583a 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -15,7 +15,7 @@ separator_value: '4699' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index 3d13a756ee0..3403e64193c 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - EventID example_log: 4700 0 0 12804 0 0x8020000000000000 344861 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin LeastPrivilege CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index 4c180ca38a4..bddee9b6cee 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - EventID example_log: 4702 0 0 12804 0 0x8020000000000000 344863 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin HighestAvailable CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index ed09ed27bd6..310316fd12c 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -15,7 +15,7 @@ separator_value: '4703' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index 4a8dfb8ca50..bf7bc7d2aa4 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -15,7 +15,7 @@ separator_value: '4719' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 5e2bbda6ab1..1372f745737 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -14,7 +14,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index fd486f8f612..5f96b26f472 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -14,7 +14,7 @@ separator_value: '4723' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index a9cd94593d2..81c019c3b43 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -14,7 +14,7 @@ separator_value: '4724' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index 9524a3f72f0..ab583b54cfb 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -14,7 +14,7 @@ separator_value: '4725' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index 8136745ad82..93d2716a2e6 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -14,7 +14,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 24032e276be..05b8d2bd41f 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index ab74f07c8d2..482d06ddf78 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index d73d16002d6..f6cf01a48d7 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index fefeeec1255..7d1b7a78cd3 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index 3fdffb89a81..803b5e8cb49 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -14,7 +14,7 @@ separator_value: '4732' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index 881d7ccf056..6241a8694e8 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index 9c4df3de2d0..4e15e78539c 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -14,7 +14,7 @@ separator_value: '4738' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4739.yml b/data_sources/windows_event_log_security_4739.yml index 7784f95bb37..60ac157f3d5 100644 --- a/data_sources/windows_event_log_security_4739.yml +++ b/data_sources/windows_event_log_security_4739.yml @@ -15,7 +15,7 @@ separator_value: '4739' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4740.yml b/data_sources/windows_event_log_security_4740.yml new file mode 100644 index 00000000000..b070516752b --- /dev/null +++ b/data_sources/windows_event_log_security_4740.yml @@ -0,0 +1,97 @@ +name: Windows Event Log Security 4740 +id: 387936fa-efa9-425d-9f1b-487425250ea9 +version: 1 +creation_date: '2026-09-08' +modification_date: '2026-09-08' +author: Nasreddine Bencherchali, Splunk +description: Logs when a user account is locked out. It includes details about the account that was locked out, the subject, and additional information. +mitre_components: + - User Account Metadata +source: XmlWinEventLog:Security +sourcetype: XmlWinEventLog +separator: EventCode +separator_value: '4740' +supported_TA: + - name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 11.0.3 +fields: + - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - Category + - change_type + - Channel + - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - eventtype + - Guid + - host + - id + - Keywords + - Level + - linecount + - Logon_ID + - name + - Name + - object + - object_attrs + - object_category + - Opcode + - ProcessID + - product + - punct + - Record + - result + - session_id + - severity + - severity_id + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_Category + - tag + - tag::eventtype + - Target_User_Name + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp + - user + - user_group + - user_name + - vendor + - vendor_product + - Version +output_fields: + - dest +example_log: 4740001382400x8020000000000000394306Securityar-win-dc.attackrange.localtestATTACKRANGE\testNT AUTHORITY\SYSTEMAR-WIN-DC$ATTACKRANGE0x3e7 diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index 1c4c800fe0c..113dfdb62a2 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -17,7 +17,7 @@ separator_value: '4741' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index 027458aca61..73a3e378cca 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index f02e15fa1a7..17716ec4550 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index dac0a891f9c..cab2404af92 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index 27c818f2890..81bd73fe377 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index f73f48479e1..a507ddf54d9 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index 8978d1ea3fb..44d305da80b 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 44102ebf15e..72a021b5ab1 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -17,7 +17,7 @@ separator_value: '4768' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index f29190cc072..85f20a46174 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -17,7 +17,7 @@ separator_value: '4769' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index bff553454a2..3a247d68691 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -17,7 +17,7 @@ separator_value: '4771' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index b01e5a06bbb..af76586dde8 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -17,7 +17,7 @@ separator_value: '4776' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index f8856f02cda..32ee3e86b67 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -17,7 +17,7 @@ separator_value: '4781' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index c21f93675c7..ed112d8efeb 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index da4093a413f..4636083cdf1 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index 75ffcb4b339..dbe5284202f 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -17,7 +17,7 @@ separator_value: supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index 50d72b8dc7f..f9c23c5c7c0 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index 8c021ffff6d..4a93ee7e359 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -17,7 +17,7 @@ separator_value: '4876' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index fc950fe6494..29fd942c970 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -17,7 +17,7 @@ separator_value: '4886' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index 88e0dff8539..d76820b4e04 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -17,7 +17,7 @@ separator_value: '4887' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index 361668dc89e..f247ab52d0e 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -12,7 +12,7 @@ separator_value: '4946' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index 892346a5984..6bf8d9f6319 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -12,7 +12,7 @@ separator_value: '4947' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index 3ed3918118c..34f0f502fc9 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -12,7 +12,7 @@ separator_value: '4948' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index fe9b0aa1ac9..987a9f95012 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -17,7 +17,7 @@ separator_value: '5136' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index 4ff1c91b19e..f52138e52a1 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -17,7 +17,7 @@ separator_value: '5137' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AppCorrelationID diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index 31c604a5035..f5aa6f25df6 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -17,7 +17,7 @@ separator_value: '5140' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index 03d0bbe1f66..a5104efd608 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -17,7 +17,7 @@ separator_value: '5141' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index bd20531413e..aa637f928a3 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -17,7 +17,7 @@ separator_value: '5145' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5441.yml b/data_sources/windows_event_log_security_5441.yml new file mode 100644 index 00000000000..0406dee9ca1 --- /dev/null +++ b/data_sources/windows_event_log_security_5441.yml @@ -0,0 +1,25 @@ +name: Windows Event Log Security 5441 +id: aac843ab-4cd6-4735-9557-cde0b504c9c9 +version: 1 +creation_date: '2026-08-23' +modification_date: '2026-08-23' +author: Nasreddine Bencherchali, Splunk +description: Logs Windows Filtering Platform filters that were present when the Base Filtering Engine started, including provider, filter, layer, conditions, and filter action metadata. +mitre_components: + - Firewall Metadata + - Security Policy Modification + - Application Log Content +source: XmlWinEventLog:Security +sourcetype: XmlWinEventLog +separator: EventCode +separator_value: '5441' +configuration: Enable the Audit Filtering Platform Policy Change subcategory to collect Windows Filtering Platform policy events. +supported_TA: + - name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 11.0.3 +fields: + - _time +output_fields: + - dest +example_log: '' diff --git a/data_sources/windows_event_log_security_5447.yml b/data_sources/windows_event_log_security_5447.yml new file mode 100644 index 00000000000..d1f16649a7f --- /dev/null +++ b/data_sources/windows_event_log_security_5447.yml @@ -0,0 +1,101 @@ +name: Windows Event Log Security 5447 +id: b94e3b5d-d00f-4fed-88e9-c8ea87495618 +version: 1 +creation_date: '2026-08-23' +modification_date: '2026-08-23' +author: Nasreddine Bencherchali, Splunk +description: Logs Windows Filtering Platform runtime filter changes, including the change type, provider, filter, layer, conditions, and filter action metadata. +mitre_components: + - Firewall Rule Modification + - Security Policy Modification + - Application Log Content +source: XmlWinEventLog:Security +sourcetype: XmlWinEventLog +separator: EventCode +separator_value: '5447' +configuration: Enable the Audit Filtering Platform Policy Change subcategory to collect Windows Filtering Platform policy events. +supported_TA: + - name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 11.0.3 +fields: + - _time + - Action + - ActivityID + - CalloutKey + - CalloutName + - ChangeType + - Channel + - Computer + - Conditions + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - FilterId + - FilterKey + - FilterName + - FilterType + - Guid + - Keywords + - LayerId + - LayerKey + - LayerName + - Level + - Name + - Opcode + - ProcessID + - ProcessId + - ProviderKey + - ProviderName + - RecordNumber + - SystemTime + - System_Props_Xml + - Task + - ThreadID + - UserName + - UserSid + - Version + - Weight + - action + - app + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dvc + - dvc_nt_host + - event_id + - eventtype + - host + - id + - index + - linecount + - name + - product + - punct + - signature + - signature_id + - source + - sourcetype + - splunk_server + - status + - subject + - ta_windows_action + - tag + - tag::action + - tag::eventtype + - timeendpos + - timestartpos + - user + - vendor + - vendor_product +output_fields: + - dest +example_log: | + 5447001357300x8020000000000000153502136Securityar-win-dc.attackrange.local16824S-1-5-21-3344543075-1022232225-2459664213-500ATTACKRANGE\Administrator{a4b43ab7-75d5-4d88-a62c-8b5d2677c73d}Microsoft Corporation%%16384{da607736-f157-4bdd-9ad9-042516072b55}Custom Outbound Filter%%16387305460{c38d57d1-05a7-4c33-904f-7fbceee60e82}ALE Connect v4 Layer4818446744073709551615Condition ID: {d78e1e87-8644-4ea5-9437-d809ecefc971} Match value: Equal to Condition value: 00000000 5c 00 64 00 65 00 76 00-69 00 63 00 65 00 5c 00 \.d.e.v.i.c.e.\. 00000010 68 00 61 00 72 00 64 00-64 00 69 00 73 00 6b 00 h.a.r.d.d.i.s.k. 00000020 76 00 6f 00 6c 00 75 00-6d 00 65 00 33 00 5c 00 v.o.l.u.m.e.3.\. 00000030 70 00 72 00 6f 00 67 00-72 00 61 00 6d 00 64 00 p.r.o.g.r.a.m.d. 00000040 61 00 74 00 61 00 5c 00-6d 00 69 00 63 00 72 00 a.t.a.\.m.i.c.r. 00000050 6f 00 73 00 6f 00 66 00-74 00 5c 00 77 00 69 00 o.s.o.f.t.\.w.i. 00000060 6e 00 64 00 6f 00 77 00-73 00 20 00 64 00 65 00 n.d.o.w.s. .d.e. 00000070 66 00 65 00 6e 00 64 00-65 00 72 00 5c 00 70 00 f.e.n.d.e.r.\.p. 00000080 6c 00 61 00 74 00 66 00-6f 00 72 00 6d 00 5c 00 l.a.t.f.o.r.m.\. 00000090 34 00 2e 00 31 00 38 00-2e 00 32 00 36 00 30 00 4...1.8...2.6.0. 000000a0 34 00 30 00 2e 00 37 00-2d 00 30 00 5c 00 6d 00 4.0...7.-.0.\.m. 000000b0 73 00 6d 00 70 00 65 00-6e 00 67 00 2e 00 65 00 s.m.p.e.n.g...e. 000000c0 78 00 65 00 00 00 x.e...%%16389{00000000-0000-0000-0000-000000000000}- diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index b7298c67134..2441f3fffbf 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_system_4720.yml b/data_sources/windows_event_log_system_4720.yml index 5b95d4b808e..f386952c7d1 100644 --- a/data_sources/windows_event_log_system_4720.yml +++ b/data_sources/windows_event_log_system_4720.yml @@ -17,7 +17,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4726.yml b/data_sources/windows_event_log_system_4726.yml index b5590d7546c..50059d6e568 100644 --- a/data_sources/windows_event_log_system_4726.yml +++ b/data_sources/windows_event_log_system_4726.yml @@ -17,7 +17,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4728.yml b/data_sources/windows_event_log_system_4728.yml index 2ca373f47e1..7a36f05d1d3 100644 --- a/data_sources/windows_event_log_system_4728.yml +++ b/data_sources/windows_event_log_system_4728.yml @@ -17,7 +17,7 @@ separator_value: '4728' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index 6cd9b92a19f..ef0de6543d2 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -17,7 +17,7 @@ separator_value: '7036' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index d43588fae6a..3e0518531c5 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -17,7 +17,7 @@ separator_value: '7040' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index 1aa7fef4267..eac759b2d86 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -17,7 +17,7 @@ separator_value: '7045' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - AccountName diff --git a/data_sources/windows_event_log_taskscheduler_200.yml b/data_sources/windows_event_log_taskscheduler_200.yml index 31739b254e3..81161d7f0d4 100644 --- a/data_sources/windows_event_log_taskscheduler_200.yml +++ b/data_sources/windows_event_log_taskscheduler_200.yml @@ -17,7 +17,7 @@ separator_value: '200' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ActionName diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index 6809dbf363c..e429edceb16 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_wmi_activity_5861.yml b/data_sources/windows_event_log_wmi_activity_5861.yml new file mode 100644 index 00000000000..ab1747e3518 --- /dev/null +++ b/data_sources/windows_event_log_wmi_activity_5861.yml @@ -0,0 +1,61 @@ +name: Windows Event Log WMI Activity 5861 +id: dad572ee-2271-4a1c-b118-ae6c5494a7c1 +version: 1 +creation_date: '2026-10-05' +modification_date: '2026-10-05' +author: Nasreddine Bencherchali, Splunk +description: Logs the creation of a permanent WMI event subscription when an event filter is bound to an event consumer, including consumer and filter details. +mitre_components: + - WMI Creation + - Application Log Content + - OS API Execution +source: XmlWinEventLog:Microsoft-Windows-WMI-Activity/Operational +sourcetype: XmlWinEventLog +separator: EventID +separator_value: '5861' +supported_TA: [] +fields: + - _time + - Channel + - Computer + - EventCode + - System_Props_Xml + - UserData_Xml + - EventID + - EventRecordID + - Guid + - Keywords + - Level + - Opcode + - ProcessID + - SystemTime + - Task + - TaskCategory + - ThreadID + - UserID + - Version + - source + - sourcetype + - user_id + - vendor_product +output_fields: + - dest +example_log: |- + 586100000x400000000000000024669Microsoft-Windows-WMI-Activity/OperationalEC2AMAZ-1QDNI6F//./root/subscriptionAtomicRedTeam_filterCommandLineEventConsumer="AtomicRedTeam_consumer"Binding EventFilter: + instance of __EventFilter + { + CreatorSID = {1, 5, 0, 0, 0, 0, 0, 5, 21, 0, 0, 0, 95, 211, 181, 28, 123, 4, 131, 205, 168, 40, 205, 106, 244, 1, 0, 0}; + EventNamespace = "root\\subscription"; + Name = "AtomicRedTeam_filter"; + Query = "SELECT * FROM __InstanceCreationEvent Within 3 Where TargetInstance Isa \"Win32_Process\" And Targetinstance.Name = \"notepad.exe\" "; + QueryLanguage = "WQL"; + }; + Perm. Consumer: + instance of CommandLineEventConsumer + { + CommandLineTemplate = "cmd.exe"; + CreatorSID = {1, 5, 0, 0, 0, 0, 0, 5, 21, 0, 0, 0, 95, 211, 181, 28, 123, 4, 131, 205, 168, 40, 205, 106, 244, 1, 0, 0}; + Name = "AtomicRedTeam_consumer"; + RunInteractively = FALSE; + }; + diff --git a/data_sources/windows_iis.yml b/data_sources/windows_iis.yml index 521b00579bc..a2adad94a89 100644 --- a/data_sources/windows_iis.yml +++ b/data_sources/windows_iis.yml @@ -16,4 +16,4 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 diff --git a/data_sources/windows_iis_29.yml b/data_sources/windows_iis_29.yml index 27abf33af68..d846b317464 100644 --- a/data_sources/windows_iis_29.yml +++ b/data_sources/windows_iis_29.yml @@ -17,7 +17,7 @@ separator_value: '29' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 11.0.2 + version: 11.0.3 fields: - _time - ComputerName diff --git a/data_sources/zeek_http.yml b/data_sources/zeek_http.yml new file mode 100644 index 00000000000..23fb4433df2 --- /dev/null +++ b/data_sources/zeek_http.yml @@ -0,0 +1,36 @@ +name: Zeek HTTP +id: 257a3ae6-a3f6-44e0-9d10-bdc5b4f011a3 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Raven Tait, Nasreddine Bencherchali, Splunk +description: Logs HTTP requests and responses analyzed by Zeek, including methods, URI, host, status codes, and request bodies when configured. +mitre_components: + - Network Traffic Content + - Network Traffic Flow + - Application Log Content +source: http.log +sourcetype: zeek:http +supported_TA: + - name: TA for Zeek + url: https://splunkbase.splunk.com/app/5466 + version: 1.0.11 +fields: + - id.orig_h + - id.orig_p + - id.resp_h + - id.resp_p + - method + - uri + - host + - status_code + - post_body + - user_agent +output_fields: + - id.orig_h + - id.resp_h + - id.resp_p + - uri + - method + - status_code +example_log: '{"ts": 1665164348.511363, "uid": "Ct9dph2EXJhTjowDF3", "id.orig_h": "192.168.196.131", "id.orig_p": 50050, "id.resp_h": "192.168.196.129", "id.resp_p": 80, "trans_depth": 13, "method": "POST", "host": "192.168.196.129", "uri": "/test.php", "version": "1.1", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36", "request_body_len": 108, "response_body_len": 0, "status_code": 200, "status_msg": "OK", "tags": [], "orig_fuids": ["FwroIQ2TSmbiOBzVz4"], "orig_mime_types": ["text/plain"], "post_body": "hMUlHTVEzmc+5fNbbspSRUEVsphYbAJ2Sy3CJZ9K12xyL1cRo1jrslMNWGGNnxbHB14R/CMybW0Z2+wOIuWtkDfKUG2IMpcOUutkDFdSiKo=", "client_header_names": ["USER-AGENT", "HOST", "CONTENT-LENGTH", "CACHE-CONTROL"], "client_header_values": ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36", "192.168.196.129", "108", "no-cache"], "server_header_names": ["CONTENT-TYPE", "DATE", "CONTENT-LENGTH"], "server_header_values": ["text/html", "Fri, 07 Oct 2022 17:39:09 GMT", "0"], "row_id": "dd80e4d5-b10b-4de0-bcd8-dba62c2901ea", "snapattack_session": "e50dc64e-0fc6-b1ad-429c-23ccdd5452c4"}' diff --git a/data_sources/zeek_ssh.yml b/data_sources/zeek_ssh.yml new file mode 100644 index 00000000000..4e165c31372 --- /dev/null +++ b/data_sources/zeek_ssh.yml @@ -0,0 +1,30 @@ +name: Zeek SSH +id: 9e228bf6-8c75-4d36-997c-e5ef1e1bf760 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Raven Tait, Nasreddine Bencherchali, Splunk +description: Logs SSH handshakes analyzed by Zeek, including client and server banners and connection endpoints. +mitre_components: + - Network Traffic Content + - Network Traffic Flow +source: ssh.log +sourcetype: zeek:ssh +supported_TA: + - name: TA for Zeek + url: https://splunkbase.splunk.com/app/5466 + version: 1.0.11 +fields: + - id.orig_h + - id.orig_p + - id.resp_h + - id.resp_p + - client + - server + - uid +output_fields: + - id.orig_h + - id.resp_h + - id.resp_p + - client +example_log: '{"_path":"ssh","_write_ts":"2026-01-15T09:21:33.456789Z","ts":"2026-01-15T09:21:32.987654Z","uid":"CkLmNo2Yp3qrStUv56","id.orig_h":"192.168.20.75","id.orig_p":53874,"id.resp_h":"198.51.100.20","id.resp_p":2222,"version":2,"auth_success":true,"auth_attempts":1,"direction":"OUTBOUND","client":"SSH-2.0-SecureBlackbox","server":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17","cipher_alg":"aes256-ctr","mac_alg":"hmac-sha1","compression_alg":"none","kex_alg":"diffie-hellman-group-exchange-sha256","host_key_alg":"ssh-ed25519","host_key":"11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00","remote_location.country_code":"US","remote_location.region":"MD","remote_location.city":"Baltimore","remote_location.latitude":39.2904,"remote_location.longitude":-76.6122}' diff --git a/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml b/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml new file mode 100644 index 00000000000..79100e68a43 --- /dev/null +++ b/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml @@ -0,0 +1,96 @@ +name: Cisco AI Defense Allowed Sensitive Prompt +id: 75f06fd6-2b31-4ca4-9aaf-56448c342e44 +version: 1 +creation_date: '2026-10-15' +modification_date: '2026-10-15' +author: Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + Detects Cisco AI Defense prompt events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data. + These events may indicate that sensitive information was submitted to an AI application and should be reviewed against the organization's data handling policy. +data_source: + - Cisco AI Defense Alerts +search: |- + `cisco_ai_defense` + event_action="allow" + event_message_type="prompt" + + | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "), + + guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "), + + application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"), + + connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"), + + application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name), + + connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name), + + policy_name='policy.policy_name', + + event_time=_time + + | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0 + + | bin _time span=10m + + | stats count as event_count + dc(event_id) as distinct_event_count + min(event_time) as firstTime + max(event_time) as lastTime + values(event_id) as event_ids + values(guardrail_ruleset_type) as guardrail_ruleset_types + values(guardrail_entity_name) as guardrail_entity_names + values(policy_name) as policy_names + values(application_name) as application_names + values(connection_name) as connection_names + by _time application_key connection_key + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + + | table _time firstTime lastTime application_key application_names connection_key connection_names + distinct_event_count event_count event_ids guardrail_ruleset_types guardrail_entity_names policy_names + + | `cisco_ai_defense_allowed_sensitive_prompt_filter` +how_to_implement: |- + Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype. + Confirm that extraction is enabled for the required fields as shown in the detection search. + Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment. + The search groups matching prompt events by application and connection in ten-minute windows to reduce duplicate findings. +known_false_positives: |- + Authorized testing, demonstrations, synthetic data, or approved workflows may submit content that matches PII or PCI guardrails. + Review the application, connection, policy, guardrail entity, and data handling requirements before treating an event as a policy violation. +drilldown_searches: + - name: View the detection results for - "$application_names$" + search: '%original_detection_search% | search application_names="$application_names$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +finding: + title: Cisco AI Defense allowed [$distinct_event_count$] sensitive prompt event(s) for application [$application_names$] and connection [$connection_names$] matched guardrail(s) [$guardrail_ruleset_types$]. + entity: + field: application_key + type: other + score: 50 +threat_objects: [] +analytic_story: + - Abuse of GenAI Systems and Applications + - Data Protection + - Critical Alerts +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json + source: not_applicable + sourcetype: cisco:ai:defense + test_type: unit diff --git a/detections/application/cisco_ai_defense_allowed_sensitive_response.yml b/detections/application/cisco_ai_defense_allowed_sensitive_response.yml new file mode 100644 index 00000000000..4c823a71c61 --- /dev/null +++ b/detections/application/cisco_ai_defense_allowed_sensitive_response.yml @@ -0,0 +1,73 @@ +name: Cisco AI Defense Allowed Sensitive Response +id: 6e4cd833-ea98-4c16-a7e7-e1909fad3fb2 +version: 1 +creation_date: '2026-10-15' +modification_date: '2026-10-15' +author: Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + Detects Cisco AI Defense response events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data. + These events may indicate that sensitive information was returned to an AI application user and should be reviewed promptly. +data_source: + - Cisco AI Defense Alerts +search: |- + `cisco_ai_defense` + event_action="allow" + event_message_type="response" + + | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "), + + guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "), + + application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"), + + connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"), + + policy_name='policy.policy_name' + + | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0 + + | table _time event_date event_id event_message_type event_action resource_type + application_id application_name connection_id connection_name model.model_name + policy_name guardrail_ruleset_type guardrail_entity_name + + | `cisco_ai_defense_allowed_sensitive_response_filter` +how_to_implement: |- + Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype. + Confirm that extraction is enabled for the required fields as shown in the detection search. + Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment. +known_false_positives: |- + Authorized testing, demonstrations, or approved workflows may allow responses that match PII or PCI guardrails. + Review the application owner, policy, response context, and whether the data was expected to be disclosed. +drilldown_searches: + - name: View the detection results for - "$application_name$" + search: '%original_detection_search% | search application_name="$application_name$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +finding: + title: Cisco AI Defense allowed response [$event_id$] for application [$application_name$] matched privacy guardrail(s) [$guardrail_ruleset_type$] and entity [$guardrail_entity_name$]. + entity: + field: application_name + type: other + score: 50 +threat_objects: [] +analytic_story: + - Abuse of GenAI Systems and Applications + - Data Protection + - Critical Alerts +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json + source: not_applicable + sourcetype: cisco:ai:defense + test_type: unit diff --git a/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml new file mode 100644 index 00000000000..d267fb97c78 --- /dev/null +++ b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml @@ -0,0 +1,96 @@ +name: Cisco AI Defense Repeated High Risk Activity +id: 45c5cf84-8ad0-4923-8332-a7fd3dab59d4 +version: 1 +creation_date: '2026-10-15' +modification_date: '2026-10-15' +author: Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + Detects bursts of five or more distinct Cisco AI Defense event IDs, or three or more occurrences of the same event ID, matching prompt injection, code detection, PII, or PCI guardrails for the same application and connection within ten minutes. + Allowed PII/PCI prompt events are handled by Cisco AI Defense Allowed Sensitive Prompt. + These patterns can indicate iterative prompt-injection probing or repeated attempts to use an AI application to access restricted data or capabilities. +data_source: + - Cisco AI Defense Alerts +search: |- + `cisco_ai_defense` + + ```Leave allowed PII/PCI prompt events to Cisco AI Defense Allowed Sensitive Prompt``` + + | eval is_allowed_sensitive_prompt=if(lower(event_action)="allow" AND lower(event_message_type)="prompt" AND mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0, 1, 0) + | where is_allowed_sensitive_prompt=0 + + | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "), + application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"), + connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"), + application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name), + connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name) + + | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0 + + | bin _time span=10m + + ```Track repeated records with the same Cisco event ID separately from bursts of distinct event IDs``` + | eventstats count as same_event_id_count by _time application_key connection_key event_id + + | stats count as event_count + dc(event_id) as distinct_event_count + max(eval(if(isnotnull(event_id) AND len(trim(event_id))>0, same_event_id_count, 0))) as max_same_event_id_count + values(eval(if(isnotnull(event_id) AND len(trim(event_id))>0 AND same_event_id_count>=3, event_id, null()))) as repeated_event_ids + count(eval(lower(event_action)="allow")) as allowed_event_count + count(eval(lower(event_action)="block")) as blocked_event_count + values(event_id) as event_ids + values(event_action) as event_actions + values(event_message_type) as message_types + values(policy.policy_name) as policy_names + values(guardrail_ruleset_type) as guardrail_ruleset_types + values(connection_name) as connection_names + values(application_name) as application_names + by _time application_key connection_key + + | where distinct_event_count>=5 OR max_same_event_id_count>=3 + + | table _time application_key application_names connection_key connection_names + event_count distinct_event_count max_same_event_id_count repeated_event_ids + allowed_event_count blocked_event_count event_actions message_types policy_names + guardrail_ruleset_types event_ids + + | `cisco_ai_defense_repeated_high_risk_activity_filter` +how_to_implement: |- + Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk. + Confirm that extraction is enabled for the required fields as shown in the detection search. + Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment. + Adjust the five-distinct-event threshold, three-occurrence same-event-ID threshold, and ten-minute window as needed. +known_false_positives: |- + Automated testing, red-team exercises, application QA, or a popular shared application may generate repeated guardrail events. + Review whether the window contains allowed events and whether the activity was expected for the application and connection. +drilldown_searches: + - name: View the detection results for - "$application_key$" + search: '%original_detection_search% | search application_key="$application_key$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +finding: + title: Cisco AI Defense observed [$event_count$] high risk event occurrences across [$distinct_event_count$] unique event IDs in ten minutes for application [$application_names$] and connection [$connection_names$]. Maximum same-ID count -> [$max_same_event_id_count$] ; Allowed events -> [$allowed_event_count$] ; Blocked events -> [$blocked_event_count$]. + entity: + field: application_key + type: other + score: 50 +threat_objects: [] +analytic_story: + - Abuse of GenAI Systems and Applications + - Critical Alerts +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json + source: not_applicable + sourcetype: cisco:ai:defense + test_type: unit diff --git a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml index cf1d7ef9e39..9aba8ccc19f 100644 --- a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml +++ b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml @@ -1,45 +1,106 @@ name: Cisco AI Defense Security Alerts by Application Name id: 105e4a69-ec55-49fc-be1f-902467435ea8 -version: 7 +version: 8 creation_date: '2025-02-14' -modification_date: '2026-05-13' -author: Bhavin Patel, Splunk +modification_date: '2026-10-15' +author: Bhavin Patel, Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: The search surfaces alerts from the Cisco AI Defense product for potential attacks against the AI models running in your environment. This analytic identifies security events within Cisco AI Defense by examining event messages, actions, and policy names. It focuses on connections and applications associated with specific guardrail entities and ruleset types. By aggregating and analyzing these elements, the search helps detect potential policy violations and security threats, enabling proactive defense measures and ensuring network integrity. +description: |- + This analytic summarizes Cisco AI Defense events by application, connection, action, message direction, and severity over ten-minute intervals. + Allowed responses flagged for privacy guardrails are handled by the dedicated sensitive-response detection. + Allowed prompts flagged for privacy guardrails are handled by Cisco AI Defense Allowed Sensitive Prompt. + Repeated prompt injection, code detection, PII, or PCI events are handled by the repeated high-risk activity detection. data_source: - Cisco AI Defense Alerts search: |- `cisco_ai_defense` - | rename genai_application.application_name as application_name - | rename connection.connection_name as connection_name - ```Aggregating data by model name, connection name, application name, application ID, and user ID``` - | stats count - values(user_id) as user_id - values(event_message_type) as event_message_type - values(event_action) as event_action - values(policy.policy_name) as policy_name - values(event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name) as guardrail_entity_name - values(event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type) as guardrail_ruleset_type - by model.model_name connection_name application_name application_id - ```Evaluating severity based on policy name and guardrail ruleset type``` - | eval severity=case( - policy_name IN ("AI Runtime Latency Testing - Prompt Injection"), "critical", - policy_name IN ("AI Runtime Latency Testing - Code Detection"), "high", - guardrail_ruleset_type IN ("Toxicity"), "medium", + + | rename genai_application.application_name as application_name, + connection.connection_name as connection_name + + | eval policy_name='policy.policy_name', + + guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "), + + guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "), + + action=lower(event_action), message_type=lower(event_message_type), + + has_privacy=if(mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0, 1, 0), + + has_sensitive_response=if(message_type="response" AND has_privacy=1, 1, 0), + + has_security=if(mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)prompt injection|code detection")>=0, 1, 0) + + ```Prioritize allowed sensitive responses, then security and privacy guardrails``` + + | eval severity=case( + action="allow" AND has_sensitive_response=1, "critical", + action="block" AND has_sensitive_response=1, "high", + action="allow" AND has_security=1, "high", + action="block" AND has_security=1, "medium", + action="allow" AND has_privacy=1, "high", + action="block" AND has_privacy=1, "medium", true(), "low" ) - ```Calculating risk score based on severity level``` - | eval risk_score=case( - severity="critical", 100, - severity="high", 75, - severity="medium", 50, - severity="low", 25 - ) - | table model.model_name, user_id, event_action, application_id, application_name, severity, risk_score, policy_name, connection_name, guardrail_ruleset_type, guardrail_entity_name - | `cisco_ai_defense_security_alerts_by_application_name_filter` -how_to_implement: To enable this detection, you need to ingest alerts from the Cisco AI Defense product. This can be done by using this app from splunkbase - Cisco Security Cloud and ingest alerts into the cisco:ai:defense sourcetype. -known_false_positives: False positives may vary based on Cisco AI Defense configuration; monitor and filter out the alerts that are not relevant to your environment. + + | eval risk_score=case( + severity="critical", 100, + severity="high", 80, + severity="medium", 50, + severity="low", 20 + ) + + | eval application_name=if(isnotnull(application_name) AND len(trim(application_name))>0, application_name, "unknown"), + connection_name=if(isnotnull(connection_name) AND len(trim(connection_name))>0, connection_name, "unknown"), + application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name), + connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name), + is_high_risk=if(has_security=1 OR has_privacy=1, 1, 0), + is_allowed_sensitive_response=if(action="allow" AND has_sensitive_response=1, 1, 0), + is_allowed_sensitive_prompt=if(action="allow" AND message_type="prompt" AND has_privacy=1, 1, 0), + high_risk_event_id=if((has_security=1 OR has_privacy=1) AND is_allowed_sensitive_prompt=0, event_id, null()), + event_time=_time + + | bin _time span=10m + + ```Use the same application/connection window and threshold as Cisco AI Defense Repeated High Risk Activity``` + | eventstats dc(high_risk_event_id) as high_risk_event_count by _time application_key connection_key + + ```Leave allowed sensitive responses to Cisco AI Defense Allowed Sensitive Response, allowed sensitive prompts to Cisco AI Defense Allowed Sensitive Prompt, and repeated high-risk bursts to Cisco AI Defense Repeated High Risk Activity``` + | where is_allowed_sensitive_response=0 AND is_allowed_sensitive_prompt=0 AND NOT (is_high_risk=1 AND high_risk_event_count>=5) + + | stats count as event_count + dc(event_id) as distinct_event_count + min(event_time) as firstTime + max(event_time) as lastTime + values(event_id) as event_ids + values(event_action) as event_actions + values(event_message_type) as message_types + values(resource_type) as resource_types + values(model.model_name) as model_names + values(application_name) as application_name + values(connection_name) as connection_name + values(policy_name) as policy_names + values(guardrail_ruleset_type) as guardrail_ruleset_types + values(guardrail_entity_name) as guardrail_entity_names + max(risk_score) as risk_score + by _time application_key connection_key action message_type severity + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + + | table _time firstTime lastTime application_key application_name connection_key connection_name + action message_type severity risk_score event_count distinct_event_count event_ids + resource_types model_names policy_names guardrail_ruleset_types guardrail_entity_names + + | `cisco_ai_defense_security_alerts_by_application_name_filter` +how_to_implement: |- + Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype. + Confirm that extraction is enabled for the required fields as shown in the detection search. + Configure the cisco_ai_defense macro to match the index, source, and sourcetype used in your environment. +known_false_positives: |- + False positives may vary based on Cisco AI Defense configuration; monitor and filter out the alerts that are not relevant to your environment. references: - https://www.robustintelligence.com/blog-posts/prompt-injection-attack-on-gpt-4 - https://docs.aws.amazon.com/prescriptive-guidance/latest/llm-prompt-engineering-best-practices/common-attacks.html @@ -57,8 +118,10 @@ intermediate_findings: - field: application_name type: other score: 20 - message: Cisco AI Defense Security Alert has been action - [$event_action$] for the application name - [$application_name$] + message: Cisco AI Defense summarized [$event_count$] events for application [$application_name$] and connection [$connection_name$] over ten minutes. Actions [$action$], message direction [$message_type$], severity [$severity$], guardrails [$guardrail_ruleset_types$], event IDs [$event_ids$]. +threat_objects: [] analytic_story: + - Abuse of GenAI Systems and Applications - Critical Alerts asset_type: Web Application mitre_attack_id: [] @@ -72,7 +135,7 @@ tests: - name: True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json - source: cisco_ai_defense + source: not_applicable sourcetype: cisco:ai:defense - description: PORTED MANUAL TEST - We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. - test_type: experimental + description: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. + test_type: unit diff --git a/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml b/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml index 8a226473725..8beac37a157 100644 --- a/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml +++ b/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml @@ -1,13 +1,13 @@ name: Cisco IOS XE WebUI Programmatic Configuration id: f9686576-a23d-4c4d-bfad-a45499dc448a -version: 1 +version: 2 creation_date: '2026-05-19' -modification_date: '2026-05-19' +modification_date: '2026-09-08' author: Nasreddine Bencherchali status: production type: Anomaly description: | - This analytic detects Cisco IOS-XE configuration changes performed by the WebUI WSMA process. + The following analytic detects Cisco IOS-XE configuration changes performed by the WebUI WSMA process. data_source: - Cisco IOS Logs search: |- @@ -47,7 +47,8 @@ intermediate_findings: - field: user type: user score: 20 - message: User $user$ performed Cisco IOS-XE WebUI programmatic configuration on $dest$. + message: User [$user$] performed Cisco IOS-XE WebUI programmatic configuration on [$dest$] via [$process$] on [$vty$]. +threat_objects: [] analytic_story: - Salt Typhoon asset_type: Network diff --git a/detections/application/detect_html_help_spawn_child_process.yml b/detections/application/detect_html_help_spawn_child_process.yml index 0b070d38386..27905230b3c 100644 --- a/detections/application/detect_html_help_spawn_child_process.yml +++ b/detections/application/detect_html_help_spawn_child_process.yml @@ -2,7 +2,7 @@ name: Detect HTML Help Spawn Child Process id: 723716de-ee55-4cd4-9759-c44e7e55ba4b version: 16 creation_date: '2021-02-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ references: - https://lolbas-project.github.io/lolbas/Binaries/Hh/ - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.001/T1218.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -66,6 +67,8 @@ analytic_story: - Compromised Windows Host - APT37 Rustonotto and FadeStealer asset_type: Endpoint +atomic_guid: + - 5cb87818-0d7c-4469-b7ef-9224107aebe8 mitre_attack_id: - T1218.001 product: diff --git a/detections/application/email_files_written_outside_of_the_outlook_directory.yml b/detections/application/email_files_written_outside_of_the_outlook_directory.yml index 229731bdfff..211609724d0 100644 --- a/detections/application/email_files_written_outside_of_the_outlook_directory.yml +++ b/detections/application/email_files_written_outside_of_the_outlook_directory.yml @@ -1,8 +1,8 @@ name: Email files written outside of the Outlook directory id: 8d52cf03-ba25-4101-aa78-07994aed4f74 -version: 13 +version: 14 creation_date: '2020-04-29' -modification_date: '2026-07-02' +modification_date: '2026-09-08' author: Bhavin Patel, Splunk status: production type: Anomaly @@ -55,6 +55,9 @@ intermediate_findings: type: system score: 20 message: A new email file [$file_name$] was written to [$file_path$] on endpoint $dest$ by user $user$. +threat_objects: + - field: file_path + type: file_path analytic_story: - Collection and Staging asset_type: Endpoint diff --git a/detections/application/esxi_audit_tampering.yml b/detections/application/esxi_audit_tampering.yml index d0936d95ff6..269ff72aeba 100644 --- a/detections/application/esxi_audit_tampering.yml +++ b/detections/application/esxi_audit_tampering.yml @@ -1,17 +1,36 @@ name: ESXi Audit Tampering id: c48a155b-2861-417a-813c-220f5272cf01 -version: 5 +version: 6 creation_date: '2025-07-11' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Raven Tait, Splunk status: production type: TTP -description: This detection identifies the use of the esxcli system auditrecords commands, which can be used to tamper with logging on an ESXi host. This action may indicate an attempt to evade detection or hinder forensic analysis by preventing the recording of system-level audit events. +description: |- + The following analytic identifies the use of the esxcli system auditrecords commands, which can be used to tamper with logging on an ESXi host. + This action may indicate an attempt to evade detection or hinder forensic analysis by preventing the recording of system-level audit events. data_source: - VMWare ESXi Syslog -search: '`esxi_syslog` Message="*esxcli system auditrecords*" Message IN ("*remote*","*local*") NOT Message = "*[shell*" | rex field=_raw "Z (?[\w\.]+)\s" | rex field=_raw "[\w+]\]: (?.*)" | rex field=full_command "\[(?.*)]:\s(?.*)" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_audit_tampering_filter`' -how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. -known_false_positives: Limited false positives in most environments, however tune as needed. +search: |- + `esxi_syslog` + Message="*esxcli system auditrecords*" + Message IN ("*remote*","*local*") + NOT Message = "*[shell*" + + | rex field=_raw "Z (?[\w\.]+)\s" + | rex field=_raw "[\w+]\]: (?.*)" + | rex field=full_command "\[(?.*)]:\s(?.*)" + + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest user command + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `esxi_audit_tampering_filter` +how_to_implement: |- + This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. +known_false_positives: No false positives have been identified at this time. references: - https://detect.fyi/detecting-and-responding-to-esxi-compromise-with-splunk-f33998ce7823 drilldown_searches: @@ -24,11 +43,14 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Audit tampering activity on ESXi host $dest$. + title: Audit tampering activity via [$command$] on ESXi host [$dest$]. entity: field: dest type: system score: 50 +threat_objects: + - field: command + type: command analytic_story: - ESXi Post Compromise - Black Basta Ransomware diff --git a/detections/application/esxi_bulk_vm_termination.yml b/detections/application/esxi_bulk_vm_termination.yml index ba4f702548e..2153c20e66b 100644 --- a/detections/application/esxi_bulk_vm_termination.yml +++ b/detections/application/esxi_bulk_vm_termination.yml @@ -1,17 +1,49 @@ name: ESXi Bulk VM Termination id: cfe094b4-0737-4a33-9d63-e0562ce2b883 -version: 4 +version: 5 creation_date: '2025-07-11' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Raven Tait, Splunk status: production type: TTP -description: This detection identifies when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads. +description: |- + The following analytic detects when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads. data_source: - VMWare ESXi Syslog -search: '`esxi_syslog` | rex field=_raw "\s\[(?[^\]]+)\]:\s(?.+)$" | rex field=_raw "Z (?[\w\.]+)\s.*:\s(?esxcli\s.+)" | eval command=mvappend(esxicli_Command, shell_Command) | where isnotnull(command) | search (command="pkill -9 vmx-*") OR ( command="*esxcli*" AND command="*--format-param*" AND command="*vm process list*" AND command="*awk*" AND command="*esxcli vm process kill*") | stats min(_time) as firstTime max(_time) as lastTime values(_time) as timeStamp values(command) as commands values(user) as user by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_bulk_vm_termination_filter`' -how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. -known_false_positives: Limited false positives in most environments, however tune as needed. +search: |- + `esxi_syslog` + Message IN ( + "*pkill -9 *", + "*process kill*" + ) + | rex field=_raw "\s\[(?[^\]]+)\]:\s(?.+)$" + | rex field=_raw "Z (?[\w\.]+)\s.*:\s(?esxcli\s.+)" + | eval command=mvappend(esxicli_Command, shell_Command) + | where isnotnull(command) + | search (command="pkill -9 vmx-*") + OR + ( + command="*esxcli*" + command="*--format-param*" + command="*vm process list*" + command="*awk*" + command="*esxcli vm process kill*" + ) + | stats min(_time) as firstTime + max(_time) as lastTime + values(_time) as timeStamp + values(command) as commands + + by dest user + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `esxi_bulk_vm_termination_filter` +how_to_implement: |- + This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. +known_false_positives: No false positives have been identified at this time. +references: + - https://www.securityweek.com/microsoft-says-ransomware-gangs-exploiting-just-patched-vmware-esxi-flaw/ drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -22,11 +54,12 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Bulk VM termination activity on ESXi host $dest$. + title: Bulk VM termination activity on ESXi host [$dest$]. entity: field: dest type: system score: 50 +threat_objects: [] analytic_story: - ESXi Post Compromise - Black Basta Ransomware diff --git a/detections/application/esxi_encryption_settings_modified.yml b/detections/application/esxi_encryption_settings_modified.yml index fa76c3090d2..8742e7446f5 100644 --- a/detections/application/esxi_encryption_settings_modified.yml +++ b/detections/application/esxi_encryption_settings_modified.yml @@ -1,17 +1,34 @@ name: ESXi Encryption Settings Modified id: dbbbe26f-83fe-4ee3-8b77-ccf7fbd416c8 -version: 5 +version: 6 creation_date: '2025-07-11' -modification_date: '2026-05-13' +modification_date: '2026-08-12' author: Raven Tait, Splunk status: production type: TTP description: Detects the disabling of critical encryption enforcement settings on an ESXi host, such as secure boot or executable verification requirements, which may indicate an attempt to weaken hypervisor integrity or allow unauthorized code execution. data_source: - VMWare ESXi Syslog -search: '`esxi_syslog` Message="*system settings encryption set*" NOT Message="*shell.*" Message IN ("* -s *", "* -e *","*--require-secure-boot*", "*require-exec-installed-only*", "execInstalledOnly") | rex field=_raw "Z (?[\w\.]*)\s.*\]: \[(?\w+)\]:(?.+)" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_encryption_settings_modified_filter`' -how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. -known_false_positives: Limited false positives in most environments, however tune as needed. +search: |- + `esxi_syslog` + Message = "*system settings encryption set*" + NOT Message = "*shell.*" + Message IN ( + "* -e *", + "* -s *", + "*--require-secure-boot*", + "*execInstalledOnly*", + "*require-exec-installed-only*" + ) + | rex field=_raw "Z (?[\w\.]*)\s.*\]: \[(?\w+)\]:(?.+)" + | stats min(_time) as firstTime max(_time) as lastTime count by dest user command + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `esxi_encryption_settings_modified_filter` +how_to_implement: |- + This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. +known_false_positives: |- + Limited false positives in most environments, however tune as needed. drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -22,7 +39,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Encryption settings modified on ESXi host $dest$. + title: Encryption settings modified on ESXi host [$dest$]. entity: field: dest type: system diff --git a/detections/application/m365_copilot_agentic_jailbreak_attack.yml b/detections/application/m365_copilot_agentic_jailbreak_attack.yml index e73d2df500c..ba76b389cfb 100644 --- a/detections/application/m365_copilot_agentic_jailbreak_attack.yml +++ b/detections/application/m365_copilot_agentic_jailbreak_attack.yml @@ -1,10 +1,10 @@ name: M365 Copilot Agentic Jailbreak Attack id: e5c7b380-19da-42e9-9e53-0af4cd27aee3 -version: 5 +version: 6 creation_date: '2025-10-13' modification_date: '2026-05-13' author: Rod Soto -status: experimental +status: production type: Anomaly description: Detects agentic AI jailbreak attempts that try to establish persistent control over M365 Copilot through rule injection, universal triggers, response automation, system overrides, and persona establishment techniques. The detection analyzes the PromptText field for keywords like "from now on," "always respond," "ignore previous," "new rule," "override," and role-playing commands (e.g., "act as," "you are now") that attempt to inject persistent instructions. The search computes risk by counting distinct jailbreak indicators per user session, flagging coordinated manipulation attempts. data_source: @@ -62,4 +62,4 @@ tests: sourcetype: csv source: csv test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + description: Automated testing is experimental because contentctl-ng replays this CSV fixture through HEC raw, which does not extract the Subject_Title and Sender fields required by this detection in the current test configuration. The same fixture yields matching results when ingested through native CSV file/oneshot input. Retain the experimental test until CI reproduces that field extraction. See TR-4611. diff --git a/detections/application/m365_copilot_impersonation_jailbreak_attack.yml b/detections/application/m365_copilot_impersonation_jailbreak_attack.yml index cba621255af..4659c8a4b80 100644 --- a/detections/application/m365_copilot_impersonation_jailbreak_attack.yml +++ b/detections/application/m365_copilot_impersonation_jailbreak_attack.yml @@ -1,10 +1,10 @@ name: M365 Copilot Impersonation Jailbreak Attack id: cc26aba8-7f4a-4078-b91a-052d6a53cb13 -version: 6 +version: 7 creation_date: '2025-10-13' modification_date: '2026-06-04' author: Rod Soto -status: experimental +status: production type: TTP description: Detects M365 Copilot impersonation and roleplay jailbreak attempts where users try to manipulate the AI into adopting alternate personas, behaving as unrestricted entities, or impersonating malicious AI systems to bypass safety controls. The detection searches exported eDiscovery prompt logs for roleplay keywords like "pretend you are," "act as," "you are now," "amoral," and "roleplay as" in the Subject_Title field. Prompts are categorized into specific impersonation types (AI_Impersonation, Malicious_AI_Persona, Unrestricted_AI_Persona, etc.) to identify attempts to override the AI's safety guardrails through persona injection attacks. data_source: @@ -54,4 +54,4 @@ tests: sourcetype: csv source: csv test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + description: Automated testing is experimental because contentctl-ng replays this CSV fixture through HEC raw, which does not extract the Subject_Title and Sender fields required by this detection in the current test configuration. The same fixture yields matching results when ingested through native CSV file/oneshot input. Retain the experimental test until CI reproduces that field extraction. See TR-4611. diff --git a/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml b/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml index 9edff8c36cc..b856ed88224 100644 --- a/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml +++ b/detections/application/m365_copilot_information_extraction_jailbreak_attack.yml @@ -1,10 +1,10 @@ name: M365 Copilot Information Extraction Jailbreak Attack id: c0ee37bb-ed43-4632-8e38-060fba80b0b2 -version: 5 +version: 6 creation_date: '2025-10-13' modification_date: '2026-05-13' author: Rod Soto -status: experimental +status: production type: TTP description: Detects M365 Copilot information extraction jailbreak attacks that attempt to obtain sensitive, classified, or comprehensive data through various social engineering techniques including fictional entity impersonation, bulk data requests, and privacy bypass attempts. The detection searches exported eDiscovery prompt logs for extraction keywords like "transcendent," "tell me everything," "confidential," "dump," "extract," "reveal," and "bypass" in the Subject_Title field, categorizing each attempt by extraction type and assigning severity levels (CRITICAL for classified/proprietary data, HIGH for bulk extraction or privacy bypass). Prompts are further analyzed for compound risk patterns such as "Confidential+Extraction" or "Bulk_Request+Bypass," filtering out low-severity cases to surface the most dangerous attempts to exfiltrate sensitive organizational information through AI manipulation. data_source: @@ -93,4 +93,4 @@ tests: sourcetype: csv source: csv test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + description: Automated testing is experimental because contentctl-ng replays this CSV fixture through HEC raw, which does not extract the Subject_Title and Sender fields required by this detection in the current test configuration. The same fixture yields matching results when ingested through native CSV file/oneshot input. Retain the experimental test until CI reproduces that field extraction. See TR-4611. diff --git a/detections/application/m365_copilot_jailbreak_attempts.yml b/detections/application/m365_copilot_jailbreak_attempts.yml index 28c8410f745..ca4445a5654 100644 --- a/detections/application/m365_copilot_jailbreak_attempts.yml +++ b/detections/application/m365_copilot_jailbreak_attempts.yml @@ -1,10 +1,10 @@ name: M365 Copilot Jailbreak Attempts id: b05a4f25-e07d-436f-ab03-f954afa922c0 -version: 6 +version: 7 creation_date: '2025-10-13' modification_date: '2026-05-13' author: Rod Soto -status: experimental +status: production type: Anomaly description: Detects M365 Copilot jailbreak attempts through prompt injection techniques including rule manipulation, system bypass commands, and AI impersonation requests that attempt to circumvent built-in safety controls. The detection searches exported eDiscovery prompt logs for jailbreak keywords like "pretend you are," "act as," "rules=," "ignore," "bypass," and "override" in the Subject_Title field, assigning severity scores based on the manipulation type (score of 4 for amoral impersonation or explicit rule injection, score of 3 for entity roleplay or bypass commands). Prompts with a jailbreak score of 2 or higher are flagged, prioritizing the most severe attempts to override AI safety mechanisms through direct instruction injection or unauthorized persona adoption. data_source: @@ -67,4 +67,4 @@ tests: sourcetype: csv source: csv test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + description: Automated testing is experimental because contentctl-ng replays this CSV fixture through HEC raw, which does not extract the Subject_Title and Sender fields required by this detection in the current test configuration. The same fixture yields matching results when ingested through native CSV file/oneshot input. Retain the experimental test until CI reproduces that field extraction. See TR-4611. diff --git a/detections/application/ollama_abnormal_network_connectivity.yml b/detections/application/ollama_abnormal_network_connectivity.yml index c12fe51364c..2a48c920127 100644 --- a/detections/application/ollama_abnormal_network_connectivity.yml +++ b/detections/application/ollama_abnormal_network_connectivity.yml @@ -1,54 +1,79 @@ name: Ollama Abnormal Network Connectivity id: 19ec30ad-faa2-496a-a6a9-f2e5f778fbdb -version: 5 +version: 6 creation_date: '2025-10-13' -modification_date: '2026-05-13' -author: Rod Soto -status: experimental +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production type: Anomaly -description: Detects abnormal network activity and connectivity issues in Ollama including non-localhost API access attempts and warning-level network errors such as DNS lookup failures, TCP connection issues, or host resolution problems that may indicate network-based attacks, unauthorized access attempts, or infrastructure reconnaissance activity. +description: |- + Detects repeated Ollama warning-level network errors, such as DNS lookup failures, TCP connection issues, or host resolution problems. These events can indicate a connectivity issue and warrant investigation, but do not by themselves establish unauthorized access or reconnaissance. data_source: - Ollama Server search: |- - `ollama_server` level=WARN (msg="*failed*" OR msg="*dial tcp*" OR msg="*lookup*" OR msg="*no such host*" OR msg="*connection*" OR msg="*network*" OR msg="*timeout*" OR msg="*unreachable*" OR msg="*refused*") - | eval src=coalesce(src, src_ip, "N/A") - | stats count as incidents, values(src) as src, values(msg) as warning_messages, latest(_time) as last_incident - BY host - | eval last_incident=strftime(last_incident, "%Y-%m-%d %H:%M:%S") - | eval severity="medium" - | eval attack_type="Abnormal Network Connectivity" - | stats count - BY last_incident, host, incidents, - src, warning_messages, severity, - attack_type - | `ollama_abnormal_network_connectivity_filter` -how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' -known_false_positives: Legitimate remote access from authorized users or applications connecting from non-localhost addresses, temporary network infrastructure issues causing DNS resolution failures, firewall or network configuration changes resulting in connection timeouts, cloud-hosted Ollama instances receiving valid external API requests, or intermittent connectivity problems during network maintenance may trigger this detection during normal operations. + `ollama_server` + level=WARN + msg IN ( + "*connection*", + "*dial tcp*", + "*failed*", + "*lookup*", + "*network*", + "*no such host*", + "*refused*", + "*timeout*", + "*unreachable*" + ) + + | bin _time span=5m + | stats count as incidents + values(msg) as warning_messages + latest(_time) as last_incident + by _time dest + + | where incidents > 3 + + | eval last_incident=strftime(last_incident, "%Y-%m-%d %H:%M:%S") + + | eval severity="medium" + + | eval attack_type="Abnormal Network Connectivity" + + | table last_incident dest incidents warning_messages severity attack_type + + | `ollama_abnormal_network_connectivity_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate remote access from authorized users or applications connecting from non-localhost addresses, temporary network infrastructure issues causing DNS resolution failures, firewall or network configuration changes resulting in connection timeouts, cloud-hosted Ollama instances receiving valid external API requests, or intermittent connectivity problems during network maintenance may trigger this detection during normal operations. references: - https://github.com/rosplk/ta-ollama drilldown_searches: - - name: View the detection results for - "$src$" - search: '%original_detection_search% | search "$src = "$src$"' + - name: View the detection results for - "$dest$" + search: |- + %original_detection_search% + | search dest="$dest$" earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - - name: View risk events for the last 7 days for - "$src$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$",) | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + - name: View risk events for the last 7 days for - "$dest$" + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$dest$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` earliest_offset: 7d latest_offset: "0" intermediate_findings: entities: - - field: host + - field: dest type: system score: 20 - message: 'Abnormal network activity detected on $host$ with $incidents$ incidents from $src$. Investigation needed for network errors: $warning_messages$.' -threat_objects: - - field: src - type: system + message: Abnormal network activity on [$dest$] with [$incidents$] matching warnings [$warning_messages$]. Investigate DNS and network reachability. analytic_story: - Suspicious Ollama Activities asset_type: Web Application -mitre_attack_id: - - T1571 +mitre_attack_id: [] product: - Splunk Enterprise - Splunk Enterprise Security @@ -61,5 +86,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log sourcetype: ollama:server source: app.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_excessive_api_requests.yml b/detections/application/ollama_excessive_api_requests.yml index 42f4958876a..76eb6313a1f 100644 --- a/detections/application/ollama_excessive_api_requests.yml +++ b/detections/application/ollama_excessive_api_requests.yml @@ -1,26 +1,62 @@ name: Ollama Excessive API Requests id: 1cfab663-9adc-4169-a88c-6bae29ba3c70 -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' -author: Rod Soto -status: experimental +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production type: Anomaly -description: Detects potential Distributed Denial of Service (DDoS) attacks or rate limit abuse against Ollama API endpoints by identifying excessive request volumes from individual client IP addresses. This detection monitors GIN-formatted Ollama server logs to identify clients generating abnormally high request rates within short time windows, which may indicate automated attacks, botnet activity, or resource exhaustion attempts targeting local AI model infrastructure. +description: Detects high Ollama API request volumes from a single client in a short time window. A burst may indicate automated abuse or contribute to resource contention, but GIN access logs do not establish malicious intent or service impact; validate the client and workload against local usage baselines. data_source: - Ollama Server -search: '`ollama_server` | rex field=_raw "\|\s+(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+\|" | eval src=coalesce(src, client_ip) | eval dest=coalesce(dest, url, uripath, endpoint) | bin _time span=5m | stats count as request_count by _time, src, dest, host | where request_count > 120 | eval severity="high" | eval attack_type="Rate Limit Abuse / DDoS" | stats count by _time, host, src, dest, request_count, severity, attack_type | `ollama_excessive_api_requests_filter`' -how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' -known_false_positives: Legitimate automated services (CI/CD pipelines, monitoring tools, batch jobs), multiple users behind NAT/proxy infrastructure, or authorized load testing activities may trigger this detection during normal operations. Operator must adjust threshold accordingly. +search: |- + `ollama_server` + "[GIN]" + + | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+(?:µs|ms|s))\s+\|\s+(?[^|]+?)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" + + | eval src=coalesce(src, trim(raw_src)) + | eval uri_path=coalesce(uri_path, raw_path) + | eval http_method=coalesce(http_method, raw_method) + | eval http_response_code=coalesce(http_response_code, raw_status) + | eval response_time_ms=coalesce(response_time_ms, case(match(raw_latency, "µs$"), tonumber(replace(raw_latency, "µs", ""))/1000, match(raw_latency, "ms$"), tonumber(replace(raw_latency, "ms", "")), match(raw_latency, "s$"), tonumber(replace(raw_latency, "s", ""))*1000)) + + | where isnotnull(src) + + | bin _time span=5m + + | stats count as request_count + dc(uri_path) as distinct_endpoints + values(uri_path) as endpoints + by _time src + + | where request_count > 120 + + | eval severity="medium" + + | eval attack_type="High Volume API Activity" + + | `ollama_excessive_api_requests_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate automated services (CI/CD pipelines, monitoring tools, batch jobs), multiple users behind NAT/proxy infrastructure, or authorized load testing activities may trigger this detection during normal operations. Operator must adjust threshold accordingly. references: - https://github.com/rosplk/ta-ollama drilldown_searches: - name: View the detection results for - "$src$" - search: '%original_detection_search% | search "$src = "$src$"' + search: |- + %original_detection_search% + | search src="$src$" earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$src$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$src$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` earliest_offset: 7d latest_offset: "0" intermediate_findings: @@ -28,7 +64,7 @@ intermediate_findings: - field: src type: system score: 20 - message: Possible DDoS attack from $src$ against Ollama server detected with request count $request_count$ in 1 minute, potentially causing service degradation or complete unavailability. + message: '[$request_count$] Ollama API requests from [$src$] across [$distinct_endpoints$] endpoints were observed in 5 minutes. Validate the client and workload before attributing the burst to abuse or service impact.' analytic_story: - Suspicious Ollama Activities asset_type: Web Application @@ -46,5 +82,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_long_running_inference_requests.yml b/detections/application/ollama_long_running_inference_requests.yml new file mode 100644 index 00000000000..49661c873ee --- /dev/null +++ b/detections/application/ollama_long_running_inference_requests.yml @@ -0,0 +1,97 @@ +name: Ollama Long-Running Inference Requests +id: 7619c98c-f53b-445f-87ca-b148e8560340 +version: 1 +creation_date: '2026-10-09' +modification_date: '2026-10-10' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: |- + Identifies repeated Ollama inference requests with long response times on /api/generate, /api/chat, and /v1/chat/completions. + Long response time can result from model size, prompt length, host resources, or normal workload. GIN access logs do not include prompt content and cannot establish a prompt injection or jailbreak attempt, so use this as an exploratory performance signal. +data_source: + - Ollama Server +search: |- + `ollama_server` + "[GIN]" + + | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?(?:\d+h)?(?:\d+m)?[\d\.]+(?:µs|ms|s))\s+\|\s+(?[^|]+?)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" + + | eval src=coalesce(src, trim(raw_src)) + | eval uri_path=mvindex(split(coalesce(uri_path, raw_path), "?"), 0) + | eval http_method=coalesce(http_method, raw_method) + | eval http_response_code=coalesce(http_response_code, raw_status) + | rex field=raw_latency "^(?:(?\d+)h)?(?:(?\d+)m)?(?[\d\.]+)(?µs|ms|s)$" + | eval response_time_ms=(coalesce(tonumber(raw_latency_hours), 0) * 3600000) + (coalesce(tonumber(raw_latency_minutes), 0) * 60000) + (tonumber(raw_latency_value) * case(raw_latency_unit="µs", 0.001, raw_latency_unit="ms", 1, raw_latency_unit="s", 1000)) + + | where isnotnull(src) AND in(uri_path, "/api/generate", "/api/chat", "/v1/chat/completions") AND response_time_ms > 30000 + + | eval response_time_seconds=response_time_ms/1000 + + | bin _time span=10m + + | stats count as long_request_count + avg(response_time_seconds) as avg_response_time + max(response_time_seconds) as max_response_time + values(uri_path) as uri_path + values(http_response_code) as status_codes + by _time src host + + | where long_request_count > 1 + + | eval avg_response_time=round(avg_response_time, 2) + | eval max_response_time=round(max_response_time, 2) + | eval severity=case(max_response_time > 55, "high", 1=1, "medium") + | eval attack_type="Long-Running Inference Requests" + + | table _time host src uri_path long_request_count + avg_response_time max_response_time + status_codes severity attack_type + + | `ollama_long_running_inference_requests_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate complex queries requiring extensive model reasoning, large context windows processing substantial amounts of text, batch processing operations, or resource-constrained systems experiencing performance degradation may trigger this detection during normal operations. +references: + - https://github.com/rosplk/ta-ollama + - https://github.com/OWASP/www-project-ai-testing-guide +drilldown_searches: + - name: View the detection results for - "$src$" + search: |- + %original_detection_search% + | search src="$src$" + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$src$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: '[$long_request_count$] long-running inference requests from [$src$] averaged [$avg_response_time$] seconds and reached [$max_response_time$] seconds. Investigate workload, model size, prompt length, and host capacity; access logs do not establish prompt injection or data exfiltration.' +analytic_story: + - Suspicious Ollama Activities +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log + sourcetype: ollama:server + source: server.log + test_type: unit diff --git a/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml b/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml index aa1b54cd733..524253871e7 100644 --- a/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml +++ b/detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml @@ -1,38 +1,69 @@ name: Ollama Possible API Endpoint Scan Reconnaissance id: ad3f352a-0347-48ee-86b9-670b5025a548 -version: 5 +version: 6 creation_date: '2025-10-13' -modification_date: '2026-05-13' -author: Rod Soto -status: experimental +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production type: Anomaly -description: Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks. +description: |- + Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks. data_source: - Ollama Server search: |- - `ollama_server` "[GIN]" - | bin _time span=5m - | stats count as total_requests, values(dest) as dest, values(http_method) as methods, values(status) as status_codes - BY _time, src, host - | where total_requests > 120 - | eval severity="medium" - | eval attack_type="API Activity Surge" - | stats count - BY _time, host, src, - total_requests, dest, methods, - status_codes, severity, attack_type - | `ollama_possible_api_endpoint_scan_reconnaissance_filter` -how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' -known_false_positives: Legitimate web application clients or mobile apps that access multiple API endpoints as part of normal functionality, monitoring and health check systems probing various endpoints for availability, load balancers performing health checks across different paths, API testing frameworks during development and QA processes, or users navigating through web interfaces that trigger multiple API calls may generate similar patterns during normal operations. + `ollama_server` + "[GIN]" + + | rex field=_raw "\|\s+(?\d+)\s+\|\s+(?[\d\.]+(?:µs|ms|s))\s+\|\s+(?[^|]+?)\s+\|\s+(?\w+)\s+\"(?[^\"]+)\"" + + | eval src=coalesce(src, trim(raw_src)) + | eval uri_path=coalesce(uri_path, raw_path) + | eval http_method=coalesce(http_method, raw_method) + | eval http_response_code=coalesce(http_response_code, raw_status) + | eval response_time_ms=coalesce(response_time_ms, case(match(raw_latency, "µs$"), tonumber(replace(raw_latency, "µs", ""))/1000, match(raw_latency, "ms$"), tonumber(replace(raw_latency, "ms", "")), match(raw_latency, "s$"), tonumber(replace(raw_latency, "s", ""))*1000)) + + | where isnotnull(src) AND isnotnull(uri_path) + + | bin _time span=5m + + | stats count as total_requests + dc(uri_path) as distinct_endpoints + count(eval(http_method="HEAD")) as head_requests + values(uri_path) as endpoints + values(http_method) as methods + values(http_response_code) as status_codes + by _time src host + + | where total_requests > 120 AND (distinct_endpoints >= 3 OR (distinct_endpoints >= 2 AND head_requests > 0)) + + | eval severity="medium" + | eval attack_type="API Activity Surge" + + | table _time host src total_requests + distinct_endpoints endpoints methods + status_codes severity attack_type + + | `ollama_possible_api_endpoint_scan_reconnaissance_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate web application clients or mobile apps that access multiple API endpoints as part of normal functionality, monitoring and health check systems probing various endpoints for availability, load balancers performing health checks across different paths, API testing frameworks during development and QA processes, or users navigating through web interfaces that trigger multiple API calls may generate similar patterns during normal operations. references: - https://github.com/rosplk/ta-ollama drilldown_searches: - name: View the detection results for - "$src$" - search: '%original_detection_search% | search "$src = "$src$"' + search: |- + %original_detection_search% + | search src="$src$" earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$src$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$src$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` earliest_offset: 7d latest_offset: "0" intermediate_findings: @@ -40,7 +71,7 @@ intermediate_findings: - field: src type: system score: 20 - message: API reconnaissance activity detected from $src$ on $host$ with $total_requests$ requests across different endpoints using methods $methods$ and receiving status codes $status_codes$, indicating systematic endpoint enumeration to map API attack surface and identify potential vulnerabilities. + message: 'Possible API reconnaissance from [$src$] on [$host$] with [$total_requests$] requests across [$distinct_endpoints$] endpoints ([$endpoints$]) using methods [$methods$] and receiving status codes [$status_codes$].' analytic_story: - Suspicious Ollama Activities asset_type: Web Application @@ -58,5 +89,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml b/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml index 6b9e2b38cbc..a124408fcbb 100644 --- a/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml +++ b/detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml @@ -1,26 +1,70 @@ name: Ollama Possible Memory Exhaustion Resource Abuse id: ca96297f-e82e-4749-8cc9-d1ab555abb57 -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' -author: Rod Soto -status: experimental +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production type: Anomaly -description: Detects abnormal memory allocation patterns and excessive runner operations in Ollama that may indicate resource exhaustion attacks, memory abuse through malicious model loading, or attempts to degrade system performance by overwhelming GPU/CPU resources. Adversaries may deliberately load multiple large models, trigger repeated model initialization cycles, or exploit memory allocation mechanisms to exhaust available system resources, causing denial of service conditions or degrading performance for legitimate users. +description: |- + Identifies high Ollama runner counts and large model buffer allocations as possible resource pressure indicators. Memory values vary with model size and hardware, and these operational logs do not establish malicious intent; validate against host capacity and workload baselines. data_source: - Ollama Server -search: '`ollama_server` ("*llama_kv_cache*" OR "*compute buffer*" OR "*llama runner started*" OR "*loaded runners*") | rex field=_raw "count=(?\d+)" | rex field=_raw "size\s*=\s*(?[\d\.]+)\s+MiB" | rex field=_raw "started in\s*(?[\d\.]+)\s*seconds" | rex field=_raw "source=(?[^\s]+)" | bin _time span=5m | stats count as operations, sum(runner_count) as total_runners, dc(code_source) as unique_sources, values(code_source) as code_sources, avg(memory_mb) as avg_memory, max(memory_mb) as max_memory, sum(memory_mb) as total_memory, avg(load_time) as avg_load_time, max(load_time) as max_load_time by _time, host | where operations > 5 OR total_runners > 0 OR max_memory > 400 OR total_memory > 500 | eval avg_memory=round(avg_memory, 2) | eval max_memory=round(max_memory, 2) | eval total_memory=round(total_memory, 2) | eval avg_load_time=round(avg_load_time, 2) | eval severity=case( max_memory > 500 OR total_memory > 1000, "critical", max_memory > 400 OR operations > 20, "high", operations > 10, "medium", 1=1, "low" ) | eval attack_type="Resource Exhaustion / Memory Abuse" | sort -_time | table _time, host, operations, total_runners, unique_sources, avg_memory, max_memory, total_memory, avg_load_time, max_load_time, severity, attack_type | `ollama_possible_memory_exhaustion_resource_abuse_filter`' -how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.' -known_false_positives: Legitimate high-volume production workloads processing multiple concurrent requests, users loading large language models (7B+ parameters) that naturally require substantial memory allocation, simultaneous multi-model deployments during system scaling, batch processing operations, or initial system startup sequences may generate similar memory allocation patterns during normal operations. +search: |- + `ollama_server` + ("*llama_kv_cache*" OR "*compute buffer*" OR "*llama runner started*" OR "*loaded runners*") + + | rex field=_raw "count=(?\d+)" + | rex field=_raw "(?[\d\.]+)\s+MiB" + | rex field=_raw "started in\s*(?[\d\.]+)\s*seconds" + | rex field=_raw "source=(?[^\s]+)" + + | bin _time span=5m + + | stats count as operations + avg(load_time) as avg_load_time + avg(memory_mb) as avg_memory + dc(code_source) as unique_sources + max(load_time) as max_load_time + max(memory_mb) as max_memory + max(runner_count) as peak_loaded_runners + values(code_source) as code_sources + by _time host + + | where operations > 10 OR peak_loaded_runners > 5 OR max_memory > 400 + + | eval avg_memory=round(avg_memory, 2) + | eval max_memory=round(max_memory, 2) + | eval avg_load_time=round(avg_load_time, 2) + | eval max_load_time=round(max_load_time, 2) + | eval severity=case(peak_loaded_runners > 10, "critical", peak_loaded_runners > 5 OR operations > 20, "high", max_memory > 400 OR operations > 10, "medium", 1=1, "low") + | eval attack_type="Resource Pressure / Memory Allocation" + + | table _time host operations peak_loaded_runners + unique_sources avg_memory max_memory + avg_load_time max_load_time severity attack_type + + | `ollama_possible_memory_exhaustion_resource_abuse_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Legitimate high-volume production workloads processing multiple concurrent requests, users loading large language models (7B+ parameters) that naturally require substantial memory allocation, simultaneous multi-model deployments during system scaling, batch processing operations, or initial system startup sequences may generate similar memory allocation patterns during normal operations. references: - https://github.com/rosplk/ta-ollama drilldown_searches: - name: View the detection results for - "$host$" - search: '%original_detection_search% | search "$host = "$host$"' + search: |- + %original_detection_search% + | search host="$host$" earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$host$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$host$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` earliest_offset: 7d latest_offset: "0" intermediate_findings: @@ -28,7 +72,7 @@ intermediate_findings: - field: host type: system score: 20 - message: Potential resource exhaustion attack detected on $host$ with $operations$ memory operations in 5 minutes, utilizing $max_memory$ MiB peak memory and $total_runners$ runners, indicating possible attempts to exhaust system resources through excessive model loading or memory abuse. + message: 'Ollama resource pressure indicators on [$host$]: [$peak_loaded_runners$] peak loaded runners and [$max_memory$] MiB largest observed buffer across [$operations$] log events in 5 minutes. Compare with expected workloads before escalation.' analytic_story: - Suspicious Ollama Activities asset_type: Web Application @@ -46,5 +90,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit diff --git a/detections/application/ollama_repeated_application_errors.yml b/detections/application/ollama_repeated_application_errors.yml new file mode 100644 index 00000000000..0dd0538dec1 --- /dev/null +++ b/detections/application/ollama_repeated_application_errors.yml @@ -0,0 +1,85 @@ +name: Ollama Repeated Application Errors +id: e0fff27e-ee9b-4b8d-b247-f93a93cefa71 +version: 1 +creation_date: '2026-10-09' +modification_date: '2026-10-09' +author: Rod Soto, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: |- + Detects repeated Ollama application error events as a possible availability issue. Ollama application logs do not reliably record process termination, so this search cannot confirm a service crash without operating system or service manager telemetry. +data_source: + - Ollama Server +search: |- + `ollama_server` + (level=ERROR OR level=FATAL) + + | rex field=_raw "msg=\"(?[^\"]+)\"" + | rex field=_raw "exit_code=(?\d+)" + + | bin _time span=5m + + | stats count as error_count + earliest(_time) as first_seen + latest(_time) as last_seen + values(msg) as error_messages + values(exit_code) as exit_codes + dc(msg) as unique_errors + by _time host + + | where error_count > 1 + + | eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S") + | eval last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S") + | eval severity=case(error_count > 5, "critical", error_count > 2, "high", 1=1, "medium") + | eval attack_type="Repeated Ollama Application Errors" + + | table first_seen last_seen host error_count + unique_errors error_messages severity attack_type + + | `ollama_repeated_application_errors_filter` +how_to_implement: |- + Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections. +known_false_positives: |- + Recoverable model load failures, temporary registry or network errors, resource constraints, and other repeated application errors may trigger this exploratory signal without causing a service outage. +references: + - https://github.com/rosplk/ta-ollama +drilldown_searches: + - name: View the detection results for - "$host$" + search: |- + %original_detection_search% + | search host="$host$" + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$host$" + search: |- + from datamodel Risk.All_Risk + | search normalized_risk_object IN ("$host$") + | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: host + type: system + score: 20 + message: 'Repeated Ollama application errors detected on host [$host$] between [$first_seen$] and [$last_seen$]: [$error_count$] events and [$unique_errors$] unique error types. Correlate with service manager logs to determine whether availability was affected. Error messages: [$error_messages$].' +analytic_story: + - Suspicious Ollama Activities +asset_type: Web Application +mitre_attack_id: [] +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: application +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log + sourcetype: ollama:server + source: app.log + test_type: unit diff --git a/detections/application/pingid_new_mfa_method_after_credential_reset.yml b/detections/application/pingid_new_mfa_method_after_credential_reset.yml index 534ffc8cb25..7b0097d43ca 100644 --- a/detections/application/pingid_new_mfa_method_after_credential_reset.yml +++ b/detections/application/pingid_new_mfa_method_after_credential_reset.yml @@ -1,17 +1,57 @@ name: PingID New MFA Method After Credential Reset id: 2fcbce12-cffa-4c84-b70c-192604d201d0 -version: 9 +version: 10 creation_date: '2023-12-20' -modification_date: '2026-05-13' +modification_date: '2026-09-29' author: Steven Dick status: production type: TTP -description: The following analytic identifies the provisioning of a new MFA device shortly after a password reset. It detects this activity by correlating Windows Event Log events for password changes (EventID 4723, 4724) with PingID logs indicating device pairing. This behavior is significant as it may indicate a social engineering attack where a threat actor impersonates a valid user to reset credentials and add a new MFA device. If confirmed malicious, this activity could allow an attacker to gain persistent access to the compromised account, bypassing traditional security measures. +description: |- + The following analytic identifies the provisioning of a new MFA device shortly after a password reset. It detects this activity by correlating Windows Event Log events for password changes + (EventID 4723, 4724) with PingID logs indicating device pairing. This behavior is significant as it may indicate a social engineering attack where a threat actor impersonates a valid user + to reset credentials and add a new MFA device. If confirmed malicious, this activity could allow an attacker to gain persistent access to the compromised account, bypassing traditional security measures. data_source: - PingID -search: "`pingid` \"result.message\" = \"*Device Paired*\" | rex field=result.message \"Device (Unp)?(P)?aired (?.+)\" | eval src = coalesce('resources{}.ipaddress','resources{}.devicemodel'), user = upper('actors{}.name'), reason = 'result.message' | eval object=CASE(ISNOTNULL('resources{}.devicemodel'),'resources{}.devicemodel',true(),device_extract) | eval action=CASE(match('result.message',\"Device Paired*\"),\"created\",match('result.message', \"Device Unpaired*\"),\"deleted\") | stats count min(_time) as firstTime, max(_time) as lastTime, values(reason) as reason by src,user,action,object | join type=outer user [| search `wineventlog_security` EventID IN(4723,4724) | eval PW_Change_Time = _time, user = upper(user) | fields user,src_user,EventID,PW_Change_Time] | eval timeDiffRaw = round(lastTime - PW_Change_Time) | eval timeDiff = replace(tostring(abs(timeDiffRaw) ,\"duration\"),\"(\\d*)\\+*(\\d+):(\\d+):(\\d+)\",\"\\2 hours \\3 minutes\") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `security_content_ctime(PW_Change_Time)` | where timeDiffRaw > 0 AND timeDiffRaw < 3600 | `pingid_new_mfa_method_after_credential_reset_filter`" -how_to_implement: Target environment must ingest Windows Event Log and PingID(PingOne) data sources. Specifically from logs from Active Directory Domain Controllers and JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription. -known_false_positives: False positives may be generated by normal provisioning workflows that generate a password reset followed by a device registration. +search: | + `pingid` + "result.message" = "*Device Paired*" + + | rex field=result.message "Device (Unp)?(P)?aired (?.+)" + | eval src = coalesce('resources{}.ipaddress','resources{}.devicemodel') + + | eval user = upper('actors{}.name') + | eval reason = 'result.message' + | eval object=CASE(ISNOTNULL('resources{}.devicemodel'),'resources{}.devicemodel',true(),device_extract) + | eval action=CASE(match('result.message',"Device Paired*"),"created",match('result.message', "Device Unpaired*"),"deleted") + + | stats count min(_time) as firstTime, max(_time) as lastTime, values(reason) as reason by src,user,action,object + + ```Standardizes user field by removing NetBIOS and email from reported user name``` + + | eval join_user = replace(user, "^[^\x5c]*\x5c|@.*$", "") + | join type=outer max=0 join_user [ + | search `wineventlog_security` EventID IN(4723,4724) + | eval PW_Change_Time = _time + ```Standardizes user field by removing NetBIOS and email from reported user name``` + | eval join_user = replace(upper(user), "^[^\x5c]*\x5c|@.*$", "") + | fields join_user,src_user,EventID,PW_Change_Time + ] + + | eval timeDiffRaw = round(lastTime - PW_Change_Time) + | eval timeDiff = replace(tostring(abs(timeDiffRaw) ,"duration"),"(\d*)\+*(\d+):(\d+):(\d+)","\2 hours \3 minutes") + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `security_content_ctime(PW_Change_Time)` + + | where timeDiffRaw > 0 AND timeDiffRaw < 3600 + | dedup src, user, action, object, lastTime sortby +timeDiffRaw + | fields - join_user + + | `pingid_new_mfa_method_after_credential_reset_filter` +how_to_implement: |- + Target environment must ingest Windows Event Log and PingID(PingOne) data sources. Specifically from logs from Active Directory Domain Controllers and JSON logging from a PingID(PingOne) enterprise environment, either via Webhook or Push Subscription. +known_false_positives: |- + False positives may be generated by normal provisioning workflows that generate a password reset followed by a device registration. references: - https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/defend-your-users-from-mfa-fatigue-attacks/ba-p/2365677 - https://www.bleepingcomputer.com/news/security/mfa-fatigue-hackers-new-favorite-tactic-in-high-profile-breaches/ @@ -28,11 +68,12 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: An MFA configuration change was detected for [$user$] within [$timeDiff$] of a password reset. The device [$object$] was $action$. + title: An MFA configuration change was detected for [$user$] within [$timeDiff$] of a password reset. The device [$object$] was [$action$]. entity: field: user type: user score: 50 +threat_objects: [] analytic_story: - Compromised User Account - Scattered Lapsus$ Hunters @@ -57,3 +98,12 @@ tests: source: PINGID sourcetype: _json test_type: unit + - name: True Positive Test - UPN usernames and multiple resets + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/windows_pw_reset_upn_multi_reset.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/pingid/pingid_upn_multi_reset.log + source: PINGID + sourcetype: _json + test_type: unit diff --git a/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml b/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml index 404144c034e..6831869df1e 100644 --- a/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml +++ b/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml @@ -1,27 +1,47 @@ name: ASL AWS ECR Container Upload Unknown User id: 886a8f46-d7e2-4439-b9ba-aec238e31732 -version: 12 +version: 13 creation_date: '2024-05-22' modification_date: '2026-05-13' author: Patrick Bareiss, Splunk status: production type: Anomaly -description: The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events. It identifies instances where a new container is uploaded by a user not previously recognized as authorized. This detection is crucial for a SOC as it can indicate a potential compromise or misuse of AWS ECR, which could lead to unauthorized access to sensitive data or the deployment of malicious containers. By identifying and investigating these events, organizations can mitigate the risk of data breaches or other security incidents resulting from unauthorized container uploads. The impact of such an attack could be significant, compromising the integrity and security of the organization's cloud environment. +description: |- + The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events. + It identifies instances where a new container is uploaded by a user not previously recognized as authorized. data_source: - ASL AWS CloudTrail search: |- - `amazon_security_lake` api.operation=PutImage NOT `aws_ecr_users_asl` - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY actor.user.uid api.operation api.service.name - http_request.user_agent src_endpoint.ip actor.user.account.uid - cloud.provider cloud.region - | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `asl_aws_ecr_container_upload_unknown_user_filter` -how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App. -known_false_positives: No false positives have been identified at this time. + `amazon_security_lake` + api.operation=PutImage + NOT `aws_ecr_users_asl` + + | fillnull + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by actor.user.uid api.operation api.service.name + http_request.user_agent + src_endpoint.ip actor.user.account.uid + cloud.provider cloud.region + + | rename actor.user.account.uid as vendor_account + actor.user.uid as user + api.operation as action + api.service.name as dest + cloud.provider as vendor_product + cloud.region as vendor_region + http_request.user_agent as user_agent + src_endpoint.ip as src + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `asl_aws_ecr_container_upload_unknown_user_filter` +how_to_implement: |- + The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App. +known_false_positives: |- + No false positives have been identified at this time. references: - https://attack.mitre.org/techniques/T1204/003/ drilldown_searches: @@ -38,7 +58,7 @@ intermediate_findings: - field: user type: user score: 20 - message: Container uploaded from unknown user $user$ + message: Container uploaded from unknown user [$user$]. threat_objects: - field: src type: ip_address diff --git a/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml b/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml index 80d1f91370f..7ac29c4a6b5 100644 --- a/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml +++ b/detections/cloud/azure_ad_oauth_application_consent_granted_by_user.yml @@ -1,17 +1,42 @@ name: Azure AD OAuth Application Consent Granted By User id: 10ec9031-015b-4617-b453-c0c1ab729007 -version: 11 +version: 12 creation_date: '2023-11-16' -modification_date: '2026-05-13' +modification_date: '2026-09-24' author: Mauricio Velazco, Splunk status: production type: TTP -description: The following analytic detects when a user in an Azure AD environment grants consent to an OAuth application. It leverages Azure AD audit logs to identify events where users approve application consents. This activity is significant as it can expose organizational data to third-party applications, a common tactic used by malicious actors to gain unauthorized access. If confirmed malicious, this could lead to unauthorized access to sensitive information and resources. Immediate investigation is required to validate the application's legitimacy, review permissions, and mitigate potential risks. +description: |- + The following analytic detects when a user in an Azure AD environment grants consent to an OAuth application. It leverages Azure AD audit logs to identify events where users approve application consents. + This activity is significant as it can expose organizational data to third-party applications, a common tactic used by malicious actors to gain unauthorized access. + If confirmed malicious, this could lead to unauthorized access to sensitive information and resources. Immediate investigation is required to validate the application's legitimacy, review permissions, and mitigate potential risks. data_source: - Azure Active Directory Consent to application -search: "`azure_monitor_aad` operationName=\"Consent to application\" properties.result=success | rename properties.* as * | eval permissions_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Permissions\") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Permissions\"), -1) | eval permissions = mvindex('targetResources{}.modifiedProperties{}.newValue',permissions_index) | rex field=permissions \"Scope: (? [ ^,]+)\" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product Scope signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_oauth_application_consent_granted_by_user_filter`" -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category. -known_false_positives: False positives may occur if users are granting consents as part of legitimate application integrations or setups. It is crucial to review the application and the permissions it requests to ensure they align with organizational policies and security best practices. +search: |- + `azure_monitor_aad` + operationName="Consent to application" + properties.result=success + + | rename properties.* as * + + | eval permissions_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions"), -1) + | eval permissions = mvindex('targetResources{}.modifiedProperties{}.newValue',permissions_index) + | rex field=permissions "Scope: (?[^,]+)" + + | fillnull + + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest user src vendor_account vendor_product Scope signature + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `azure_ad_oauth_application_consent_granted_by_user_filter` +how_to_implement: |- + You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category. +known_false_positives: |- + False positives may occur if users are granting consents as part of legitimate application integrations or setups. + It is crucial to review the application and the permissions it requests to ensure they align with organizational policies and security best practices. references: - https://attack.mitre.org/techniques/T1528/ - https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/ diff --git a/detections/cloud/azure_ad_privileged_role_assigned.yml b/detections/cloud/azure_ad_privileged_role_assigned.yml index d352b47e158..29ccd68bf85 100644 --- a/detections/cloud/azure_ad_privileged_role_assigned.yml +++ b/detections/cloud/azure_ad_privileged_role_assigned.yml @@ -1,8 +1,8 @@ name: Azure AD Privileged Role Assigned id: a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a -version: 16 +version: 17 creation_date: '2022-08-29' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP @@ -20,7 +20,7 @@ search: |- BY dest user src vendor_account vendor_product initiatedBy result role signature - | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description + | lookup local=t privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description | search isprvilegedadrole = True | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml index 7064e4b1e2c..9640b9bc5d6 100644 --- a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml +++ b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml @@ -1,8 +1,8 @@ name: Azure AD Privileged Role Assigned to Service Principal id: 5dfaa3d3-e2e4-4053-8252-16d9ee528c41 -version: 14 +version: 15 creation_date: '2023-04-28' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Mauricio Velazco, Splunk status: production type: TTP @@ -24,7 +24,7 @@ search: |- vendor_account vendor_product displayName initiatedBy result role signature - | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description + | lookup local=t privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description | search isprvilegedadrole = True | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml b/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml index 33466bc2234..34fb99e3aed 100644 --- a/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml +++ b/detections/cloud/azure_ad_user_consent_blocked_for_risky_application.yml @@ -1,17 +1,44 @@ name: Azure AD User Consent Blocked for Risky Application id: 06b8ec9a-d3b5-4882-8f16-04b4d10f5eab -version: 11 +version: 12 creation_date: '2023-11-16' -modification_date: '2026-05-13' +modification_date: '2026-09-24' author: Mauricio Velazco, Splunk status: production type: TTP -description: The following analytic detects instances where Azure AD has blocked a user's attempt to grant consent to a risky or potentially malicious application. This detection leverages Azure AD audit logs, focusing on user consent actions and system-driven blocks. Monitoring these blocked consent attempts is crucial as it highlights potential threats early on, indicating that a user might be targeted or that malicious applications are attempting to infiltrate the organization. If confirmed malicious, this activity suggests that Azure's security measures successfully prevented a harmful application from accessing organizational data, warranting immediate investigation to understand the context and take preventive measures. +description: |- + The following analytic detects instances where Azure AD has blocked a user's attempt to grant consent to a risky or potentially malicious application. + This detection leverages Azure AD audit logs, focusing on user consent actions and system-driven blocks. + Monitoring these blocked consent attempts is crucial as it highlights potential threats early on, indicating that a user might be targeted or that malicious applications are attempting to infiltrate the organization. + If confirmed malicious, this activity suggests that Azure's security measures successfully prevented a harmful application from accessing organizational data, warranting immediate investigation to understand the context and take preventive measures. data_source: - Azure Active Directory Consent to application -search: "`azure_monitor_aad` operationName=\"Consent to application\" properties.result=failure | rename properties.* as * | eval reason_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Reason\") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Reason\"), -1) | eval permissions_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Permissions\") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', \"ConsentAction.Permissions\"), -1) | search reason_index >= 0 | eval reason = mvindex('targetResources{}.modifiedProperties{}.newValue',reason_index) | eval permissions = mvindex('targetResources{}.modifiedProperties{}.newValue',permissions_index) | search reason = \"\\\"Risky application detected\\\"\" | rex field=permissions \"Scope: (? [ ^,]+)\" | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product reason Scope signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_user_consent_blocked_for_risky_application_filter`" -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category. -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +search: |- + `azure_monitor_aad` + operationName="Consent to application" + properties.result=failure + + | rename properties.* as * + + | eval reason_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Reason") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Reason"), -1) + | eval permissions_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions"), -1) + | search reason_index >= 0 + | eval reason = mvindex('targetResources{}.modifiedProperties{}.newValue',reason_index) | eval permissions = mvindex('targetResources{}.modifiedProperties{}.newValue',permissions_index) + | search reason = "\"Risky application detected\"" + | rex field=permissions "Scope: (?[^,]+)" + | fillnull + + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest user src vendor_account vendor_product reason Scope signature + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `azure_ad_user_consent_blocked_for_risky_application_filter` +how_to_implement: |- + You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category. +known_false_positives: |- + No false positives have been identified at this time. references: - https://attack.mitre.org/techniques/T1528/ - https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/ diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index eacd8e6352b..ddd55187d0a 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -1,8 +1,8 @@ name: Cloud API Calls From Previously Unseen User Roles id: 2181ad1f-1e73-4d0c-9780-e8880482a08f -version: 11 +version: 12 creation_date: '2020-10-27' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Splunk status: production type: Anomaly @@ -16,7 +16,7 @@ search: |- All_Changes.status=success BY All_Changes.user, All_Changes.command All_Changes.object | `drop_dm_object_name("All_Changes")` - | lookup previously_seen_cloud_api_calls_per_user_role user as user, command as command OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_api_calls_per_user_role user as user, command as command OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUserApiCall=min(firstTimeSeen) diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index c6b2f67045d..223a8926b2e 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -1,8 +1,8 @@ name: Cloud Compute Instance Created By Previously Unseen User id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149 -version: 12 +version: 13 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Splunk status: production type: Anomaly @@ -14,7 +14,7 @@ search: |- WHERE All_Changes.action=created BY All_Changes.user All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` - | lookup previously_seen_cloud_compute_creations_by_user user as user OUTPUTNEW firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_compute_creations_by_user user as user OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUser=min(firstTimeSeen) diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml index 1e909aad75e..9d8da86c8ea 100644 --- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml +++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml @@ -1,8 +1,8 @@ name: Cloud Compute Instance Created In Previously Unused Region id: fa4089e2-50e3-40f7-8469-d2cc1564ca59 -version: 10 +version: 11 creation_date: '2020-11-30' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Splunk status: production type: Anomaly @@ -14,7 +14,7 @@ search: |- WHERE All_Changes.action=created BY All_Changes.vendor_region, All_Changes.user | `drop_dm_object_name("All_Changes")` - | lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index acb3a1e5c8e..98bcc0d7b31 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -1,8 +1,8 @@ name: Cloud Compute Instance Created With Previously Unseen Image id: bc24922d-987c-4645-b288-f8c73ec194c4 -version: 10 +version: 11 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Splunk status: production type: Anomaly @@ -16,7 +16,7 @@ search: |- | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" - | lookup previously_seen_cloud_compute_images image_id as image_id OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_compute_images image_id as image_id OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenImage=min(firstTimeSeen) diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index 3ff282b40bd..d6277404767 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -1,8 +1,8 @@ name: Cloud Compute Instance Created With Previously Unseen Instance Type id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda -version: 11 +version: 12 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Splunk status: production type: Anomaly @@ -26,7 +26,7 @@ search: |- | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where instance_type != "unknown" - | lookup previously_seen_cloud_compute_instance_types instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_compute_instance_types instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenInstanceType=min(firstTimeSeen) diff --git a/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml index 9a90486c1b6..2ff5d407c10 100644 --- a/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml @@ -1,8 +1,8 @@ name: Cloud Instance Modified By Previously Unseen User id: 7fb15084-b14e-405a-bd61-a6de15a40722 -version: 12 +version: 13 creation_date: '2020-11-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Splunk status: production type: Anomaly @@ -14,7 +14,7 @@ search: |- WHERE All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success BY All_Changes.user | `drop_dm_object_name("All_Changes")` - | lookup previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUser=min(firstTimeSeen) diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml index 19fb7fd7ce3..986561019d7 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml @@ -1,8 +1,8 @@ name: Cloud Provisioning Activity From Previously Unseen City id: e7ecc5e0-88df-48b9-91af-51104c68f02f -version: 9 +version: 10 creation_date: '2020-11-30' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Bhavin Patel, Splunk status: production type: Anomaly @@ -22,7 +22,7 @@ search: |- | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(City) - | lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenCity=min(firstTimeSeen) diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml index b88a2410262..a59431fb49a 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml @@ -1,8 +1,8 @@ name: Cloud Provisioning Activity From Previously Unseen Country id: 94994255-3acf-4213-9b3f-0494df03bb31 -version: 9 +version: 10 creation_date: '2020-12-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Bhavin Patel, Splunk status: production type: Anomaly @@ -22,7 +22,7 @@ search: |- | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) - | lookup previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenCountry=min(firstTimeSeen) diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml index c66d7cbe66a..94db84a678f 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml @@ -1,8 +1,8 @@ name: Cloud Provisioning Activity From Previously Unseen IP Address id: f86a8ec9-b042-45eb-92f4-e9ed1d781078 -version: 9 +version: 10 creation_date: '2020-11-30' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Splunk status: production type: Anomaly @@ -19,7 +19,7 @@ search: |- All_Changes.status=success BY All_Changes.src, All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` - | lookup previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) diff --git a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml index 68b6adb810e..ecd39cf37de 100644 --- a/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml +++ b/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml @@ -1,8 +1,8 @@ name: Cloud Provisioning Activity From Previously Unseen Region id: 5aba1860-9617-4af9-b19d-aecac16fe4f2 -version: 9 +version: 10 creation_date: '2020-10-26' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Bhavin Patel, Splunk status: production type: Anomaly @@ -22,7 +22,7 @@ search: |- | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Region) - | lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT firstTimeSeen, enough_data + | lookup local=t previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index 55cad130737..6f54d9dce32 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -1,29 +1,85 @@ name: Detect New Open S3 Buckets over AWS CLI id: 39c61d09-8b30-4154-922b-2d0a694ecc22 -version: 10 +version: 11 creation_date: '2021-01-12' modification_date: '2026-05-13' -author: Patrick Bareiss, Splunk +author: Patrick Bareiss, Splunk, vshcherbakov status: production type: TTP -description: The following analytic detects the creation of open/public S3 buckets via the AWS CLI. It leverages AWS CloudTrail logs to identify events where a user has set bucket permissions to allow access to "AuthenticatedUsers" or "AllUsers." This activity is significant because open S3 buckets can expose sensitive data to unauthorized users, leading to data breaches. If confirmed malicious, an attacker could gain unauthorized access to potentially sensitive information stored in the S3 bucket, posing a significant security risk. +description: |- + The following analytic detects the creation of open/public S3 buckets via the AWS CLI. + It leverages AWS CloudTrail logs to identify events where a user has set bucket permissions to allow access to "AuthenticatedUsers" or "AllUsers." This activity is significant because open S3 buckets can expose sensitive data to unauthorized users, leading to data breaches. + If confirmed malicious, an attacker could gain unauthorized access to potentially sensitive information stored in the S3 bucket, posing a significant security risk. data_source: - AWS CloudTrail search: |- - `cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") - | rename requestParameters.bucketName AS bucketName - | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime - BY userIdentity.userName userIdentity.principalId userAgent - bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp - requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control - | rename userIdentity.userName as user - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `detect_new_open_s3_buckets_over_aws_cli_filter` -how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. -known_false_positives: While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. -references: [] + `cloudtrail` + eventSource="s3.amazonaws.com" + eventName="PutBucketAcl" + errorCode=success + userAgent IN ("[aws-cli*", "aws-cli*") + + | rename requestParameters.bucketName AS bucketName + requestParameters.accessControlList.x-amz-grant-read AS grantRead + requestParameters.accessControlList.x-amz-grant-read-acp AS grantReadAcp + requestParameters.accessControlList.x-amz-grant-write AS grantWrite + requestParameters.accessControlList.x-amz-grant-write-acp AS grantWriteAcp + requestParameters.accessControlList.x-amz-grant-full-control AS grantFullControl + requestParameters.x-amz-acl AS cannedAcl, + userIdentity.principalId AS principalId + userIdentity.userName AS userName + userIdentity.arn AS userArn + + | eval grantRead=coalesce(grantRead,"-"), + grantReadAcp=coalesce(grantReadAcp,"-"), + grantWrite=coalesce(grantWrite,"-"), + grantWriteAcp=coalesce(grantWriteAcp,"-"), + grantFullControl=coalesce(grantFullControl,"-"), + cannedAcl=coalesce(cannedAcl,"-"), + user=coalesce(userName,userArn) + + | eval publicGrant = if( + match(grantRead, "(?i)AllUsers|AuthenticatedUsers") + OR + match(grantReadAcp, "(?i)AllUsers|AuthenticatedUsers") + OR + match(grantWrite, "(?i)AllUsers|AuthenticatedUsers") + OR + match(grantWriteAcp, "(?i)AllUsers|AuthenticatedUsers") + OR + match(grantFullControl, "(?i)AllUsers|AuthenticatedUsers"), + 1, + 0 + ) + + | eval publicCanned = if(cannedAcl IN ("public-read", "public-read-write", "authenticated-read"), 1, 0) + + | where publicGrant=1 OR publicCanned=1 + + | eval exposure=case(cannedAcl=="public-read-write","public-write", match(grantWrite."".grantWriteAcp."".grantFullControl,"(?i)AllUsers"),"public-write", cannedAcl=="public-read" OR match(grantRead,"(?i)AllUsers"),"public-read", cannedAcl=="authenticated-read" OR match(grantRead,"(?i)AuthenticatedUsers"),"authenticated-read", true(),"custom-grant") + + | stats count + min(_time) AS firstTime + max(_time) AS lastTime + values(cannedAcl) AS cannedAcl + values(grantRead) AS grantRead + values(grantReadAcp) AS grantReadAcp + values(grantWrite) AS grantWrite + values(grantWriteAcp) AS grantWriteAcp + values(grantFullControl) AS grantFullControl + values(eventName) AS eventName + + BY user principalId userAgent bucketName exposure + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `detect_new_open_s3_buckets_over_aws_cli_filter` +how_to_implement: |- + The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. +known_false_positives: |- + It is possible that an AWS admin has legitimately created a public bucket for a specific purpose. AWS strongly advises against granting full control to the "All Users" group. Investigate and apply the necessary filters as needed. +references: + - https://docs.aws.amazon.com/cli/latest/reference/s3api/create-bucket.html drilldown_searches: - name: View the detection results for - "$user$" search: '%original_detection_search% | search user = "$user$"' @@ -34,11 +90,14 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: User $user$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$ + title: User [$user$] has created an open/public S3 Bucket [$bucketName$] using AWS CLI with the following permissions - [$grantRead$] [$grantReadAcp$] [$grantWrite$] [$grantWriteAcp$] [$grantFullControl$] [$cannedAcl$] entity: field: user type: user score: 50 +threat_objects: + - field: bucketName + type: bucket_name analytic_story: - Suspicious AWS S3 Activities asset_type: S3 Bucket diff --git a/detections/cloud/kubernetes_nginx_ingress_lfi.yml b/detections/cloud/kubernetes_nginx_ingress_lfi.yml index 93c1f49678b..0cc3b3e3437 100644 --- a/detections/cloud/kubernetes_nginx_ingress_lfi.yml +++ b/detections/cloud/kubernetes_nginx_ingress_lfi.yml @@ -1,14 +1,14 @@ name: Kubernetes Nginx Ingress LFI id: 0f83244b-425b-4528-83db-7a88c5f66e48 -version: 11 +version: 12 creation_date: '2021-08-23' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Patrick Bareiss, Splunk status: production type: TTP description: The following analytic detects local file inclusion (LFI) attacks targeting Kubernetes Nginx ingress controllers. It leverages Kubernetes logs, parsing fields such as `request` and `status` to identify suspicious patterns indicative of LFI attempts. This activity is significant because LFI attacks can allow attackers to read sensitive files from the server, potentially exposing critical information. If confirmed malicious, this could lead to unauthorized access to sensitive data, further exploitation, and potential compromise of the Kubernetes environment. data_source: [] -search: '`kubernetes_container_controller` | rex field=_raw "^(?\S+)\s+-\s+-\s+\[(?[^\]]*)\]\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\"(?[^\"]*)\"\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\[(?[^\]]*)\]\s\[(?[^\]]*)\]\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)" | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | rex field=request "^(?\S+)\s(?\S+)\s" | eval phase="operate" | eval severity="high" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, url, http_method, host, http_user_agent, proxy, phase, severity, request | lookup local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT lfi_path | search lfi_path=yes | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter`' +search: '`kubernetes_container_controller` | rex field=_raw "^(?\S+)\s+-\s+-\s+\[(?[^\]]*)\]\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\"(?[^\"]*)\"\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\[(?[^\]]*)\]\s\[(?[^\]]*)\]\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)" | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | rex field=request "^(?\S+)\s(?\S+)\s" | eval phase="operate" | eval severity="high" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, url, http_method, host, http_user_agent, proxy, phase, severity, request | lookup local=t local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT lfi_path | search lfi_path=yes | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter`' how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/cloud/o365_bec_email_hiding_rule_created.yml b/detections/cloud/o365_bec_email_hiding_rule_created.yml index 7887386766b..de038e494d2 100644 --- a/detections/cloud/o365_bec_email_hiding_rule_created.yml +++ b/detections/cloud/o365_bec_email_hiding_rule_created.yml @@ -1,8 +1,8 @@ name: O365 BEC Email Hiding Rule Created id: 603ebac2-f157-4df7-a6ac-34e8d0350f86 -version: 8 +version: 9 creation_date: '2025-02-14' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: '0xC0FFEEEE, Github Community' status: production type: TTP @@ -13,7 +13,7 @@ search: |- | stats min(_time) as firstTime, max(_time) as lastTime, values(Operation) as Operation, latest(Name) as Name, latest(MarkAsRead) as MarkAsRead, latest(MoveToFolder) as MoveToFolder by object_id user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup ut_shannon_lookup word as Name + | lookup local=t ut_shannon_lookup word as Name | eval entropy_score=if(ut_shannon<=2, 1, 0) | eval len_score=if(len(Name)<=3, 1,0) | eval read_score=if(MarkAsRead="True", 1, 0) diff --git a/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml b/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml index e48b35f375f..9b4d1e6d12c 100644 --- a/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml +++ b/detections/cloud/o365_email_password_and_payroll_compromise_behavior.yml @@ -1,12 +1,14 @@ name: O365 Email Password and Payroll Compromise Behavior id: e36de71a-6bdc-4002-98ff-e3e51b0d8f96 -version: 7 +version: 8 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick status: production type: TTP -description: The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period. This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account. +description: |- + The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period. + This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account. data_source: - Office 365 Universal Audit Log - Office 365 Reporting Message Trace @@ -14,8 +16,8 @@ search: |- `o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") | eval mailtime = _time | bin _time span=4hr - | eval user = lower(RecipientAddress) - | eval InternetMessageId = lower(MessageId) + | eval user = lower(recipient) + | eval InternetMessageId = lower(message_id) | join InternetMessageId, user max=0 [ | search `o365_management_activity` Workload=Exchange Operation IN ("SoftDelete","HardDelete") @@ -32,8 +34,10 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_password_and_payroll_compromise_behavior_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. -known_false_positives: No false positives have been identified at this time. +how_to_implement: |- + You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. +known_false_positives: |- + No false positives have been identified at this time. references: - https://attack.mitre.org/techniques/T1114/ - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf @@ -48,7 +52,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" - name: Investigate Email for $user$ - search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*password*","*passcode*") RecipientAddress = "$user$"' + search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*password*","*passcode*") recipient = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ finding: @@ -86,3 +90,12 @@ tests: source: o365_messagetrace sourcetype: o365:reporting:messagetrace test_type: unit + - name: True Positive Test - Graph message trace + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log + source: o365 + sourcetype: o365:management:activity + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + source: o365_messagetrace + sourcetype: o365:graph:messagetrace + test_type: unit diff --git a/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml b/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml index 5362379aa31..51c0ec9f307 100644 --- a/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml +++ b/detections/cloud/o365_email_receive_and_hard_delete_takeover_behavior.yml @@ -1,12 +1,14 @@ name: O365 Email Receive and Hard Delete Takeover Behavior id: b66aeaa4-586f-428b-8a2b-c4fd3039d8d3 -version: 6 +version: 7 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick status: production type: Anomaly -description: The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period. This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account. +description: |- + The following analytic identifies when an O365 email recipient receives and then deletes emails related to password or banking/payroll changes within a short period. + This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account. data_source: - Office 365 Universal Audit Log - Office 365 Reporting Message Trace @@ -14,8 +16,8 @@ search: |- `o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") | eval mailtime = _time | bin _time span=4hr - | eval user = lower(RecipientAddress) - | eval InternetMessageId = lower(MessageId) + | eval user = lower(recipient) + | eval InternetMessageId = lower(message_id) | join InternetMessageId, user max=0 [ | search `o365_management_activity` Workload=Exchange Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions") @@ -31,8 +33,10 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_receive_and_hard_delete_takeover_behavior_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. -known_false_positives: Possible new user/account onboarding processes. +how_to_implement: |- + You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. +known_false_positives: |- + Possible new user/account onboarding processes. references: - https://attack.mitre.org/techniques/T1114/ - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf @@ -47,7 +51,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" - name: Investigate Email for $user$ - search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") AND RecipientAddress = "$user$"' + search: '`o365_messagetrace` subject IN ("*banking*","*direct deposit*","*pay-to*","*password *","*passcode *","*OTP *","*MFA *","*Account Recovery*") AND recipient = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ intermediate_findings: @@ -87,3 +91,12 @@ tests: source: o365_messagetrace sourcetype: o365:reporting:messagetrace test_type: unit + - name: True Positive Test - Graph message trace + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log + source: o365 + sourcetype: o365:management:activity + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + source: o365_messagetrace + sourcetype: o365:graph:messagetrace + test_type: unit diff --git a/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml b/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml index 5fc9037fee1..174bf25eb1c 100644 --- a/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml +++ b/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml @@ -1,21 +1,24 @@ name: O365 Email Send and Hard Delete Exfiltration Behavior id: dd7798cf-c4f5-4114-ad0f-beacd9a33708 -version: 6 +version: 7 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick status: production type: Anomaly -description: The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of exfiltration activity. This behavior is often seen when threat actors want to reduce the probability of detection by the compromised account owner. +description: |- + The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour). + This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of exfiltration activity. + This behavior is often seen when threat actors want to reduce the probability of detection by the compromised account owner. data_source: - Office 365 Universal Audit Log - Office 365 Reporting Message Trace search: |- - `o365_messagetrace` Status=Delivered + `o365_messagetrace` status_code=Delivered | eval mailtime = _time | bin _time span=1hr - | eval user = lower(SenderAddress), recipient = lower(RecipientAddress) - | eval InternetMessageId = lower(MessageId) + | eval user = lower(src_user), recipient = lower(recipient) + | eval InternetMessageId = lower(message_id) | join InternetMessageId, user, max=0 [ | search `o365_management_activity` Workload=Exchange (Operation IN ("Send*")) OR (Operation IN ("HardDelete") AND Folder.Path IN ("\\Sent Items","\\Recoverable Items\\Deletions")) @@ -26,14 +29,16 @@ search: |- | stats values(sender) as sender, values(ClientInfoString) as http_user_agent, values(InternetMessageId) as InternetMessageId, values(file_name) as file_name, sum(file_size) as file_size, values(sendtime) as firstTime, values(deltime) as lastTime values(Operation) as signature, dc(Operation) as opcount, count by _time,subject,user | where opcount > 1 AND firstTime < lastTime ] - | stats values(sender) as sender, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, sum(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime count by subject,user,recipient,Organization - | eval externalRecipient = if(match(lower(recipient),mvindex(split(lower(Organization),"."),0)),0,1) + | stats values(sender) as sender, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, sum(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime count by subject,user,recipient + | eval externalRecipient = if(mvindex(split(lower(recipient),"@"),1)==mvindex(split(lower(user),"@"),1),0,1) | where externalRecipient = 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_send_and_hard_delete_exfiltration_behavior_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. -known_false_positives: Users that habitually/proactively cleaning the recoverable items folder may trigger this alert. +how_to_implement: |- + You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. +known_false_positives: |- + Users that habitually/proactively cleaning the recoverable items folder may trigger this alert. references: - https://attack.mitre.org/techniques/T1114/ - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf @@ -90,3 +95,12 @@ tests: source: o365_messagetrace sourcetype: o365:reporting:messagetrace test_type: unit + - name: True Positive Test - Graph message trace + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log + source: o365 + sourcetype: o365:management:activity + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + source: o365_messagetrace + sourcetype: o365:graph:messagetrace + test_type: unit diff --git a/detections/cloud/o365_email_send_attachments_excessive_volume.yml b/detections/cloud/o365_email_send_attachments_excessive_volume.yml index 3842d035eed..1616e1a2701 100644 --- a/detections/cloud/o365_email_send_attachments_excessive_volume.yml +++ b/detections/cloud/o365_email_send_attachments_excessive_volume.yml @@ -1,20 +1,24 @@ name: O365 Email Send Attachments Excessive Volume id: 70a050a2-8537-488a-a628-b60a9558d96a -version: 6 +version: 7 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick status: production type: Anomaly -description: The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox. Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox. Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors. +description: |- + The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour). + This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox. + Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox. + Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors. data_source: - Office 365 Universal Audit Log search: |- - `o365_messagetrace` Status=Delivered + `o365_messagetrace` status_code=Delivered | eval mailtime = _time | bin _time span=1hr - | eval user = lower(SenderAddress), recipient = lower(RecipientAddress) - | eval InternetMessageId = lower(MessageId) + | eval user = lower(src_user), recipient = lower(recipient) + | eval InternetMessageId = lower(message_id) | join InternetMessageId, user, _time max=0 [ | search `o365_management_activity` Workload=Exchange Operation IN ("Send","SendAs","SendOnBehalf") @@ -27,14 +31,16 @@ search: |- | eval file_name = mvjoin(file_name,"||") ] | eval file_name = split(file_name,"||") - | stats values(sender) as sender, values(recipient) as recipient, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, max(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime max(count) as count by subject,user,Organization,InternetMessageId + | stats values(sender) as sender, values(recipient) as recipient, values(http_user_agent) as http_user_agent, values(signature) as signature, values(file_name) as file_name, max(file_size) as file_size, min(firstTime) as firstTime, max(lastTime) as lastTime max(count) as count by subject,user,InternetMessageId | eval recipient = mvmap(recipient, if(match(mvindex(split(lower(recipient),"@"),1),mvindex(split(lower(user),"@"),1)), null(),recipient)) | search recipient = * | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_email_send_attachments_excessive_volume_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. -known_false_positives: Users or processes that are send a large number of attachments may trigger this alert, adjust thresholds accordingly. +how_to_implement: |- + You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events AND Message Trace events. +known_false_positives: |- + Users or processes that are send a large number of attachments may trigger this alert, adjust thresholds accordingly. references: - https://attack.mitre.org/techniques/T1114/ - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf @@ -84,3 +90,12 @@ tests: source: o365_messagetrace sourcetype: o365:reporting:messagetrace test_type: unit + - name: True Positive Test - Graph message trace + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log + source: o365 + sourcetype: o365:management:activity + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log + source: o365_messagetrace + sourcetype: o365:graph:messagetrace + test_type: unit diff --git a/detections/cloud/o365_privileged_role_assigned.yml b/detections/cloud/o365_privileged_role_assigned.yml index 75a8eaf3254..f4680f055fe 100644 --- a/detections/cloud/o365_privileged_role_assigned.yml +++ b/detections/cloud/o365_privileged_role_assigned.yml @@ -1,15 +1,15 @@ name: O365 Privileged Role Assigned id: db435700-4ddc-4c23-892e-49e7525d7d39 -version: 11 +version: 12 creation_date: '2024-04-13' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP description: The following analytic identifies the assignment of sensitive and privileged Azure Active Directory roles to an Azure AD user. Adversaries and red teams alike may assign these roles to a compromised account to establish Persistence in an Azure AD environment. This detection leverages the O365 Universal Audit Log data source. data_source: - Office 365 Universal Audit Log -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature, vendor_account, vendor_product, dest | lookup privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category=\"User\" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_filter`" +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature, vendor_account, vendor_product, dest | lookup local=t privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category=\"User\" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Administrators will legitimately assign the privileged roles users as part of administrative tasks. Microsoft Privileged Identity Management (PIM) may cause false positives / less accurate alerting. references: diff --git a/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml b/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml index 3ccfbf7cbfd..ffeaa95712c 100644 --- a/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml +++ b/detections/cloud/o365_privileged_role_assigned_to_service_principal.yml @@ -1,15 +1,15 @@ name: O365 Privileged Role Assigned To Service Principal id: 80f3fc1b-705f-4080-bf08-f61bf013b900 -version: 11 +version: 12 creation_date: '2024-04-13' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP description: The following analytic detects potential privilege escalation threats in Azure Active Directory (AD). This detection is important because it identifies instances where privileged roles that hold elevated permissions are assigned to service principals. This prevents unauthorized access or malicious activities, which occur when these non-human entities access Azure resources to exploit them. False positives might occur since administrators can legitimately assign privileged roles to service principals. This detection leverages the O365 Universal Audit Log data source. data_source: - Office 365 Universal Audit Log -search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature,vendor_account, vendor_product, dest | lookup privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category!=\"User\" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_to_service_principal_filter`" +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature,vendor_account, vendor_product, dest | lookup local=t privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category!=\"User\" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_to_service_principal_filter`" how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Administrators may legitimately assign the privileged roles to Service Principals as part of administrative tasks. Filter as needed. references: diff --git a/detections/endpoint/child_processes_of_spoolsv_exe.yml b/detections/deprecated/child_processes_of_spoolsv_exe.yml similarity index 88% rename from detections/endpoint/child_processes_of_spoolsv_exe.yml rename to detections/deprecated/child_processes_of_spoolsv_exe.yml index 8dcc2901ae7..8caf4cabe3f 100644 --- a/detections/endpoint/child_processes_of_spoolsv_exe.yml +++ b/detections/deprecated/child_processes_of_spoolsv_exe.yml @@ -1,10 +1,10 @@ name: Child Processes of Spoolsv exe id: aa0c4aeb-5b18-41c4-8c07-f1442d7599df -version: 11 +version: 12 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Rico Valdez, Splunk -status: experimental +status: deprecated type: TTP description: The following analytic identifies child processes spawned by spoolsv.exe, the Print Spooler service in Windows, which typically runs with SYSTEM privileges. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. Monitoring this activity is crucial as it can indicate exploitation attempts, such as those associated with CVE-2018-8440, which can lead to privilege escalation. If confirmed malicious, attackers could gain SYSTEM-level access, allowing them to execute arbitrary code, escalate privileges, and potentially compromise the entire system. data_source: @@ -57,3 +57,9 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint +deprecation_info: + reason: |- + Deprecated because the broad parent-child logic generated substantial legitimate printer, driver, and print-management activity and did not directly detect the exploitation behavior associated with its CVE reference. + More specific Print Spooler behaviors are covered by existing production detections. + removed_in_version: 6.10.0 + replacement_content: [] diff --git a/detections/cloud/circle_ci_disable_security_job.yml b/detections/deprecated/circle_ci_disable_security_job.yml similarity index 89% rename from detections/cloud/circle_ci_disable_security_job.yml rename to detections/deprecated/circle_ci_disable_security_job.yml index 86c52cf751c..b93cd1860a7 100644 --- a/detections/cloud/circle_ci_disable_security_job.yml +++ b/detections/deprecated/circle_ci_disable_security_job.yml @@ -1,10 +1,10 @@ name: Circle CI Disable Security Job id: 4a2fdd41-c578-4cd4-9ef7-980e352517f2 -version: 10 +version: 12 creation_date: '2021-09-02' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Patrick Bareiss, Splunk -status: production +status: deprecated type: Anomaly description: The following analytic detects the disabling of security jobs in CircleCI pipelines. It leverages CircleCI log data, renaming and extracting fields such as job names, workflow IDs, user information, commit messages, URLs, and branches. The detection identifies mandatory jobs for each workflow and checks if they were executed. This activity is significant because disabling security jobs can allow malicious code to bypass security checks, leading to potential data breaches, system downtime, and reputational damage. If confirmed malicious, this could result in unauthorized code execution and compromised pipeline integrity. data_source: @@ -15,7 +15,7 @@ search: |- | stats values(job_name) as job_names BY workflow_id workflow_name user commit_message url branch - | lookup mandatory_job_for_workflow workflow_name OUTPUTNEW job_name AS mandatory_job + | lookup local=t mandatory_job_for_workflow workflow_name OUTPUTNEW job_name AS mandatory_job | search mandatory_job=* | eval mandatory_job_executed=if(like(job_names, "%".mandatory_job."%"), 1, 0) | where mandatory_job_executed=0 @@ -60,3 +60,7 @@ tests: sourcetype: circleci source: circleci test_type: unit +deprecation_info: + reason: Detection deprecated because the Technology Add-on it uses has been archived, and no replacement TA exists. + removed_in_version: 6.12.0 + replacement_content: [] diff --git a/detections/cloud/circle_ci_disable_security_step.yml b/detections/deprecated/circle_ci_disable_security_step.yml similarity index 91% rename from detections/cloud/circle_ci_disable_security_step.yml rename to detections/deprecated/circle_ci_disable_security_step.yml index 9f5d5ce02e0..5b234e57c1c 100644 --- a/detections/cloud/circle_ci_disable_security_step.yml +++ b/detections/deprecated/circle_ci_disable_security_step.yml @@ -1,10 +1,10 @@ name: Circle CI Disable Security Step id: 72cb9de9-e98b-4ac9-80b2-5331bba6ea97 -version: 9 +version: 10 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Patrick Bareiss, Splunk -status: experimental +status: deprecated type: Anomaly description: The following analytic detects the disablement of security steps in a CircleCI pipeline. It leverages CircleCI logs, using field renaming, joining, and statistical analysis to identify instances where mandatory security steps are not executed. This activity is significant because disabling security steps can introduce vulnerabilities, unauthorized changes, or malicious code into the pipeline. If confirmed malicious, this could lead to potential attacks, data breaches, or compromised infrastructure. Investigate by reviewing job names, commit details, and user information associated with the disablement, and examine any relevant artifacts and concurrent processes. data_source: @@ -58,3 +58,7 @@ tests: source: circleci test_type: experimental description: This test is a legacy experimental test and may not be accurate. +deprecation_info: + reason: Detection deprecated because the Technology Add-on it uses has been archived, and no replacement TA exists. + removed_in_version: 6.12.0 + replacement_content: [] diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/deprecated/detect_html_help_renamed.yml similarity index 89% rename from detections/endpoint/detect_html_help_renamed.yml rename to detections/deprecated/detect_html_help_renamed.yml index e9d228305a9..6a71fb80287 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/deprecated/detect_html_help_renamed.yml @@ -1,10 +1,10 @@ name: Detect HTML Help Renamed id: 62fed254-513b-460e-953d-79771493a9f3 -version: 14 +version: 15 creation_date: '2021-02-11' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects instances where hh.exe (HTML Help) has been renamed and is executing a Compiled HTML Help (CHM) file. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because attackers can use renamed hh.exe to execute malicious scripts embedded in CHM files, potentially leading to code execution. If confirmed malicious, this technique could allow attackers to run arbitrary scripts, escalate privileges, or persist within the environment, posing a significant security risk. data_source: @@ -53,3 +53,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/network/detect_large_icmp_traffic.yml b/detections/deprecated/detect_large_icmp_traffic.yml similarity index 95% rename from detections/network/detect_large_icmp_traffic.yml rename to detections/deprecated/detect_large_icmp_traffic.yml index 98f14307a8c..f491f9d89e6 100644 --- a/detections/network/detect_large_icmp_traffic.yml +++ b/detections/deprecated/detect_large_icmp_traffic.yml @@ -1,10 +1,10 @@ name: Detect Large ICMP Traffic id: 9cd6d066-94d5-4ccd-a8b9-28c03ca91be8 -version: 8 +version: 9 creation_date: '2020-01-19' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Rico Valdez, Dean Luxton, Bhavin Patel, Splunk -status: production +status: deprecated type: TTP description: | The following analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes. @@ -95,3 +95,7 @@ tests: source: cisco_cloud_security_addon sourcetype: cisco:cloud_security:firewall test_type: unit +deprecation_info: + reason: Detection deprecated as it is determined to be very noisy in a production environment. + removed_in_version: 6.12.0 + replacement_content: [] diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/deprecated/detect_mshta_renamed.yml similarity index 88% rename from detections/endpoint/detect_mshta_renamed.yml rename to detections/deprecated/detect_mshta_renamed.yml index e04f4d7434c..a18668a17fe 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/deprecated/detect_mshta_renamed.yml @@ -1,10 +1,10 @@ name: Detect mshta renamed id: 8f45fcf0-5b68-11eb-ae93-0242ac130002 -version: 13 +version: 14 creation_date: '2021-01-15' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic identifies instances where mshta.exe has been renamed and executed. It leverages Endpoint Detection and Response (EDR) data, specifically focusing on the original file name field to detect discrepancies. This activity is significant because renaming mshta.exe is a common tactic used by attackers to evade detection and execute malicious scripts. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network. data_source: @@ -52,3 +52,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/deprecated/detect_renamed_7_zip.yml similarity index 88% rename from detections/endpoint/detect_renamed_7_zip.yml rename to detections/deprecated/detect_renamed_7_zip.yml index 667a8ad2f50..fea1e5e5ce5 100644 --- a/detections/endpoint/detect_renamed_7_zip.yml +++ b/detections/deprecated/detect_renamed_7_zip.yml @@ -1,10 +1,10 @@ name: Detect Renamed 7-Zip id: 4057291a-b8cf-11eb-95fe-acde48001122 -version: 12 +version: 13 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects the usage of a renamed 7-Zip executable using Sysmon data. It leverages the OriginalFileName field to identify instances where the 7-Zip process has been renamed. This activity is significant as attackers often rename legitimate tools to evade detection while staging or exfiltrating data. If confirmed malicious, this behavior could indicate data exfiltration attempts or other unauthorized data manipulation, potentially leading to significant data breaches or loss of sensitive information. Analysts should validate the legitimacy of the 7-Zip executable and investigate parallel processes for further suspicious activities. data_source: @@ -52,3 +52,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed Popular 3rd Party Software was Executed diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/deprecated/detect_renamed_psexec.yml similarity index 89% rename from detections/endpoint/detect_renamed_psexec.yml rename to detections/deprecated/detect_renamed_psexec.yml index 2e56a883799..52e1bdf8899 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/deprecated/detect_renamed_psexec.yml @@ -1,10 +1,10 @@ name: Detect Renamed PSExec id: 683e6196-b8e8-11eb-9a79-acde48001122 -version: 17 +version: 18 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk, Alex Oberkircher, Github Community -status: production +status: deprecated type: Hunting description: The following analytic identifies instances where `PsExec.exe` has been renamed and executed on an endpoint. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because renaming `PsExec.exe` is a common tactic to evade detection. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to unauthorized access, lateral movement, or further compromise of the network. data_source: @@ -67,3 +67,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all command interpreter binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed Command Interpreter was Executed diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/deprecated/detect_renamed_rclone.yml similarity index 88% rename from detections/endpoint/detect_renamed_rclone.yml rename to detections/deprecated/detect_renamed_rclone.yml index d7bbfa5d717..7e9bccd3330 100644 --- a/detections/endpoint/detect_renamed_rclone.yml +++ b/detections/deprecated/detect_renamed_rclone.yml @@ -1,10 +1,10 @@ name: Detect Renamed RClone id: 6dca1124-b3ec-11eb-9328-acde48001122 -version: 12 +version: 13 creation_date: '2021-05-13' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects the execution of a renamed `rclone.exe` process, which is commonly used for data exfiltration to remote destinations. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and original file names that do not match. This activity is significant because ransomware groups often use RClone to exfiltrate sensitive data. If confirmed malicious, this behavior could indicate an ongoing data exfiltration attempt, potentially leading to significant data loss and further compromise of the affected systems. data_source: @@ -56,3 +56,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed Popular 3rd Party Software was Executed diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/deprecated/detect_renamed_winrar.yml similarity index 87% rename from detections/endpoint/detect_renamed_winrar.yml rename to detections/deprecated/detect_renamed_winrar.yml index 5779de2a81b..215d1d0a53e 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/deprecated/detect_renamed_winrar.yml @@ -1,10 +1,10 @@ name: Detect Renamed WinRAR id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122 -version: 16 +version: 17 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic identifies instances where `WinRAR.exe` has been renamed and executed. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names within the Endpoint data model. This activity is significant because renaming executables is a common tactic used by attackers to evade detection. If confirmed malicious, this could indicate an attempt to bypass security controls, potentially leading to unauthorized data extraction or further system compromise. data_source: @@ -52,3 +52,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed Popular 3rd Party Software was Executed diff --git a/detections/endpoint/detect_wmi_event_subscription_persistence.yml b/detections/deprecated/detect_wmi_event_subscription_persistence.yml similarity index 89% rename from detections/endpoint/detect_wmi_event_subscription_persistence.yml rename to detections/deprecated/detect_wmi_event_subscription_persistence.yml index 779f9b78bba..2d746625cbf 100644 --- a/detections/endpoint/detect_wmi_event_subscription_persistence.yml +++ b/detections/deprecated/detect_wmi_event_subscription_persistence.yml @@ -1,10 +1,10 @@ name: Detect WMI Event Subscription Persistence id: 01d9a0c2-cece-11eb-ab46-acde48001122 -version: 12 +version: 13 creation_date: '2021-06-16' -modification_date: '2026-05-13' +modification_date: '2026-10-05' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP description: The following analytic identifies the creation of WMI Event Subscriptions, which can be used to establish persistence or perform privilege escalation. It detects EventID 19 (EventFilter creation), EventID 20 (EventConsumer creation), and EventID 21 (FilterToConsumerBinding creation) from Sysmon logs. This activity is significant because WMI Event Subscriptions can execute code with elevated SYSTEM privileges, making it a powerful persistence mechanism. If confirmed malicious, an attacker could maintain long-term access, escalate privileges, and execute arbitrary code, posing a severe threat to the environment. data_source: @@ -60,3 +60,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: This rule uses only Sysmon EventID 20, which records creation of a WMI event consumer but does not confirm that a filter is bound to it. The Sysmon permanent subscription detection covers the binding with EventID 21. + removed_in_version: 6.10.0 + replacement_content: + - WMI Permanent Event Subscription - Sysmon diff --git a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml b/detections/deprecated/detection_of_tools_built_by_nirsoft.yml similarity index 92% rename from detections/endpoint/detection_of_tools_built_by_nirsoft.yml rename to detections/deprecated/detection_of_tools_built_by_nirsoft.yml index c41a4a0605d..2fe7690cc05 100644 --- a/detections/endpoint/detection_of_tools_built_by_nirsoft.yml +++ b/detections/deprecated/detection_of_tools_built_by_nirsoft.yml @@ -1,10 +1,10 @@ name: Detection of tools built by NirSoft id: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0 -version: 11 +version: 12 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Bhavin Patel, Splunk -status: experimental +status: deprecated type: Anomaly description: The following analytic identifies the execution of tools built by NirSoft by detecting specific command-line arguments such as "/stext" and "/scomma". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because NirSoft tools, while legitimate, can be exploited by attackers for malicious purposes such as credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further compromise of the affected system. data_source: @@ -53,3 +53,8 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint +deprecation_info: + reason: Detection deprecated due to duplicated content already covered by other detections. + removed_in_version: 6.12.0 + replacement_content: + - Windows NirSoft Utilities diff --git a/detections/endpoint/macos___re_opened_applications.yml b/detections/deprecated/macos___re_opened_applications.yml similarity index 90% rename from detections/endpoint/macos___re_opened_applications.yml rename to detections/deprecated/macos___re_opened_applications.yml index b81a9593cce..708d18b6276 100644 --- a/detections/endpoint/macos___re_opened_applications.yml +++ b/detections/deprecated/macos___re_opened_applications.yml @@ -1,10 +1,10 @@ name: MacOS - Re-opened Applications id: 40bb64f9-f619-4e3d-8732-328d40377c4b -version: 8 +version: 9 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-09-18' author: Jamie Windley, Splunk -status: experimental +status: deprecated type: TTP description: The following analytic identifies processes referencing plist files that determine which applications are re-opened when a user reboots their MacOS machine. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes related to "com.apple.loginwindow." This activity is significant because it can indicate attempts to persist across reboots, a common tactic used by attackers to maintain access. If confirmed malicious, this could allow an attacker to execute code or maintain persistence on the affected system, potentially leading to further compromise. data_source: @@ -43,3 +43,7 @@ product: - Splunk Cloud category: endpoint security_domain: threat +deprecation_info: + reason: Detection deprecated as it is targeting a method of persistence that has been disabled in MacOS for years. As well, as the fact that the detection has been set to experimental since 2020. + removed_in_version: 6.10.0 + replacement_content: [] diff --git a/detections/application/ollama_abnormal_service_crash_availability_attack.yml b/detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml similarity index 90% rename from detections/application/ollama_abnormal_service_crash_availability_attack.yml rename to detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml index e37ebbe1b63..9c14555e326 100644 --- a/detections/application/ollama_abnormal_service_crash_availability_attack.yml +++ b/detections/deprecated/ollama_abnormal_service_crash_availability_attack.yml @@ -1,10 +1,10 @@ name: Ollama Abnormal Service Crash Availability Attack id: 327fa152-9b56-4e4e-bc0b-2795d4068afa -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rod Soto -status: experimental +status: deprecated type: Anomaly description: Detects critical service crashes, fatal errors, and abnormal process terminations in Ollama that may indicate exploitation attempts, resource exhaustion attacks, malicious input triggering unhandled exceptions, or deliberate denial of service attacks designed to disrupt AI model availability and degrade system stability. data_source: @@ -46,5 +46,9 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log sourcetype: ollama:server source: app.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit +deprecation_info: + reason: This experimental rule is being deprecated while we enhance Ollama availability detection. Application errors alone do not confirm a service outage, so we are improving the evidence needed to identify service interruptions reliably. + removed_in_version: 6.12.0 + replacement_content: + - Ollama Repeated Application Errors diff --git a/detections/application/ollama_possible_model_exfiltration_data_leakage.yml b/detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml similarity index 92% rename from detections/application/ollama_possible_model_exfiltration_data_leakage.yml rename to detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml index 3140267adc4..f04b73cb26f 100644 --- a/detections/application/ollama_possible_model_exfiltration_data_leakage.yml +++ b/detections/deprecated/ollama_possible_model_exfiltration_data_leakage.yml @@ -1,10 +1,10 @@ name: Ollama Possible Model Exfiltration Data Leakage id: c9fd1a54-0eab-4470-8970-d5fcc3c740fb -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rod Soto -status: experimental +status: deprecated type: Anomaly description: Detects data leakage and exfiltration attempts targeting Ollama model metadata and configuration endpoints. Adversaries repeatedly query /api/show, /api/tags, and /api/v1/models to systematically extract sensitive model information including architecture details, fine-tuning parameters, system paths, Modelfile configurations, and proprietary customizations. Multiple inspection attempts within a 15-minute window indicate automated exfiltration of valuable intellectual property such as custom model configurations, system prompts, and internal model specifications. This activity represents unauthorized data disclosure that could enable competitive intelligence gathering, model replication, or preparation for advanced attacks against the AI infrastructure. data_source: @@ -48,3 +48,7 @@ tests: source: server.log test_type: experimental description: This test is a legacy experimental test and may not be accurate. +deprecation_info: + reason: This experimental rule is being deprecated while we enhance Ollama exfiltration detection. Access requests and response timing alone do not show what data was returned or transferred, so stronger evidence and correlation are needed. + removed_in_version: 6.12.0 + replacement_content: [] diff --git a/detections/application/ollama_possible_rce_via_model_loading.yml b/detections/deprecated/ollama_possible_rce_via_model_loading.yml similarity index 92% rename from detections/application/ollama_possible_rce_via_model_loading.yml rename to detections/deprecated/ollama_possible_rce_via_model_loading.yml index be366b8ce8f..8fdeddd5eea 100644 --- a/detections/application/ollama_possible_rce_via_model_loading.yml +++ b/detections/deprecated/ollama_possible_rce_via_model_loading.yml @@ -1,10 +1,10 @@ name: Ollama Possible RCE via Model Loading id: 3f28c930-5208-425d-a7b9-53d349756d91 -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rod Soto -status: experimental +status: deprecated type: Anomaly description: Detects Ollama server errors and failures during model loading operations that may indicate malicious model injection, path traversal attempts, or exploitation of model loading mechanisms to achieve remote code execution. Adversaries may attempt to load specially crafted malicious models or exploit vulnerabilities in the model loading process to execute arbitrary code on the server. This detection monitors error messages and failure patterns that could signal attempts to abuse model loading functionality for malicious purposes. data_source: @@ -46,5 +46,8 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/app.log sourcetype: ollama:server source: app.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit +deprecation_info: + reason: This experimental rule is being deprecated while we enhance Ollama model-loading detection. Model-loading errors alone do not confirm code execution, so the detection needs stronger evidence of execution. + removed_in_version: 6.12.0 + replacement_content: [] diff --git a/detections/application/ollama_suspicious_prompt_injection_jailbreak.yml b/detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml similarity index 90% rename from detections/application/ollama_suspicious_prompt_injection_jailbreak.yml rename to detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml index 3fdfeb434f1..691b8187d54 100644 --- a/detections/application/ollama_suspicious_prompt_injection_jailbreak.yml +++ b/detections/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml @@ -1,10 +1,10 @@ name: Ollama Suspicious Prompt Injection Jailbreak id: aac5df6f-9151-4da6-bdb2-5691aa6e376f -version: 4 +version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rod Soto -status: experimental +status: deprecated type: Anomaly description: Detects potential prompt injection or jailbreak attempts against Ollama API endpoints by identifying requests with abnormally long response times. Attackers often craft complex, layered prompts designed to bypass AI safety controls, which typically result in extended processing times as the model attempts to parse and respond to these malicious inputs. This detection monitors /api/generate and /api/chat endpoints for requests exceeding 30 seconds, which may indicate sophisticated jailbreak techniques, multi-stage prompt injections, or attempts to extract sensitive information from the model. data_source: @@ -48,5 +48,9 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log sourcetype: ollama:server source: server.log - test_type: experimental - description: This test is a legacy experimental test and may not be accurate. + test_type: unit +deprecation_info: + reason: This experimental rule is being deprecated while we enhance Ollama prompt-injection detection. Long response times do not reveal prompt content or show that safeguards were bypassed, so they are not enough to identify these attacks reliably. + removed_in_version: 6.12.0 + replacement_content: + - Ollama Long-Running Inference Requests diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/deprecated/possible_browser_pass_view_parameter.yml similarity index 92% rename from detections/endpoint/possible_browser_pass_view_parameter.yml rename to detections/deprecated/possible_browser_pass_view_parameter.yml index 70b5aa3b1a2..b21bcb9a319 100644 --- a/detections/endpoint/possible_browser_pass_view_parameter.yml +++ b/detections/deprecated/possible_browser_pass_view_parameter.yml @@ -1,10 +1,10 @@ name: Possible Browser Pass View Parameter id: 8ba484e8-4b97-11ec-b19a-acde48001122 -version: 8 +version: 9 creation_date: '2021-11-22' -modification_date: '2026-05-13' +modification_date: '2026-10-01' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: Hunting description: The following analytic identifies processes with command-line parameters associated with web browser credential dumping tools, specifically targeting behaviors used by Remcos RAT malware. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and specific file paths. This activity is significant as it indicates potential credential theft, a common tactic in broader cyber-espionage campaigns. If confirmed malicious, attackers could gain unauthorized access to sensitive web credentials, leading to further system compromise and data breaches. data_source: @@ -35,3 +35,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to duplicated content already covered by other detections. + removed_in_version: 6.12.0 + replacement_content: + - Windows NirSoft Utilities diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/deprecated/suspicious_microsoft_workflow_compiler_rename.yml similarity index 89% rename from detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml rename to detections/deprecated/suspicious_microsoft_workflow_compiler_rename.yml index 21f34aefa8a..ec137b5b28c 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml +++ b/detections/deprecated/suspicious_microsoft_workflow_compiler_rename.yml @@ -1,10 +1,10 @@ name: Suspicious microsoft workflow compiler rename id: f0db4464-55d9-11eb-ae93-0242ac130002 -version: 14 +version: 15 creation_date: '2021-01-19' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects the renaming of microsoft.workflow.compiler.exe, a rarely used executable typically located in C:\Windows\Microsoft.NET\Framework64\v4.0.30319. This detection leverages Endpoint Detection and Response (EDR) data, focusing on process names and original file names. This activity is significant because renaming this executable can indicate an attempt to evade security controls. If confirmed malicious, an attacker could use this renamed executable to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment. data_source: @@ -56,3 +56,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/deprecated/suspicious_msbuild_rename.yml similarity index 89% rename from detections/endpoint/suspicious_msbuild_rename.yml rename to detections/deprecated/suspicious_msbuild_rename.yml index 7a4091f3103..4fb2bbb641e 100644 --- a/detections/endpoint/suspicious_msbuild_rename.yml +++ b/detections/deprecated/suspicious_msbuild_rename.yml @@ -1,10 +1,10 @@ name: Suspicious MSBuild Rename id: 4006adac-5937-11eb-ae93-0242ac130002 -version: 14 +version: 15 creation_date: '2021-01-15' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting description: The following analytic detects the execution of renamed instances of msbuild.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names within the Endpoint data model. This activity is significant because msbuild.exe is a legitimate tool often abused by attackers to execute malicious code while evading detection. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network. data_source: @@ -58,3 +58,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml b/detections/deprecated/windows_lolbas_executed_as_renamed_file.yml similarity index 90% rename from detections/endpoint/windows_lolbas_executed_as_renamed_file.yml rename to detections/deprecated/windows_lolbas_executed_as_renamed_file.yml index de0367bd262..94d1538a1af 100644 --- a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml +++ b/detections/deprecated/windows_lolbas_executed_as_renamed_file.yml @@ -1,17 +1,17 @@ name: Windows LOLBAS Executed As Renamed File id: fd496996-7d9e-4894-8d40-bb85b6192dc6 -version: 10 +version: 11 creation_date: '2024-05-03' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Steven Dick -status: production +status: deprecated type: TTP description: The following analytic identifies a LOLBAS process being executed where it's process name does not match it's original file name attribute. Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` latest(Processes.parent_process) as parent_process, latest(Processes.process) as process, latest(Processes.process_guid) as process_guid count, min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes where NOT Processes.original_file_name IN("-","unknown") AND NOT Processes.process_path IN ("*\\Program Files*","*\\PROGRA~*","*\\Windows\\System32\\*","*\\Windows\\Syswow64\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product |`drop_dm_object_name(Processes)` | where NOT match(process_name, "(?i)".original_file_name) | lookup lolbas_file_path lolbas_file_name as original_file_name OUTPUT description as desc | search desc!="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_lolbas_executed_as_renamed_file_filter`' +search: '| tstats `security_content_summariesonly` latest(Processes.parent_process) as parent_process, latest(Processes.process) as process, latest(Processes.process_guid) as process_guid count, min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes where NOT Processes.original_file_name IN("-","unknown") AND NOT Processes.process_path IN ("*\\Program Files*","*\\PROGRA~*","*\\Windows\\System32\\*","*\\Windows\\Syswow64\\*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product |`drop_dm_object_name(Processes)` | where NOT match(process_name, "(?i)".original_file_name) | lookup local=t lolbas_file_path lolbas_file_name as original_file_name OUTPUT description as desc | search desc!="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_lolbas_executed_as_renamed_file_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: A certain amount of false positives are likely with this detection. MSI based installers often trigger for SETUPAPL.dll and vendors will often copy system exectables to a different path for application usage. references: @@ -63,3 +63,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to renaming of its newer version. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/deprecated/windows_nirsoft_advancedrun.yml similarity index 91% rename from detections/endpoint/windows_nirsoft_advancedrun.yml rename to detections/deprecated/windows_nirsoft_advancedrun.yml index 7954dc5dcc7..8e8fc5ffdff 100644 --- a/detections/endpoint/windows_nirsoft_advancedrun.yml +++ b/detections/deprecated/windows_nirsoft_advancedrun.yml @@ -1,10 +1,10 @@ name: Windows NirSoft AdvancedRun id: bb4f3090-7ae4-11ec-897f-acde48001122 -version: 12 +version: 13 creation_date: '2022-01-24' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP description: The following analytic detects the execution of AdvancedRun.exe, a tool with capabilities similar to remote administration programs like PsExec. It identifies the process by its name or original file name and flags common command-line arguments. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. Monitoring this activity is crucial as AdvancedRun can be used for remote code execution and configuration-based automation. If malicious, this could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment. data_source: @@ -35,6 +35,7 @@ known_false_positives: False positives should be limited as it is specific to Ad references: - http://www.nirsoft.net/utils/advanced_run.html - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L623 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -67,6 +68,8 @@ analytic_story: - Data Destruction - WhisperGate asset_type: Endpoint +atomic_guid: + - 81ce22fd-9612-4154-918e-8a1f285d214d mitre_attack_id: - T1588.002 product: @@ -82,3 +85,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to duplicated content already covered by other detections. + removed_in_version: 6.12.0 + replacement_content: + - Windows NirSoft Utilities diff --git a/detections/endpoint/windows_process_injection_into_notepad.yml b/detections/deprecated/windows_process_injection_into_notepad.yml similarity index 92% rename from detections/endpoint/windows_process_injection_into_notepad.yml rename to detections/deprecated/windows_process_injection_into_notepad.yml index 07b256cded5..d4869ca37be 100644 --- a/detections/endpoint/windows_process_injection_into_notepad.yml +++ b/detections/deprecated/windows_process_injection_into_notepad.yml @@ -1,10 +1,10 @@ name: Windows Process Injection into Notepad id: b8340d0f-ba48-4391-bea7-9e793c5aae36 -version: 13 +version: 14 creation_date: '2023-02-24' -modification_date: '2026-05-13' +modification_date: '2026-09-21' author: Michael Haag, Splunk -status: production +status: deprecated type: Anomaly description: The following analytic detects process injection into Notepad.exe using Sysmon EventCode 10. It identifies suspicious GrantedAccess requests (0x40 and 0x1fffff) to Notepad.exe, excluding common system paths like System32, Syswow64, and Program Files. This behavior is often associated with the SliverC2 framework by BishopFox. Monitoring this activity is crucial as it may indicate an initial payload attempting to execute malicious code within Notepad.exe. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment. data_source: @@ -55,3 +55,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated as it is already covered by the" Windows Process Injection into Commonly Abused Processes" detection. + removed_in_version: 6.10.0 + replacement_content: + - Windows Process Injection into Commonly Abused Processes diff --git a/detections/endpoint/windows_regsvr32_renamed_binary.yml b/detections/deprecated/windows_regsvr32_renamed_binary.yml similarity index 90% rename from detections/endpoint/windows_regsvr32_renamed_binary.yml rename to detections/deprecated/windows_regsvr32_renamed_binary.yml index 883a47c7e4b..4d6940c412e 100644 --- a/detections/endpoint/windows_regsvr32_renamed_binary.yml +++ b/detections/deprecated/windows_regsvr32_renamed_binary.yml @@ -1,10 +1,10 @@ name: Windows Regsvr32 Renamed Binary id: 7349a9e9-3cf6-4171-bb0c-75607a8dcd1a -version: 13 +version: 14 creation_date: '2022-10-27' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP description: The following analytic identifies instances where the regsvr32.exe binary has been renamed and executed. This detection leverages Endpoint Detection and Response (EDR) data, specifically focusing on the original filename metadata. Renaming regsvr32.exe is significant as it can be an evasion technique used by attackers to bypass security controls. If confirmed malicious, this activity could allow an attacker to execute arbitrary DLLs, potentially leading to code execution, privilege escalation, or persistence within the environment. data_source: @@ -65,3 +65,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed LOLBAS Binary was Executed diff --git a/detections/endpoint/windows_renamed_powershell_execution.yml b/detections/deprecated/windows_renamed_powershell_execution.yml similarity index 91% rename from detections/endpoint/windows_renamed_powershell_execution.yml rename to detections/deprecated/windows_renamed_powershell_execution.yml index bade4e80afd..dbb8ef8e183 100644 --- a/detections/endpoint/windows_renamed_powershell_execution.yml +++ b/detections/deprecated/windows_renamed_powershell_execution.yml @@ -1,10 +1,10 @@ name: Windows Renamed Powershell Execution id: c08014de-cc5a-42de-9775-76ecd5b37bbd -version: 8 +version: 9 creation_date: '2022-10-27' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Teoderick Contreras, Nasreddine Bencherchali, Splunk -status: production +status: deprecated type: TTP description: The following analytic identifies instances where the PowerShell executable has been renamed and executed under an alternate filename. This behavior is commonly associated with attempts to evade security controls or bypass logging mechanisms that monitor standard PowerShell usage. While rare in legitimate environments, renamed PowerShell binaries are frequently observed in malicious campaigns leveraging Living-off-the-Land Binaries (LOLBins) and fileless malware techniques. This detection flags executions of PowerShell where the process name does not match the default powershell.exe or pwsh.exe, especially when invoked from unusual paths or accompanied by suspicious command-line arguments. data_source: @@ -49,3 +49,8 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to having a duplicated content with another detection. Renaming of all command interpreter binaries are covered in a single detection instead of having their separate searches, for performance related reasons. + removed_in_version: 6.10.0 + replacement_content: + - Windows Renamed Command Interpreter was Executed diff --git a/detections/endpoint/wmi_temporary_event_subscription.yml b/detections/deprecated/wmi_temporary_event_subscription.yml similarity index 82% rename from detections/endpoint/wmi_temporary_event_subscription.yml rename to detections/deprecated/wmi_temporary_event_subscription.yml index b08200b0fc1..abe30ff2973 100644 --- a/detections/endpoint/wmi_temporary_event_subscription.yml +++ b/detections/deprecated/wmi_temporary_event_subscription.yml @@ -1,10 +1,10 @@ name: WMI Temporary Event Subscription id: 38cbd42c-1098-41bb-99cf-9d6d2b296d83 -version: 10 +version: 11 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-05' author: Rico Valdez, Splunk -status: experimental +status: deprecated type: TTP description: The following analytic detects the creation of WMI temporary event subscriptions. It leverages Windows Event Logs, specifically EventCode 5860, to identify these activities. This detection is significant because attackers often use WMI to execute commands, gather information, or maintain persistence within a compromised system. If confirmed malicious, this activity could allow an attacker to execute arbitrary code, escalate privileges, or persist in the environment. Analysts should review the specific WMI queries and assess their intent, considering potential false positives from legitimate administrative tasks. data_source: [] @@ -43,3 +43,9 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint +deprecation_info: + reason: |- + This rule is deprecated in its current form because EventID 5860 identifies temporary subscriptions rather than permanent persistence, and the broad match with exact query-string exceptions does not reliably distinguish malicious use from legitimate software. + Temporary WMI activity may warrant a separate behavior-focused detection. + removed_in_version: 6.10.0 + replacement_content: [] diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/deprecated/xmrig_driver_loaded.yml similarity index 89% rename from detections/endpoint/xmrig_driver_loaded.yml rename to detections/deprecated/xmrig_driver_loaded.yml index a6e725500ee..325f1d027df 100644 --- a/detections/endpoint/xmrig_driver_loaded.yml +++ b/detections/deprecated/xmrig_driver_loaded.yml @@ -1,10 +1,10 @@ name: XMRIG Driver Loaded id: 90080fa6-a8df-11eb-91e4-acde48001122 -version: 10 +version: 11 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP description: The following analytic detects the installation of the XMRIG coinminer driver on a system. It identifies the loading of the `WinRing0x64.sys` driver, commonly associated with XMRIG, by analyzing Sysmon EventCode 6 logs for specific signatures and image loads. This activity is significant because XMRIG is an open-source CPU miner frequently exploited by adversaries to mine cryptocurrency illicitly. If confirmed malicious, this activity could lead to unauthorized resource consumption, degraded system performance, and potential financial loss due to unauthorized cryptocurrency mining. data_source: @@ -49,3 +49,9 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated as it is inaccurate. WinRing0x64.sys is not related to XMRIG. It is a driver that is used to access the hardware ring0. + removed_in_version: 6.10.0 + replacement_content: + - Windows Vulnerable Driver Installed + - Windows Vulnerable Driver Loaded diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index e09ae3823a9..bb435a02c50 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -2,7 +2,7 @@ name: Access LSASS Memory for Dump Creation id: fb4c31b0-13e8-4155-8aa5-24de4b8d6717 version: 16 creation_date: '2019-12-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -29,6 +29,7 @@ how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, w known_false_positives: Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -54,6 +55,8 @@ analytic_story: - Lokibot - Scattered Lapsus$ Hunters asset_type: Windows +atomic_guid: + - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml index 9092c986eae..9e7ebdc39cc 100644 --- a/detections/endpoint/adsisearcher_account_discovery.yml +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -2,7 +2,7 @@ name: AdsiSearcher Account Discovery id: de7fcadc-04f3-11ec-a241-acde48001122 version: 13 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: TTP @@ -27,6 +27,7 @@ references: - https://attack.mitre.org/techniques/T1087/002/ - https://www.blackhillsinfosec.com/red-blue-purple/ - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L234 drilldown_searches: - name: View the detection results for - "$dest$" and "$user_id$" search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' @@ -55,6 +56,8 @@ analytic_story: - Data Destruction - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 02e8be5a-3065-4e54-8cc8-a14d138834d3 mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index 2f1379ec50a..57ab16b66d7 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -1,8 +1,8 @@ name: Attacker Tools On Endpoint id: a51bfe1a-94f0-48cc-b4e4-16a110145893 -version: 19 +version: 20 creation_date: '2021-07-12' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Bhavin Patel, Splunk, sventec, Github Community status: production type: TTP @@ -42,7 +42,7 @@ search: |- | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup attacker_tools attacker_tool_names AS process_name OUTPUT description + | lookup local=t attacker_tools attacker_tool_names AS process_name OUTPUT description | search description !=false | `attacker_tools_on_endpoint_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index 9db0967a1f8..c2c09667a35 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -2,7 +2,7 @@ name: BCDEdit Failure Recovery Modification id: 809b31d2-5462-11eb-ae93-0242ac130002 version: 15 creation_date: '2021-01-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators may modify the boot configuration. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L66 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - Storm-2460 CLFS Zero Day Exploitation - Void Manticore asset_type: Endpoint +atomic_guid: + - cf21060a-80b3-4238-a595-22525de4ab81 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index b7f6c0dce0a..d60fb19be34 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -2,7 +2,7 @@ name: BITS Job Persistence id: e97a5ffe-90bf-11eb-928a-acde48001122 version: 13 creation_date: '2021-03-30' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1197/T1197.yaml#L51 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - BITS Jobs - Living Off The Land asset_type: Endpoint +atomic_guid: + - 62a06ec5-5754-47d2-bcfc-123d8314c6ae mitre_attack_id: - T1197 product: diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index ec76c0eedfd..76c73828b14 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -2,7 +2,7 @@ name: BITSAdmin Download File id: 80630ff4-8e4c-11eb-aab5-acde48001122 version: 18 creation_date: '2021-03-30' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Sittikorn S status: production type: TTP @@ -32,6 +32,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md - https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L236 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -70,6 +71,8 @@ analytic_story: - GhostRedirector IIS Module and Rungan Backdoor - Hellcat Ransomware asset_type: Endpoint +atomic_guid: + - a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b mitre_attack_id: - T1197 - T1105 diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml index 42845a1248a..69b55219b93 100644 --- a/detections/endpoint/certutil_with_decode_argument.yml +++ b/detections/endpoint/certutil_with_decode_argument.yml @@ -2,7 +2,7 @@ name: CertUtil With Decode Argument id: bfe94226-8c10-11eb-a4b3-acde48001122 version: 15 creation_date: '2021-03-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil - https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml#L25 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -70,6 +71,8 @@ threat_group: - Cozy Bear - Midnight Blizzard asset_type: Endpoint +atomic_guid: + - 71abc534-3c05-4d0c-80f7-cbe93cb2aa94 mitre_attack_id: - T1140 product: diff --git a/detections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml b/detections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml index e7875db3e45..eaf17da0a93 100644 --- a/detections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml +++ b/detections/endpoint/cisco_isovalent___curl_execution_with_insecure_flags.yml @@ -2,7 +2,7 @@ name: Cisco Isovalent - Curl Execution With Insecure Flags id: c16c4899-d3f7-461b-92c2-cc0ef5758855 version: 5 creation_date: '2026-01-05' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Bhavin Patel, Splunk status: production type: Anomaly @@ -22,6 +22,7 @@ known_false_positives: This activity may be triggered by legitimate administrati references: - https://rawcode7.medium.com/understanding-the-kubernetes-attack-surface-9a48ebcb6bc4 - https://www.tutorialworks.com/kubernetes-curl/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L1275 drilldown_searches: - name: View the detection results for - "$pod_name$" search: '%original_detection_search% | search pod_name = "$pod_name$"' diff --git a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml new file mode 100644 index 00000000000..72bbe5d0998 --- /dev/null +++ b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml @@ -0,0 +1,115 @@ +name: Cisco NVM - Browser Spawned Unix Shell with External Connection +id: 6f2de8d1-9a2d-4c7a-9b8c-3b8a2f7d0e41 +version: 1 +creation_date: '2026-09-02' +modification_date: '2026-09-22' +author: Maria Jose Erquiaga, Splunk +status: production +type: Anomaly +description: | + Detects a Unix-based (Linux or macOS) browser process spawning a Unix shell that establishes an outbound connection to an external destination. + This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension on Linux or macOS systems. + The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows. +data_source: + - Cisco Network Visibility Module Flow Data +search: | + `cisco_network_visibility_module_flowdata` + process_path IN ( + "*/bash", + "*/csh", + "*/dash", + "*/fish", + "*/sh", + "*/tcsh", + "*/zsh" + ) + parent_process_path IN ( + "*/arc", "*/brave", "*/brave-browser", "*/chrome", "*/chromium", "*/duckduckgo", "*/firefox", "*/firefox-bin", + "*/google chrome", "*/google-chrome", "*/librewolf", "*/microsoft edge", "*/msedge", "*/opera", + "*/opera gx", "*/safari", "*/tor browser", "*/vivaldi", "*/waterfox" + ) + NOT dest IN ( + "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10", + "127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", + "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", + "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24", + "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1" + ) + + | stats count + min(_time) as firstTime + max(_time) as lastTime + values(parent_process_hash) as parent_process_hash + values(process_hash) as process_hash + values(module_name_list) as module_name_list + values(module_hash_list) as module_hash_list + values(dest_port) as dest_port + values(dest_hostname) as dest_hostname + + by src src_ip dest dest_ip bytes_in bytes_out + user process_id process_name process_path process + parent_process_id parent_process_name parent_process_path parent_process + + | table + firstTime lastTime user + parent_process_path parent_process_name parent_process parent_process_hash + process_path process_name process process_hash process_id + module_name_list module_hash_list + src src_ip dest_hostname dest dest_ip dest_port bytes_in bytes_out + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `cisco_nvm___browser_spawned_unix_shell_with_external_connection_filter` +how_to_implement: |- + This search requires Network Visibility Module logs, which includes the flow data sourcetype. + This search uses an input macro named `cisco_network_visibility_module_flowdata`. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + Replace the macro definition with configurations for your Splunk environment. + The search also uses a post-filter macro designed to filter out known false positives. + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). +known_false_positives: | + Legitimate workflows may launch Unix command interpreters from browser contexts, including developer tooling, software installers, SSO helpers, browser extensions, and automation wrappers. Tuning may be required for approved applications, users, and destinations. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059/ + - https://redcanary.com/threat-detection-report/threats/socgholish/ +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src="$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: A Unix-based browser process [$parent_process$] spawned shell [$process$] on host [$src$], which made an outbound connection to external destination [$dest_hostname$] with IP [$dest_ip$] on port [$dest_port$]. +threat_objects: + - field: process + type: process + - field: dest_ip + type: ip_address + - field: dest_hostname + type: domain +analytic_story: + - Cisco Network Visibility Module Analytics +asset_type: Endpoint +mitre_attack_id: + - T1059 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test - Cisco NVM + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/macos_browser_spawned_script_external_network_connection/nvm_flowdata.log + source: not_applicable + sourcetype: cisco:nvm:flowdata:v2 + test_type: unit diff --git a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml index 4f2287fd2b1..62be4e512f7 100644 --- a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml +++ b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Curl Execution With Insecure Flags id: cc695238-3117-4e60-aa83-4beac2a42c69 version: 8 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -45,14 +45,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___curl_execution_with_insecure_flags_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Usage of these flags to reach public IPs or uncommon destinations should be reviewed. Tuning may be required for domains with known certificate issues. diff --git a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml index 1230dc1fe34..7784dec31a4 100644 --- a/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml +++ b/detections/endpoint/cisco_nvm___installation_of_typosquatted_python_package.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Installation of Typosquatted Python Package id: 5e3f6b44-42cb-4f8a-99f0-59e78a52ea1d -version: 5 +version: 6 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -21,7 +21,7 @@ search: | (process_arguments = "*poetry*" process_arguments = "*add*") ) | rex field=process_arguments "(?i)(?:pip|poetry)[^|]*?\s+(?:install|add)\s+(?P[^\s\"']+)$" - | lookup typo_squatted_python_packages + | lookup local=t typo_squatted_python_packages typosquatted_package_name as package_name OUTPUTNEW comment package_official_url | where isnotnull(comment) @@ -43,14 +43,13 @@ search: | process_integrity_level process_path process_name process_arguments process_hash process_id additional_logged_in_users_list module_name_list module_hash_list | `cisco_nvm___installation_of_typosquatted_python_package_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). In addition to this, the search make use of the lookup "typo_squatted_python_packages". Which needs to be configured and tuned. known_false_positives: | False positives should be very minimal to non existent, as the names of the packages in the lookup are all extracted from previously malicious packages. diff --git a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml index 39f753ba7ed..ff2f2a11089 100644 --- a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml +++ b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml @@ -2,7 +2,7 @@ name: Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI id: f2a9df84-9b01-4a21-9e3a-7aa1a217f69e version: 6 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -48,14 +48,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | False positives should be minimal as the presence of a network connection during such executions increases the likelihood of malicious behavior. references: diff --git a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml index 30d14780297..5d9707b4712 100644 --- a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml +++ b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Non-Network Binary Making Network Connection id: c6db35af-8a0e-4b61-88ed-738e66f15715 version: 6 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -46,14 +46,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___non_network_binary_making_network_connection_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Rare cases may exist where these binaries are used by plugins or third-party extensions to initiate outbound communication. However, such behavior is extremely uncommon and should be investigated for potential injection or abuse. diff --git a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml new file mode 100644 index 00000000000..f9a7a87931a --- /dev/null +++ b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml @@ -0,0 +1,103 @@ +name: Cisco NVM - Osascript Network Connection for a Long Duration +id: 6bc88a9d-f7de-4257-b526-acf15bc5a517 +version: 1 +creation_date: '2026-09-18' +modification_date: '2026-09-22' +author: Radka Viskova, Splunk +status: production +type: Anomaly +description: |- + This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds). + Adversaries may abuse osascript and AppleScript shell execution to establish long-lived command-and-control or remote connections. +data_source: + - Cisco Network Visibility Module Flow Data +search: |- + `cisco_network_visibility_module_flowdata` + ( + parent_process_name="osascript" + OR + process_name="osascript" + ) + + ``` + FSS stands for Flow Start Seconds + FES stands for Flow End Seconds + ``` + | eval duration=fes-fss + + | where duration>600 + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(parent_process_hash) as parent_process_hash + values(process_hash) as process_hash + values(dest_port) as dest_port + values(dest_hostname) as dest_hostname + values(http_method) as http_method + by src dest transport parent_process_path parent_process_name + parent_process parent_process_id process_path process_name + process process_id user duration + + | eval duration=tostring(duration)." seconds" + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `cisco_nvm___osascript_network_connection_for_a_long_duration_filter` +how_to_implement: |- + This search requires Network Visibility Module logs, which includes the flow data sourcetype. + This search uses an input macro named `cisco_network_visibility_module_flowdata`. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + Replace the macro definition with configurations for your Splunk environment. + The search also uses a post-filter macro designed to filter out known false positives. + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). +known_false_positives: |- + Legitimate administrative scripting, automation, software deployment, or support workflows that use osascript for long-running network operations. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/tactics/TA0011/ + - https://attack.mitre.org/techniques/T1059/002/ + - https://attack.mitre.org/techniques/T1071/001/ + - https://www.loobins.io/binaries/osascript/ +drilldown_searches: + - name: View detection results for "$src$" and "$dest$" + search: '%original_detection_search% | search src="$src$" dest="$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for "$src$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: The macOS host [$src$] used the Osascript utility with the command line [$process$] and a parent process [$parent_process_name$] to initiate a network connection to [$dest$] lasting [$duration$]. +threat_objects: + - field: parent_process_name + type: process_name + - field: process_name + type: process_name + - field: dest + type: ip_address +analytic_story: + - Command And Control + - Cisco Network Visibility Module Analytics + - MacOS Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059.002 + - T1071.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript_long_lived_connection_to_remote_host/osascript_long_lived_connection_to_remote_host.log + source: not_applicable + sourcetype: cisco:nvm:flowdata:v2 + test_type: unit diff --git a/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml b/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml index 012a98db4fd..61d00ba1160 100644 --- a/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml +++ b/detections/endpoint/cisco_nvm___outbound_connection_to_suspicious_port.yml @@ -1,8 +1,8 @@ name: Cisco NVM - Outbound Connection to Suspicious Port id: fc32a8d5-bc79-4437-b48f-4646ab7bed9d -version: 6 +version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -33,7 +33,7 @@ search: | values(aliul) as additional_logged_in_users_list values(dest_hostname) as dest_hostname by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport - | lookup suspicious_ports_list dest_port OUTPUTNEW comment as dest_port_metadata confidence as dest_confidence category as dest_port_category + | lookup local=t suspicious_ports_list dest_port OUTPUTNEW comment as dest_port_metadata confidence as dest_confidence category as dest_port_category | where isnotnull(dest_port_metadata) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -43,14 +43,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___outbound_connection_to_suspicious_port_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Some legitimate applications may use high or non-standard ports, such as alternate SSH daemons or development tools. However, many of these ports are commonly used by threat actors for reverse shells or C2 communications. diff --git a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml index d707ed47453..f08391700bf 100644 --- a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml +++ b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Rclone Execution With Network Activity id: 719f8c78-b20d-4bb9-8c33-6d1a762e7a9a version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -52,14 +52,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___rclone_execution_with_network_activity_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Rclone is used legitimately in some backup or other workflows. Tune this rule based on known-good operational usage or restrict by known user/service accounts an specific folders or remote names. references: diff --git a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml index 3b0f0d51b9b..b64b3f4cbee 100644 --- a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml +++ b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download id: 18f0d27d-569e-4bc4-96e1-09b214fa73c0 version: 6 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -39,14 +39,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | `rundll32.exe` using `mshtml.dll` is rare in legitimate environments. However, edge cases might exist. Tuning may be needed in environments with custom automation scripts. references: diff --git a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml index 0072fc506ec..fe101b8b271 100644 --- a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml +++ b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Susp Script From Archive Triggering Network Activity id: 8b07c2c9-0cde-4c44-9fa6-59dcf2b25777 version: 6 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -39,14 +39,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___susp_script_from_archive_triggering_network_activity_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Some software installers or automation scripts may extract and run scripts from archive files in temporary directories. However, it is uncommon for such scripts to initiate outbound network connections immediately upon extraction. diff --git a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml index 88bfa5cba70..790d763268a 100644 --- a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Suspicious Download From File Sharing Website id: 94ebc001-35e7-4ae8-9b0e-52766b2f99c7 version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -54,14 +54,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___suspicious_download_from_file_sharing_website_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Some system administrators or development teams may use tools like curl or PowerShell to download files from public services for legitimate automation or scripting purposes. However, use of these binaries to contact domains commonly associated with file sharing or temporary hosting diff --git a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml index 7ea531ccb15..868531d2817 100644 --- a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml +++ b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Suspicious File Download via Headless Browser id: cd0e816f-f67d-4dbe-a153-480b546e867e version: 6 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -74,14 +74,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___suspicious_file_download_via_headless_browser_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Some internal automation frameworks may invoke Chromium browsers in headless mode to programmatically access internal services or webpages. These tools may occasionally download legitimate resources as part of their normal behavior. diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml index 30cb586fc2a..c3ab060c003 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Suspicious Network Connection From Process With No Args id: 54fa06c5-96a2-4406-a4a7-44d93ddbd173 version: 6 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -49,14 +49,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___suspicious_network_connection_from_process_with_no_args_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Some system binaries may execute without arguments in rare legitimate scenarios (e.g., certain service launches), and initiate a network connection to microsoft servers for telemetry or update purposes. Apply additional filters as needed. diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml index 8fe5860f2bc..7a99176ded8 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Suspicious Network Connection Initiated via MsXsl id: 1cbcf75f-0e45-4f29-8c1b-7fcd7e55cc55 version: 6 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -43,14 +43,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___suspicious_network_connection_initiated_via_msxsl_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | False positives may occur in development or administrative environments where msxsl.exe is used for legitimate XML transformations. However, its use is uncommon in standard user activity diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml index 681ce03876d..6586f1d026e 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Suspicious Network Connection to IP Lookup Service API id: 568cb83e-d79e-4a23-85ec-6e1f6c30cb2f version: 8 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk, Janantha Marasinghe status: production type: Anomaly @@ -53,14 +53,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | Internal scripts or agents performing network checks may query IP geolocation services. Tune by excluding known tools or adding internal allowlists for destination domains or process names and commandlines. diff --git a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml index bdcf425a928..e79046f8d0f 100644 --- a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml @@ -2,7 +2,7 @@ name: Cisco NVM - Webserver Download From File Sharing Website id: 1984f997-3b49-4d4b-a7e9-dc5dbf88370e version: 7 creation_date: '2025-07-01' -modification_date: '2026-07-14' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -46,14 +46,13 @@ search: | additional_logged_in_users_list module_name_list module_hash_list src dest_hostname dest dest_port transport firstTime lastTime | `cisco_nvm___webserver_download_from_file_sharing_website_filter` -how_to_implement: | +how_to_implement: |- This search requires Network Visibility Module logs, which includes the flow data sourcetype. This search uses an input macro named `cisco_network_visibility_module_flowdata`. - We strongly recommend that you specify your environment-specific configurations - (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. + We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. - The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221). + The logs are to be ingested using the Cisco Security Cloud App for Splunk (https://splunkbase.splunk.com/app/7404). known_false_positives: | In rare cases, a web server may make outbound connections to pull content for legitimate purposes (e.g., downloading templates or updates from a trusted source). However, communication to anonymous file-sharing or temporary content domains is strongly suspicious. diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 8f922873d49..7fb53d11a58 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -1,8 +1,8 @@ name: Common Ransomware Extensions id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec -version: 22 +version: 23 creation_date: '2019-10-16' -modification_date: '2026-07-02' +modification_date: '2026-09-22' author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk, Steven Dick status: production type: TTP @@ -56,7 +56,7 @@ search: | Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | rex field=file_name "(?(\.[^\.]+){1,2})$" - | lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Extensions Name + | lookup local=t update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Extensions Name | search Name !=False | stats min(firstTime) as firstTime max(lastTime) as lastTime @@ -105,6 +105,9 @@ intermediate_findings: type: system score: 50 message: The device $dest$ wrote $file_count$ files to $path_count$ path(s) with the $file_extension$ extension. This extension and behavior may indicate a $Name$ ransomware attack. +threat_objects: + - field: file_path + type: file_path analytic_story: - Rhysida Ransomware - Prestige Ransomware diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml index 49b1b9120d8..7eb280d8203 100644 --- a/detections/endpoint/control_loading_from_world_writable_directory.yml +++ b/detections/endpoint/control_loading_from_world_writable_directory.yml @@ -2,7 +2,7 @@ name: Control Loading from World Writable Directory id: 10423ac4-10c9-11ec-8dc4-acde48001122 version: 13 creation_date: '2021-09-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -20,6 +20,7 @@ references: - https://attack.mitre.org/techniques/T1218/011/ - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.002/T1218.002.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -53,6 +54,8 @@ analytic_story: asset_type: Endpoint cve: - CVE-2021-40444 +atomic_guid: + - 037e9d8a-9e46-4255-8b33-2ae3b545ca6f mitre_attack_id: - T1218.002 product: diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index 88e5ff9751b..d5039c90a25 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -2,7 +2,7 @@ name: Create or delete windows shares using net exe id: 743a322c-9a68-4a0f-9c17-85d9cce2a27c version: 18 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Splunk status: production type: TTP @@ -30,6 +30,8 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators often leverage net.exe to create or delete network shares. You should verify that the activity was intentional and is legitimate. references: - https://attack.mitre.org/techniques/T1070/005/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1070.005/T1070.005.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1070.005/T1070.005.yaml#L21 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +65,9 @@ analytic_story: - Prestige Ransomware - DarkGate Malware asset_type: Endpoint +atomic_guid: + - 14c38f32-6509-46d8-ab43-d53e32d2b131 + - 09210ad5-1ef2-4077-9ad3-7351e13e9222 mitre_attack_id: - T1070.005 product: diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml index 744a19680f8..c0b325b2304 100644 --- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml +++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml @@ -1,30 +1,40 @@ name: Creation of lsass Dump with Taskmgr id: b2fbe95a-9c62-4c12-8a29-24b97e84c0cd -version: 14 +version: 15 creation_date: '2019-12-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic detects the creation of an lsass.exe process dump using Windows Task Manager. It leverages Sysmon EventID 11 to identify file creation events where the target filename matches *lsass*.dmp. This activity is significant because creating an lsass dump can be a precursor to credential theft, as the dump file contains sensitive information such as user passwords. If confirmed malicious, an attacker could use the lsass dump to extract credentials and escalate privileges, potentially compromising the entire network. +description: |- + The following analytic detects the creation of an lsass.exe process dump using Windows Task Manager. + It leverages Sysmon EventID 11 to identify file creation events where the target filename matches *lsass*.dmp. + This activity is significant because creating an lsass dump can be a precursor to credential theft, as the dump file contains sensitive information such as user passwords. data_source: - Sysmon EventID 11 search: |- - `sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp - | stats count min(_time) as firstTime max(_time) as lastTime - BY action dest file_name - file_path process_guid process_id - user_id vendor_product process_name - TargetFilename - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `creation_of_lsass_dump_with_taskmgr_filter` + `sysmon` + EventID=11 + process_name=taskmgr.exe + file_path=*lsass*.dmp + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY action dest + file_name file_path + process_name process_guid process_id + user_id vendor_product + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `creation_of_lsass_dump_with_taskmgr_filter` how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 11 for detecting file create of lsass.dmp. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. known_false_positives: Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-5---dump-lsassexe-memory-using-windows-task-manager - https://attack.mitre.org/techniques/T1003/001/ - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L122 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -35,11 +45,14 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: $process_name$ was identified on endpoint $dest$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager. + title: The process [$process_name$] was identified on endpoint [$dest$] writing [$file_path$] to disk. entity: field: dest type: system score: 50 +threat_objects: + - field: file_path + type: file_path analytic_story: - Credential Dumping - CISA AA22-257A @@ -47,6 +60,8 @@ analytic_story: - Seashell Blizzard - Scattered Lapsus$ Hunters asset_type: Windows +atomic_guid: + - dea6c349-f1c6-44f3-87a1-1ed33a59a607 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index 05b52a99353..d5262c808c0 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -2,7 +2,7 @@ name: Creation of Shadow Copy id: eb120f5f-b879-4a63-97c1-93352b5df844 version: 13 creation_date: '2019-12-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -33,6 +33,8 @@ known_false_positives: Legitimate administrator usage of Vssadmin or Wmic will c references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L116 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +64,9 @@ analytic_story: - Compromised Windows Host - Credential Dumping asset_type: Endpoint +atomic_guid: + - dcebead7-6c28-4b4b-bf3c-79deb1b1fc7f + - 224f7de0-8f0a-4a94-b5d8-989b036c86da mitre_attack_id: - T1003.003 product: diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index f6257bbe425..92750935e23 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -2,7 +2,7 @@ name: Creation of Shadow Copy with wmic and powershell id: 2ed8b538-d284-449a-be1d-82ad1dbd186b version: 15 creation_date: '2019-12-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -32,6 +32,8 @@ known_false_positives: Legitimate administrator usage of wmic to create a shadow references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L116 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L204 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +61,9 @@ analytic_story: - Compromised Windows Host - Credential Dumping asset_type: Endpoint +atomic_guid: + - 224f7de0-8f0a-4a94-b5d8-989b036c86da + - 542bb97e-da53-436b-8e43-e0a7d31a6c24 mitre_attack_id: - T1003.003 product: diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml index c62a95e4524..39fdc97d94a 100644 --- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml @@ -2,7 +2,7 @@ name: Credential Dumping via Copy Command from Shadow Copy id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -16,6 +16,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L31 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -41,6 +42,8 @@ analytic_story: - Compromised Windows Host - Credential Dumping asset_type: Endpoint +atomic_guid: + - c6237146-9ea6-4711-85c9-c56d263a6b03 mitre_attack_id: - T1003.003 product: diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml index 4363f7400e0..2dc83ba0168 100644 --- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml @@ -2,7 +2,7 @@ name: Credential Dumping via Symlink to Shadow Copy id: c5eac648-fae0-4263-91a6-773df1f4c903 version: 14 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L228 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -54,6 +55,8 @@ analytic_story: - Compromised Windows Host - Credential Dumping asset_type: Endpoint +atomic_guid: + - 21748c28-2793-4284-9e07-d6d028b66702 mitre_attack_id: - T1003.003 product: diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index c5148d86a4e..55a0ec44a14 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -2,7 +2,7 @@ name: Delete ShadowCopy With PowerShell id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122 version: 13 creation_date: '2021-05-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -26,6 +26,7 @@ known_false_positives: No false positives have been identified at this time. references: - https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations - https://www.techtarget.com/searchwindowsserver/tutorial/Set-up-PowerShell-script-block-logging-for-added-security + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L82 drilldown_searches: - name: View the detection results for - "$user_id$" and "$dest$" search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' @@ -55,6 +56,8 @@ analytic_story: - Cactus Ransomware - VanHelsing Ransomware asset_type: Endpoint +atomic_guid: + - 39a295ca-7059-4a88-86f6-09556c1211e7 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index a6317940389..4e8f64722a3 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -2,7 +2,7 @@ name: Deleting Shadow Copies id: b89919ed-ee5f-492c-b139-95dbb162039e version: 19 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -34,6 +34,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: vssadmin.exe and wmic.exe are standard applications shipped with modern versions of windows. They may be used by administrators to legitimately delete old backup copies, although this is typically rare. references: - https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -80,6 +81,8 @@ analytic_story: - Storm-2460 CLFS Zero Day Exploitation - Void Manticore asset_type: Endpoint +atomic_guid: + - 43819286-91a9-4369-90ed-d31fb4da2c01 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index e2a9be602fc..a7052b3dca7 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -1,33 +1,55 @@ name: Detect Credential Dumping through LSASS access id: 2c365e57-4414-4540-8dc0-73ab10729996 -version: 15 +version: 16 creation_date: '2019-12-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP -description: The following analytic detects attempts to read LSASS memory, indicative of credential dumping. It leverages Sysmon EventCode 10, filtering for specific access permissions (0x1010 and 0x1410) on the lsass.exe process. This activity is significant because it suggests an attacker is trying to extract credentials from LSASS memory, potentially leading to unauthorized access, data breaches, and compromise of sensitive information. If confirmed malicious, this could enable attackers to escalate privileges, move laterally within the network, or exfiltrate data. Extensive triage is necessary to differentiate between malicious and benign activities. +description: |- + The following analytic detects attempts to read LSASS memory, indicative of credential dumping. + It leverages Sysmon EventCode 10 and checks for "PROCESS_VM_READ" with query information access on lsass.exe. data_source: - Sysmon EventID 10 search: |- - `sysmon` EventCode=10 TargetImage=*lsass.exe (GrantedAccess=0x1010 OR GrantedAccess=0x1410) - | stats count min(_time) as firstTime max(_time) as lastTime - BY CallTrace EventID GrantedAccess - Guid Opcode ProcessID - SecurityID SourceImage SourceProcessGUID - SourceProcessId TargetImage TargetProcessGUID - TargetProcessId UserID dest - granted_access parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path - process_exec process_guid process_id - process_name process_path signature - signature_id user_id vendor_product - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `detect_credential_dumping_through_lsass_access_filter` + `sysmon` + EventCode=10 + TargetImage="*\\lsass.exe" + + ``` + Convert GrantedAccess from hexadecimal to decimal. + Match "PROCESS_VM_READ" with either "PROCESS_QUERY_LIMITED_INFORMATION" or "PROCESS_QUERY_INFORMATION", which represent the either the "0x1010" or "0x1410" hexadecimal masks. + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_VM_READ = 16 + | eval PROCESS_QUERY_LIMITED_INFORMATION = 4096 + | eval PROCESS_QUERY_INFORMATION = 1024 + | eval vm_read_set = bit_and(g_access_decimal, PROCESS_VM_READ) + | eval query_limited_set = bit_and(g_access_decimal, PROCESS_QUERY_LIMITED_INFORMATION) + | eval query_information_set = bit_and(g_access_decimal, PROCESS_QUERY_INFORMATION) + | where vm_read_set == PROCESS_VM_READ + AND query_limited_set == PROCESS_QUERY_LIMITED_INFORMATION + AND (query_information_set == 0 OR query_information_set == PROCESS_QUERY_INFORMATION) + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `detect_credential_dumping_through_lsass_access_filter` how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. known_false_positives: The activity may be legitimate. Other tools can access lsass for legitimate reasons, and it's possible this event could be generated in those cases. In these cases, false positives should be fairly obvious and you may need to tweak the search to eliminate noise. -references: [] +references: + - https://www.microsoft.com/en-us/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks/ + - https://attack.mitre.org/techniques/T1003/001/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" and "$TargetImage$" search: '%original_detection_search% | search dest = "$dest$" TargetImage = "$TargetImage$"' @@ -38,11 +60,14 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: The $SourceImage$ has attempted access to read $TargetImage$ was identified on endpoint $dest$, this is indicative of credential dumping and should be investigated. + title: The process [$SourceImage$] requested read access via the access mask [$granted_access$] to [$TargetImage$] on [$dest$], which may indicate credential dumping. entity: field: dest type: system score: 50 +threat_objects: + - field: SourceImage + type: file_path analytic_story: - Detect Zerologon Attack - CISA AA23-347A @@ -51,6 +76,8 @@ analytic_story: - Lokibot - Scattered Lapsus$ Hunters asset_type: Windows +atomic_guid: + - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index b12bf89d2b9..5cd4424c36d 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -2,7 +2,7 @@ name: Detect HTML Help URL in Command Line id: 8c5835b9-39d9-438b-817c-95f14c69a31e version: 17 creation_date: '2021-02-11' -modification_date: '2026-07-14' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -35,6 +35,7 @@ references: - https://blog.sevagas.com/?Hacking-around-HTA-files - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.001/T1218.001.yaml#L30 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -68,6 +69,8 @@ analytic_story: - Compromised Windows Host - Cisco Network Visibility Module Analytics asset_type: Endpoint +atomic_guid: + - 0f8af516-9818-4172-922b-42986ef1e81d mitre_attack_id: - T1218.001 product: diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml index 246aba48a5f..874d1399a09 100644 --- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml @@ -2,7 +2,7 @@ name: Detect HTML Help Using InfoTech Storage Handlers id: 0b2eefa5-5508-450d-b970-3dd2fb761aec version: 15 creation_date: '2021-02-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -34,6 +34,7 @@ references: - https://lolbas-project.github.io/lolbas/Binaries/Hh/ - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7 - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.001/T1218.001.yaml#L121 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -64,6 +65,8 @@ analytic_story: - Compromised Windows Host - APT37 Rustonotto and FadeStealer asset_type: Endpoint +atomic_guid: + - 4f83adda-f5ec-406d-b318-9773c9ca92e5 mitre_attack_id: - T1218.001 product: diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml index 444545ff5eb..bac8267504f 100644 --- a/detections/endpoint/detect_mshta_inline_hta_execution.yml +++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml @@ -2,7 +2,7 @@ name: Detect mshta inline hta execution id: a0873b32-5b68-11eb-ae93-0242ac130002 version: 22 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Michael Haag, Splunk status: production type: TTP @@ -36,6 +36,9 @@ references: - https://github.com/redcanaryco/AtomicTestHarnesses - https://redcanary.com/blog/introducing-atomictestharnesses/ - https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L20 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L216 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -71,6 +74,10 @@ analytic_story: - APT37 Rustonotto and FadeStealer - BlankGrabber Stealer asset_type: Endpoint +atomic_guid: + - 1483fab9-4f52-4217-a9ce-daa9d7747cae + - 906865c3-e05f-4acc-85c4-fbc185455095 + - 8707a805-2b76-4f32-b1c0-14e558205772 mitre_attack_id: - T1218.005 product: diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index a38dbcb9880..e2e33938374 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -2,7 +2,7 @@ name: Detect MSHTA Url in Command Line id: 9b3af1e6-5b68-11eb-ae93-0242ac130002 version: 21 creation_date: '2020-04-29' -modification_date: '2026-07-20' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -36,6 +36,7 @@ references: - https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing - https://denwp.com/dissecting-lumma-malware/ - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/behind-the-captcha-a-clever-gateway-of-malware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L32 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -73,6 +74,8 @@ analytic_story: - NetSupport RMM Tool Abuse - Starland RAT Campaign asset_type: Endpoint +atomic_guid: + - c4b97eeb-5249-4455-a607-59f95485cb45 mitre_attack_id: - T1218.005 product: diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index 10c569305e2..f3230cf3a92 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -2,7 +2,7 @@ name: Detect New Local Admin account id: b25f6f62-0712-43c1-b203-083231ffd97d version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -36,7 +36,8 @@ search: | | `detect_new_local_admin_account_filter` how_to_implement: You must be ingesting Windows event logs using the Splunk Windows TA and collecting event code 4720 and 4732 known_false_positives: The activity may be legitimate. For this reason, it's best to verify the account with an administrator and ask whether there was a valid service request for the account creation. If your local administrator group name is not "Administrators", this search may generate an excessive number of false positives -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L156 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -65,6 +66,8 @@ analytic_story: - CISA AA24-241A - Scattered Lapsus$ Hunters asset_type: Windows +atomic_guid: + - fda74566-a604-4581-a4cc-fbbe21d66559 mitre_attack_id: - T1136.001 product: diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml index 3c269270f41..0e9292cc278 100644 --- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml @@ -2,7 +2,7 @@ name: Detect Path Interception By Creation Of program exe id: cbef820c-e1ff-407f-887f-0a9240a2d477 version: 18 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -16,6 +16,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1574.009/T1574.009.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -46,6 +47,8 @@ analytic_story: - Windows Persistence Techniques - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 2770dea7-c50f-457b-84c4-c40a47460d9f mitre_attack_id: - T1574.009 product: diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index cdc2f6698e5..847e1b446b6 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -2,7 +2,7 @@ name: Detect PsExec With accepteula Flag id: 27c3a83d-cada-47c6-9042-67baf19d2574 version: 19 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Splunk status: production type: TTP @@ -34,6 +34,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators can leverage PsExec for accessing remote systems and might pass `accepteula` as an argument if they are running this tool for the first time. However, it is not likely that you'd see multiple occurrences of this event on a machine references: - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1021.002/T1021.002.yaml#L55 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -79,6 +80,8 @@ analytic_story: - VanHelsing Ransomware - Storm-0501 Ransomware asset_type: Endpoint +atomic_guid: + - 0eb03d41-79e4-4393-8e57-6344856be1cf mitre_attack_id: - T1021.002 product: diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index d6c5a7d777b..6c4e565d054 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -2,7 +2,7 @@ name: Detect Regsvr32 Application Control Bypass id: 070e9b80-6252-11eb-ae93-0242ac130002 version: 15 creation_date: '2021-01-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/ - https://support.microsoft.com/en-us/topic/how-to-use-the-regsvr32-tool-and-troubleshoot-regsvr32-error-messages-a98d960a-7392-e6fe-d90a-3f4e0cb543e5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.010/T1218.010.yaml#L38 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -67,6 +68,8 @@ analytic_story: - BlackByte Ransomware - PHP-CGI RCE Attack on Japanese Organizations asset_type: Endpoint +atomic_guid: + - c9d0c4ef-8a96-4794-a75b-3d3a5e6f2a36 mitre_attack_id: - T1218.010 product: diff --git a/detections/endpoint/detect_remote_access_software_usage_file.yml b/detections/endpoint/detect_remote_access_software_usage_file.yml index 6c971f45ac7..0746d33835a 100644 --- a/detections/endpoint/detect_remote_access_software_usage_file.yml +++ b/detections/endpoint/detect_remote_access_software_usage_file.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage File id: 3bf5541a-6a45-4fdc-b01d-59b899fff961 -version: 16 +version: 17 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -40,7 +40,7 @@ search: | | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Filesystem)` - | lookup remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category + | lookup local=t remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_file_filter` diff --git a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml index 2c3579d0b6f..b7e8eb806bb 100644 --- a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml +++ b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage FileInfo id: ccad96d7-a48c-4f13-8b9c-9f6a31cba454 -version: 15 +version: 16 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -19,7 +19,7 @@ search: |- process_hash process_id process_integrity_level process_name process_path user user_id vendor_product - | lookup remote_access_software remote_utility_fileinfo AS Product OUTPUT isutility, description as signature, comment_reference as desc, category + | lookup local=t remote_access_software remote_utility_fileinfo AS Product OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_fileinfo_filter` diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml index 49afb5a4844..b579e35a226 100644 --- a/detections/endpoint/detect_remote_access_software_usage_process.yml +++ b/detections/endpoint/detect_remote_access_software_usage_process.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage Process id: ffd5e001-2e34-48f4-97a2-26dc4bb08178 -version: 17 +version: 18 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Steven Dick, Sebastian Wurl, Splunk Community status: production type: Anomaly @@ -24,7 +24,7 @@ search: | | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` - | lookup remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category + | lookup local=t remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_process_filter` @@ -34,6 +34,17 @@ references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L95 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L222 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L250 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L287 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L314 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L342 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L371 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L452 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L483 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1219/T1219.yaml#L509 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -77,6 +88,18 @@ analytic_story: - Scattered Lapsus$ Hunters - Storm-0501 Ransomware asset_type: Endpoint +atomic_guid: + - 8ca3b96d-8983-4a7f-b125-fc98cc0a2aa0 + - d03683ec-aae0-42f9-9b4c-534780e0f8e1 + - 0ae9e327-3251-465a-a53b-485d4e3f58fa + - fbff3f1f-b0bf-448e-840f-7e1687affdce + - ecca999b-e0c8-40e8-8416-ad320b146a75 + - 19acf63b-55c4-4b6a-8552-00a8865105c8 + - 42e51815-a6cc-4c75-b970-3f0ff54b610e + - b1b8128b-c5d4-4de9-bf70-e60419274562 + - b025c580-029e-4023-888d-a42710d76934 + - 3e1858ee-3550-401c-86ec-5e70ed79295b + - 1aea6d15-70f1-4b4e-8b02-397b5d5ffe75 mitre_attack_id: - T1219 product: diff --git a/detections/endpoint/detect_remote_access_software_usage_registry.yml b/detections/endpoint/detect_remote_access_software_usage_registry.yml index 3d9d5dfbde7..f000f5d3d43 100644 --- a/detections/endpoint/detect_remote_access_software_usage_registry.yml +++ b/detections/endpoint/detect_remote_access_software_usage_registry.yml @@ -1,15 +1,15 @@ name: Detect Remote Access Software Usage Registry id: 33804986-25dd-43cf-bb6b-dc14956c7cbc -version: 13 +version: 14 creation_date: '2024-12-28' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly description: The following analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` latest(Registry.process_guid) as process_guid count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*" OR (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" AND Registry.registry_value_name="ImagePath")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rex field=registry_value_data "(\")?.+\\\(?[^\"=]+\.[^\" ]{1,5})(\")?" | rex field=registry_value_data "(?[^\.]+\.[^\" ]{1,5}$)" | eval file_name = coalesce(file_name_1,file_name_2) | lookup remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_registry_filter`' +search: '| tstats `security_content_summariesonly` latest(Registry.process_guid) as process_guid count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*" OR (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" AND Registry.registry_value_name="ImagePath")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rex field=registry_value_data "(\")?.+\\\(?[^\"=]+\.[^\" ]{1,5})(\")?" | rex field=registry_value_data "(?[^\.]+\.[^\" ]{1,5}$)" | eval file_name = coalesce(file_name_1,file_name_2) | lookup local=t remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_registry_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Registry` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content references: diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml index 55da551a7bb..84014e941a4 100644 --- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml @@ -2,7 +2,7 @@ name: Detect Rundll32 Inline HTA Execution id: 91c79f14-5b41-11eb-ae93-0242ac130002 version: 14 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,8 @@ references: - https://github.com/redcanaryco/AtomicTestHarnesses - https://redcanary.com/blog/introducing-atomictestharnesses/ - https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L25 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L42 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -54,6 +56,9 @@ analytic_story: - Living Off The Land - APT37 Rustonotto and FadeStealer asset_type: Endpoint +atomic_guid: + - 638730e7-7aed-43dc-bf8c-8117f805f5bb + - 32d1cf1b-cbc2-4c09-8d05-07ec5c83a821 mitre_attack_id: - T1218.005 product: diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml index 63bdf218366..29bf8194068 100644 --- a/detections/endpoint/detect_sharphound_command_line_arguments.yml +++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml @@ -2,7 +2,7 @@ name: Detect SharpHound Command-Line Arguments id: a0bdd2f6-c2ff-11eb-b918-acde48001122 version: 12 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ references: - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors - https://github.com/BloodHoundAD/SharpHound3 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1059.001/T1059.001.yaml#L36 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -53,6 +54,8 @@ analytic_story: - Ransomware - BlackSuit Ransomware asset_type: Endpoint +atomic_guid: + - a21bb23e-e677-4ee7-af90-6931b57b6350 mitre_attack_id: - T1069.001 - T1069.002 diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml index 37561415c35..30c27dcd9d3 100644 --- a/detections/endpoint/detect_sharphound_file_modifications.yml +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -2,7 +2,7 @@ name: Detect SharpHound File Modifications id: 42b4b438-beed-11eb-ba1d-acde48001122 version: 13 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -29,6 +29,7 @@ references: - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors - https://github.com/BloodHoundAD/SharpHound3 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1059.001/T1059.001.yaml#L36 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -55,6 +56,8 @@ analytic_story: - Ransomware - BlackSuit Ransomware asset_type: Endpoint +atomic_guid: + - a21bb23e-e677-4ee7-af90-6931b57b6350 mitre_attack_id: - T1069.001 - T1069.002 diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml index ae3e4b97b96..db38a68f5dd 100644 --- a/detections/endpoint/detect_sharphound_usage.yml +++ b/detections/endpoint/detect_sharphound_usage.yml @@ -2,7 +2,7 @@ name: Detect SharpHound Usage id: dd04b29a-beed-11eb-87bc-acde48001122 version: 13 creation_date: '2021-06-03' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -37,6 +37,7 @@ references: - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors - https://github.com/BloodHoundAD/SharpHound3 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1059.001/T1059.001.yaml#L36 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -56,6 +57,8 @@ analytic_story: - Windows Discovery Techniques - Ransomware asset_type: Endpoint +atomic_guid: + - a21bb23e-e677-4ee7-af90-6931b57b6350 mitre_attack_id: - T1069.001 - T1069.002 diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index 1e8c89f64a5..0f2a1fc0a0a 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -2,7 +2,7 @@ name: Disable ETW Through Registry id: f0eacfa4-d33f-11eb-8f9d-acde48001122 version: 15 creation_date: '2021-06-23' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: network operator may disable this feature of windows but not so common. references: - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1571 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1581 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +36,9 @@ analytic_story: - CISA AA23-347A - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 8a4c33be-a0d3-434a-bee6-315405edbd5b + - 19c07a45-452d-4620-90ed-4c34fffbe758 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml index 67810100423..88c0511f904 100644 --- a/detections/endpoint/disable_logs_using_wevtutil.yml +++ b/detections/endpoint/disable_logs_using_wevtutil.yml @@ -2,7 +2,7 @@ name: Disable Logs Using WevtUtil id: 236e7c8e-c9d9-11eb-a824-acde48001122 version: 14 creation_date: '2021-06-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -33,6 +33,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: network operator may disable audit event logs for debugging purposes. references: - https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L105 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -53,6 +54,8 @@ analytic_story: - CISA AA23-347A - Rhysida Ransomware asset_type: Endpoint +atomic_guid: + - b26a3340-dad7-4360-9176-706269c74103 mitre_attack_id: - T1685.005 product: diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 95c6027ece7..29007d8b5cd 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -2,7 +2,7 @@ name: Disable Registry Tool id: cd2cf33c-9201-11eb-a10a-acde48001122 version: 17 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: admin may disable this application for non technical user. references: - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L174 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Windows Registry Abuse - NjRAT asset_type: Endpoint +atomic_guid: + - ac34b0f7-0f85-4ac0-b93e-3ced2bc69bb8 mitre_attack_id: - T1112 - T1685 diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index f01e4f92e98..d08ed0971c1 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -2,7 +2,7 @@ name: Disable Windows Behavior Monitoring id: 79439cae-9200-11eb-a4d3-acde48001122 version: 24 creation_date: '2021-03-31' -modification_date: '2026-06-08' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -31,6 +31,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: admin or user may choose to disable this windows features. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1051 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -63,6 +64,8 @@ analytic_story: - BlankGrabber Stealer - Salat Stealer asset_type: Endpoint +atomic_guid: + - a72cfef8-d252-48b3-b292-635d332625c3 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index ca614ff9528..947161c2e43 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -2,7 +2,7 @@ name: Disabling CMD Application id: ff86077c-9212-11eb-a1e6-acde48001122 version: 17 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: admin may disable this application for non technical user. references: - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L188 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -40,6 +41,8 @@ analytic_story: - Windows Registry Abuse - NjRAT asset_type: Endpoint +atomic_guid: + - d2561a6d-72bd-408c-b150-13efe1801c2a mitre_attack_id: - T1112 - T1685 diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index 3e4d52301ee..3332cbc903e 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -2,7 +2,7 @@ name: Disabling Remote User Account Control id: bbc644bc-37df-4e1a-9c88-ec9a53e2038c version: 14 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Patrick Bareiss, Splunk status: production type: TTP @@ -12,7 +12,8 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA* Registry.registry_value_data="0x00000000" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `disabling_remote_user_account_control_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications. known_false_positives: This registry key may be modified via administrators to implement a change in system policy. This type of change should be a very rare occurrence. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1548.002/T1548.002.yaml#L151 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -42,6 +43,8 @@ analytic_story: - Azorult - AgentTesla asset_type: Endpoint +atomic_guid: + - 9e8af564-53ec-407e-aaa8-3cb20c3af7f9 mitre_attack_id: - T1548.002 product: diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 1d00844d939..3a75b8fc099 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -2,7 +2,7 @@ name: Disabling SystemRestore In Registry id: f4f837e2-91fb-11eb-8bf6-acde48001122 version: 15 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: in some cases admin can disable systemrestore on a machine. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L132 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -40,6 +41,8 @@ analytic_story: - Windows Registry Abuse - NjRAT asset_type: Endpoint +atomic_guid: + - 66e647d1-8741-4e43-b7c1-334760c2047f mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml index 1a3b7b14d24..4913e9b7abd 100644 --- a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml +++ b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml @@ -2,7 +2,7 @@ name: Domain Group Discovery with Adsisearcher id: 089c862f-5f83-49b5-b1c8-7e4ff66560c7 version: 14 creation_date: '2021-08-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -26,6 +26,7 @@ known_false_positives: Administrators or power users may use Adsisearcher for tr references: - https://attack.mitre.org/techniques/T1069/002/ - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L150 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +46,8 @@ analytic_story: - Scattered Lapsus$ Hunters - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 9f4e344b-8434-41b3-85b1-d38f29d148d0 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml index 0897dbdc89a..12add244b61 100644 --- a/detections/endpoint/dsquery_domain_discovery.yml +++ b/detections/endpoint/dsquery_domain_discovery.yml @@ -2,7 +2,7 @@ name: DSQuery Domain Discovery id: cc316032-924a-11eb-91a2-acde48001122 version: 13 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://blog.harmj0y.net/redteaming/a-guide-to-attacking-domain-trusts/ - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11) - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc754232(v=ws.11) + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +64,8 @@ analytic_story: - Domain Trust Discovery - Compromised Windows Host asset_type: Endpoint +atomic_guid: + - 4700a710-c821-4e17-a3ec-9e4c81d6845f mitre_attack_id: - T1482 product: diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index e5bad39bcfd..ce62844c17e 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -2,7 +2,7 @@ name: Dump LSASS via comsvcs DLL id: 8943b567-f14d-4ee8-a0bb-2121d4ce3184 version: 17 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Patrick Bareiss, Splunk status: production type: TTP @@ -31,6 +31,7 @@ references: - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/ - https://twitter.com/SBousseaden/status/1167417096374050817 - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L45 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -73,6 +74,8 @@ analytic_story: - Scattered Lapsus$ Hunters - Hellcat Ransomware asset_type: Endpoint +atomic_guid: + - 2536dee2-12fb-459a-8c37-971844fa73be mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index c02b721f037..f83b777679a 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -2,7 +2,7 @@ name: Dump LSASS via procdump id: 3742ebfe-64c2-11eb-ae93-0242ac130002 version: 20 creation_date: '2021-02-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -76,6 +76,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - https://x.com/wietze/status/1958302556033065292?s=12 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -110,6 +111,8 @@ analytic_story: - Seashell Blizzard - Storm-2460 CLFS Zero Day Exploitation asset_type: Endpoint +atomic_guid: + - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index e207d4573fd..e2c065432ac 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -2,7 +2,7 @@ name: Enable WDigest UseLogonCredential Registry id: 0c7d8ffe-25b1-11ec-9f39-acde48001122 version: 16 creation_date: '2021-10-05' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: No false positives have been identified at this time. references: - https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L39 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L54 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -40,6 +42,9 @@ analytic_story: - Windows Registry Abuse - CISA AA22-320A asset_type: Endpoint +atomic_guid: + - c0413fb5-33e2-40b7-9b6f-60b29f4a7a18 + - 68254a85-aa42-4312-a695-38b7276307f8 mitre_attack_id: - T1112 - T1003 diff --git a/detections/endpoint/esentutl_sam_copy.yml b/detections/endpoint/esentutl_sam_copy.yml index bff789bd1fa..508a661ec4e 100644 --- a/detections/endpoint/esentutl_sam_copy.yml +++ b/detections/endpoint/esentutl_sam_copy.yml @@ -2,7 +2,7 @@ name: Esentutl SAM Copy id: d372f928-ce4f-11eb-a762-acde48001122 version: 10 creation_date: '2021-08-18' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -31,10 +31,13 @@ known_false_positives: False positives should be limited. Filter as needed. references: - https://github.com/redcanaryco/atomic-red-team/blob/6a570c2a4630cf0c2bd41a2e8375b5d5ab92f700/atomics/T1003.002/T1003.002.md - https://attack.mitre.org/software/S0404/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.002/T1003.002.yaml#L66 analytic_story: - Credential Dumping - Living Off The Land asset_type: Endpoint +atomic_guid: + - a90c2f4d-6726-444e-99d2-a00cd7c20480 mitre_attack_id: - T1003.002 product: diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 9238e5d7fff..277d02f4520 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -2,7 +2,7 @@ name: Eventvwr UAC Bypass id: 9cf8fe08-7ad8-11eb-9819-acde48001122 version: 13 creation_date: '2021-03-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Steven Dick, Michael Haag, Splunk status: production type: TTP @@ -17,6 +17,8 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md - https://attack.mitre.org/techniques/T1548/002/ - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1548.002/T1548.002.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1548.002/T1548.002.yaml#L24 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -45,6 +47,9 @@ analytic_story: - Windows Registry Abuse - ValleyRAT asset_type: Endpoint +atomic_guid: + - 5073adf8-9a50-4bd9-b298-a9bd2ead8af9 + - a6ce9acf-842a-4af6-8f79-539be7608e2b mitre_attack_id: - T1548.002 product: diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 5b7e8644f40..89453e0e89a 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -1,12 +1,12 @@ name: Excessive Usage of NSLOOKUP App id: 0a69fdaa-a2b8-11eb-b16d-acde48001122 -version: 12 +version: 13 creation_date: '2021-04-22' -modification_date: '2026-05-13' +modification_date: '2026-08-24' author: Teoderick Contreras, Stanislav Miskovic, Splunk status: production type: Anomaly -description: The following analytic detects excessive usage of the nslookup application, which may indicate potential DNS exfiltration attempts. It leverages Sysmon EventCode 1 to monitor process executions, specifically focusing on nslookup.exe. The detection identifies outliers by comparing the frequency of nslookup executions against a calculated threshold. This activity is significant as it can reveal attempts by malware or APT groups to exfiltrate data via DNS queries. If confirmed malicious, this behavior could allow attackers to stealthily transfer sensitive information out of the network, bypassing traditional data exfiltration defenses. +description: The following analytic detects excessive usage of the nslookup application, which may indicate potential DNS exfiltration attempts. It leverages Sysmon EventCode 1 to monitor process executions, specifically focusing on nslookup.exe. The detection identifies outliers by comparing the frequency of nslookup executions against a calculated threshold. This activity is significant as it can reveal attempts by malware or APT groups to exfiltrate data via DNS queries. If confirmed malicious,this behavior could allow attackers to stealthily transfer sensitive information out of the network, bypassing traditional data exfiltration defenses. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 @@ -25,7 +25,7 @@ search: |- | `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of nslookup.exe may be used. -known_false_positives: No false positives have been identified at this time. +known_false_positives: Network or DNS monitoring tools that perform bulk nslookup checks against multiple domains in quick succession (e.g., CDN health checks, load balancer DNS validation scripts) may exceed the detection threshold as part of normal, scheduled operation. Hosts with limited historical baseline data may also cross the dynamic threshold more easily due to low computed average and standard deviation values. Tune the detection or add exceptions for known monitoring tool parent processes as needed. references: - https://www.mandiant.com/resources/fin7-spear-phishing-campaign-targets-personnel-involved-sec-filings - https://www.varonis.com/blog/dns-tunneling diff --git a/detections/endpoint/file_download_or_read_to_pipe_execution.yml b/detections/endpoint/file_download_or_read_to_pipe_execution.yml index 7afb8738003..df3d8bb192e 100644 --- a/detections/endpoint/file_download_or_read_to_pipe_execution.yml +++ b/detections/endpoint/file_download_or_read_to_pipe_execution.yml @@ -1,8 +1,8 @@ name: File Download or Read to Pipe Execution id: 26f86252-1549-45e1-a212-eb26840e86bc -version: 5 +version: 6 creation_date: '2025-10-24' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Michael Haag, Nasreddine Bencherchali, Splunk, DipsyTipsy status: production type: TTP @@ -56,7 +56,7 @@ search: | OR ``` Because the "sh" string can overlap and is a short atom we treat it in a special case ``` Processes.process IN ( - "*|sh" + "*|sh*" "* sh*" ) OR @@ -103,7 +103,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: An instance of $process_name$ was identified on endpoint $dest$ attempting to immediately read or download a file and run it via a shell. + title: An instance of [$process_name$] was identified on endpoint [$dest$] attempting to immediately read or download a file and run it via a shell via the CommandLine [$process$] via the ParentProcess [$parent_process$]. entity: field: user type: user @@ -113,10 +113,10 @@ intermediate_findings: - field: dest type: system score: 50 - message: An instance of $process_name$ was identified on endpoint $dest$ attempting to immediately read or download a file and run it via a shell. + message: An instance of [$process_name$] was identified on endpoint [$dest$] attempting to immediately read or download a file and run it via a shell via the CommandLine [$process$] via the ParentProcess [$parent_process$]. threat_objects: - field: process - type: process_name + type: process - field: process_name type: process_name analytic_story: diff --git a/detections/endpoint/first_time_seen_child_process_of_zoom.yml b/detections/endpoint/first_time_seen_child_process_of_zoom.yml index 6f88871ef26..3c4b132b750 100644 --- a/detections/endpoint/first_time_seen_child_process_of_zoom.yml +++ b/detections/endpoint/first_time_seen_child_process_of_zoom.yml @@ -1,8 +1,8 @@ name: First Time Seen Child Process of Zoom id: e91bd102-d630-4e76-ab73-7e3ba22c5961 -version: 11 +version: 12 creation_date: '2020-05-28' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: David Dorsey, Splunk status: experimental type: Anomaly @@ -20,7 +20,7 @@ search: |- ) BY Processes.process_id Processes.dest | `drop_dm_object_name(Processes)` - | lookup zoom_first_time_child_process dest as dest process_name as process_name OUTPUT firstTimeSeen + | lookup local=t zoom_first_time_child_process dest as dest process_name as process_name OUTPUT firstTimeSeen | where isnull(firstTimeSeen) OR firstTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_window`") | `security_content_ctime(firstTime)` | `first_time_seen_child_process_of_zoom_filter` diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml index 6faaff19d7d..f42622c18f9 100644 --- a/detections/endpoint/fodhelper_uac_bypass.yml +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -2,7 +2,7 @@ name: FodHelper UAC Bypass id: 909f8fd8-7ac8-11eb-a1f3-acde48001122 version: 15 creation_date: '2021-03-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,8 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md - https://github.com/gushmazuko/WinBypass/blob/master/FodhelperBypass.ps1 - https://attack.mitre.org/techniques/T1548/002/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1548.002/T1548.002.yaml#L44 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1548.002/T1548.002.yaml#L64 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +65,9 @@ analytic_story: - Windows Defense Evasion Tactics - BlankGrabber Stealer asset_type: Endpoint +atomic_guid: + - 58f641ea-12e3-499a-b684-44dee46bd182 + - 3f627297-6c38-4e7d-a278-fc2563eaaeaa mitre_attack_id: - T1112 - T1548.002 diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml index 35e8d5cd718..94aabd68e79 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml @@ -2,7 +2,7 @@ name: Get ADDefaultDomainPasswordPolicy with Powershell id: 36e46ebe-065a-11ec-b4c7-acde48001122 version: 10 creation_date: '2021-08-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -49,9 +49,12 @@ references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet - https://attack.mitre.org/techniques/T1201/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1201/T1201.yaml#L110 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - b2698b33-984c-4a1c-93bb-e4ba72a0babb mitre_attack_id: - T1201 product: diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml index bb2744dac84..0fd84d5b523 100644 --- a/detections/endpoint/get_aduser_with_powershell.yml +++ b/detections/endpoint/get_aduser_with_powershell.yml @@ -2,7 +2,7 @@ name: Get ADUser with PowerShell id: 0b6ee3f4-04e3-11ec-a87d-acde48001122 version: 10 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: Hunting @@ -36,10 +36,13 @@ references: - https://www.blackhillsinfosec.com/red-blue-purple/ - https://attack.mitre.org/techniques/T1087/002/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L17 analytic_story: - Active Directory Discovery - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 8b8a6449-be98-4f42-afd2-dedddc7453b2 mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml index b6c105338ea..7d47e8dcceb 100644 --- a/detections/endpoint/get_aduser_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -2,7 +2,7 @@ name: Get ADUser with PowerShell Script Block id: 21432e40-04f4-11ec-b7e6-acde48001122 version: 10 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: Hunting @@ -27,10 +27,13 @@ references: - https://www.blackhillsinfosec.com/red-blue-purple/ - https://attack.mitre.org/techniques/T1087/002/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L17 analytic_story: - Active Directory Discovery - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 8b8a6449-be98-4f42-afd2-dedddc7453b2 mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml index 19669f89fd2..6a4263494ec 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell.yml @@ -2,7 +2,7 @@ name: Get DomainPolicy with Powershell id: b8f9947e-065a-11ec-aafb-acde48001122 version: 11 creation_date: '2021-08-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: TTP @@ -36,6 +36,7 @@ references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/ - https://attack.mitre.org/techniques/T1201/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1201/T1201.yaml#L99 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +64,8 @@ threat_objects: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 3177f4da-3d4b-4592-8bdc-aa23d0b2e843 mitre_attack_id: - T1201 product: diff --git a/detections/endpoint/get_domaintrust_with_powershell.yml b/detections/endpoint/get_domaintrust_with_powershell.yml index 8276c690bd9..f74ffdc7a44 100644 --- a/detections/endpoint/get_domaintrust_with_powershell.yml +++ b/detections/endpoint/get_domaintrust_with_powershell.yml @@ -2,7 +2,7 @@ name: Get-DomainTrust with PowerShell id: 4fa7f846-054a-11ec-a836-acde48001122 version: 10 creation_date: '2021-09-02' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute. references: - https://blog.harmj0y.net/redteaming/a-guide-to-attacking-domain-trusts/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml#L118 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -53,6 +54,8 @@ intermediate_findings: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - f974894c-5991-4b19-aaf5-7cc2fe298c5d mitre_attack_id: - T1482 product: diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml index a8879480e68..88ec1582dff 100644 --- a/detections/endpoint/get_domainuser_with_powershell.yml +++ b/detections/endpoint/get_domainuser_with_powershell.yml @@ -2,7 +2,7 @@ name: Get DomainUser with PowerShell id: 9a5a41d6-04e7-11ec-923c-acde48001122 version: 12 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: TTP @@ -34,6 +34,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L223 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - Active Directory Discovery - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 93662494-5ed7-4454-a04c-8c8372808ac2 mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/get_foresttrust_with_powershell.yml b/detections/endpoint/get_foresttrust_with_powershell.yml index 41c578874ec..e64ae44fd8a 100644 --- a/detections/endpoint/get_foresttrust_with_powershell.yml +++ b/detections/endpoint/get_foresttrust_with_powershell.yml @@ -2,7 +2,7 @@ name: Get-ForestTrust with PowerShell id: 584f4884-0bf1-11ec-a5ec-acde48001122 version: 10 creation_date: '2021-09-02' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -31,6 +31,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute. references: - https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml#L130 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -55,6 +56,8 @@ intermediate_findings: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 58ed10e8-0738-4651-8408-3a3e9a526279 mitre_attack_id: - T1482 product: diff --git a/detections/endpoint/get_wmiobject_group_discovery.yml b/detections/endpoint/get_wmiobject_group_discovery.yml index dcba3dc093c..4598e7afaac 100644 --- a/detections/endpoint/get_wmiobject_group_discovery.yml +++ b/detections/endpoint/get_wmiobject_group_discovery.yml @@ -2,7 +2,7 @@ name: Get WMIObject Group Discovery id: 5434f670-155d-11ec-8cca-acde48001122 version: 9 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -35,9 +35,12 @@ known_false_positives: False positives may be present. Tune as needed. references: - https://attack.mitre.org/techniques/T1069/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L94 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 69119e58-96db-4110-ad27-954e48f3bb13 mitre_attack_id: - T1069.001 product: diff --git a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml index 3a2cdee9a57..06687a5f053 100644 --- a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml +++ b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml @@ -2,7 +2,7 @@ name: Get WMIObject Group Discovery with Script Block Logging id: 69df7f7c-155d-11ec-a055-acde48001122 version: 11 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -30,9 +30,12 @@ references: - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L94 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 69119e58-96db-4110-ad27-954e48f3bb13 mitre_attack_id: - T1069.001 product: diff --git a/detections/endpoint/getadcomputer_with_powershell_script_block.yml b/detections/endpoint/getadcomputer_with_powershell_script_block.yml index 600cf3dc6da..4c45f3b0557 100644 --- a/detections/endpoint/getadcomputer_with_powershell_script_block.yml +++ b/detections/endpoint/getadcomputer_with_powershell_script_block.yml @@ -2,7 +2,7 @@ name: GetAdComputer with PowerShell Script Block id: a9a1da02-8e27-4bf7-a348-f4389c9da487 version: 11 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -25,12 +25,15 @@ known_false_positives: Administrators or power users may use this PowerShell com references: - https://attack.mitre.org/techniques/T1018/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml#L346 analytic_story: - Active Directory Discovery - CISA AA22-320A - Medusa Ransomware - Gozi Malware asset_type: Endpoint +atomic_guid: + - 97e89d9e-e3f5-41b5-a90f-1e0825df0fdf mitre_attack_id: - T1018 product: diff --git a/detections/endpoint/getadgroup_with_powershell.yml b/detections/endpoint/getadgroup_with_powershell.yml index 997e7928c36..c1bbefd3b0f 100644 --- a/detections/endpoint/getadgroup_with_powershell.yml +++ b/detections/endpoint/getadgroup_with_powershell.yml @@ -2,7 +2,7 @@ name: GetAdGroup with PowerShell id: 872e3063-0fc4-4e68-b2f3-f2b99184a708 version: 9 creation_date: '2021-08-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -33,9 +33,12 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://attack.mitre.org/techniques/T1069/002/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L19 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 6d5d8c96-3d2a-4da9-9d6d-9a9d341899a7 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/getadgroup_with_powershell_script_block.yml b/detections/endpoint/getadgroup_with_powershell_script_block.yml index 42f816782f9..6e962e28926 100644 --- a/detections/endpoint/getadgroup_with_powershell_script_block.yml +++ b/detections/endpoint/getadgroup_with_powershell_script_block.yml @@ -2,7 +2,7 @@ name: GetAdGroup with PowerShell Script Block id: e4c73d68-794b-468d-b4d0-dac1772bbae7 version: 12 creation_date: '2021-08-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -26,10 +26,13 @@ known_false_positives: Administrators or power users may use this PowerShell com references: - https://attack.mitre.org/techniques/T1069/002/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L19 analytic_story: - Scattered Lapsus$ Hunters - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 6d5d8c96-3d2a-4da9-9d6d-9a9d341899a7 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/getcurrent_user_with_powershell.yml b/detections/endpoint/getcurrent_user_with_powershell.yml index 543c998725a..4920d258f43 100644 --- a/detections/endpoint/getcurrent_user_with_powershell.yml +++ b/detections/endpoint/getcurrent_user_with_powershell.yml @@ -2,7 +2,7 @@ name: GetCurrent User with PowerShell id: 7eb9c3d5-c98c-4088-acc5-8240bad15379 version: 8 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -32,9 +32,12 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1033/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L67 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 1392bd0f-5d5a-429e-81d9-eb9d4d4d5b3b mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml index bda0937e98e..a1f4716abcc 100644 --- a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml +++ b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml @@ -2,7 +2,7 @@ name: GetCurrent User with PowerShell Script Block id: 80879283-c30f-44f7-8471-d1381f6d437a version: 10 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -26,9 +26,12 @@ known_false_positives: Administrators or power users may use this PowerShell com references: - https://attack.mitre.org/techniques/T1033/ - https://docs.microsoft.com/en-us/dotnet/api/system.security.principal.windowsidentity.getcurrent?view=net-6.0&viewFallbackFrom=net-5.0 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L55 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - dcb6cdee-1fb0-4087-8bf8-88cfd136ba51 mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/getdomaincontroller_with_powershell.yml b/detections/endpoint/getdomaincontroller_with_powershell.yml index 6d257dfc2b7..47c45c98fcf 100644 --- a/detections/endpoint/getdomaincontroller_with_powershell.yml +++ b/detections/endpoint/getdomaincontroller_with_powershell.yml @@ -2,7 +2,7 @@ name: GetDomainController with PowerShell id: 868ee0e4-52ab-484a-833a-6d85b7c028d0 version: 8 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -33,9 +33,12 @@ known_false_positives: Administrators or power users may use PowerView for troub references: - https://attack.mitre.org/techniques/T1018/ - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml#L372 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - b9d2e8ca-5520-4737-8076-4f08913da2c4 mitre_attack_id: - T1018 product: diff --git a/detections/endpoint/getdomaingroup_with_powershell.yml b/detections/endpoint/getdomaingroup_with_powershell.yml index 538ed03bad9..4a0f23382c7 100644 --- a/detections/endpoint/getdomaingroup_with_powershell.yml +++ b/detections/endpoint/getdomaingroup_with_powershell.yml @@ -2,7 +2,7 @@ name: GetDomainGroup with PowerShell id: 93c94be3-bead-4a60-860f-77ca3fe59903 version: 11 creation_date: '2021-08-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -33,6 +33,7 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://attack.mitre.org/techniques/T1069/002/ - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L200 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -51,6 +52,8 @@ finding: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 5a8a181c-2c8e-478d-a943-549305a01230 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml index 0e920c4bf7d..a02305e9030 100644 --- a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml @@ -2,7 +2,7 @@ name: GetDomainGroup with PowerShell Script Block id: 09725404-a44f-4ed3-9efa-8ed5d69e4c53 version: 13 creation_date: '2021-08-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -26,6 +26,7 @@ known_false_positives: Administrators or power users may use this PowerView func references: - https://attack.mitre.org/techniques/T1069/002/ - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L138 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -44,6 +45,8 @@ finding: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 3d1fcd2a-e51c-4cbe-8d84-9a843bad8dc8 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml index 4401f356384..e5b1606c69e 100644 --- a/detections/endpoint/getlocaluser_with_powershell.yml +++ b/detections/endpoint/getlocaluser_with_powershell.yml @@ -2,7 +2,7 @@ name: GetLocalUser with PowerShell id: 85fae8fa-0427-11ec-8b78-acde48001122 version: 9 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -32,9 +32,12 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting. references: - https://attack.mitre.org/techniques/T1087/001/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.001/T1087.001.yaml#L151 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - ae4b6361-b5f8-46cb-a3f9-9cf108ccfe7b mitre_attack_id: - T1087.001 product: diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml index 484c938c43d..fa061c119e2 100644 --- a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml @@ -2,7 +2,7 @@ name: GetWmiObject Ds Computer with PowerShell id: 7141122c-3bc2-4aaa-ab3b-7a85a0bbefc3 version: 9 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Anomaly @@ -54,6 +54,7 @@ known_false_positives: |- Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1018/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml#L383 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -77,6 +78,8 @@ threat_objects: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - e3cf5123-f6c9-4375-bdf2-1bb3ba43a1ad mitre_attack_id: - T1018 product: diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml index 13d308b0783..b23955db43d 100644 --- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml @@ -2,7 +2,7 @@ name: Hiding Files And Directories With Attrib exe id: 6e5a3ae4-90a3-462d-9aa6-0119f638c0f1 version: 18 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Splunk status: production type: TTP @@ -27,7 +27,8 @@ search: |- | `hiding_files_and_directories_with_attrib_exe_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Some applications and users may legitimately use attrib.exe to interact with the files. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1222.001/T1222.001.yaml#L90 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -58,6 +59,8 @@ analytic_story: - Crypto Stealer - VIP Keylogger asset_type: Endpoint +atomic_guid: + - 32b979da-7b68-42c9-9a99-0e39900fc36c mitre_attack_id: - T1222.001 product: diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index b4a97dd8d02..034bbb883c3 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -1,34 +1,47 @@ name: Icacls Deny Command id: cf8d753e-a8fe-11eb-8f58-acde48001122 -version: 14 +version: 15 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Teoderick Contreras, Splunk status: production type: Anomaly description: | - The following analytic detects instances where an adversary modifies - security permissions of a file or directory using commands like "icacls.exe", "cacls.exe", - or "xcacls.exe" with deny options. It leverages data from Endpoint Detection and - Response (EDR) agents, focusing on process names and command-line executions. This - activity is significant as it is commonly used by Advanced Persistent Threats (APTs) - and coinminer scripts to evade detection and impede access to critical files. If - confirmed malicious, this could allow attackers to maintain persistence and hinder - incident response efforts. + The following analytic detects instances where an adversary modifies security permissions of a file or directory using commands like "icacls.exe", "cacls.exe", or "xcacls.exe" with deny options. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. + This activity is significant as it is commonly used by Advanced Persistent Threats (APTs) and coinminer scripts to evade detection and impede access to critical files. + If confirmed malicious, this could allow attackers to maintain persistence and hinder incident response efforts. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: | - | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where - Processes.process_name IN ( "icacls.exe", "cacls.exe", "xcacls.exe") AND - Processes.process IN ("*/deny*", "*/d:*", "*/d ") - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id - Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec - Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + From datamodel=Endpoint.Processes Where + + Processes.process_name IN ( + "icacls.exe", + "cacls.exe", + "xcacls.exe" + ) + Processes.process IN ( + "*/deny*", + "*/d:*", + "*/d *" + ) + + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -60,11 +73,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: Process name $process_name$ with deny argument executed by $user$ to change security permission of a specific file or directory on host $dest$ + message: Process name [$process_name$] with deny argument executed by [$user$] to change security permission of a specific file or directory on host [$dest$]. - field: user type: user score: 20 - message: Process name $process_name$ with deny argument executed by $user$ to change security permission of a specific file or directory on host $dest$ + message: Process name [$process_name$] with deny argument executed by [$user$] to change security permission of a specific file or directory on host [$dest$]. analytic_story: - Azorult - Sandworm Tools diff --git a/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml index a2989a0e6a4..c0a9f61513f 100644 --- a/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_wmiexec_commandline_parameters.yml @@ -2,7 +2,7 @@ name: Impacket Lateral Movement WMIExec Commandline Parameters id: d6e464e4-5c6a-474e-82d2-aed616a3a492 version: 12 creation_date: '2021-11-19' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -24,6 +24,7 @@ references: - https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L238 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -52,6 +53,8 @@ analytic_story: - CISA AA22-277A - Storm-0501 Ransomware asset_type: Endpoint +atomic_guid: + - a3ddaf15-d1a1-4bc3-8683-84c7c67120fe mitre_attack_id: - T1021.002 - T1021.003 diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml index 422eeccc3e8..198f9016e62 100644 --- a/detections/endpoint/jscript_execution_using_cscript_app.yml +++ b/detections/endpoint/jscript_execution_using_cscript_app.yml @@ -1,39 +1,59 @@ name: Jscript Execution Using Cscript App id: 002f1e24-146e-11ec-a470-acde48001122 -version: 13 +version: 15 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects the execution of JScript using the cscript.exe process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This behavior is significant because JScript files are typically executed by wscript.exe, making cscript.exe execution unusual and potentially indicative of malicious activity, such as the FIN7 group's tactics. If confirmed malicious, this activity could allow attackers to execute arbitrary scripts, leading to code execution, data exfiltration, or further system compromise. +type: Anomaly +description: |- + The following analytic detects the execution of JScript using the cscript.exe process. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. + This behavior is significant because JScript files are typically executed by wscript.exe, making cscript.exe execution unusual and potentially indicative of malicious activity, such as the FIN7 group's tactics. + If confirmed malicious, this activity could allow attackers to execute arbitrary scripts, leading to code execution, data exfiltration, or further system compromise. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE ( + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + ( + ( Processes.parent_process_name = "cscript.exe" - AND Processes.parent_process = "*//e:jscript*" ) - OR (Processes.process_name = "cscript.exe" AND Processes.process = "*//e:jscript*") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + OR + ( + Processes.process_name = "cscript.exe" + Processes.process = "*//e:jscript*" + ) + ) + + NOT Processes.process="*/Job:AgentHIScript*" + NOT Processes.parent_process="*/Job:AgentHIScript*" + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `jscript_execution_using_cscript_app_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: No false positives have been identified at this time. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Symantec Host Integrity check uses Jscript through cscript.exe references: - https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation - https://attack.mitre.org/groups/G0046/ + - https://nasbench.medium.com/symantec-endpoint-protection-meets-com-using-symantec-sshelper-as-a-lolbin-40d515a121ce drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -43,18 +63,17 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: Process name $process_name$ with commandline $process$ to execute jscript on $dest$ - entity: - field: user - type: user - score: 50 intermediate_findings: entities: - field: dest type: system - score: 50 - message: Process name $process_name$ with commandline $process$ to execute jscript on $dest$ + score: 20 + message: The process [$parent_process_name$] with commandline [$parent_process$] launched [$process_name$] with commandline [$process$] on [$dest$] +threat_objects: + - field: parent_process + type: process + - field: process + type: process analytic_story: - FIN7 - Remcos diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml index a986cf92e75..59273ca788e 100644 --- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml +++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml @@ -2,7 +2,7 @@ name: Kerberoasting spn request with RC4 encryption id: 5cc67381-44fa-4111-8a37-7a230943f027 version: 15 creation_date: '2020-06-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Jose Hernandez, Patrick Bareiss, Mauricio Velazco, Dean Luxton, Splunk status: production type: TTP @@ -23,6 +23,8 @@ known_false_positives: Older systems that support kerberos RC4 by default like N references: - https://github.com/redcanaryco/atomic-red-team/blob/4e3e9c8096dde00639a6b98845ec349135554ed5/atomics/T1208/T1208.md - https://www.hub.trimarcsecurity.com/post/trimarc-research-detecting-kerberoasting-activity + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1558.003/T1558.003.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1558.003/T1558.003.yaml#L30 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +47,9 @@ analytic_story: - Compromised Windows Host - Hermetic Wiper asset_type: Endpoint +atomic_guid: + - 3f987809-3681-43c8-bcd8-b3ff3a28533a + - 14625569-6def-4497-99ac-8e7817105b55 mitre_attack_id: - T1558.003 product: diff --git a/detections/endpoint/linux_add_user_account.yml b/detections/endpoint/linux_add_user_account.yml index 5dde70f3539..c15a28e179e 100644 --- a/detections/endpoint/linux_add_user_account.yml +++ b/detections/endpoint/linux_add_user_account.yml @@ -2,7 +2,7 @@ name: Linux Add User Account id: 51fbcaf2-6259-11ec-b0f3-acde48001122 version: 10 creation_date: '2022-01-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Bhavin Patel, Splunk status: production type: Hunting @@ -30,11 +30,14 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L5 analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques - Cisco Isovalent Suspicious Activity asset_type: Endpoint +atomic_guid: + - 40d8eabd-e394-46f6-8785-b9bfa1d011d2 mitre_attack_id: - T1136.001 product: diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml index a1d7ffa6500..0311793793b 100644 --- a/detections/endpoint/linux_at_application_execution.yml +++ b/detections/endpoint/linux_at_application_execution.yml @@ -2,7 +2,7 @@ name: Linux At Application Execution id: bf0a378e-5f3c-11ec-a6de-acde48001122 version: 13 creation_date: '2021-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Bhavin Patel, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ known_false_positives: Administrator or network operator can use this applicatio references: - https://attack.mitre.org/techniques/T1053/001/ - https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1053.002/T1053.002.yaml#L20 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -53,7 +54,7 @@ analytic_story: - Cisco Isovalent Suspicious Activity asset_type: Endpoint atomic_guid: - - 9ddf2e5e-7e2c-46c2-9940-3c2ff29c7213 + - 7266d898-ac82-4ec0-97c7-436075d0d08e mitre_attack_id: - T1053.002 product: diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml index 9824c54cf7f..cd965ede127 100644 --- a/detections/endpoint/linux_auditd_add_user_account.yml +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -2,7 +2,7 @@ name: Linux Auditd Add User Account id: aae66dc0-74b4-4807-b480-b35f8027abb4 version: 10 creation_date: '2022-01-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -21,6 +21,7 @@ how_to_implement: To implement this detection, the process begins by ingesting a known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -41,6 +42,8 @@ analytic_story: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - 40d8eabd-e394-46f6-8785-b9bfa1d011d2 mitre_attack_id: - T1136.001 product: diff --git a/detections/endpoint/linux_auditd_clipboard_data_copy.yml b/detections/endpoint/linux_auditd_clipboard_data_copy.yml index bb9a48d432c..79d77ca293a 100644 --- a/detections/endpoint/linux_auditd_clipboard_data_copy.yml +++ b/detections/endpoint/linux_auditd_clipboard_data_copy.yml @@ -2,7 +2,7 @@ name: Linux Auditd Clipboard Data Copy id: 9ddfe470-c4d0-4e60-8668-7337bd699edd version: 9 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -24,6 +24,7 @@ known_false_positives: False positives may be present on Linux desktop as it may references: - https://attack.mitre.org/techniques/T1115/ - https://linux.die.net/man/1/xclip + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1115/T1115.yaml#L73 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -43,6 +44,8 @@ analytic_story: - Linux Living Off The Land - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - ee363e53-b083-4230-aff3-f8d955f2d5bb mitre_attack_id: - T1115 product: diff --git a/detections/endpoint/linux_auditd_dd_file_overwrite.yml b/detections/endpoint/linux_auditd_dd_file_overwrite.yml index dae8597a7a5..068bfe8ecad 100644 --- a/detections/endpoint/linux_auditd_dd_file_overwrite.yml +++ b/detections/endpoint/linux_auditd_dd_file_overwrite.yml @@ -2,7 +2,7 @@ name: Linux Auditd Dd File Overwrite id: d1b74420-4cea-4752-a123-9b40dfcca49a version: 9 creation_date: '2024-08-09' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -22,6 +22,7 @@ known_false_positives: Administrator or network operator can execute this comman references: - https://gtfobins.github.io/gtfobins/dd/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1485/T1485.yaml#L37 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -42,6 +43,8 @@ analytic_story: - Data Destruction - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - 38deee99-fd65-4031-bec8-bfa4f9f26146 mitre_attack_id: - T1485 product: diff --git a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml index 4047605305d..31443e42291 100644 --- a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml @@ -2,7 +2,7 @@ name: Linux Auditd File And Directory Discovery id: 0bbfb79c-a755-49a5-a38a-1128d0a452f1 version: 9 creation_date: '2024-08-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -24,6 +24,7 @@ known_false_positives: Administrator or network operator can use this applicatio references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1083/T1083.yaml#L40 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +46,8 @@ analytic_story: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - ffc8b249-372a-4b74-adcd-e4c0430842de mitre_attack_id: - T1083 product: diff --git a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml index c6646ed32d3..d47d541e842 100644 --- a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml @@ -2,7 +2,7 @@ name: Linux Auditd Insert Kernel Module Using Insmod Utility id: bc0ca53f-dea6-4906-9b12-09c396fdf1d3 version: 11 creation_date: '2024-08-09' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -25,6 +25,7 @@ references: - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ - https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup - https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.006/T1547.006.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques asset_type: Endpoint +atomic_guid: + - 687dcb93-9656-4853-9c36-9977315e9d23 mitre_attack_id: - T1547.006 product: diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index 576808b5d50..03d5a7c4cae 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -2,7 +2,7 @@ name: Linux Auditd Possible Access To Credential Files id: 0419cb7a-57ea-467b-974f-77c303dfe2a3 version: 13 creation_date: '2024-08-19' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: Administrator or network operator can execute this comman references: - https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd - https://attack.mitre.org/techniques/T1003/008/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.008/T1003.008.yaml#L61 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -38,6 +39,8 @@ analytic_story: - Linux Privilege Escalation - Axios Supply Chain Post Compromise asset_type: Endpoint +atomic_guid: + - df1a55ae-019d-4120-bc35-94f4bc5c4b0a mitre_attack_id: - T1003.008 product: diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml index 93512a389ed..096dc9401e6 100644 --- a/detections/endpoint/linux_auditd_stop_services.yml +++ b/detections/endpoint/linux_auditd_stop_services.yml @@ -2,7 +2,7 @@ name: Linux Auditd Stop Services id: 43bc9281-753b-4743-b4b7-60af84f085f3 version: 9 creation_date: '2024-08-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -23,6 +23,7 @@ known_false_positives: Administrator or network operator can use this applicatio references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - https://cert.gov.ua/article/39518 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml#L63 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -38,6 +39,8 @@ analytic_story: - AwfulShred - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - 42e3a5bd-1e45-427f-aa08-2a65fa29a820 mitre_attack_id: - T1489 product: diff --git a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml index d0c23eb7f1a..0935ded19f5 100644 --- a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml +++ b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml @@ -2,7 +2,7 @@ name: Linux Auditd System Network Configuration Discovery id: 5db16825-81bd-4923-a8d6-d6a13a59832a version: 9 creation_date: '2024-08-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -23,6 +23,7 @@ how_to_implement: To implement this detection, the process begins by ingesting a known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1016/T1016.yaml#L33 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -44,6 +45,8 @@ analytic_story: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - c141bbdb-7fca-4254-9fd6-f47e79447e17 mitre_attack_id: - T1016 product: diff --git a/detections/endpoint/linux_auditd_whoami_user_discovery.yml b/detections/endpoint/linux_auditd_whoami_user_discovery.yml index 7fa8e37fef1..99c021d2f88 100644 --- a/detections/endpoint/linux_auditd_whoami_user_discovery.yml +++ b/detections/endpoint/linux_auditd_whoami_user_discovery.yml @@ -2,7 +2,7 @@ name: Linux Auditd Whoami User Discovery id: d1ff2e22-310d-446a-80b3-faedaa7b3b52 version: 9 creation_date: '2024-08-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -24,6 +24,7 @@ known_false_positives: Administrator or network operator can use this applicatio references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L131 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -46,6 +47,8 @@ analytic_story: - Compromised Linux Host - QuietVault asset_type: Endpoint +atomic_guid: + - aab580c7-cc30-4a7c-b5a9-46a29066b022 mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/linux_clipboard_data_copy.yml b/detections/endpoint/linux_clipboard_data_copy.yml index 9aa385a01a7..ff3d0c76b84 100644 --- a/detections/endpoint/linux_clipboard_data_copy.yml +++ b/detections/endpoint/linux_clipboard_data_copy.yml @@ -2,7 +2,7 @@ name: Linux Clipboard Data Copy id: 7173b2ad-6146-418f-85ae-c3479e4515fc version: 11 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -28,6 +28,7 @@ known_false_positives: False positives may be present on Linux desktop as it may references: - https://attack.mitre.org/techniques/T1115/ - https://linux.die.net/man/1/xclip + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1115/T1115.yaml#L73 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -53,6 +54,8 @@ threat_objects: analytic_story: - Linux Living Off The Land asset_type: Endpoint +atomic_guid: + - ee363e53-b083-4230-aff3-f8d955f2d5bb mitre_attack_id: - T1115 product: diff --git a/detections/endpoint/linux_crontab_enumeration.yml b/detections/endpoint/linux_crontab_enumeration.yml new file mode 100644 index 00000000000..fbbe3ecedd9 --- /dev/null +++ b/detections/endpoint/linux_crontab_enumeration.yml @@ -0,0 +1,76 @@ +name: Linux Crontab Enumeration +id: 8ef82980-0e95-43d7-a802-b488b668d14f +version: 1 +creation_date: '2026-09-03' +modification_date: '2026-09-03' +author: Teoderick Contreras, Bhavin Patel, Onur Mustafa Erdogan, Splunk +status: production +type: Hunting +description: |- + The following analytic detects the use of the crontab command with the list parameter (-l) to enumerate scheduled tasks configured in the invoking user's crontab on Linux systems. + Adversaries may use this information to identify persistence mechanisms, scheduled execution, or potential privilege escalation opportunities. + The use of crontab -l is also common administrative activity and may require tuning based on the executing user, parent process, and environment. +data_source: + - Sysmon for Linux EventID 1 + - Cisco Isovalent Process Exec +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name = "crontab" + Processes.process= "* -l*" + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `linux_crontab_enumeration_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +references: + - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ + - https://cert.gov.ua/article/39518 +analytic_story: + - Cisco Isovalent Suspicious Activity + - Industroyer2 + - Linux Privilege Escalation + - Linux Living Off The Land + - Data Destruction + - Linux Persistence Techniques + - Scheduled Tasks + - Gomir + - VoidLink Cloud-Native Linux Malware +asset_type: Endpoint +mitre_attack_id: + - T1053.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/crontab_list_parameter/sysmon_linux.log + source: Syslog:Linux-Sysmon/Operational + sourcetype: sysmon:linux + test_type: unit + - name: True Positive Test - Cisco Isovalent + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_isovalent/cisco_isovalent.log + source: not_applicable + sourcetype: cisco:isovalent:processExec + test_type: unit diff --git a/detections/endpoint/linux_curl_upload_file.yml b/detections/endpoint/linux_curl_upload_file.yml index 5421e5f8f4e..52c42cdbf09 100644 --- a/detections/endpoint/linux_curl_upload_file.yml +++ b/detections/endpoint/linux_curl_upload_file.yml @@ -2,7 +2,7 @@ name: Linux Curl Upload File id: c1de2d9a-0c02-4bb4-a49a-510c6e9cf2bf version: 13 creation_date: '2022-07-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://curl.se/docs/manpage.html - https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/ - https://gtfobins.github.io/gtfobins/curl/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L501 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - Ingress Tool Transfer - NPM Supply Chain Compromise asset_type: Endpoint +atomic_guid: + - 635c9a38-6cbf-47dc-8615-3810bc1167cf mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/linux_data_destruction_command.yml b/detections/endpoint/linux_data_destruction_command.yml index da89fb867b1..ba11f557e11 100644 --- a/detections/endpoint/linux_data_destruction_command.yml +++ b/detections/endpoint/linux_data_destruction_command.yml @@ -1,32 +1,48 @@ name: Linux Data Destruction Command id: b11d3979-b2f7-411b-bb1a-bd00e642173b -version: 12 +version: 13 creation_date: '2023-02-08' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on the 'rm' command with force recursive deletion and the '--no-preserve-root' option. This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred. If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host. Immediate investigation and response are crucial to mitigate potential damage. +type: Anomaly +description: |- + The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on the 'rm' command with the '--no-preserve-root' option. + This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred. + If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host. + Immediate investigation and response are crucial to mitigate potential damage. data_source: - Sysmon for Linux EventID 1 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process_name = "rm" - AND - Processes.process IN ("* -rf*", "* -fr*") - AND - Processes.process = "* --no-preserve-root" - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name = "rm" + Processes.process = "* --no-preserve-root*" + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `linux_data_destruction_command_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. + These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. + To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. + The logs must also be mapped to the `Processes` node of the `Endpoint` data model. + Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: No false positives have been identified at this time. references: - https://cert.gov.ua/article/3718487 @@ -40,18 +56,12 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: a $process_name$ execute rm command with --no-preserve-root parmeter that can wipe root files on $dest$ - entity: - field: user - type: user - score: 50 intermediate_findings: entities: - field: dest type: system score: 50 - message: a $process_name$ execute rm command with --no-preserve-root parmeter that can wipe root files on $dest$ + message: The process [$process_name$] was executed with the command [$process$] that allows for the removal of files from the root directory on [$dest$]. analytic_story: - AwfulShred - Data Destruction diff --git a/detections/endpoint/linux_dd_file_overwrite.yml b/detections/endpoint/linux_dd_file_overwrite.yml index db17611ba4d..3db2e4903f9 100644 --- a/detections/endpoint/linux_dd_file_overwrite.yml +++ b/detections/endpoint/linux_dd_file_overwrite.yml @@ -2,7 +2,7 @@ name: Linux DD File Overwrite id: 9b6aae5e-8d85-11ec-b2ae-acde48001122 version: 10 creation_date: '2022-02-15' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: Administrator or network operator can execute this comman references: - https://gtfobins.github.io/gtfobins/dd/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1485/T1485.yaml#L37 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -49,6 +50,8 @@ analytic_story: - Data Destruction - Industroyer2 asset_type: Endpoint +atomic_guid: + - 38deee99-fd65-4031-bec8-bfa4f9f26146 mitre_attack_id: - T1485 product: diff --git a/detections/endpoint/linux_decode_base64_to_shell.yml b/detections/endpoint/linux_decode_base64_to_shell.yml index e3e800b6581..500697152f3 100644 --- a/detections/endpoint/linux_decode_base64_to_shell.yml +++ b/detections/endpoint/linux_decode_base64_to_shell.yml @@ -2,7 +2,7 @@ name: Linux Decode Base64 to Shell id: 637b603e-1799-40fd-bf87-47ecbd551b66 version: 14 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md#atomic-test-1---decode-base64-data-into-script - https://redcanary.com/blog/lateral-movement-with-secure-shell/ - https://linux.die.net/man/1/base64 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml#L240 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +64,8 @@ analytic_story: - Linux Living Off The Land - Cisco Isovalent Suspicious Activity asset_type: Endpoint +atomic_guid: + - 3a15c372-67c1-4430-ac8e-ec06d641ce4d mitre_attack_id: - T1027 - T1059.004 diff --git a/detections/endpoint/linux_docker_root_directory_mount.yml b/detections/endpoint/linux_docker_root_directory_mount.yml index d055ab84d4e..e5e94296a05 100644 --- a/detections/endpoint/linux_docker_root_directory_mount.yml +++ b/detections/endpoint/linux_docker_root_directory_mount.yml @@ -2,7 +2,7 @@ name: Linux Docker Root Directory Mount id: aa049566-f76a-43b9-908c-3c27e079fd43 version: 4 creation_date: '2026-03-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Gowthamaraj Rajendran, Splunk, Emil Elsetrønning status: production type: TTP @@ -41,6 +41,7 @@ known_false_positives: False positives are present based on automated tooling or references: - https://docs.docker.com/engine/storage/volumes/ - https://gtfobins.github.io/gtfobins/docker/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1611/T1611.yaml#L59 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -69,6 +70,8 @@ analytic_story: - Linux Privilege Escalation - Linux Living Off The Land asset_type: Endpoint +atomic_guid: + - 6c499943-b098-4bc6-8d38-0956fc182984 mitre_attack_id: - T1611 product: diff --git a/detections/endpoint/linux_ghostscript_exploitation.yml b/detections/endpoint/linux_ghostscript_exploitation.yml index 39c1533e182..a3c7d729290 100644 --- a/detections/endpoint/linux_ghostscript_exploitation.yml +++ b/detections/endpoint/linux_ghostscript_exploitation.yml @@ -1,8 +1,8 @@ name: Linux Ghostscript Exploitation id: 580f99d8-a4c8-4ef1-9c84-f355867bca41 -version: 1 +version: 2 creation_date: '2026-07-08' -modification_date: '2026-07-08' +modification_date: '2026-09-01' author: Raven Tait, Splunk status: production type: TTP @@ -22,7 +22,7 @@ search: |- "*/gs", "*/ghostscript" ) - Processes.process="sh -c*" + Processes.process="*sh -c*" by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash Processes.parent_process_name diff --git a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml index fa0e86065ce..c117c573c21 100644 --- a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml +++ b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml @@ -2,7 +2,7 @@ name: Linux Ingress Tool Transfer Hunting id: 52fd468b-cb6d-48f5-b16a-92f1c9bb10cf version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Hunting @@ -34,6 +34,7 @@ references: - https://curl.se/docs/manpage.html#-I - https://gtfobins.github.io/gtfobins/curl/ - https://github.com/rapid7/metasploit-framework/search?q=curl + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L763 analytic_story: - Ingress Tool Transfer - Linux Living Off The Land @@ -41,6 +42,8 @@ analytic_story: - NPM Supply Chain Compromise - Axios Supply Chain Post Compromise asset_type: Endpoint +atomic_guid: + - bdc373c5-e9cf-4563-8a7b-a9ba720a90f3 mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml index b56bae8e7e5..de6be1e2157 100644 --- a/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml +++ b/detections/endpoint/linux_ingress_tool_transfer_with_curl.yml @@ -2,7 +2,7 @@ name: Linux Ingress Tool Transfer with Curl id: 8c1de57d-abc1-4b41-a727-a7a8fc5e0857 version: 14 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -39,6 +39,7 @@ references: - https://curl.se/docs/manpage.html#-I - https://gtfobins.github.io/gtfobins/curl/ - https://github.com/rapid7/metasploit-framework/search?q=curl + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L763 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -67,6 +68,8 @@ analytic_story: - XorDDos - NPM Supply Chain Compromise asset_type: Endpoint +atomic_guid: + - bdc373c5-e9cf-4563-8a7b-a9ba720a90f3 mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml index 254f4b5f1e1..47e497dcdb3 100644 --- a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml @@ -2,7 +2,7 @@ name: Linux Insert Kernel Module Using Insmod Utility id: 18b5a1a0-6326-11ec-943a-acde48001122 version: 12 creation_date: '2022-01-05' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -31,6 +31,7 @@ references: - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ - https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup - https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.006/T1547.006.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -52,6 +53,8 @@ analytic_story: - Linux Rootkit - Linux Privilege Escalation asset_type: Endpoint +atomic_guid: + - 687dcb93-9656-4853-9c36-9977315e9d23 mitre_attack_id: - T1547.006 product: diff --git a/detections/endpoint/linux_kernel_module_enumeration.yml b/detections/endpoint/linux_kernel_module_enumeration.yml index 0d1d07356f8..87223e336ec 100644 --- a/detections/endpoint/linux_kernel_module_enumeration.yml +++ b/detections/endpoint/linux_kernel_module_enumeration.yml @@ -2,7 +2,7 @@ name: Linux Kernel Module Enumeration id: 6df99886-0e04-4c11-8b88-325747419278 version: 13 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -27,6 +27,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed. references: - https://man7.org/linux/man-pages/man8/kmod.8.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml#L357 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -55,6 +56,8 @@ analytic_story: - XorDDos - Linux Rootkit asset_type: Endpoint +atomic_guid: + - 034fe21c-3186-49dd-8d5d-128b35f181c7 mitre_attack_id: - T1082 - T1014 diff --git a/detections/endpoint/linux_magic_sysrq_key_abuse.yml b/detections/endpoint/linux_magic_sysrq_key_abuse.yml index a11c81271a0..72e51baaa80 100644 --- a/detections/endpoint/linux_magic_sysrq_key_abuse.yml +++ b/detections/endpoint/linux_magic_sysrq_key_abuse.yml @@ -2,7 +2,7 @@ name: Linux Magic SysRq Key Abuse id: 22c03600-f84a-47fa-abaa-ffbe3e72c782 version: 5 creation_date: '2025-08-28' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Milad Cheraghi status: production type: TTP @@ -62,6 +62,8 @@ references: - https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel - https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml#L157 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml#L282 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest="$dest$"' @@ -80,6 +82,9 @@ finding: analytic_story: - Compromised Linux Host asset_type: Endpoint +atomic_guid: + - 6e76f56f-2373-4a6c-a63f-98b7b72761f1 + - d2a1f4bc-a064-4223-8281-a086dce5423c mitre_attack_id: - T1059.004 - T1529 diff --git a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml index 57811191502..3d698d7a8c0 100644 --- a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml +++ b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml @@ -2,7 +2,7 @@ name: Linux Obfuscated Files or Information Base64 Decode id: 303b38b2-c03f-44e2-8f41-4594606fcfc7 version: 13 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -29,6 +29,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md#atomic-test-1---decode-base64-data-into-script - https://redcanary.com/blog/lateral-movement-with-secure-shell/ - https://linux.die.net/man/1/base64 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -56,6 +57,8 @@ threat_objects: analytic_story: - Linux Living Off The Land asset_type: Endpoint +atomic_guid: + - f45df6be-2e1e-4136-a384-8f18ab3826fb mitre_attack_id: - T1027 product: diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml index 9ebd9e75979..cd3a8eca4cd 100644 --- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml @@ -1,26 +1,57 @@ name: Linux Possible Append Command To Profile Config File id: 9c94732a-61af-11ec-91e3-acde48001122 -version: 11 +version: 12 creation_date: '2022-01-11' -modification_date: '2026-05-13' +modification_date: '2026-08-12' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious command-lines that modify user profile files to automatically execute scripts or executables upon system reboot. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving profile files like ~/.bashrc and /etc/profile. This activity is significant as it indicates potential persistence mechanisms used by adversaries to maintain access to compromised hosts. If confirmed malicious, this could allow attackers to execute arbitrary code upon reboot, leading to persistent control over the system and potential further exploitation. +description: |- + The following analytic detects suspicious command-lines that modify user profile files to automatically execute scripts or executables upon system reboot. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving profile files like ~/.bashrc and /etc/profile. + This activity is significant as it indicates potential persistence mechanisms used by adversaries to maintain access to compromised hosts. + If confirmed malicious, this could allow attackers to execute arbitrary code upon reboot, leading to persistent control over the system and potential further exploitation. data_source: - Sysmon for Linux EventID 1 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process = "*echo*" - AND - Processes.process IN("*~/.bashrc", "*~/.bash_profile", "*/etc/profile", "~/.bash_login", "*~/.profile", "~/.bash_logout") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process = "*echo*" + ( + Processes.process IN ("*/home/*", "*~/*", "*/etc/*") + Processes.process IN ( + "*/.bash_login*", + "*/.bash_logout*", + "*/.bash_profile*", + "*/.bashrc*", + "*/.profile*", + "*/profile*" + ) + OR + ( + Processes.process_current_directory = "/home/*" + Processes.process IN ( + "*.bash_login*", + "*.bash_logout*", + "*.bash_profile*", + "*.bashrc*", + "*.profile*", + "* profile*" + ) + ) + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process_current_directory Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -44,7 +75,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: a commandline $process$ that may modify profile files on $dest$ + message: The [$process_name$] process is attempting to modify Shell Profile files via the Command Line [$process$] on [$dest$] +threat_objects: + - field: process + type: process analytic_story: - Linux Privilege Escalation - Linux Persistence Techniques diff --git a/detections/endpoint/linux_ssh_authorized_keys_modification.yml b/detections/endpoint/linux_ssh_authorized_keys_modification.yml index ea690990975..3fa6d9e2a51 100644 --- a/detections/endpoint/linux_ssh_authorized_keys_modification.yml +++ b/detections/endpoint/linux_ssh_authorized_keys_modification.yml @@ -2,7 +2,7 @@ name: Linux SSH Authorized Keys Modification id: f5ab595e-28e5-4327-8077-5008ba97c850 version: 14 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -28,6 +28,7 @@ known_false_positives: Filtering will be required as system administrators will references: - https://redcanary.com/blog/lateral-movement-with-secure-shell/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1098.004/T1098.004.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098.004/T1098.004.yaml#L7 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -57,6 +58,8 @@ analytic_story: - Hellcat Ransomware - VoidLink Cloud-Native Linux Malware asset_type: Endpoint +atomic_guid: + - 342cc723-127c-4d3a-8292-9c0c6b4ecadc mitre_attack_id: - T1098.004 product: diff --git a/detections/endpoint/linux_system_network_discovery.yml b/detections/endpoint/linux_system_network_discovery.yml index 5a7f67486d4..f41e115544d 100644 --- a/detections/endpoint/linux_system_network_discovery.yml +++ b/detections/endpoint/linux_system_network_discovery.yml @@ -2,7 +2,7 @@ name: Linux System Network Discovery id: 535cb214-8b47-11ec-a2c7-acde48001122 version: 11 creation_date: '2022-02-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -65,6 +65,7 @@ known_false_positives: |- Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1016/T1016.yaml#L33 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -91,6 +92,8 @@ analytic_story: - Industroyer2 - VoidLink Cloud-Native Linux Malware asset_type: Endpoint +atomic_guid: + - c141bbdb-7fca-4254-9fd6-f47e79447e17 mitre_attack_id: - T1016 product: diff --git a/detections/endpoint/linux_system_reboot_via_system_request_key.yml b/detections/endpoint/linux_system_reboot_via_system_request_key.yml index 9d3f412eb63..fae06269f2f 100644 --- a/detections/endpoint/linux_system_reboot_via_system_request_key.yml +++ b/detections/endpoint/linux_system_reboot_via_system_request_key.yml @@ -2,7 +2,7 @@ name: Linux System Reboot Via System Request Key id: e1912b58-ed9c-422c-bbb0-2dbc70398345 version: 11 creation_date: '2023-02-09' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -28,6 +28,7 @@ references: - https://www.kernel.org/doc/html/latest/admin-guide/sysrq.html - https://cert.gov.ua/article/3718487 - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1529/T1529.yaml#L282 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - AwfulShred - Data Destruction asset_type: Endpoint +atomic_guid: + - d2a1f4bc-a064-4223-8281-a086dce5423c mitre_attack_id: - T1529 product: diff --git a/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml b/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml new file mode 100644 index 00000000000..aa4777b88a4 --- /dev/null +++ b/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml @@ -0,0 +1,166 @@ +name: LOLBAS Network Connection On Uncommon Port +id: a6628e6d-be28-4278-b17d-6b5a32968eea +version: 1 +creation_date: '2026-08-24' +modification_date: '2026-08-24' +author: Steven Dick, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: | + The following analytic identifies Living Off the Land Binaries and Scripts (LOLBAS) that can legitimately initiate public network connections but are communicating over uncommon destination ports. + It leverages the Network Traffic data model and applies per-binary common-port exclusions to reduce false positives while preserving suspicious non-standard communication. + This behavior may indicate payload download, command-and-control, proxy execution, or attempts to blend malicious traffic into trusted Windows binaries. + Join this detection with the Process Execution events to provide context and avoid false positives. +data_source: + - Sysmon EventID 3 +search: | + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Network_Traffic.All_Traffic where + + All_Traffic.app IN ( + "*\\bitsadmin.exe", + "*\\certutil.exe", + "*\\cmstp.exe", + "*\\cscript.exe", + "*\\ftp.exe", + "*\\hh.exe", + "*\\ie4uinit.exe", + "*\\ieexec.exe", + "*\\msbuild.exe", + "*\\msdt.exe", + "*\\mshta.exe", + "*\\msiexec.exe", + "*\\presentationhost.exe", + "*\\settingsynchost.exe", + "*\\syncappvpublishingserver.exe", + "*\\workfolders.exe", + "*\\wscript.exe", + "*\\wuauclt.exe" + ) + + NOT All_Traffic.dest_ip IN ( + "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", + "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16", + "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", + "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", + "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", + "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", + "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", + "203.0.113.0/24", "240.0.0.0/4" + ) + + NOT ( + ( + All_Traffic.app IN ( + "*\\cscript.exe", + "*\\wscript.exe" + ) + All_Traffic.dest_port IN ("80", "443", "3128") + ) + OR + ( + All_Traffic.app="*\\ftp.exe" + All_Traffic.dest_port IN ("20", "21", "989", "990") + ) + OR + ( + All_Traffic.app IN ( + "*\\bitsadmin.exe", + "*\\certutil.exe", + "*\\cmstp.exe", + "*\\hh.exe", + "*\\ieexec.exe", + "*\\msbuild.exe", + "*\\msdt.exe", + "*\\mshta.exe", + "*\\msiexec.exe", + "*\\presentationhost.exe", + "*\\settingsynchost.exe", + "*\\syncappvpublishingserver.exe", + "*\\workfolders.exe", + "*\\wuauclt.exe" + ) + All_Traffic.dest_port IN ("80", "443") + ) + OR + ( + All_Traffic.app IN ( + "*\\certutil.exe", + "*\\ie4uinit.exe" + ) + All_Traffic.dest_port IN ("389") + ) + ) + + by All_Traffic.action All_Traffic.app All_Traffic.dest + All_Traffic.dest_ip All_Traffic.dest_port + All_Traffic.direction All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src + All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user + All_Traffic.vendor_product + + | `drop_dm_object_name(All_Traffic)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `lolbas_network_connection_on_uncommon_port_filter` +how_to_implement: |- + To successfully implement this detection you must ingest events into the Network Traffic data model that contain the source, destination, destination port, and communicating process name in the app field. + Sysmon EventID 3 is a common source for this data when normalized into the Network Traffic data model. +known_false_positives: |- + Legitimate software installation, support tooling, scripting, synchronization, or update workflows may still use uncommon ports in some environments. + Tune approved destinations, ports, and process paths with the analytic filter macro. +references: + - https://lolbas-project.github.io/# + - https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/ +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: LOLBAS process [$app$] on [$src$] connected to public destination [$dest_ip$] over uncommon port [$dest_port$]. +threat_objects: + - field: app + type: process_name + - field: dest_ip + type: ip_address +analytic_story: + - Fake CAPTCHA Campaigns + - Living Off The Land + - Malicious Inno Setup Loader + - Water Gamayun + - APT37 Rustonotto and FadeStealer + - GhostRedirector IIS Module and Rungan Backdoor + - Hellcat Ransomware + - NetSupport RMM Tool Abuse +asset_type: Endpoint +mitre_attack_id: + - T1105 + - T1567 + - T1218 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: network +tests: + - name: Common Port Suppression Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + expected_results: 1 + test_type: unit diff --git a/detections/endpoint/lolbas_rare_network_connection.yml b/detections/endpoint/lolbas_rare_network_connection.yml new file mode 100644 index 00000000000..f6bc5c36555 --- /dev/null +++ b/detections/endpoint/lolbas_rare_network_connection.yml @@ -0,0 +1,144 @@ +name: LOLBAS Rare Network Connection +id: d09b66cc-269b-4675-81b5-a3dabe4f5ac2 +version: 1 +creation_date: '2026-08-24' +modification_date: '2026-08-24' +author: Steven Dick, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: | + The following analytic identifies public network connections initiated by Living Off the Land Binaries and Scripts (LOLBAS) that rarely require direct outbound network access. + It leverages the Network Traffic data model and focuses on native Windows binaries where any public destination should be investigated and explicitly approved. + This activity may indicate proxy execution, process injection, payload download, command-and-control, or other abuse of trusted binaries to evade security controls. + Keep in mind that some of these binaries, such as Netsh.exe, Gpscript.exe, Wmic.exe, etc., will occasionally communicate with public network resources to perform their intended function. + Exclude said processes from the detection if they are too noisy for your environment. + Join this detection with the Process Execution events to provide context and avoid false positives. +data_source: + - Sysmon EventID 3 +search: | + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Network_Traffic.All_Traffic where + + All_Traffic.app IN ( + "*\\at.exe", + "*\\atbroker.exe", + "*\\certoc.exe", + "*\\diskshadow.exe", + "*\\dnscmd.exe", + "*\\extexport.exe", + "*\\forfiles.exe", + "*\\gpscript.exe", + "*\\infdefaultinstall.exe", + "*\\installutil.exe", + "*\\makecab.exe", + "*\\mavinject.exe", + "*\\microsoft.workflow.compiler.exe", + "*\\msconfig.exe", + "*\\netsh.exe", + "*\\notepad.exe", + "*\\odbcconf.exe", + "*\\offlinescannershell.exe", + "*\\pcalua.exe", + "*\\pcwrun.exe", + "*\\pnputil.exe", + "*\\rasautou.exe", + "*\\regasm.exe", + "*\\register-cimprovider.exe", + "*\\regsvcs.exe", + "*\\regsvr32.exe", + "*\\runonce.exe", + "*\\runscripthelper.exe", + "*\\schtasks.exe", + "*\\scriptrunner.exe", + "*\\stordiag.exe", + "*\\ttdinject.exe", + "*\\tttracer.exe", + "*\\verclsid.exe", + "*\\wab.exe", + "*\\wmic.exe", + "*\\xwizard.exe" + ) + + NOT All_Traffic.dest_ip IN ( + "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", + "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16", + "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", + "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", + "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", + "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", + "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", + "203.0.113.0/24", "240.0.0.0/4" + ) + + by All_Traffic.action All_Traffic.app All_Traffic.dest + All_Traffic.dest_ip All_Traffic.dest_port + All_Traffic.direction All_Traffic.dvc All_Traffic.protocol + All_Traffic.protocol_version All_Traffic.src + All_Traffic.src_ip All_Traffic.src_port + All_Traffic.transport All_Traffic.user + All_Traffic.vendor_product + + | `drop_dm_object_name(All_Traffic)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `lolbas_rare_network_connection_filter` +how_to_implement: |- + To successfully implement this detection you must ingest events into the Network Traffic data model that contain the source, destination, destination port, and communicating process name in the app field. Sysmon EventID 3 is a common source for this data when normalized into the Network Traffic data model. +known_false_positives: |- + Limited legitimate administrative automation and scripts may cause false positives. + Any recurring use of these binaries for public network access should be reviewed, approved, and filtered with the analytic filter macro. + Notepad.exe can now communicate with Microsoft's service "apsaiservices.microsoft.com" over port 443 to provide AI services. Apply filtering if this behavior is known in your environment. + PowerShell, PowerShell ISE, PowerShell 7 (pwsh.exe), and cmd.exe are intentionally excluded from this analytic because they are too noisy. +references: + - https://lolbas-project.github.io/# + - https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/ +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$src$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: A rare public network connection from LOLBAS process [$app$] was observed on [$src$] to [$dest_ip$] over port [$dest_port$]. +threat_objects: + - field: app + type: process_name + - field: dest_ip + type: ip_address +analytic_story: + - Fake CAPTCHA Campaigns + - Living Off The Land + - Malicious Inno Setup Loader + - Water Gamayun + - APT37 Rustonotto and FadeStealer + - GhostRedirector IIS Module and Rungan Backdoor + - Hellcat Ransomware + - NetSupport RMM Tool Abuse +asset_type: Endpoint +mitre_attack_id: + - T1105 + - T1567 + - T1218 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/macos_account_created.yml b/detections/endpoint/macos_account_created.yml index 64f46cb85e2..80b1f4b0565 100644 --- a/detections/endpoint/macos_account_created.yml +++ b/detections/endpoint/macos_account_created.yml @@ -1,8 +1,8 @@ name: MacOS Account Created id: 491004ae-694f-453e-b1e0-fc1e65daeea1 -version: 3 +version: 4 creation_date: '2026-04-14' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Raven Tait, Splunk status: production type: Anomaly @@ -19,7 +19,7 @@ search: |- from datamodel=Endpoint.Processes where ( - Processes.process = "*sysadminctl" + Processes.process = "*sysadminctl*" Processes.process = "*-addUser*" ) OR diff --git a/detections/endpoint/macos_applescript_shell_execution_and_compilation.yml b/detections/endpoint/macos_applescript_shell_execution_and_compilation.yml new file mode 100644 index 00000000000..be5632f1187 --- /dev/null +++ b/detections/endpoint/macos_applescript_shell_execution_and_compilation.yml @@ -0,0 +1,93 @@ +name: MacOS AppleScript Shell Execution and Compilation +id: ceee1f2b-4b40-4721-b91e-40d1134e9dc4 +version: 1 +creation_date: '2026-09-03' +modification_date: '2026-09-03' +author: Radka Viskova, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the use of macOS AppleScript utilities to execute shell commands or compile AppleScript containing shell-command logic. + The analytic identifies `osascript` invocations using AppleScript's `do shell script` command, which executes shell commands on the host. + It also identifies `osacompile` invocations referencing `do shell script`. `osacompile` compiles AppleScript into a compiled script but does not execute it directly. + Adversaries may abuse these utilities to execute shell commands, stage AppleScript payloads, or prepare scripts for later execution. Matches involving `osacompile` should be interpreted as script compilation or staging rather than confirmed shell-command execution. +data_source: + - Osquery Results +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name IN ("osascript", "osacompile") + Processes.process="*do *" + Processes.process="* shell *" + Processes.process="* script*" + + BY Processes.action Processes.dest Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | eval activity_type=case( + process_name="osascript", "AppleScript Shell Command Execution", + process_name="osacompile", "AppleScript Compilation or Staging" + ) + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + + | table firstTime lastTime dest user activity_type parent_process process parent_process_name parent_process_exec parent_process_guid parent_process_id parent_process_path process_exec process_guid process_hash process_id process_integrity_level process_name process_path action user_id vendor_product + + | `macos_applescript_shell_execution_and_compilation_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the TA-OSquery (https://splunkbase.splunk.com/app/8574) must be deployed in order to have the osquery data populate the data models. +known_false_positives: |- + Legitimate administrative scripts or automation tools using Applescript. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059/002/ + - https://www.loobins.io/binaries/osascript/ + - https://redcanary.com/threat-detection-report/techniques/applescript/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: AppleScript shell execution or compilation via [$process_name$] with commandline [$process$] was observed on [$dest$]. +threat_objects: + - field: process + type: process +analytic_story: + - MacOS Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript_do_shell_script/osascript_do_shell_script.log + source: osquery + sourcetype: osquery:results + test_type: unit diff --git a/detections/endpoint/macos_data_chunking.yml b/detections/endpoint/macos_data_chunking.yml index d3d5acda779..4fb29f13823 100644 --- a/detections/endpoint/macos_data_chunking.yml +++ b/detections/endpoint/macos_data_chunking.yml @@ -1,8 +1,8 @@ name: MacOS Data Chunking id: 7f1c8bed-9bd4-40b0-a1df-c262cbade0fc -version: 3 +version: 4 creation_date: '2026-04-14' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Raven Tait, Splunk status: production type: Anomaly @@ -20,7 +20,7 @@ search: |- from datamodel=Endpoint.Processes where ( - Processes.process = "dd *" + Processes.process IN ("*/dd *", "dd *") Processes.process = "* if=*" ) OR diff --git a/detections/endpoint/macos_gatekeeper_bypass.yml b/detections/endpoint/macos_gatekeeper_bypass.yml index 79c9774b6e2..2525ad03a2e 100644 --- a/detections/endpoint/macos_gatekeeper_bypass.yml +++ b/detections/endpoint/macos_gatekeeper_bypass.yml @@ -2,7 +2,7 @@ name: MacOS Gatekeeper Bypass id: 2c9346f3-bbeb-48ce-8411-fc13d09d83a5 version: 3 creation_date: '2026-04-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Raven Tait, Splunk status: production type: Anomaly @@ -48,6 +48,7 @@ references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ - https://ss64.com/mac/xattr.html - https://ss64.com/mac/spctl.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1553.001/T1553.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -75,6 +76,8 @@ analytic_story: - MacOS Post-Exploitation - MacOS Persistence Techniques asset_type: Endpoint +atomic_guid: + - fb3d46c6-9480-4803-8d7d-ce676e1f1a9b mitre_attack_id: - T1553.001 product: diff --git a/detections/endpoint/macos_keychains_dumped.yml b/detections/endpoint/macos_keychains_dumped.yml index 2e6aa922738..baa8affa24f 100644 --- a/detections/endpoint/macos_keychains_dumped.yml +++ b/detections/endpoint/macos_keychains_dumped.yml @@ -2,7 +2,7 @@ name: MacOS Keychains Dumped id: dcb45a09-5e6f-441e-b2f8-cbbf923e36d9 version: 4 creation_date: '2026-04-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Raven Tait, Jamie Windley, Splunk status: production type: TTP @@ -70,6 +70,7 @@ references: - https://gist.github.com/hfeeki/88c12f01d00534e09a84 - https://ss64.com/mac/security-keychain-settings.html - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.001/T1555.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1555.001/T1555.001.yaml#L6 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -94,6 +95,8 @@ intermediate_findings: analytic_story: - MacOS Privilege Escalation asset_type: Endpoint +atomic_guid: + - 88e1fa00-bf63-4e5b-a3e1-e2ea51c8cca6 mitre_attack_id: - T1555.001 product: diff --git a/detections/endpoint/macos_list_firewall_rules.yml b/detections/endpoint/macos_list_firewall_rules.yml index 488af3e2302..a09c47f4b16 100644 --- a/detections/endpoint/macos_list_firewall_rules.yml +++ b/detections/endpoint/macos_list_firewall_rules.yml @@ -2,7 +2,7 @@ name: MacOS List Firewall Rules id: f8db6e0b-55bb-40ca-bc85-2b3700adb0f8 version: 2 creation_date: '2026-04-15' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Jamie Windley, Splunk status: production type: Anomaly @@ -52,6 +52,7 @@ known_false_positives: | references: - https://www.manpagez.com/man/8/socketfilterfw/ - https://ss64.com/mac/defaults.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1016/T1016.yaml#L183 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" AND dest = "$dest$"' @@ -81,6 +82,8 @@ threat_objects: analytic_story: - Network Discovery asset_type: Endpoint +atomic_guid: + - ff1d8c25-2aa4-4f18-a425-fede4a41ee88 mitre_attack_id: - T1016 product: diff --git a/detections/endpoint/macos_network_share_discovery.yml b/detections/endpoint/macos_network_share_discovery.yml index e5a07e40a3b..f5a37a09cc2 100644 --- a/detections/endpoint/macos_network_share_discovery.yml +++ b/detections/endpoint/macos_network_share_discovery.yml @@ -2,7 +2,7 @@ name: MacOS Network Share Discovery id: a5f5fe52-8e50-4fb0-ad1b-780be6c0d857 version: 3 creation_date: '2026-04-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Raven Tait, Splunk status: production type: Anomaly @@ -39,6 +39,7 @@ references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ - https://leopard-adc.pepas.com/documentation/Darwin/Reference/ManPages/man8/showmount.8.html - https://www.unix.com/man_page/osx/1/smbutil/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -64,6 +65,8 @@ threat_objects: analytic_story: - MacOS Post-Exploitation asset_type: Endpoint +atomic_guid: + - f94b5ad9-911c-4eff-9718-fd21899db4f7 mitre_attack_id: - T1135 product: diff --git a/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml b/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml new file mode 100644 index 00000000000..983787c0c01 --- /dev/null +++ b/detections/endpoint/macos_osascript_displaying_suspicious_user_prompt.yml @@ -0,0 +1,106 @@ +name: MacOS Osascript Displaying Suspicious User Prompt +id: d565ae18-7db6-460c-a2eb-a7109f18bc5e +version: 1 +creation_date: '2026-08-03' +modification_date: '2026-10-02' +author: Radka Viskova, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects the execution of the macOS osascript utility with AppleScript commands that display a dialog or alert containing potentially deceptive, credential-related, or security-themed content. + Adversaries may abuse osascript to present fake system messages or credential prompts and trick users into disclosing sensitive information. + This detection is based on command-line content and should be reviewed with the parent process, executing user, script content, and surrounding endpoint activity. +data_source: + - Osquery Results +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name="osascript" + Processes.process IN ( + "*display alert*", + "*display dialog*" + ) + Processes.process IN ( + "*access System*", + "*authentication*", + "*credentials*", + "*critical update*", + "*needs your attention*", + "*password*", + "*security update*", + "*system error*", + "*verify*", + "*with hidden answer*" + ) + + BY Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_osascript_displaying_suspicious_user_prompt_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Legitimate administrative, MDM, software deployment, support, or automation scripts may use osascript to display dialogs or alerts. Review the parent process, executing user, script content, signer, and known administrative tooling before suppressing the activity. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/tactics/TA0006/ + - https://attack.mitre.org/techniques/T1056/002/ + - https://attack.mitre.org/techniques/T1059/002/ + - https://www.loobins.io/binaries/osascript/ + - https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/#cq=i1 + - https://www.infostealers.com/article/an-infostealers-brewin-cuckoo-atomicstealer-get-creative/ + - https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1056.002/T1056.002.yaml#L31 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1056.002/T1056.002.yaml#L5 +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: The osascript utility executed a command containing dialog-related and potentially deceptive content on endpoint [$dest$] with the Command Line [$process$]. +threat_objects: + - field: process + type: process +analytic_story: + - MacOS Privilege Escalation +asset_type: Endpoint +atomic_guid: + - b7037b89-947a-427a-ba29-e7e9f09bc045 + - 76628574-0bc1-4646-8fe2-8f4427b47d15 +mitre_attack_id: + - T1059.002 + - T1056.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript/osascript_prompts_user.log + source: osquery + sourcetype: osquery:results + test_type: unit diff --git a/detections/endpoint/macos_osascript_executing_interactive_shell.yml b/detections/endpoint/macos_osascript_executing_interactive_shell.yml new file mode 100644 index 00000000000..5c50548ce5e --- /dev/null +++ b/detections/endpoint/macos_osascript_executing_interactive_shell.yml @@ -0,0 +1,86 @@ +name: MacOS Osascript Executing Interactive Shell +id: 01168215-d1c7-4a37-8bd3-c5b64664c947 +version: 1 +creation_date: '2026-09-18' +modification_date: '2026-09-18' +author: Radka Viskova, Splunk +status: production +type: Anomaly +description: |- + This analytic detects the macOS osascript utility being used with an interactive Bash invocation, identified by the presence + of "bash -i" in the command line. + Adversaries may abuse osascript and AppleScript's shell execution capabilities to launch + interactive shells, establish remote access, or execute post-exploitation commands. +data_source: + - Osquery Results +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name="osascript" + Processes.process="*bash *" + Processes.process="* -i*" + + BY Processes.action Processes.dest Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_osascript_executing_interactive_shell_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Legitimate administrative scripts, MDM workflows, software deployment tools, developer automation, or support utilities may use osascript to invoke an interactive shell. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059/002/ + - https://attack.mitre.org/techniques/T1059/004/ + - https://redcanary.com/threat-detection-report/techniques/applescript/ + - https://www.loobins.io/binaries/osascript/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: The Osascript utility with the command line [$process$] was observed on [$dest$] executing an interactive Bash command line. +threat_objects: + - field: process + type: process +analytic_story: + - MacOS Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059.002 + - T1059.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript_spawns_shell_process/osascript_spawns_shell_process.log + source: osquery + sourcetype: osquery:results + test_type: unit diff --git a/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml b/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml new file mode 100644 index 00000000000..b0a26a48976 --- /dev/null +++ b/detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml @@ -0,0 +1,86 @@ +name: MacOS Osascript Executing JavaScript Code With ObjC +id: 9ad44dce-7291-47f8-84a7-e343a5147242 +version: 1 +creation_date: '2026-09-18' +modification_date: '2026-09-18' +author: Radka Viskova, Splunk +status: production +type: Anomaly +description: |- + This analytic detects the macOS osascript utility executing JavaScript for Automation (JXA) code, identified by + the "-l JavaScript" interpreter flag, with references to the Objective-C bridge. Adversaries may abuse JXA and + Objective-C APIs to interact with macOS applications, access native system functionality, execute commands, or + perform post-exploitation activity. +data_source: + - Osquery Results +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name="osascript" + Processes.process="*-l *" + Processes.process="* JavaScript*" + Processes.process="*ObjC.*" + + BY Processes.action Processes.dest Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_osascript_executing_javascript_code_with_objc_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Scripts that legitimately invoke utility Osascript with JavaScript for automation or system management. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059/002/ + - https://attack.mitre.org/techniques/T1059/007/ + - https://www.loobins.io/binaries/osascript/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 30 + message: The Osascript utility with the command line [$process$] was observed on [$dest$] executing JXA code with Objective-C bridge references. +threat_objects: + - field: process + type: process +analytic_story: + - MacOS Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059.002 + - T1059.007 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.002/osascript_JavaScript_command_execution_Objective_C/osascript_JavaScript_command_execution_Objective_C.log + source: osquery + sourcetype: osquery:results + test_type: unit diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 4155e06ea08..744d2ba42f5 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -2,7 +2,7 @@ name: Malicious PowerShell Process - Encoded Command id: c4db14d9-7909-48b4-a054-aa14d89dbb19 version: 21 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Michael Haag, Splunk, SirDuckly, GitHub Community status: production type: Hunting @@ -48,6 +48,7 @@ references: - https://twitter.com/M_haggis/status/1440758396534214658?s=20 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml#L39 analytic_story: - SolarWinds WHD RCE Post Exploitation - CISA AA22-320A @@ -67,6 +68,8 @@ analytic_story: - GhostRedirector IIS Module and Rungan Backdoor - Microsoft WSUS CVE-2025-59287 asset_type: Endpoint +atomic_guid: + - a50d5a97-2531-499e-a1de-5544c74432c6 mitre_attack_id: - T1027 product: diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index eddcaed3e3c..59f00a04fa0 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -2,7 +2,7 @@ name: Monitor Registry Keys for Print Monitors id: f5f6af30-7ba7-4295-bfe9-07de87c01bbc version: 15 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk, Steven Dick, Bhavin Patel status: production type: TTP @@ -12,7 +12,8 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*") by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `monitor_registry_keys_for_print_monitors_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: You will encounter noise from legitimate print-monitor registry entries. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.010/T1547.010.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ analytic_story: - Windows Persistence Techniques - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - d34ef297-f178-4462-871e-9ce618d44e50 mitre_attack_id: - T1547.010 product: diff --git a/detections/endpoint/network_connection_discovery_with_arp.yml b/detections/endpoint/network_connection_discovery_with_arp.yml index 29915a85421..f1074df0d86 100644 --- a/detections/endpoint/network_connection_discovery_with_arp.yml +++ b/detections/endpoint/network_connection_discovery_with_arp.yml @@ -1,8 +1,8 @@ name: Network Connection Discovery With Arp id: ae008c0f-83bd-4ed4-9350-98d4328e15d2 -version: 10 +version: 11 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-08-30' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -22,7 +22,7 @@ search: |- ( Processes.process_name="arp.exe" OR - Processes.process_original_file_name="arp.exe" + Processes.original_file_name="arp.exe" ) Processes.process IN ( "* -a*", diff --git a/detections/endpoint/network_share_discovery_via_dir_command.yml b/detections/endpoint/network_share_discovery_via_dir_command.yml index bb6f37b475f..6373999c085 100644 --- a/detections/endpoint/network_share_discovery_via_dir_command.yml +++ b/detections/endpoint/network_share_discovery_via_dir_command.yml @@ -2,7 +2,7 @@ name: Network Share Discovery Via Dir Command id: dc1457d0-1d9b-422e-b5a7-db46c184d9aa version: 7 creation_date: '2023-05-23' -modification_date: '2026-08-05' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -51,6 +51,7 @@ references: - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140#table-of-file-access-codes - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml#L166 analytic_story: - IcedID asset_type: Endpoint diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index 4b5982ff643..6424ba14476 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -2,7 +2,7 @@ name: NLTest Domain Trust Discovery id: c3e05466-5f22-11eb-ae93-0242ac130002 version: 14 creation_date: '2021-01-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -40,6 +40,7 @@ references: - https://ss64.com/nt/nltest.html - https://redcanary.com/threat-detection-report/techniques/domain-trust-discovery/ - https://thedfirreport.com/2020/10/08/ryuks-return/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1482/T1482.yaml#L16 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -66,6 +67,8 @@ analytic_story: - Ryuk Ransomware - Storm-0501 Ransomware asset_type: Endpoint +atomic_guid: + - 2e22641d-0498-48d2-b9ff-c71e496ccdbe mitre_attack_id: - T1482 product: diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml index 500aedd2cac..7ebf6578f52 100644 --- a/detections/endpoint/ntdsutil_export_ntds.yml +++ b/detections/endpoint/ntdsutil_export_ntds.yml @@ -2,7 +2,7 @@ name: Ntdsutil Export NTDS id: da63bc76-61ae-11eb-ae93-0242ac130002 version: 12 creation_date: '2021-01-28' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Patrick Bareiss, Splunk status: production type: TTP @@ -35,6 +35,7 @@ references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf - https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.003/T1003.003.yaml#L83 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -59,6 +60,8 @@ analytic_story: - Rhysida Ransomware - NetSupport RMM Tool Abuse asset_type: Endpoint +atomic_guid: + - 2364e33d-ceab-4641-8468-bfb1d7cc2723 mitre_attack_id: - T1003.003 product: diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index 7c7e4800678..1cc5ecc0aa7 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -2,7 +2,7 @@ name: Overwriting Accessibility Binaries id: 13c2f6c3-10c5-4deb-9ba1-7c4460ebe4ae version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -12,7 +12,13 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem where (Filesystem.file_path=*\\Windows\\System32\\sethc.exe* OR Filesystem.file_path=*\\Windows\\System32\\utilman.exe* OR Filesystem.file_path=*\\Windows\\System32\\osk.exe* OR Filesystem.file_path=*\\Windows\\System32\\Magnify.exe* OR Filesystem.file_path=*\\Windows\\System32\\Narrator.exe* OR Filesystem.file_path=*\\Windows\\System32\\DisplaySwitch.exe* OR Filesystem.file_path=*\\Windows\\System32\\AtBroker.exe*) by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `overwriting_accessibility_binaries_filter`' how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. known_false_positives: Microsoft may provide updates to these binaries. Verify that these changes do not correspond with your normal software update cycle. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L50 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L125 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L141 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L157 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L173 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.008/T1546.008.yaml#L189 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -37,6 +43,13 @@ analytic_story: - Windows Privilege Escalation - Flax Typhoon asset_type: Endpoint +atomic_guid: + - 934e90cf-29ca-48b3-863c-411737ad44e3 + - 1db380da-3422-481d-a3c8-6d5770dba580 + - 5e4fa70d-c789-470e-85e1-6992b92bb321 + - 2002f5ea-cd13-4c82-bf73-e46722e5dc5e + - 825ba8ca-71cc-436b-b1dd-ea0d5e109086 + - 210be7ea-d841-40ec-b3e1-ff610bb62744 mitre_attack_id: - T1546.008 product: diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml index 37c510fdca8..2283e1a9af9 100644 --- a/detections/endpoint/ping_sleep_batch_command.yml +++ b/detections/endpoint/ping_sleep_batch_command.yml @@ -1,19 +1,19 @@ name: Ping Sleep Batch Command id: ce058d6c-79f2-11ec-b476-acde48001122 -version: 16 +version: 18 creation_date: '2022-01-20' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: Anomaly description: |- - The following analytic identifies the execution of ping sleep batch commands. - It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process command-line details. - This activity is significant as it indicates an attempt to delay malicious code execution, potentially evading detection or sandbox analysis. - If confirmed malicious, this technique allows attackers to bypass security measures, making it harder to detect and analyze their activities, thereby increasing the risk of prolonged unauthorized access and potential data exfiltration. + The following analytic identifies the use of ping commands as a delay or sleep mechanism within batch-style command execution. + It leverages process creation telemetry from Endpoint Detection and Response (EDR) agents and examines process and parent process command-line fields for ping commands that specify a count and are chained with additional commands using command separators or redirection operators. + While execution of the command may generate individual process creation events, such as a separate ping.exe process, this analytic specifically focuses on the original command string passed to a command interpreter, such as cmd.exe /c, that combines the ping-based delay with subsequent command execution. + Adversaries may use ping as an alternative to explicit sleep or timeout commands to introduce execution delays, potentially evading automated analysis, sandboxing, or behavior-based detection. + Because ping is commonly used for legitimate network troubleshooting, findings should be reviewed in the context of the complete command line, parent process, user, and commands executed before or after the delay. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime @@ -22,13 +22,17 @@ search: |- FROM datamodel=Endpoint.Processes WHERE ( Processes.parent_process= "*ping*" - Processes.parent_process = *-n* + Processes.parent_process IN ( + "*-n*", + "*/n*" + ) Processes.parent_process IN ( "*& *", "*&*", "*&C:*", "*>*", - "*>*" + "*>*", + "*||*" ) ) OR @@ -38,13 +42,17 @@ search: |- OR Processes.original_file_name= "ping.exe" ) - Processes.process = *-n* + Processes.process IN ( + "*-n*", + "*/n*" + ) Processes.process IN ( "*& *", "*&*", "*&C:*", "*>*", - "*>*" + "*>*", + "*||*" ) ) @@ -61,8 +69,16 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `ping_sleep_batch_command_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Administrator or network operator may execute this command. Please update the filter macros to remove false positives. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. + These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. + Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Administrators, network operators, scripts, and software installers may legitimately use ping commands as a simple delay mechanism between commands or operations. + Review the full command line, parent process, user context, and surrounding activity to determine whether the execution is expected. + Update the filter macro to exclude known legitimate command patterns or processes in your environment. references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ drilldown_searches: @@ -79,11 +95,16 @@ intermediate_findings: - field: user type: user score: 20 - message: suspicious $process$ commandline run on $dest$ + message: Potential ping-based execution delay detected on [$dest$] by [$user$] via [$process$] - field: dest type: system score: 20 - message: suspicious $process$ commandline run on $dest$ + message: Potential ping-based execution delay detected on [$dest$] by [$user$] via [$process$] +threat_objects: + - field: process + type: process + - field: parent_process + type: parent_process analytic_story: - Warzone RAT - Quasar RAT diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml index 8fe0edf7a66..6b73129ed47 100644 --- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml +++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml @@ -1,8 +1,8 @@ name: Possible Lateral Movement PowerShell Spawn id: cb909b3e-512b-11ec-aa31-3e22fbd008af -version: 17 +version: 18 creation_date: '2021-11-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Mauricio Velazco, Michael Haag, Splunk status: production type: Anomaly @@ -13,7 +13,6 @@ description: | If confirmed malicious, this behavior could allow attackers to execute code remotely, escalate privileges, or persist within the environment. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/potential_password_in_username.yml b/detections/endpoint/potential_password_in_username.yml index e6fb5a7cbe4..06649111165 100644 --- a/detections/endpoint/potential_password_in_username.yml +++ b/detections/endpoint/potential_password_in_username.yml @@ -1,8 +1,8 @@ name: Potential password in username id: 5ced34b4-ab32-4bb0-8f22-3b8f186f0a38 -version: 8 +version: 9 creation_date: '2022-05-27' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Mikael Bjerkeland, Splunk status: production type: Hunting @@ -14,7 +14,7 @@ search: |- WHERE nodename=Authentication.Failed_Authentication BY "Authentication.user" | `drop_dm_object_name(Authentication)` - | lookup ut_shannon_lookup word AS user + | lookup local=t ut_shannon_lookup word AS user | where ut_shannon>3 AND len(user)>=8 AND mvcount(src) == 1 | sort count, - ut_shannon | eval incorrect_cred=user diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index d8fb84f944f..006d345909f 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,8 +1,8 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 -version: 28 +version: 29 creation_date: '2021-08-19' -modification_date: '2026-07-20' +modification_date: '2026-09-03' author: Michael Haag, Splunk status: production type: Hunting @@ -14,36 +14,110 @@ data_source: search: |- `powershell` EventCode=4104 - | eval DoIt = if(match(ScriptBlockText,"(?i)(\$doit)"), "4", 0) - | eval enccom=if(match(ScriptBlockText,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)") OR match(ScriptBlockText, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) - | eval suspcmdlet=if(match(ScriptBlockText, "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-Jboss|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|get-net\S+|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|Kerberos.*(policy|ticket)|netfirewall|Uninstall-Windows|Verb\s+Runas|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0) - | eval base64 = if(match(lower(ScriptBlockText),"frombase64"), "4", 0) - | eval empire=if(match(lower(ScriptBlockText),"system.net.webclient") AND match(lower(ScriptBlockText), "frombase64string") ,5,0) - | eval mimikatz=if(match(lower(ScriptBlockText),"mimikatz") OR match(lower(ScriptBlockText), "-dumpcr") OR match(lower(ScriptBlockText), "SEKURLSA::Pth") OR match(lower(ScriptBlockText), "kerberos::ptt") OR match(lower(ScriptBlockText), "kerberos::golden") ,5,0) - | eval iex=if(match(ScriptBlockText, "(?i)iex|invoke-expression"),2,0) - | eval webclient=if(match(lower(ScriptBlockText),"http") OR match(lower(ScriptBlockText),"web(client|request)") OR match(lower(ScriptBlockText),"socket") OR match(lower(ScriptBlockText),"download(file|string)") OR match(lower(ScriptBlockText),"bitstransfer") OR match(lower(ScriptBlockText),"internetexplorer.application") OR match(lower(ScriptBlockText),"xmlhttp"),5,0) - | eval get = if(match(lower(ScriptBlockText),"get-"), "1", 0) - | eval rundll32 = if(match(lower(ScriptBlockText),"rundll32"), "4", 0) - | eval suspkeywrd=if(match(ScriptBlockText, "(?i)(bitstransfer|mimik|metasp|AssemblyBuilderAccess|Reflection\.Assembly|shellcode|injection|cnvert|shell\.application|start-process|Rc4ByteStream|System\.Security\.Cryptography|lsass\.exe|localadmin|LastLoggedOn|hijack|BackupPrivilege|ngrok|comsvcs|backdoor|brute.?force|Port.?Scan|Exfiltration|exploit|DisableRealtimeMonitoring|beacon)"),1,0) - | eval syswow64 = if(match(lower(ScriptBlockText),"syswow64"), "3", 0) - | eval httplocal = if(match(lower(ScriptBlockText),"http://127.0.0.1"), "4", 0) - | eval reflection = if(match(lower(ScriptBlockText),"reflection"), "1", 0) - | eval invokewmi=if(match(lower(ScriptBlockText), "(?i)(wmiobject|WMIMethod|RemoteWMI|PowerShellWmi|wmicommand)"),5,0) - | eval downgrade=if(match(ScriptBlockText, "(?i)([-]ve*r*s*i*o*n*\s+2)") OR match(lower(ScriptBlockText),"powershell -version"),3,0) - | eval compressed=if(match(ScriptBlockText, "(?i)GZipStream|::Decompress|IO.Compression|write-zip|(expand|compress)-Archive"),5,0) - | eval invokecmd = if(match(lower(ScriptBlockText),"invoke-command"), "4", 0) - | addtotals fieldname=Score DoIt, enccom, suspcmdlet, suspkeywrd, compressed, downgrade, mimikatz, iex, empire, rundll32, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get - | stats values(Score) - BY UserID, Computer, DoIt, - enccom, compressed, downgrade, - iex, mimikatz, rundll32, - empire, webclient, syswow64, - httplocal, reflection, invokewmi, - invokecmd, base64, get, - suspcmdlet, suspkeywrd - | rename Computer as dest, UserID as user - | `powershell_4104_hunting_filter` -how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. + + ScriptBlockText IN ( + "*-dumpcr*", "* -version *", "*::decompress*", + "*Add-Exfiltration*", "*Add-Persistence*", "*Add-RegBackdoor*", + "*Add-ScrnSaveBackdoor*", "*AmsiBypass*", "*assemblybuilderaccess*", "*backdoor*", + "*backupprivilege*", "*beacon*", "*bitstransfer*", "*Brute-Force*", "*BruteForce*", + "*CachedRDPConnection*", "*Check-VM*", "*cnvert*", "*compress-archive*", "*ComputerProperty*", + "*comsvcs*", "*copy-vss*", "*CreateShortcut*", "*disablerealtimemonitoring*", + "*Do-Exfiltration*", "*downloadfile*", "*downloadstring*", "*Enabled-DuplicateToken*", + "*EXEonRemote*", "*exfiltration*", "*expand-archive*", "*Exploit-*", "*exploit*", + "*Find-*", "*Frombase64*", "*Get-ApplicationHost*", "*Get-ChromeDump*", + "*Get-ClipboardContents*", "*Get-*Credent*", "*Get-FoxDump*", "*Get-GPPPassword*", "*Get-IndexedItem*", + "*Get-Keystrokes*", "*Get-PassHash*", "*Get-*Password*", "*Get-RegAlwaysInstallElevated*", "*Get-RegAutoLogon*", + "*Get-RickAstley*", "*Get-Screenshot*", "*Get-SecurityPackages*", "*Get-ServiceFilePermission*", + "*Get-ServicePermission*", "*Get-ServiceUnquoted*", "*Get-SiteListPassword*", + "*Get-System*", "*Get-TimedScreenshot*", "*Get-UnattendedInstallFile*", + "*Get-Unconstrained*", "*Get-VaultCredential*", "*Get-VulnAutoRun*", + "*Get-VulnSchTask*", "*Gupt-Backdoor*", "*gzipstream*", "*hijack*", + "*HTTP-Login*", "*IEX *", "*injection*", "*Install-Service*", + "*Install-ServiceBinary*", "*Install-SSP*", "*internetexplorer.application*", + "*Invoke-*", "*io.compression*", "*kerberos::*", "*lastloggedon*", + "*localadmin*", "*LSASecret*", "*lsass.exe*", "*MailRaider*", "*metasp*", + "*mimikatz*", "*NEEEEWWW*", "*netfirewall*", "*NetworkRelay*", + "*New-HoneyHash*", "*ngrok*", "*nishang*", "*Out-Minidump*", + "*out-shortcut*", "*Port-Scan*", "*PortScan*", "*PowerBreach*", + "*PowerShellIcmp*", "*PowerShelludp*", "*powershellwmi*", "*PowerUp*", "*PowerView*", + "*rc4bytestream*", "*reflection.assembly*", "*remoteps*", "*remotewmi*", + "*Remove-Update*", "*SEKURLSA::*", "*Set-MacAttribute*", "*Set-Wallpaper*", + "*shell.application*", "*shellcode*", "*Show-TargetScreen*", "*Start-CaptureServer*", + "*start-process*", "*system.security.cryptography*", "*Uninstall-Windows*", "*UserProperty*", + "*VolumeShadowCopyTools*", "*WebClient*", "*webrequest*", "*wmicommand*", + "*wmimethod*", "*wmiobject*", "*write-zip*", "*xmlhttp*", + ) + + | eval script_lower=lower(ScriptBlockText) + + | eval ecnoded_command_keyword=if(match(ScriptBlockText,"(?i)(?:^|\\s)(?:/(?!/)|--?|–{1,2}|—{1,2}|―{1,2})(?:ec|encodedcommand|encodedcomman|encodedcomma|encodedcomm|encodedcom|encodedco|encodedc|encoded|encode|encod|enco|enc|en|e(?=\\s))\\s+['\\\"]?[A-Za-z0-9+/=]{5,}['\\\"]?"), 4, 0) + + | eval suspicious_cmdlets=if(match(ScriptBlockText, "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|netfirewall|Uninstall-Windows|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0) + + | eval base64_keyword=if(like(script_lower,"%frombase64%"), 4, 0) + + | eval empire=if(like(script_lower,"%system.net.webclient%") AND like(script_lower,"%frombase64%"),5,0) + + | eval mimikatz=if(like(script_lower,"%mimikatz%") OR like(script_lower,"%-dumpcr%") OR like(script_lower,"%sekurlsa::pth%") OR like(script_lower,"%kerberos::ptt%") OR like(script_lower,"%kerberos::golden%"),5,0) + + | eval invoke_expression_keyword=if(like(script_lower,"%iex %") OR like(script_lower,"%invoke-expression %"),2,0) + + | eval webclient=if(like(script_lower,"%webclient%") OR like(script_lower,"%webrequest%") OR like(script_lower,"%downloadfile%") OR like(script_lower,"%downloadstring%") OR like(script_lower,"%bitstransfer%") OR like(script_lower,"%internetexplorer.application%") OR like(script_lower,"%xmlhttp%"),5,0) + + | eval suspicious_keyword=if(match(script_lower, "(metasp|assemblybuilderaccess|reflection\.assembly|shellcode|injection|cnvert|shell\.application|start-process |rc4bytestream|system\.security\.cryptography|lsass\.exe|localadmin|lastloggedon|hijack|backupprivilege|ngrok|comsvcs|backdoor|brute.?force|port.?scan|exfiltration|exploit|disablerealtimemonitoring|beacon)"),1,0) + + | eval invoke_wmi_keyword=if(like(script_lower,"%wmiobject%") OR like(script_lower,"%wmimethod%") OR like(script_lower,"%remotewmi%") OR like(script_lower,"%powershellwmi%") OR like(script_lower,"%wmicommand%"),5,0) + + | eval downgrade_version=if(like(script_lower, "% -version 2%"),3,0) + + | eval compression_keyword=if(match(script_lower, "gzipstream|::decompress|io.compression|write-zip|(expand|compress)-archive"),5,0) + + | eval invoke_command_keyword=if(like(script_lower,"%invoke-command%"), 4, 0) + + | eval Score=ecnoded_command_keyword + + suspicious_cmdlets + + suspicious_keyword + + compression_keyword + + downgrade_version + + mimikatz + + invoke_expression_keyword + + empire + + webclient + + invoke_wmi_keyword + + invoke_command_keyword + + base64_keyword + + | where Score>=4 OR mimikatz>0 OR suspicious_cmdlets>0 OR suspicious_keyword>0 + + | eval matched_rules=mvappend( + if(ecnoded_command_keyword>0, "Encoded Command Keywords", null()), + if(suspicious_cmdlets>0, "Suspicious Cmdlets", null()), + if(base64_keyword>0, "Base64 Keyword", null()), + if(empire>0, "Empire Framework Commands", null()), + if(mimikatz>0, "Mimikatz Keywords or Strings", null()), + if(invoke_expression_keyword>0, "Invoke Expression Keywords", null()), + if(webclient>0, "Webclient Keywords", null()), + if(suspicious_keyword>0, "Potentially Suspicious Keywords or Strings", null()), + if(invoke_wmi_keyword>0, "Invoke WMI Keywords", null()), + if(downgrade_version>0, "PowerShell Downgrade Version Attempt", null()), + if(compression_keyword>0, "Compression Keywords", null()), + if(invoke_command_keyword>0, "Invoke Command Keywords", null()) + ) + + | eval matched_rules=mvfilter(isnotnull(matched_rules)) + + | rename Computer as dest, UserID as user + + | stats max(Score) as Score values(matched_rules) as matched_rules + BY user dest ScriptBlockId + + | eval matched_rules=mvjoin(matched_rules, ", ") + + | `powershell_4104_hunting_filter` +how_to_implement: |- + The following Hunting analytic requires PowerShell operational logs to be ingested with ScriptBlockLogging enabled. + Modify the powershell macro as needed to match the sourcetype or add index. + This analytic is specific to EventID 4104, or PowerShell Script Block Logging. known_false_positives: Limited false positives. May filter as needed. references: - https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md @@ -90,6 +164,8 @@ analytic_story: asset_type: Endpoint mitre_attack_id: - T1059.001 + - T1689 + - T1003 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml index 8a3b89b1145..c5982ee92c5 100644 --- a/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml +++ b/detections/endpoint/powershell_com_hijacking_inprocserver32_modification.yml @@ -2,7 +2,7 @@ name: Powershell COM Hijacking InprocServer32 Modification id: ea61e291-af05-4716-932a-67faddb6ae6f version: 10 creation_date: '2022-09-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -17,6 +17,7 @@ references: - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.015/T1546.015.yaml#L5 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -35,6 +36,8 @@ finding: analytic_story: - Malicious PowerShell asset_type: Endpoint +atomic_guid: + - 48117158-d7be-441b-bc6a-d9e36e47b52b mitre_attack_id: - T1059.001 - T1546.015 diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index 2c505368865..7f5e5a62b20 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -2,7 +2,7 @@ name: Powershell Disable Security Monitoring id: c148a894-dd93-11eb-bf2a-acde48001122 version: 17 creation_date: '2021-07-05' -modification_date: '2026-06-08' +modification_date: '2026-10-02' author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -92,6 +92,7 @@ known_false_positives: | references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell - https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps + - https://github.com/redcanaryco/atomic-red-team/blob/61080b19460f2c6431c31689d58063c5f6c1f8fb/atomics/T1562.001/T1562.001.yaml#L328 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -114,6 +115,8 @@ analytic_story: - BlankGrabber Stealer - Salat Stealer asset_type: Endpoint +atomic_guid: + - 6b8df440-51ec-4d53-bf83-899591c9b5d7 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/powershell_enable_powershell_remoting.yml b/detections/endpoint/powershell_enable_powershell_remoting.yml index fa068b59638..cd1f780f46a 100644 --- a/detections/endpoint/powershell_enable_powershell_remoting.yml +++ b/detections/endpoint/powershell_enable_powershell_remoting.yml @@ -2,7 +2,7 @@ name: PowerShell Enable PowerShell Remoting id: 40e3b299-19a5-4460-96e9-e1467f714f8e version: 12 creation_date: '2023-03-22' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -25,6 +25,7 @@ how_to_implement: To successfully implement this analytic, you will need to enab known_false_positives: Note that false positives may occur due to the use of the Enable-PSRemoting cmdlet by legitimate users, such as system administrators. It is recommended to apply appropriate filters as needed to minimize the number of false positives. references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.3 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1021.006/T1021.006.yaml#L5 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -43,6 +44,8 @@ intermediate_findings: analytic_story: - Malicious PowerShell asset_type: Endpoint +atomic_guid: + - 9059e8de-3d7d-4954-a322-46161880b9cf mitre_attack_id: - T1059.001 product: diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index 1b2cd0e10c4..c35197e74fc 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -2,7 +2,7 @@ name: Powershell Execute COM Object id: 65711630-f9bf-11eb-8d72-acde48001122 version: 12 creation_date: '2021-08-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -26,6 +26,7 @@ known_false_positives: network operrator may use this command. references: - https://threadreaderapp.com/thread/1423361119926816776.html - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.015/T1546.015.yaml#L58 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - Hermetic Wiper - Data Destruction asset_type: Endpoint +atomic_guid: + - 752191b1-7c71-445c-9dbe-21bb031b18eb mitre_attack_id: - T1059.001 - T1546.015 diff --git a/detections/endpoint/powershell_get_localgroup_discovery.yml b/detections/endpoint/powershell_get_localgroup_discovery.yml index 62987dfb8ef..fce9a2354d9 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery.yml @@ -2,7 +2,7 @@ name: PowerShell Get LocalGroup Discovery id: b71adfcc-155b-11ec-9413-acde48001122 version: 9 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -35,9 +35,12 @@ known_false_positives: False positives may be present. Tune as needed. references: - https://attack.mitre.org/techniques/T1069/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L33 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - a580462d-2c19-4bc7-8b9a-57a41b7d3ba4 mitre_attack_id: - T1069.001 product: diff --git a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml index 979ae189536..81e3c49d6ba 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml @@ -2,7 +2,7 @@ name: Powershell Get LocalGroup Discovery with Script Block Logging id: d7c6ad22-155c-11ec-bb64-acde48001122 version: 11 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -30,9 +30,12 @@ references: - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L33 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - a580462d-2c19-4bc7-8b9a-57a41b7d3ba4 mitre_attack_id: - T1069.001 product: diff --git a/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml b/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml index 25c23b9b490..da3bad95877 100644 --- a/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml +++ b/detections/endpoint/powershell_invoke_cimmethod_cimsession.yml @@ -2,7 +2,7 @@ name: PowerShell Invoke CIMMethod CIMSession id: 651ee958-a433-471c-b264-39725b788b83 version: 12 creation_date: '2023-03-22' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -25,6 +25,7 @@ how_to_implement: To successfully implement this analytic, you will need to enab known_false_positives: False positives may be present based on third-party applications or administrators using CIM. It is recommended to apply appropriate filters as needed to minimize the number of false positives. references: - https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/invoke-cimmethod?view=powershell-7.3 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546/T1546.yaml#L72 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -45,6 +46,8 @@ analytic_story: - Malicious PowerShell - Active Directory Lateral Movement asset_type: Endpoint +atomic_guid: + - adae83d3-0df6-45e7-b2c3-575f91584577 mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml index 729331c475c..3b69c4a75d2 100644 --- a/detections/endpoint/powershell_start_bitstransfer.yml +++ b/detections/endpoint/powershell_start_bitstransfer.yml @@ -2,7 +2,7 @@ name: PowerShell Start-BitsTransfer id: 39e2605a-90d8-11eb-899e-acde48001122 version: 12 creation_date: '2021-03-30' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: Limited false positives. It is possible administrators wi references: - https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281 - https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1197/T1197.yaml#L27 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -55,6 +56,8 @@ analytic_story: - BITS Jobs - Gozi Malware asset_type: Endpoint +atomic_guid: + - f63b8bc4-07e5-4112-acba-56f646f3f0bc mitre_attack_id: - T1197 product: diff --git a/detections/endpoint/powershell_start_or_stop_service.yml b/detections/endpoint/powershell_start_or_stop_service.yml index f7608d09ab7..84b0b7eb74a 100644 --- a/detections/endpoint/powershell_start_or_stop_service.yml +++ b/detections/endpoint/powershell_start_or_stop_service.yml @@ -2,7 +2,7 @@ name: PowerShell Start or Stop Service id: 04207f8a-e08d-4ee6-be26-1e0c4488b04a version: 12 creation_date: '2023-03-24' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -26,6 +26,7 @@ known_false_positives: This behavior may be noisy, as these cmdlets are commonly references: - https://learn-powershell.net/2012/01/15/startingstopping-and-restarting-remote-services-with-powershell/ - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/start-service?view=powershell-7.3 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1543.003/T1543.003.yaml#L191 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -45,6 +46,8 @@ analytic_story: - Scattered Lapsus$ Hunters - Active Directory Lateral Movement asset_type: Endpoint +atomic_guid: + - 1f896ce4-8070-4959-8a25-2658856a70c9 mitre_attack_id: - T1059.001 product: diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml index 22b1972074f..8b86ff9be68 100644 --- a/detections/endpoint/process_execution_via_wmi.yml +++ b/detections/endpoint/process_execution_via_wmi.yml @@ -2,7 +2,7 @@ name: Process Execution via WMI id: 24869767-8579-485d-9a4f-d9ddfd8f0cac version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rico Valdez, Michael Haag, Splunk status: production type: TTP @@ -14,7 +14,8 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=WmiPrvSE.exe NOT (Processes.process IN ("*\\dismhost.exe*")) by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_execution_via_wmi_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Although unlikely, administrators may use wmi to execute commands for legitimate purposes. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L85 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -39,6 +40,8 @@ intermediate_findings: analytic_story: - Suspicious WMI Use asset_type: Endpoint +atomic_guid: + - b3bdfc91-b33e-4c6d-a5c8-d64bee0276b3 mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/python_network_traffic_during_package_build.yml b/detections/endpoint/python_network_traffic_during_package_build.yml index eeb6f097b73..b5b36b69b29 100644 --- a/detections/endpoint/python_network_traffic_during_package_build.yml +++ b/detections/endpoint/python_network_traffic_during_package_build.yml @@ -46,7 +46,7 @@ search: |- by dest source process_id - | search process="* build_wheel*" + | search process="* build_wheel*" dest_ip=* | table firstTime lastTime parent_process_id parent_process_path parent_process_name parent_process diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 795aad1726d..e4b56f2824e 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -2,7 +2,7 @@ name: Registry Keys for Creating SHIM Databases id: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb version: 17 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Teoderick Contreras, Splunk, Steven Dick, Bhavin Patel status: production type: TTP @@ -12,7 +12,8 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB*) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_for_creating_shim_databases_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 known_false_positives: There are many legitimate applications that leverage shim databases for compatibility purposes for legacy applications -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.011/T1546.011.yaml#L61 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -39,6 +40,8 @@ analytic_story: - Windows Persistence Techniques - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 9b6a06f9-ab5e-4e8d-8289-1df4289db02f mitre_attack_id: - T1546.011 product: diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index a01367e4256..8cd37e1aa5b 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -2,7 +2,7 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b version: 35 creation_date: '2020-04-29' -modification_date: '2026-07-20' +modification_date: '2026-10-09' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk status: production type: TTP @@ -12,7 +12,8 @@ data_source: search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce OR Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run OR Registry.registry_path= "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\*" OR Registry.registry_path= "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\*" OR Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices* OR Registry.registry_path=*\\SOFTWARE\\Microsoft\\Netsh\\* OR Registry.registry_path= "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup" OR Registry.registry_path= *\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SharedTaskScheduler OR Registry.registry_path= *\\Classes\\htmlfile\\shell\\open\\command OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger) OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig" AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows" AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion" AND Registry.registry_key_name="Svchost") OR (Registry.registry_path="*\\CurrentControlSet\Control\Session Manager"AND Registry.registry_key_name="BootExecute") OR (Registry.registry_path="*\\Software\\Run" AND Registry.registry_key_name="auto_update")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `registry_keys_used_for_persistence_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. known_false_positives: There are many legitimate applications that must execute on system startup and will use these registry keys to accomplish that task. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.001/T1547.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -85,6 +86,8 @@ analytic_story: - Phantom Stealer - Starland RAT Campaign asset_type: Endpoint +atomic_guid: + - e55be3fd-3521-4610-9d1a-e210e42dcf05 mitre_attack_id: - T1547.001 product: diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index e26ba5a7ae3..10e5ebad02c 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -2,7 +2,7 @@ name: Registry Keys Used For Privilege Escalation id: c9f4b923-f8af-4155-b697-1354f5bcbc5e version: 17 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,9 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: There are many legitimate applications that must execute upon system startup and will use these registry keys to accomplish that task. references: - https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.012/T1546.012.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.012/T1546.012.yaml#L27 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.012/T1546.012.yaml#L53 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -43,6 +46,10 @@ analytic_story: - Data Destruction - Suspicious Windows Registry Activities asset_type: Endpoint +atomic_guid: + - fdda2626-5234-4c90-b163-60849a24c0b8 + - 46b1f278-c8ee-4aa5-acce-65e77b11f3c1 + - 13117939-c9b2-4a43-999e-0a543df92f0d mitre_attack_id: - T1546.012 product: diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index 46996d8c896..87f04574190 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -2,7 +2,7 @@ name: Regsvr32 Silent and Install Param Dll Loading id: f421c250-24e7-11ec-bc43-acde48001122 version: 15 creation_date: '2021-10-04' -modification_date: '2026-06-09' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -40,6 +40,7 @@ known_false_positives: | references: - https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/ - https://attack.mitre.org/techniques/T1218/010/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.010/T1218.010.yaml#L133 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -72,6 +73,8 @@ analytic_story: - Remcos - Suspicious Regsvr32 Activity asset_type: Endpoint +atomic_guid: + - 9d71c492-ea2e-4c08-af16-c6994cdf029f mitre_attack_id: - T1218.010 product: diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 9f27b3820a0..2f1ac099df1 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -2,7 +2,7 @@ name: Remote Process Instantiation via WMI id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da version: 19 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Mauricio Velazco, Splunk status: production type: TTP @@ -36,6 +36,7 @@ known_false_positives: The wmic.exe utility is a benign Windows application. It references: - https://attack.mitre.org/techniques/T1047/ - https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/create-method-in-class-win32-process + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L103 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -66,6 +67,8 @@ analytic_story: - Active Directory Lateral Movement - Void Manticore asset_type: Endpoint +atomic_guid: + - 9c8ef159-c666-472f-9874-90c8d60d136b mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml index dd954094480..ee8f9d31a3f 100644 --- a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml +++ b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml @@ -2,7 +2,7 @@ name: Remote System Discovery with Adsisearcher id: 70803451-0047-4e12-9d63-77fa7eb8649c version: 12 creation_date: '2021-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -25,6 +25,7 @@ known_false_positives: Administrators or power users may use Adsisearcher for tr references: - https://attack.mitre.org/techniques/T1018/ - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml#L359 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -43,6 +44,8 @@ finding: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - 64ede6ac-b57a-41c2-a7d1-32c6cd35397d mitre_attack_id: - T1018 product: diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml index ff26b5ddb97..b7f9a718a63 100644 --- a/detections/endpoint/remote_wmi_command_attempt.yml +++ b/detections/endpoint/remote_wmi_command_attempt.yml @@ -2,7 +2,7 @@ name: Remote WMI Command Attempt id: 272df6de-61f1-4784-877c-1fbc3e2d0838 version: 13 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Rico Valdez, Michael Haag, Splunk status: production type: TTP @@ -31,6 +31,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L103 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -60,6 +61,8 @@ analytic_story: - Suspicious WMI Use - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 9c8ef159-c666-472f-9874-90c8d60d136b mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml index a2952ed45c7..f0450790d44 100644 --- a/detections/endpoint/resize_shadowstorage_volume.yml +++ b/detections/endpoint/resize_shadowstorage_volume.yml @@ -2,7 +2,7 @@ name: Resize ShadowStorage volume id: bc760ca6-8336-11eb-bcbb-acde48001122 version: 11 creation_date: '2021-03-19' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras status: production type: TTP @@ -39,6 +39,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md - https://redcanary.com/blog/blackbyte-ransomware/ - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin-resize-shadowstorage + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L152 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -67,6 +68,8 @@ analytic_story: - BlackByte Ransomware - VanHelsing Ransomware asset_type: Endpoint +atomic_guid: + - da558b07-69ae-41b9-b9d4-4d98154a7049 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml index 8b18aec0c04..28850f03f50 100644 --- a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml +++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml @@ -1,17 +1,54 @@ name: Rubeus Kerberos Ticket Exports Through Winlogon Access id: 5ed8c50a-8869-11ec-876f-acde48001122 -version: 14 +version: 15 creation_date: '2022-02-07' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Mauricio Velazco, Splunk status: production type: TTP -description: The following analytic detects a process accessing the winlogon.exe system process, indicative of the Rubeus tool attempting to export Kerberos tickets from memory. This detection leverages Sysmon EventCode 10 logs, focusing on processes obtaining a handle to winlogon.exe with specific access rights. This activity is significant as it often precedes pass-the-ticket attacks, where adversaries use stolen Kerberos tickets to move laterally within an environment. If confirmed malicious, this could allow attackers to bypass normal access controls, escalate privileges, and persist within the network, posing a severe security risk. +description: |- + The following analytic detects an uncommon process requesting full access rights to winlogon.exe, which may indicate Rubeus exporting Kerberos tickets from memory. + It leverages Sysmon EventCode 10 and checks for full-access rights, specifically the value 0x1f3fff. data_source: - Sysmon EventID 10 -search: '`sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe (GrantedAccess=0x1f3fff) (SourceImage!=C:\\Windows\\system32\\svchost.exe AND SourceImage!=C:\\Windows\\system32\\lsass.exe AND SourceImage!=C:\\Windows\\system32\\LogonUI.exe AND SourceImage!=C:\\Windows\\system32\\smss.exe AND SourceImage!=C:\\Windows\\system32\\wbem\\wmiprvse.exe) | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`' -how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. -known_false_positives: Legitimate applications may obtain a handle for winlogon.exe. Filter as needed +search: |- + `sysmon` + EventCode=10 + TargetImage="*:\\Windows\\system32\\winlogon.exe" + NOT SourceImage IN ( + "C:\\Windows\\system32\\LogonUI.exe", + "C:\\Windows\\system32\\lsass.exe", + "C:\\Windows\\system32\\smss.exe", + "C:\\Windows\\system32\\svchost.exe", + "C:\\Windows\\system32\\wbem\\wmiprvse.exe" + ) + + ``` + Convert GrantedAccess from hexadecimal to decimal. 0x1f3fff is the legacy full-access mask observed for this activity. + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_ALL_ACCESS_LEGACY = 2047999 + | eval legacy_full_access_set = bit_and(g_access_decimal, PROCESS_ALL_ACCESS_LEGACY) + | where legacy_full_access_set == PROCESS_ALL_ACCESS_LEGACY + + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter` +how_to_implement: |- + This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. +known_false_positives: |- + No false positives have been identified at this time. references: - https://github.com/GhostPack/Rubeus - https://web.archive.org/web/20210725005734/http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/ @@ -26,14 +63,14 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Winlogon.exe was accessed by $SourceImage$ on $dest$ + title: The process [$SourceImage$] requested full access via the access mask [$granted_access$] to [$TargetImage$] on [$dest$]. entity: field: dest type: system score: 50 threat_objects: - - field: TargetImage - type: process + - field: SourceImage + type: file_path analytic_story: - CISA AA23-347A - Active Directory Kerberos Attacks diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml index 4ec87180d0e..253a86ce924 100644 --- a/detections/endpoint/rundll32_control_rundll_hunt.yml +++ b/detections/endpoint/rundll32_control_rundll_hunt.yml @@ -2,7 +2,7 @@ name: Rundll32 Control RunDLL Hunt id: c8e7ced0-10c5-11ec-8b03-acde48001122 version: 10 creation_date: '2021-09-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -34,6 +34,7 @@ references: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml - https://redcanary.com/blog/intelligence-insights-december-2021/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L250 analytic_story: - Suspicious Rundll32 Activity - Microsoft MSHTML Remote Code Execution CVE-2021-40444 @@ -41,6 +42,8 @@ analytic_story: asset_type: Endpoint cve: - CVE-2021-40444 +atomic_guid: + - e4c04b6f-c492-4782-82c7-3bf75eb8077e mitre_attack_id: - T1218.011 product: diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index 3123233083d..cf0aed06433 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -2,7 +2,7 @@ name: RunDLL Loading DLL By Ordinal id: 6c135f8d-5e60-454e-80b7-c56eed739833 version: 16 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, David Dorsey, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ - https://twitter.com/M_haggis/status/1491109262428635136 - https://twitter.com/pr0xylife/status/1590394227758104576 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L222 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -59,6 +60,8 @@ analytic_story: - Living Off The Land - IcedID asset_type: Endpoint +atomic_guid: + - 9fd5a74b-ba89-482a-8a3e-a5feaa3697b0 mitre_attack_id: - T1218.011 product: diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 06db197fc7c..94b93cb98e9 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -2,7 +2,7 @@ name: Scheduled Task Deleted Or Created via CMD id: d5af132c-7c17-439c-9d31-13d55340f36c version: 28 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Splunk status: production type: Anomaly @@ -60,6 +60,7 @@ references: - https://www.joesandbox.com/analysis/691823/0/html - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-delete - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1053.005/T1053.005.yaml#L21 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -124,6 +125,8 @@ analytic_story: - PlugX - Remcos asset_type: Endpoint +atomic_guid: + - 42f53695-ad4a-4546-abb6-7d837f644a71 mitre_attack_id: - T1053.005 product: diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml index 5d75b6e9d95..4a5ca53c4f1 100644 --- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml @@ -2,7 +2,7 @@ name: Scheduled Task Initiation on Remote Endpoint id: 95cf4608-4302-11ec-8194-3e22fbd008af version: 13 creation_date: '2021-11-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk, Badoodish, Github Community status: production type: TTP @@ -35,6 +35,7 @@ known_false_positives: Administrators may start scheduled tasks on remote system references: - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks - https://attack.mitre.org/techniques/T1053/005/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1053.005/T1053.005.yaml#L43 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -57,6 +58,8 @@ analytic_story: - Medusa Ransomware - Seashell Blizzard asset_type: Endpoint +atomic_guid: + - 2e5eac3e-327b-4a88-a0c0-c4057039a8dd mitre_attack_id: - T1053.005 product: diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index 67d1e5a5b90..e8269ce2321 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -2,7 +2,7 @@ name: Schtasks scheduling job on remote system id: 1297fb80-f42a-4b4a-9c8a-88c066237cf6 version: 20 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: David Dorsey, Mauricio Velazco, Splunk status: production type: TTP @@ -32,7 +32,8 @@ search: |- | `schtasks_scheduling_job_on_remote_system_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: While it is possible to have false positives, due to legitimate administrative tasks, these are usually limited and should still be validated and investigated as appropriate. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1053.005/T1053.005.yaml#L43 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -68,6 +69,8 @@ analytic_story: - NOBELIUM Group - Compromised Windows Host asset_type: Endpoint +atomic_guid: + - 2e5eac3e-327b-4a88-a0c0-c4057039a8dd mitre_attack_id: - T1053.005 product: diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml index f061c3f6caa..90b3694e8c4 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml @@ -2,7 +2,7 @@ name: ServicePrincipalNames Discovery with SetSPN id: ae8b3efc-2d2e-11ec-8b57-acde48001122 version: 13 creation_date: '2021-10-15' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -47,6 +47,7 @@ references: - https://blog.zsec.uk/paving-2-da-wholeset/ - https://msitpros.com/?p=3113 - https://adsecurity.org/?p=3466 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1558.003/T1558.003.yaml#L82 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -79,6 +80,8 @@ analytic_story: - Compromised Windows Host - Active Directory Kerberos Attacks asset_type: Endpoint +atomic_guid: + - e6f4affd-d826-4871-9a62-6c9004b8fe06 mitre_attack_id: - T1558.003 product: diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml index 2c0b0f9eb92..d382049a835 100644 --- a/detections/endpoint/shim_database_file_creation.yml +++ b/detections/endpoint/shim_database_file_creation.yml @@ -2,7 +2,7 @@ name: Shim Database File Creation id: 6e4c4588-ba2f-42fa-97e6-9f6f548eaa33 version: 13 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -12,7 +12,8 @@ data_source: search: '| tstats `security_content_summariesonly` count values(Filesystem.action) values(Filesystem.file_hash) as file_hash values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path=*Windows\\AppPatch\\Custom* by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` |`drop_dm_object_name(Filesystem)` | `shim_database_file_creation_filter`' how_to_implement: You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. known_false_positives: Because legitimate shim files are created and used all the time, this event, in itself, is not suspicious. However, if there are other correlating events, it may warrant further investigation. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.011/T1546.011.yaml#L44 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ threat_objects: analytic_story: - Windows Persistence Techniques asset_type: Endpoint +atomic_guid: + - aefd6866-d753-431f-a7a4-215ca7e3f13d mitre_attack_id: - T1546.011 product: diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml index d7bacbc89ba..cc68f93c14a 100644 --- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml +++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml @@ -2,7 +2,7 @@ name: Shim Database Installation With Suspicious Parameters id: 404620de-46d8-48b6-90cc-8a8d7b0876a3 version: 15 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -14,7 +14,8 @@ data_source: search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sdbinst.exe NOT Processes.process IN ("\"C:\\Windows\\System32\\sdbinst.exe\"", "C:\\Windows\\System32\\sdbinst.exe", "*-mm", "*-?", "*-m -bg") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `shim_database_installation_with_suspicious_parameters_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: No false positives have been identified at this time. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.011/T1546.011.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -40,6 +41,8 @@ analytic_story: - Windows Persistence Techniques - Compromised Windows Host asset_type: Endpoint +atomic_guid: + - 9ab27e22-ee62-4211-962b-d36d9a0e6a18 mitre_attack_id: - T1546.011 product: diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml index a54276b474b..e645476aa65 100644 --- a/detections/endpoint/short_lived_windows_accounts.yml +++ b/detections/endpoint/short_lived_windows_accounts.yml @@ -2,7 +2,7 @@ name: Short Lived Windows Accounts id: b25f6f62-0782-43c1-b403-083231ffd97d version: 14 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Bhavin Patel, Splunk status: production type: TTP @@ -32,6 +32,8 @@ known_false_positives: It is possible that an administrator created and deleted references: - https://www.youtube.com/watch?v=D4Cd-KK4ctk - https://attack.mitre.org/techniques/T1078/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L68 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L91 drilldown_searches: - name: View the detection results for - "$dest$" and "$src_user$" search: '%original_detection_search% | search dest = "$dest$" src_user = "$src_user$"' @@ -57,6 +59,9 @@ analytic_story: - Active Directory Lateral Movement - GhostRedirector IIS Module and Rungan Backdoor asset_type: Windows +atomic_guid: + - 6657864e-0323-4206-9344-ac9cd7265a4f + - bc8be0ac-475c-4fbf-9b1d-9fffd77afbde mitre_attack_id: - T1078.003 - T1136.001 diff --git a/detections/endpoint/socat_network_listener_binding_an_executable.yml b/detections/endpoint/socat_network_listener_binding_an_executable.yml new file mode 100644 index 00000000000..2ff67a8fe48 --- /dev/null +++ b/detections/endpoint/socat_network_listener_binding_an_executable.yml @@ -0,0 +1,91 @@ +name: Socat Network Listener Binding an Executable +id: 72482d45-1d05-46f5-bb6c-e2b709a8073a +version: 1 +creation_date: '2026-08-27' +modification_date: '2026-08-27' +author: Maria Jose Erquiaga, Splunk +status: production +type: TTP +description: |- + The following analytic detects the execution of the socat utility with command-line arguments that configure a TCP or OpenSSL listener and bind an executable to incoming connections. + Socat is a legitimate network utility, but this behavior may be used to expose executables, establish bind shells, facilitate remote command execution, or support lateral movement. +data_source: + - Osquery Results + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count + min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_name="socat*" + Processes.process="*exec:*" + Processes.process="*-listen:*" + + by Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `socat_network_listener_binding_an_executable_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Developers, network engineers, and system administrators may use socat to expose benign executables for protocol testing, debugging, data transformation, or troubleshooting. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059 + - https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/ + - https://gtfobins.github.io/gtfobins/socat/ + - https://hackers-arise.com/socat-the-advanced-hackers-network-tool/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Socat was executed with a TCP or OpenSSL listener configured to pass inbound connections to an executable via [$process$] on endpoint [$dest$] by user [$user$]. + entity: + field: dest + type: system + score: 50 +intermediate_findings: + entities: + - field: user + type: user + score: 50 + message: Socat was executed with a TCP or OpenSSL listener configured to pass inbound connections to an executable via [$process$] on endpoint [$dest$] by user [$user$]. +threat_objects: + - field: process + type: process +analytic_story: + - MacOS Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059 + - T1572 +product: + - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/utility_socat_listener_binding_executable/osquery.log + source: osqueryd.results.log + sourcetype: osquery:results + test_type: unit diff --git a/detections/endpoint/socat_remote_tcp_connection_with_local_echo_disabled.yml b/detections/endpoint/socat_remote_tcp_connection_with_local_echo_disabled.yml new file mode 100644 index 00000000000..cc264218561 --- /dev/null +++ b/detections/endpoint/socat_remote_tcp_connection_with_local_echo_disabled.yml @@ -0,0 +1,90 @@ +name: Socat Remote TCP Connection with Local Echo Disabled +id: 458c6c37-116d-4f01-8267-f09f5b82cd14 +version: 1 +creation_date: '2026-08-27' +modification_date: '2026-08-27' +author: Maria Jose Erquiaga, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects execution of the socat utility with a remote TCP or OpenSSL connection and local terminal echo disabled. + This configuration may be used for interactive terminal sessions, password handling, automation, or network debugging. + When observed in an unexpected context, such as execution by an unusual parent process or connection to an untrusted endpoint, it may indicate suspicious remote access activity. +data_source: + - Osquery Results + - Sysmon for Linux EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_name="socat*" + Processes.process="*echo=0*" + Processes.process IN ( + "*openssl:*", + "*tcp:*", + "*tcp4:*", + "*tcp6:*" + ) + + by Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `socat_remote_tcp_connection_with_local_echo_disabled_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Developers and network engineers may use socat with local echo disabled for legitimate TCP debugging, protocol testing, terminal handling, or troubleshooting. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/techniques/T1059 + - https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/ + - https://gtfobins.github.io/gtfobins/socat/ + - https://hackers-arise.com/socat-the-advanced-hackers-network-tool/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Socat was executed with local terminal echo disabled and a remote TCP or OpenSSL connection via Command Line [$process$] on endpoint [$dest$] by user [$user$]. +threat_objects: + - field: process + type: process +analytic_story: + - MacOS Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059 + - T1572 +product: + - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/utility_socat_remote_tcp_connection_with_echo_disabled/osquery.log + source: osquery + sourcetype: osquery:results + test_type: unit diff --git a/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml b/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml index bb94157473c..18647c0001a 100644 --- a/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml +++ b/detections/endpoint/steal_or_forge_authentication_certificates_behavior_identified.yml @@ -2,7 +2,7 @@ name: Steal or Forge Authentication Certificates Behavior Identified id: 87ac670e-bbfd-44ca-b566-44e9f835518d version: 9 creation_date: '2023-05-01' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Correlation @@ -22,6 +22,9 @@ known_false_positives: False positives may be present based on automated tooling references: - https://research.splunk.com/stories/windows_certificate_services/ - https://attack.mitre.org/techniques/T1649/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L377 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L351 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L325 drilldown_searches: - name: View the detection results for - "$risk_object$" search: '%original_detection_search% | search risk_object = "$risk_object$"' diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml index f6d98621048..a06f18a25fd 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml @@ -2,7 +2,7 @@ name: Suspicious microsoft workflow compiler usage id: 9bbc62e8-55d8-11eb-ae93-0242ac130002 version: 13 creation_date: '2021-01-19' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -34,6 +34,7 @@ known_false_positives: Although unlikely, limited instances have been identified references: - https://lolbas-project.github.io/lolbas/Binaries/Msbuild/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-6---microsoftworkflowcompilerexe-payload-execution + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml#L112 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -59,6 +60,8 @@ analytic_story: - Trusted Developer Utilities Proxy Execution - Living Off The Land asset_type: Endpoint +atomic_guid: + - 7cbb0f26-a4c1-4f77-b180-a009aa05637e mitre_attack_id: - T1127 product: diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml index d175f3d219e..abb3eb65e56 100644 --- a/detections/endpoint/suspicious_mshta_child_process.yml +++ b/detections/endpoint/suspicious_mshta_child_process.yml @@ -2,7 +2,7 @@ name: Suspicious mshta child process id: 60023bb6-5500-11eb-ae93-0242ac130002 version: 15 creation_date: '2021-01-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Teoderick Contreras Splunk status: production type: TTP @@ -32,6 +32,8 @@ known_false_positives: Although unlikely, some legitimate applications may exhib references: - https://github.com/redcanaryco/AtomicTestHarnesses - https://redcanary.com/blog/introducing-atomictestharnesses/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L20 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.005/T1218.005.yaml#L216 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +64,9 @@ analytic_story: - Lumma Stealer - MuddyWater asset_type: Endpoint +atomic_guid: + - 906865c3-e05f-4acc-85c4-fbc185455095 + - 8707a805-2b76-4f32-b1c0-14e558205772 mitre_attack_id: - T1218.005 product: diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml index 36c2cd036ec..f563ea52fd0 100644 --- a/detections/endpoint/suspicious_reg_exe_process.yml +++ b/detections/endpoint/suspicious_reg_exe_process.yml @@ -2,7 +2,7 @@ name: Suspicious Reg exe Process id: a6b3ab4e-dd77-4213-95fa-fc94701995e0 version: 16 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: Anomaly @@ -39,6 +39,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: It's possible for system administrators to write scripts that exhibit this behavior. If this is the case, the search will need to be modified to filter them out. references: - https://car.mitre.org/wiki/CAR-2013-03-001/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L39 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -68,6 +69,8 @@ analytic_story: - Disabling Security Tools - DHS Report TA18-074A asset_type: Endpoint +atomic_guid: + - c0413fb5-33e2-40b7-9b6f-60b29f4a7a18 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml index 9be3b0f5307..eae3bc1abe6 100644 --- a/detections/endpoint/suspicious_rundll32_startw.yml +++ b/detections/endpoint/suspicious_rundll32_startw.yml @@ -2,7 +2,7 @@ name: Suspicious Rundll32 StartW id: 9319dda5-73f2-4d43-a85a-67ce961bddb7 version: 15 creation_date: '2021-02-09' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ references: - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/index.htm#cshid=1036 - https://lolbas-project.github.io/lolbas/Binaries/Rundll32/ - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L195 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -62,6 +63,8 @@ analytic_story: - Graceful Wipe Out Attack - Hellcat Ransomware asset_type: Endpoint +atomic_guid: + - ae3a8605-b26e-457c-b6b3-2702fd335bac mitre_attack_id: - T1218.011 product: diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index 64062460cb2..09efb091a46 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -1,34 +1,77 @@ name: Suspicious wevtutil Usage id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f -version: 20 +version: 22 creation_date: '2019-10-16' -modification_date: '2026-05-13' -author: David Dorsey, Michael Haag, Teoderick Contreras, Splunk +modification_date: '2026-10-02' +author: David Dorsey, Michael Haag, Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production type: TTP -description: The following analytic detects the usage of wevtutil.exe with parameters for clearing event logs such as Application, Security, Setup, Trace, or System. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations. If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise. +description: |- + The following analytic detects the usage of wevtutil.exe with parameters for clearing event logs such as Application, Security, Setup, Trace, or System. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. + This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations. + If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*") Processes.process IN ("*System*", "*Security*", "*Setup*", "*Application*", "*trace*", "*powershell*", "Sysmon") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + ( + Processes.process_name="wevtutil.exe" + OR + Processes.original_file_name="wevtutil.exe" + ) + + Processes.process IN ("* cl *", "*clear-log*") + Processes.process IN ( + "*/Trace*", + "*AMSI/Debug*", + "*Application*", + "*CiscoSecureEndpoint*", + "*Microsoft-Windows-BitLocker*", + "*Microsoft-Windows-Bits*", + "*Microsoft-Windows-CAPI2*", + "*Microsoft-Windows-Kernel-File*", + "*Microsoft-Windows-Kernel-Process*", + "*Microsoft-Windows-LDAP*", + "*Microsoft-Windows-PowerShell*", + "*Microsoft-Windows-Sysmon*", + "*Microsoft-Windows-TerminalServices-LocalSessionManager*", + "*Microsoft-Windows-TerminalServices-RemoteConnectionManager*", + "*Microsoft-Windows-WMI-Activity*", + "*OpenSSH/*", + "*PowerShellCore/*", + "*Security*", + "*Setup*", + "*System*", + "*Windows Firewall With Advanced Security*", + "*Windows PowerShell*" + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_wevtutil_usage_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/61080b19460f2c6431c31689d58063c5f6c1f8fb/atomics/T1070.001/T1070.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -39,7 +82,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Wevtutil.exe being used to clear Event Logs on $dest$ by $user$ + title: The EventLog was cleared using the [$process_name$] utility with the Command Line [$process$] on [$dest$] by [$user$]. entity: field: user type: user @@ -49,7 +92,10 @@ intermediate_findings: - field: dest type: system score: 50 - message: Wevtutil.exe being used to clear Event Logs on $dest$ by $user$ + message: The EventLog was cleared using the [$process_name$] utility with the Command Line [$process$] on [$dest$] by [$user$]. +threat_objects: + - field: process + type: process analytic_story: - Windows Log Manipulation - Ransomware @@ -62,6 +108,8 @@ analytic_story: - Storm-0501 Ransomware - VoidLink Cloud-Native Linux Malware asset_type: Endpoint +atomic_guid: + - e6abb60e-26b8-41da-8aae-0c35174b0967 mitre_attack_id: - T1685.005 product: diff --git a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml index 2d1937a88b6..d0ab2e98694 100644 --- a/detections/endpoint/svchost_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_lolbas_execution_process_spawn.yml @@ -1,8 +1,8 @@ name: Svchost LOLBAS Execution Process Spawn id: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af -version: 15 +version: 16 creation_date: '2021-11-23' -modification_date: '2026-07-27' +modification_date: '2026-10-09' author: Mauricio Velazco, Splunk status: production type: TTP @@ -11,7 +11,6 @@ description: |- If confirmed malicious, this behavior could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment, posing a significant security risk. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index e762a054875..1cda3a4ce34 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -2,7 +2,7 @@ name: System Information Discovery Detection id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72 version: 16 creation_date: '2020-10-14' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Patrick Bareiss, Splunk status: production type: TTP @@ -16,6 +16,9 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators debugging servers references: - https://web.archive.org/web/20210119205146/https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml#L95 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L43 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -50,6 +53,10 @@ analytic_story: - BlankGrabber Stealer - Lotus Blossom Chrysalis Backdoor asset_type: Windows +atomic_guid: + - 66703791-c902-4560-8770-42b8a91f7667 + - 85cfbf23-4a1e-4342-8792-007e004b975f + - 718aebaa-d0e0-471a-8241-c5afa69c7414 mitre_attack_id: - T1082 product: diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml index 4404c793fdb..1de08f7f7e3 100644 --- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml +++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml @@ -1,8 +1,8 @@ name: System Processes Run From Unexpected Locations id: a34aae96-ccf8-4aef-952c-3ea21444444d -version: 17 +version: 18 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -35,7 +35,7 @@ search: | | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile + | lookup local=t update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true | `system_processes_run_from_unexpected_locations_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. @@ -43,6 +43,7 @@ known_false_positives: This detection may require tuning based on third party ap references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml - https://attack.mitre.org/techniques/T1036/003/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1036.003/T1036.003.yaml#L74 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -70,6 +71,8 @@ analytic_story: - Windows Error Reporting Service Elevation of Privilege Vulnerability - DarkGate Malware asset_type: Endpoint +atomic_guid: + - ac9d0fc3-8aa8-4ab5-b11f-682cd63b40aa mitre_attack_id: - T1036.003 product: diff --git a/detections/endpoint/system_user_discovery_with_query.yml b/detections/endpoint/system_user_discovery_with_query.yml index 92519700dbf..f2f2511cf5e 100644 --- a/detections/endpoint/system_user_discovery_with_query.yml +++ b/detections/endpoint/system_user_discovery_with_query.yml @@ -2,7 +2,7 @@ name: System User Discovery With Query id: ad03bfcf-8a91-4bc2-a500-112993deba87 version: 9 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -34,10 +34,15 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1033/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L30 analytic_story: - Active Directory Discovery - Medusa Ransomware asset_type: Endpoint +atomic_guid: + - 4c4959bf-addf-4b4a-be86-8d09cc1857aa + - 2a9b677d-a230-44f4-ad86-782df1ef108c mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/system_user_discovery_with_whoami.yml b/detections/endpoint/system_user_discovery_with_whoami.yml index 952697b9f19..79d629583e5 100644 --- a/detections/endpoint/system_user_discovery_with_whoami.yml +++ b/detections/endpoint/system_user_discovery_with_whoami.yml @@ -1,8 +1,8 @@ name: System User Discovery With Whoami id: 894fc43e-6f50-47d5-a68b-ee9ee23e18f4 -version: 11 +version: 12 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-08-30' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -16,7 +16,7 @@ search: |- WHERE ( Processes.process_name="whoami.exe" OR - Processes.process_original_file_name="whoami.exe" + Processes.original_file_name="whoami.exe" ) BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml index 63850b2cd6e..0761ee9525e 100644 --- a/detections/endpoint/unload_sysmon_filter_driver.yml +++ b/detections/endpoint/unload_sysmon_filter_driver.yml @@ -2,7 +2,7 @@ name: Unload Sysmon Filter Driver id: e5928ff3-23eb-4d8b-b8a4-dcbc844fdfbe version: 16 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Bhavin Patel, Splunk status: production type: TTP @@ -34,6 +34,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://www.ired.team/offensive-security/defense-evasion/unloading-sysmon-driver + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L236 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -53,6 +54,8 @@ analytic_story: - CISA AA23-347A - Disabling Security Tools asset_type: Endpoint +atomic_guid: + - 811b3e76-c41b-430c-ac0d-e2380bfaa164 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell.yml b/detections/endpoint/user_discovery_with_env_vars_powershell.yml index 0d800ec0e74..57b0d50680c 100644 --- a/detections/endpoint/user_discovery_with_env_vars_powershell.yml +++ b/detections/endpoint/user_discovery_with_env_vars_powershell.yml @@ -2,7 +2,7 @@ name: User Discovery With Env Vars PowerShell id: 0cdf318b-a0dd-47d7-b257-c621c0247de8 version: 8 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -32,9 +32,12 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1033/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L55 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - dcb6cdee-1fb0-4087-8bf8-88cfd136ba51 mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml index 70f9d59fb9f..5d3c9681ab5 100644 --- a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml +++ b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml @@ -2,7 +2,7 @@ name: User Discovery With Env Vars PowerShell Script Block id: 77f41d9e-b8be-47e3-ab35-5776f5ec1d20 version: 10 creation_date: '2021-08-24' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -25,9 +25,12 @@ how_to_implement: To successfully implement this analytic, you will need to enab known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting. references: - https://attack.mitre.org/techniques/T1033/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L55 analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - dcb6cdee-1fb0-4087-8bf8-88cfd136ba51 mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml index c40e3ee4119..634a025820c 100644 --- a/detections/endpoint/usn_journal_deletion.yml +++ b/detections/endpoint/usn_journal_deletion.yml @@ -2,7 +2,7 @@ name: USN Journal Deletion id: b6e0ff70-b122-4227-9368-4cf322ab43c3 version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: David Dorsey, Splunk status: production type: TTP @@ -38,6 +38,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1070/T1070.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -57,6 +58,8 @@ analytic_story: - Windows Log Manipulation - Ransomware asset_type: Endpoint +atomic_guid: + - b4115c7a-0e92-47f0-a61e-17e7218b2435 mitre_attack_id: - T1070 product: diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml index 7ae808c2c9e..628db714370 100644 --- a/detections/endpoint/vbscript_execution_using_wscript_app.yml +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -1,15 +1,14 @@ name: Vbscript Execution Using Wscript App id: 35159940-228f-11ec-8a49-acde48001122 -version: 13 +version: 14 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects the execution of VBScript using the wscript.exe application. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This activity is significant because wscript.exe is typically not used to execute VBScript, which is usually associated with cscript.exe. This deviation can indicate an attempt to evade traditional process monitoring and antivirus defenses. If confirmed malicious, this technique could allow attackers to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE ( diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml index 59931288430..2667b4b122f 100644 --- a/detections/endpoint/wbadmin_delete_system_backups.yml +++ b/detections/endpoint/wbadmin_delete_system_backups.yml @@ -2,7 +2,7 @@ name: WBAdmin Delete System Backups id: cd5aed7e-5cea-11eb-ae93-0242ac130002 version: 14 creation_date: '2021-01-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -38,6 +38,7 @@ references: - https://attack.mitre.org/techniques/T1490/ - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin - https://www.welivesecurity.com/2019/04/30/buhtrap-backdoor-ransomware-advertising-platform/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L108 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -61,6 +62,8 @@ analytic_story: - Storm-2460 CLFS Zero Day Exploitation - Storm-0501 Ransomware asset_type: Endpoint +atomic_guid: + - 584331dd-75bc-4c02-9e0b-17f5fd81c748 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index cee3e655c7a..f13ca4cd96e 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -2,7 +2,7 @@ name: Windows Access Token Manipulation SeDebugPrivilege id: 6ece9ed0-5f92-4315-889d-48560472b188 version: 24 creation_date: '2022-09-05' -modification_date: '2026-08-14' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -18,6 +18,7 @@ references: - https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e - https://atomicredteam.io/privilege-escalation/T1134.001/#atomic-test-2---%60sedebugprivilege%60-token-duplication - https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1134.001/T1134.001.yaml#L20 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -55,6 +56,8 @@ analytic_story: - Salat Stealer - Vidar Stealer asset_type: Endpoint +atomic_guid: + - 34f0a430-9d04-4d98-bcb5-1989f14719f0 mitre_attack_id: - T1134.002 product: diff --git a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml index fee41b3ad00..b29ba78c190 100644 --- a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml +++ b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml @@ -1,17 +1,58 @@ name: Windows Access Token Manipulation Winlogon Duplicate Token Handle id: dda126d7-1d99-4f0b-b72a-4c14031f9398 -version: 9 +version: 10 creation_date: '2022-09-01' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Hunting -description: The following analytic detects a process attempting to access winlogon.exe to duplicate its handle. This is identified using Sysmon EventCode 10, focusing on processes targeting winlogon.exe with specific access rights. This activity is significant because it is a common technique used by adversaries to escalate privileges by leveraging the high privileges and security tokens associated with winlogon.exe. If confirmed malicious, this could allow an attacker to gain elevated privileges, potentially leading to full system compromise and unauthorized access to sensitive information. +description: |- + The following analytic detects a process requesting duplicate-handle and query-limited-information access to winlogon.exe. + It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000). data_source: - Sysmon EventID 10 -search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") GrantedAccess = 0x1040 | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_access_token_manipulation_winlogon_duplicate_token_handle_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: It is possible legitimate applications will request access to winlogon, filter as needed. +search: |- + `sysmon` + EventCode=10 + TargetImage="*:\\Windows\\system32\\winlogon.exe" + + NOT SourceImage IN ( + "C:\\Windows\\system32\\LogonUI.exe", + "C:\\Windows\\system32\\lsass.exe", + "C:\\Windows\\system32\\smss.exe", + "C:\\Windows\\system32\\svchost.exe", + "C:\\Windows\\system32\\wbem\\wmiprvse.exe" + ) + + ``` + Convert GrantedAccess from hexadecimal to decimal. + 0x1040 combines PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000). + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_DUP_HANDLE = 64 + | eval PROCESS_QUERY_LIMITED_INFORMATION = 4096 + | eval duplicate_handle_set = bit_and(g_access_decimal, PROCESS_DUP_HANDLE) + | eval query_limited_set = bit_and(g_access_decimal, PROCESS_QUERY_LIMITED_INFORMATION) + | where duplicate_handle_set == PROCESS_DUP_HANDLE + AND query_limited_set == PROCESS_QUERY_LIMITED_INFORMATION + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_access_token_manipulation_winlogon_duplicate_token_handle_filter` +how_to_implement: |- + To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: |- + It is possible legitimate applications will request access to winlogon, filter as needed. references: - https://docs.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-duplicatehandle - https://attack.mitre.org/techniques/T1134/001/ diff --git a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml index a0e87a811c6..c6f811f2d9e 100644 --- a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml +++ b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml @@ -1,16 +1,53 @@ name: Windows Access Token Winlogon Duplicate Handle In Uncommon Path id: b8f7ed6b-0556-4c84-bffd-839c262b0278 -version: 12 +version: 13 creation_date: '2022-09-01' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects a process attempting to duplicate the handle of winlogon.exe from an uncommon or public source path. This is identified using Sysmon EventCode 10, focusing on processes targeting winlogon.exe with specific access rights and excluding common system paths. This activity is significant because it may indicate an adversary trying to escalate privileges by leveraging the high-privilege tokens associated with winlogon.exe. If confirmed malicious, this could allow the attacker to gain elevated access, potentially leading to full system compromise and persistent control over the affected host. +description: |- + The following analytic detects duplicate-handle and query-limited-information access to winlogon.exe from an uncommon or public source path. + It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000). data_source: - Sysmon EventID 10 -search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") AND GrantedAccess = 0x1040 AND NOT (SourceImage IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_access_token_winlogon_duplicate_handle_in_uncommon_path_filter`' -how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +search: |- + `sysmon` + EventCode=10 + TargetImage="*:\\Windows\\System32\\winlogon.exe" + NOT SourceImage IN ( + "%SystemRoot%\\*", + "C:\\Program Files (x86)\\*", + "C:\\Program Files\\*", + "C:\\Windows\\*" + ) + + ``` + Convert GrantedAccess from hexadecimal to decimal. 0x1040 combines PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000). + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_DUP_HANDLE = 64 + | eval PROCESS_QUERY_LIMITED_INFORMATION = 4096 + | eval duplicate_handle_set = bit_and(g_access_decimal, PROCESS_DUP_HANDLE) + | eval query_limited_set = bit_and(g_access_decimal, PROCESS_QUERY_LIMITED_INFORMATION) + | where duplicate_handle_set == PROCESS_DUP_HANDLE + AND query_limited_set == PROCESS_QUERY_LIMITED_INFORMATION + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_access_token_winlogon_duplicate_handle_in_uncommon_path_filter` +how_to_implement: |- + To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: It is possible legitimate applications will request access to winlogon, filter as needed. references: - https://docs.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-duplicatehandle @@ -29,10 +66,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: A process $SourceImage$ is duplicating the handle token of winlogon.exe on $dest$ + message: The process [$SourceImage$] requested duplicate-handle access [$granted_access$] to [$TargetImage$] on [$dest$] threat_objects: - field: SourceImage - type: process_name + type: file_path analytic_story: - Brute Ratel C4 - PathWiper diff --git a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml index 9d6cd43a91b..22272eb1e64 100644 --- a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml +++ b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml @@ -1,15 +1,15 @@ name: Windows AD AdminSDHolder ACL Modified id: 00d877c3-7b7b-443d-9562-6b231e2abab9 -version: 11 +version: 12 creation_date: '2022-11-15' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Mauricio Velazco, Dean Luxton, Splunk status: production type: TTP description: The following analytic detects modifications to the Access Control List (ACL) of the AdminSDHolder object in a Windows domain, specifically the addition of new rules. It leverages EventCode 5136 from the Security Event Log, focusing on changes to the nTSecurityDescriptor attribute. This activity is significant because the AdminSDHolder object secures privileged group members, and unauthorized changes can allow attackers to establish persistence and escalate privileges. If confirmed malicious, this could enable an attacker to control domain-level permissions, compromising the entire Active Directory environment. data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=container ObjectDN="CN=AdminSDHolder,CN=System*" | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUTNEW builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_adminsdholder_acl_modified_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=container ObjectDN="CN=AdminSDHolder,CN=System*" | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUTNEW builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId by ObjectClass ObjectDN src_user user | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_adminsdholder_acl_modified_filter`' how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. Additionally, a SACL needs to be created for the AdminSDHolder object in order to log modifications. known_false_positives: Adding new users or groups to the AdminSDHolder ACL is not usual. Filter as needed references: diff --git a/detections/endpoint/windows_ad_computer_spn_modified_by_user_account.yml b/detections/endpoint/windows_ad_computer_spn_modified_by_user_account.yml new file mode 100644 index 00000000000..a2fef1d15e8 --- /dev/null +++ b/detections/endpoint/windows_ad_computer_spn_modified_by_user_account.yml @@ -0,0 +1,96 @@ +name: Windows AD Computer SPN Modified By User Account +id: dbe30a35-b56d-4a7a-82c4-2433da06b342 +version: 1 +creation_date: '2026-09-25' +modification_date: '2026-09-25' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects a user account (non-machine account) adding or removing a servicePrincipalName (SPN) on a computer object in Active Directory, via Windows Security Event 5136. + In normal AD operations, SPN values on computer objects are managed exclusively by the computer account itself (during domain join or name change), by Domain Controllers during replication, or by the SYSTEM/NETWORK SERVICE context — all of which appear as accounts ending in the dollar sign ($) convention. + A named user account writing to the servicePrincipalName attribute of a computer object is anomalous and may indicate an attacker with delegated WriteProperty rights over computer accounts performing SPN manipulation. +data_source: + - Windows Event Log Security 5136 +search: |- + `wineventlog_security` + EventCode=5136 + AttributeLDAPDisplayName=servicePrincipalName + ObjectClass=computer + NOT SubjectUserName="*$" + NOT SubjectUserSid IN ( + "S-1-5-18", + "S-1-5-19", + "S-1-5-20" + ) + NOT SubjectUserName IN ( + "*ANONYMOUS*", + "*NT AUTHORITY*", + "*SYSTEM" + ) + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(AttributeValue) as spn_values + values(OperationType) as operation_types + by Computer SubjectUserName SubjectDomainName SubjectUserSid ObjectDN + + | eval operation_types=mvmap(operation_types, case(operation_types="%%14675", "Deleted", operation_types="%%14674", "Added", true(), operation_types)) + + | rename Computer as dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_ad_computer_spn_modified_by_user_account_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Domain Controller Security event logs. Enable the Advanced Security Audit policy `DS Access > Audit Directory Service Changes` for Success events. A WriteProperty audit SACL must also be configured on the computer object class (or CN=Computers container with inheritance) to generate Event 5136 when servicePrincipalName is modified. +known_false_positives: |- + Administrators using tools such as setspn.exe, ADSI Edit, or PowerShell AD modules to manually manage SPNs on computer objects will trigger this detection. + Service account provisioning workflows and some third-party identity management platforms may also legitimately modify computer SPNs. + Review the SubjectUserName, ObjectDN, and spn_values fields to determine if the change is expected. + Consider adding known administrative accounts to the filter macro. +references: + - https://www.semperis.com/blog/identity-crisis-novel-vulnerabilities-leading-to-kerberos-downgrade-dos-and-full-domain-takeover/ + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25177 + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136 +drilldown_searches: + - name: View the detection results for - "$SubjectUserName$" + search: '%original_detection_search% | search SubjectUserName = "$SubjectUserName$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$SubjectUserName$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$SubjectUserName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: SubjectUserName + type: user + score: 20 + message: User [$SubjectUserName$] modified SPNs on computer object [$ObjectDN$] on $dest$ +threat_objects: + - field: SubjectUserName + type: user +analytic_story: + - Active Directory Kerberos Attacks + - Compromised User Account + - Sneaky Active Directory Persistence Tricks +asset_type: Endpoint +cve: + - CVE-2026-25177 +mitre_attack_id: + - T1562.010 + - T1558.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.010/kerberloss/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml b/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml index 4c843d442b4..2ec0999809b 100644 --- a/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml +++ b/detections/endpoint/windows_ad_dangerous_deny_acl_modification.yml @@ -1,15 +1,15 @@ name: Windows AD Dangerous Deny ACL Modification id: 8e897153-2ebd-4cb2-85d3-09ad57db2fb7 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: This detection identifies an Active Directory access-control list (ACL) modification event, which applies permissions that deny the ability to enumerate permissions of the object. data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC) | `windows_ad_dangerous_deny_acl_modification_filter`' +search: '`wineventlog_security` EventCode=5136 | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("Full control","Read permissions",RC) | `windows_ad_dangerous_deny_acl_modification_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml b/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml index 496738c80c9..bb3d90f6285 100644 --- a/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml +++ b/detections/endpoint/windows_ad_dangerous_group_acl_modification.yml @@ -1,15 +1,15 @@ name: Windows AD Dangerous Group ACL Modification id: 59b0fc85-7a0d-4585-97ec-06a382801990 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: 'This detection monitors the addition of the following ACLs to an Active Directory group object: "Full control", "All extended rights", "All validated writes", "Create all child objects", "Delete all child objects", "Delete subtree", "Delete", "Modify permissions", "Modify owner", and "Write all properties". Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert.' data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=group | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_group_acl_modification_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=group | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceInheritance=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=if((ControlAccessRights="Write member" OR aceObjectGuid="bf9679c0-0de6-11d0-a285-00aa003049e2") AND (aceAccessRights="All validated writes" OR AccessRights="SW"),"Add/remove self as member",coalesce(ControlAccessRights,aceObjectGuid)), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceInheritance) as aceInheritance values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN ("*denied*","D","OD","XD") AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_group_acl_modification_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml b/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml index 953f11c0280..efaba46b0d9 100644 --- a/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml +++ b/detections/endpoint/windows_ad_dangerous_user_acl_modification.yml @@ -1,15 +1,15 @@ name: Windows AD Dangerous User ACL Modification id: ec5b6790-595a-4fb8-ad43-56e5b55a9617 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: 'This detection monitors the addition of the following ACLs to an Active Directory user object: "Full control","All extended rights","All validated writes", "Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties". Such modifications can indicate potential privilege escalation or malicious activity. Immediate investigation is recommended upon alert.' data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=user | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_user_acl_modification_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=user | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search NOT aceType IN (*denied*,D,OD,XD) AND aceAccessRights IN ("Full control","All extended rights","All validated writes","Create all child objects","Delete all child objects","Delete subtree","Delete","Modify permissions","Modify owner","Write all properties",CC,CR,DC,DT,SD,SW,WD,WO,WP) | `windows_ad_dangerous_user_acl_modification_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml b/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml index 961b49dc716..6722e417c57 100644 --- a/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml +++ b/detections/endpoint/windows_ad_dcshadow_privileges_acl_addition.yml @@ -1,8 +1,8 @@ name: Windows AD DCShadow Privileges ACL Addition id: ae915743-1aa8-4a94-975c-8062ebc8b723 -version: 11 +version: 12 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -22,13 +22,13 @@ search: |- | search aceObjectGuid IN ("9923a32a-3607-11d2-b9be-0000f87a36b2","1131f6ab-9c07-11d1-f79f-00c04fc2dcd2","1131f6ac-9c07-11d1-f79f-00c04fc2dcd2") | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value - | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user - | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value + | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups + | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` + | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId BY ObjectClass ObjectDN src_user diff --git a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml index a9de68376c1..4ae8bbf8237 100644 --- a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml +++ b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml @@ -1,8 +1,8 @@ name: Windows AD Domain Controller Audit Policy Disabled id: fc3ccef1-60a4-4239-bd66-b279511b4d14 -version: 12 +version: 13 creation_date: '2023-01-25' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -15,7 +15,7 @@ search: |- | eval AuditPolicyChanges=coalesce(AuditPolicyChanges,Changes), SubcategoryGuid=coalesce(SubcategoryGuid,Subcategory_GUID) | stats min(_time) as _time values(host) as dest BY AuditPolicyChanges SubcategoryGuid - | lookup advanced_audit_policy_guids GUID as SubcategoryGuid OUTPUT Category SubCategory + | lookup local=t advanced_audit_policy_guids GUID as SubcategoryGuid OUTPUT Category SubCategory | `windows_ad_domain_controller_audit_policy_disabled_filter` how_to_implement: Ensure you are ingesting EventCode `4719` from your domain controllers, the category domain_controller exists in assets and identities, and that assets and identities is enabled. If A&I is not configured, you will need to manually filter the results within the base search. known_false_positives: No false positives have been identified at this time. diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml index fa3da3a0fa4..008078814aa 100644 --- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -1,8 +1,8 @@ name: Windows AD Domain Replication ACL Addition id: 8c372853-f459-4995-afdc-280c114d33ab -version: 14 +version: 15 creation_date: '2022-11-17' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -22,11 +22,11 @@ search: |- | search aceObjectGuid IN ("1131f6aa-9c07-11d1-f79f-00c04fc2dcd2","1131f6ad-9c07-11d1-f79f-00c04fc2dcd2","89e95b76-444d-4c62-991a-0facbeda640c") | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights - | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value - | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value - | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value - | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value + | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats min(_time) as _time values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(SubjectLogonId) as SubjectLogonId BY ObjectClass ObjectDN src_user dest user diff --git a/detections/endpoint/windows_ad_domain_root_acl_deletion.yml b/detections/endpoint/windows_ad_domain_root_acl_deletion.yml index 3d8f5ea920b..f4c529ed511 100644 --- a/detections/endpoint/windows_ad_domain_root_acl_deletion.yml +++ b/detections/endpoint/windows_ad_domain_root_acl_deletion.yml @@ -1,15 +1,15 @@ name: Windows AD Domain Root ACL Deletion id: 3cb56e57-5642-4638-907f-8dfde9afb889 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: ACL deletion performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage. data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand old_values | where NOT old_values IN (new_values) | rex field=old_values "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(old_values) as old_values by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_deletion_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand old_values | where NOT old_values IN (new_values) | rex field=old_values "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(old_values) as old_values by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_deletion_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_domain_root_acl_modification.yml b/detections/endpoint/windows_ad_domain_root_acl_modification.yml index dd7f05a1ec1..e3e9320ce78 100644 --- a/detections/endpoint/windows_ad_domain_root_acl_modification.yml +++ b/detections/endpoint/windows_ad_domain_root_acl_modification.yml @@ -1,15 +1,15 @@ name: Windows AD Domain Root ACL Modification id: 4981e2db-1372-440d-816e-3e7e2ed74433 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: ACL modification performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage. data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",''access_rights_value''), aceType=ace_type_value, aceFlags=coalesce(ace_flag_value,"This object only"), aceControlAccessRights=ControlAccessRights, user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_modification_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=domainDNS | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);;(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",''access_rights_value''), aceType=ace_type_value, aceFlags=coalesce(ace_flag_value,"This object only"), aceControlAccessRights=ControlAccessRights, user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags(inheritance) values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | `windows_ad_domain_root_acl_modification_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_dsrm_password_reset.yml b/detections/endpoint/windows_ad_dsrm_password_reset.yml index 45150fe2117..7ad5873bbb8 100644 --- a/detections/endpoint/windows_ad_dsrm_password_reset.yml +++ b/detections/endpoint/windows_ad_dsrm_password_reset.yml @@ -2,7 +2,7 @@ name: Windows AD DSRM Password Reset id: d1ab841c-36a6-46cf-b50f-b2b04b31182a version: 10 creation_date: '2022-09-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Dean Luxton status: production type: TTP @@ -22,6 +22,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: Resetting the DSRM password for legitamate reasons, i.e. forgot the password. Disaster recovery. Deploying AD backdoor deliberately. references: - https://adsecurity.org/?p=1714 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml#L533 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - Sneaky Active Directory Persistence Tricks - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - d5b886d9-d1c7-4b6e-a7b0-460041bf2823 mitre_attack_id: - T1098 product: diff --git a/detections/endpoint/windows_ad_gpo_new_cse_addition.yml b/detections/endpoint/windows_ad_gpo_new_cse_addition.yml index ee01fe92ecd..7ee0d8c86b5 100644 --- a/detections/endpoint/windows_ad_gpo_new_cse_addition.yml +++ b/detections/endpoint/windows_ad_gpo_new_cse_addition.yml @@ -1,8 +1,8 @@ name: Windows AD GPO New CSE Addition id: 700c11d1-da09-47b2-81aa-358c143c7986 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -24,7 +24,7 @@ search: |- | \d]+\-[A-Z | \d]+\-[A-Z | \d]+\}") - | lookup msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType + | lookup local=t msad_guid_lookup guid as new_values OUTPUTNEW displayName as policyType | eval newPolicy=if(policyType like "%",policyType,new_values) | join ObjectDN [ | search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update diff --git a/detections/endpoint/windows_ad_hidden_ou_creation.yml b/detections/endpoint/windows_ad_hidden_ou_creation.yml index 753e9958033..f3b1f2b8cc0 100644 --- a/detections/endpoint/windows_ad_hidden_ou_creation.yml +++ b/detections/endpoint/windows_ad_hidden_ou_creation.yml @@ -1,15 +1,15 @@ name: Windows AD Hidden OU Creation id: 66b6ad5e-339a-40af-b721-dacefc7bdb75 -version: 10 +version: 11 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP description: This analytic is looking for when an ACL is applied to an OU which denies listing the objects residing in the OU. This activity combined with modifying the owner of the OU will hide AD objects even from domain administrators. data_source: - Windows Event Log Security 5136 -search: '`wineventlog_security` EventCode=5136 ObjectClass=organizationalUnit | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("List contents","List objects",LC,LO) | `windows_ad_hidden_ou_creation_filter`' +search: '`wineventlog_security` EventCode=5136 ObjectClass=organizationalUnit | stats min(_time) as _time values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(dest) as dest by ObjectClass ObjectDN OpCorrelationID src_user SubjectLogonId | rex field=old_value max_match=10000 "\((?P.*?)\)" | rex field=new_value max_match=10000 "\((?P.*?)\)" | mvexpand new_ace | where NOT new_ace IN (old_values) | rex field=new_ace "(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?);(?P.*?)$" | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value ``` Optional SID resolution lookups | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType=coalesce(ace_type_value,aceType), aceFlags=coalesce(ace_flag_value,"This object only"), aceAccessRights=if(aceAccessRights="CCDCLCSWRPWPDTLOCRSDRCWDWO","Full control",coalesce(access_rights_value,AccessRights)), aceControlAccessRights=coalesce(ControlAccessRights,aceObjectGuid), user=coalesce(user, group, builtin_group, aceSid) | stats values(aceType) as aceType values(aceFlags) as aceFlags values(aceControlAccessRights) as aceControlAccessRights values(aceAccessRights) as aceAccessRights values(new_ace) as new_ace values(aceInheritedTypeGuid) as aceInheritedTypeGuid by _time ObjectClass ObjectDN src_user SubjectLogonId user OpCorrelationID | eval aceControlAccessRights=if(mvcount(aceControlAccessRights)=1 AND aceControlAccessRights="","All rights",''aceControlAccessRights'') | search aceType IN ("Access denied",D) AND aceAccessRights IN ("List contents","List objects",LC,LO) | `windows_ad_hidden_ou_creation_filter`' how_to_implement: Ensure you are ingesting Active Directory audit logs - specifically event 5136. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security macro is configured with the correct indexes and include lookups for SID resolution if evt_resolve_ad_obj is set to 0. known_false_positives: No false positives have been identified at this time. references: diff --git a/detections/endpoint/windows_ad_object_owner_updated.yml b/detections/endpoint/windows_ad_object_owner_updated.yml index b242e6adefb..d26cae513be 100644 --- a/detections/endpoint/windows_ad_object_owner_updated.yml +++ b/detections/endpoint/windows_ad_object_owner_updated.yml @@ -1,8 +1,8 @@ name: Windows AD Object Owner Updated id: 4af01f6b-d8d4-4f96-8635-758a01557130 -version: 12 +version: 13 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -17,12 +17,12 @@ search: |- | rex field=old_value "O:(?P.*?)G:" | rex field=new_value "O:(?P.*?)G:" | where old_owner!=new_owner ``` optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as new_owner OUTPUT downLevelDomainName as new_owner_user - | lookup admon_groups_def objectSid as new_owner OUTPUT cn as new_owner_group - | lookup identity_lookup_expanded objectSid as old_owner OUTPUT downLevelDomainName as old_owner_user - | lookup admon_groups_def objectSid as old_owner OUTPUT cn as old_owner_group ``` - | lookup builtin_groups_lookup builtin_group_string as new_owner_group OUTPUT builtin_group_name as new_owner_group_builtin_group - | lookup builtin_groups_lookup builtin_group_string as old_owner OUTPUT builtin_group_name as old_owner_group_builtin_group + | lookup local=t identity_lookup_expanded objectSid as new_owner OUTPUT downLevelDomainName as new_owner_user + | lookup local=t admon_groups_def objectSid as new_owner OUTPUT cn as new_owner_group + | lookup local=t identity_lookup_expanded objectSid as old_owner OUTPUT downLevelDomainName as old_owner_user + | lookup local=t admon_groups_def objectSid as old_owner OUTPUT cn as old_owner_group ``` + | lookup local=t builtin_groups_lookup builtin_group_string as new_owner_group OUTPUT builtin_group_name as new_owner_group_builtin_group + | lookup local=t builtin_groups_lookup builtin_group_string as old_owner OUTPUT builtin_group_name as old_owner_group_builtin_group | eval user=coalesce(new_owner_user, new_owner_group, new_owner_group_builtin_group, new_owner), previousOwner=coalesce(old_owner_user, old_owner_group, old_owner_group_builtin_group, old_owner) | stats values(previousOwner) as previousOwner values(user) as user values(SubjectLogonId) as SubjectLogonId BY _time ObjectClass ObjectDN diff --git a/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml b/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml index 49124a77138..4d065865c8f 100644 --- a/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_privileged_account_sid_history_addition.yml @@ -1,8 +1,8 @@ name: Windows AD Privileged Account SID History Addition id: 6b521149-b91c-43aa-ba97-c2cac59ec830 -version: 13 +version: 14 creation_date: '2023-04-11' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -16,7 +16,7 @@ search: |- NOT SidHistory IN ("%%1793", -) | rex field=SidHistory "(^%{|^)(?P.*?)(}$|$)" | eval category="privileged" - | lookup identity_lookup_expanded category, identity as SidHistory OUTPUT identity_tag as match + | lookup local=t identity_lookup_expanded category, identity as SidHistory OUTPUT identity_tag as match | where isnotnull(match) | rename TargetSid as userSid | table _time action status host user userSid SidHistory Logon_ID src_user dest diff --git a/detections/endpoint/windows_ad_privileged_group_modification.yml b/detections/endpoint/windows_ad_privileged_group_modification.yml index bcfe2f7cef9..0feccfdd2fb 100644 --- a/detections/endpoint/windows_ad_privileged_group_modification.yml +++ b/detections/endpoint/windows_ad_privileged_group_modification.yml @@ -1,8 +1,8 @@ name: Windows AD Privileged Group Modification id: 187bf937-c436-4c65-bbcb-7539ffe02da1 -version: 11 +version: 12 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -20,7 +20,7 @@ search: |- `wineventlog_security` EventCode IN (4728) | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc BY signature, Group_Name,src_user dest - | lookup admon_groups_def cn as Group_Name OUTPUT category + | lookup local=t admon_groups_def cn as Group_Name OUTPUT category | where category="privileged" | `windows_ad_privileged_group_modification_filter` how_to_implement: This analytic requires eventCode 4728 to be ingested along with the admon_groups_def lookup being configured to include a list of AD groups along with a category to identify privileged groups. See splunkbase app listed in the references for further details. diff --git a/detections/endpoint/windows_ad_self_dacl_assignment.yml b/detections/endpoint/windows_ad_self_dacl_assignment.yml index 086f99486a4..cc4b4578cdd 100644 --- a/detections/endpoint/windows_ad_self_dacl_assignment.yml +++ b/detections/endpoint/windows_ad_self_dacl_assignment.yml @@ -1,8 +1,8 @@ name: Windows AD Self DACL Assignment id: 16132445-da9f-4d03-ad44-56d717dcd67d -version: 12 +version: 13 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -36,17 +36,17 @@ search: | | rex max_match=100 field=aceAccessRights "(?P[A-Z]{2})" | rex max_match=100 field=aceFlags "(?P[A-Z]{2})" - | lookup ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType - | lookup ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value - | lookup ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value - | lookup msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights + | lookup local=t ace_type_lookup ace_type_string as aceType OUTPUT ace_type_value as aceType + | lookup local=t ace_flag_lookup flag_string as aceFlags OUTPUT flag_value as ace_flag_value + | lookup local=t ace_access_rights_lookup access_rights_string as AccessRights OUTPUT access_rights_value + | lookup local=t msad_guid_lookup guid as aceObjectGuid OUTPUT displayName as ControlAccessRights ``` Optional SID resolution lookups - | lookup identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user - | lookup admon_groups_def objectSid as aceSid OUTPUT cn as group + | lookup local=t identity_lookup_expanded objectSid as aceSid OUTPUT downLevelDomainName as user + | lookup local=t admon_groups_def objectSid as aceSid OUTPUT cn as group ``` - | lookup builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group + | lookup local=t builtin_groups_lookup builtin_group_string as aceSid OUTPUT builtin_group_name as builtin_group | eval aceType = coalesce(ace_type_value, aceType), aceInheritance = coalesce(ace_flag_value, "This object only"), diff --git a/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml b/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml new file mode 100644 index 00000000000..95de6c73ae6 --- /dev/null +++ b/detections/endpoint/windows_ad_spn_unicode_collision_injection.yml @@ -0,0 +1,104 @@ +name: Windows AD SPN Unicode Collision Injection +id: d2d2c043-57a6-4aca-be43-ebb402dbb9e5 +version: 1 +creation_date: '2026-09-25' +modification_date: '2026-09-25' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects the addition or modification of a servicePrincipalName (SPN) containing invisible Unicode characters to an Active Directory computer object via Windows Security Event 5136. + This is the key indicator of the KerberLoss attack (CVE-2026-25177), where an attacker with write access to a machine account's SPN attribute injects a collision SPN that contains a Zero Width or other invisible Unicode character (e.g. U+200C Zero Width Non-Joiner). + LDAP's string preparation rules (RFC 4518) cause these characters to be ignored during uniqueness checking, allowing the write to succeed even when an identical SPN already exists on another machine account. + The Kerberos KDC, however, does not apply the same normalisation — it finds two accounts with matching SPNs and returns KDC_ERR_S_PRINCIPAL_UNKNOWN, causing a Kerberos denial-of-service or forcing clients to fall back to NTLM downgrade. +data_source: + - Windows Event Log Security 5136 +search: |- + `wineventlog_security` + EventCode=5136 + AttributeValue=* + AttributeLDAPDisplayName=servicePrincipalName + OperationType IN ( + "%%14674", + "%%14675" + ) + + | regex AttributeValue="[\x{034F}\x{200B}-\x{200F}\x{00AD}\x{1806}\x{FEFF}\x{FFFC}\x{2060}\x{206A}-\x{206F}\x{180B}-\x{180D}\x{FE00}-\x{FE0F}]" + + | eval matched_invisible_chars=mvappend( + if(match(AttributeValue, "\x{034F}"), "U+034F (Combining Grapheme Joiner)", null()), + if(match(AttributeValue, "\x{200B}"), "U+200B (Zero Width Space)", null()), + if(match(AttributeValue, "\x{200C}"), "U+200C (Zero Width Non-Joiner)", null()), + if(match(AttributeValue, "\x{200D}"), "U+200D (Zero Width Joiner)", null()), + if(match(AttributeValue, "\x{200E}"), "U+200E (Left-to-Right Mark)", null()), + if(match(AttributeValue, "\x{200F}"), "U+200F (Right-to-Left Mark)", null()), + if(match(AttributeValue, "\x{00AD}"), "U+00AD (Soft Hyphen)", null()), + if(match(AttributeValue, "\x{1806}"), "U+1806 (Mongolian Todo Soft Hyphen)", null()), + if(match(AttributeValue, "\x{FEFF}"), "U+FEFF (Zero Width No-Break Space)", null()), + if(match(AttributeValue, "\x{FFFC}"), "U+FFFC (Object Replacement Character)", null()), + if(match(AttributeValue, "\x{2060}"), "U+2060 (Word Joiner)", null()), + if(match(AttributeValue, "[\x{206A}-\x{206F}]"), "U+206A-206F (Deprecated Format Characters)", null()), + if(match(AttributeValue, "[\x{180B}-\x{180D}]"), "U+180B-180D (Variation Selectors)", null()), + if(match(AttributeValue, "[\x{FE00}-\x{FE0F}]"), "U+FE00-FE0F (Variation Selectors)", null())) + + | where isnotnull(matched_invisible_chars) + | rename Computer as dest + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(matched_invisible_chars) as matched_invisible_chars + by dest SubjectUserName SubjectDomainName ObjectDN ObjectClass AttributeValue + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_ad_spn_unicode_collision_injection_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Domain Controller Security event logs. Enable the Advanced Security Audit policy `DS Access > Audit Directory Service Changes` for Success events. Additionally, a WriteProperty audit SACL must be configured on the computer object class (or the CN=Computers container with inheritance) to generate Event 5136 when servicePrincipalName is modified. +known_false_positives: |- + Legitimate use of invisible Unicode characters in SPN values is not expected. This detection should have a very low false positive rate. + Provisioning tools or scripts that incorrectly encode SPN strings from certain character sets may trigger this. + Verify the SubjectUserName and ObjectDN to confirm intent. +references: + - https://www.semperis.com/blog/identity-crisis-novel-vulnerabilities-leading-to-kerberos-downgrade-dos-and-full-domain-takeover/ + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25177 + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136 +drilldown_searches: + - name: View the detection results for - "$SubjectUserName$" + search: '%original_detection_search% | search SubjectUserName = "$SubjectUserName$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$SubjectUserName$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$SubjectUserName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: User [$SubjectUserName$] injected an invisible-Unicode SPN [$matched_invisible_chars$] onto [$ObjectDN$] on $dest$ + entity: + field: SubjectUserName + type: user + score: 50 +threat_objects: + - field: AttributeValue + type: user +analytic_story: + - Active Directory Kerberos Attacks + - Compromised User Account + - Sneaky Active Directory Persistence Tricks +asset_type: Endpoint +cve: + - CVE-2026-25177 +mitre_attack_id: + - T1562.010 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.010/kerberloss/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_ad_user_suspicious_upn_change.yml b/detections/endpoint/windows_ad_user_suspicious_upn_change.yml new file mode 100644 index 00000000000..aa955d2dd76 --- /dev/null +++ b/detections/endpoint/windows_ad_user_suspicious_upn_change.yml @@ -0,0 +1,91 @@ +name: Windows AD User Suspicious UPN Change +id: 81324b8b-46c0-4ca3-b9a1-d33638f21021 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects a user account modifying its own userPrincipalName (UPN) to match the sAMAccountName of another account via Windows Security Event 4738. + This is the setup step of the ResetNightmare attack (CVE-2026-27912), where an attacker with WriteProperty rights on their own UPN attribute spoofs their identity to a target account. + The KDC then resolves a ptype=10 (NT-ENTERPRISE) Kerberos pre-authentication request against the spoofed UPN, issuing a kadmin/changepw TGT that can be used to change the target account's password via kpasswd (port 464). + Event 4738 is generated when a user account attribute is changed. This analytic filters to events where the SubjectUserSid equals the TargetSid (self-modification), the new UPN value is not a standard UPN (no @ sign), and the value is not a Windows placeholder. + A non-UPN value set on one's own account is anomalous and has no legitimate administrative use case. +data_source: + - Windows Event Log Security 4738 +search: |- + `wineventlog_security` + EventCode=4738 + UserPrincipalName="*" + NOT UserPrincipalName IN ( + "-", + "", + "*@*", + "%%1793" + ) + NOT SubjectUserSid IN ( + "S-1-5-18", + "S-1-5-7" + ) + NOT SubjectUserName IN ( + "ANONYMOUS*", + "NT AUTHORITY*" + ) + + | where SubjectUserSid=TargetSid + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by dest SubjectUserName SubjectUserSid TargetUserName TargetSid UserPrincipalName + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_ad_user_suspicious_upn_change_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `User Account Management` within `Account Management` needs to be enabled. +known_false_positives: |- + Administrators or identity management tools may legitimately set a UPN that does not contain an @ sign during account provisioning or migration workflows. Investigate the SubjectUserName and context to confirm. +references: + - https://cravaterouge.com/articles/resetnightmare/ + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27912 + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738 +drilldown_searches: + - name: View the detection results for - "$SubjectUserName$" + search: '%original_detection_search% | search SubjectUserName = "$SubjectUserName$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$SubjectUserName$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$SubjectUserName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: User [$SubjectUserName$] set their UPN to [$UserPrincipalName$] on $dest$ + entity: + field: SubjectUserName + type: user + score: 50 +threat_objects: + - field: SubjectUserName + type: user +analytic_story: + - Active Directory Kerberos Attacks +asset_type: Endpoint +cve: + - CVE-2026-27912 +mitre_attack_id: + - T1078.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/resetnightmare/windows-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml index 61a8f0b0b9e..e03658266cf 100644 --- a/detections/endpoint/windows_adfind_exe.yml +++ b/detections/endpoint/windows_adfind_exe.yml @@ -2,7 +2,7 @@ name: Windows AdFind Exe id: bd3b0187-189b-46c0-be45-f52da2bae67f version: 14 creation_date: '2020-12-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Jose Hernandez, Bhavin Patel, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -66,6 +66,12 @@ references: - https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption - https://www.joeware.net/freetools/tools/adfind/index.htm - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L71 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L96 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L121 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L146 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L378 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L399 drilldown_searches: - name: View the detection results for - "$user$" search: '%original_detection_search% | search user = "$user$"' diff --git a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml index 7bb99a45b9b..1d6ad8ec27f 100644 --- a/detections/endpoint/windows_admin_password_changed_by_non_admin.yml +++ b/detections/endpoint/windows_admin_password_changed_by_non_admin.yml @@ -1,8 +1,8 @@ name: Windows Admin Password Changed by Non-Admin id: 6d4c4d88-cd60-43a1-8c70-c74a9614f724 -version: 1 +version: 2 creation_date: '2026-04-27' -modification_date: '2026-04-27' +modification_date: '2026-09-23' author: Raven Tait, Splunk status: production type: TTP @@ -13,15 +13,27 @@ data_source: search: |- `wineventlog_security` EventCode=4723 - | rex field=object_id "-(?\d+)$" + TargetSid IN ( + "*500*", + "*512*", + "*513*", + "*518*", + "*519*", + "*520*" + ) + + | rex field=TargetSid "-(?\d+)$" | rex field=SubjectUserSid "-(?\d+)$" - | where target_rid="500" OR tonumber(target_rid) IN (512,513,518,519,520) + + | where tonumber(target_rid)=500 OR tonumber(target_rid) IN (512,513,518,519,520) | where tonumber(subject_rid) >= 1000 - | where SubjectUserSid != object_id + | where subject_rid != target_rid + | stats count min(_time) as firstTime max(_time) as lastTime - by dest user object_id EventCode src_user - SubjectUserSid SubjectLogonId PrivilegeList + + by dest TargetSid EventCode SubjectUserSid src_user TargetUserName + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_admin_password_changed_by_non_admin_filter` @@ -41,17 +53,21 @@ drilldown_searches: name: View risk events for the last 7 days for - "$dest$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' finding: - title: Non-Administrator account $src_user$ changed password of Admin account $user$ on $dest$. + title: Non-Administrator account [$src_user$] changed the password of the Admin account [$TargetUserName$] on $dest$. entity: field: dest type: system score: 50 +threat_objects: + - field: src_user + type: user analytic_story: - Windows Privilege Escalation - BlueHammer asset_type: Endpoint cve: - CVE-2026-33825 + - CVE-2026-27912 mitre_attack_id: - T1068 - T1543.003 diff --git a/detections/endpoint/windows_ai_platform_dns_query.yml b/detections/endpoint/windows_ai_platform_dns_query.yml index 60a3555327e..64febb1b456 100644 --- a/detections/endpoint/windows_ai_platform_dns_query.yml +++ b/detections/endpoint/windows_ai_platform_dns_query.yml @@ -1,8 +1,8 @@ name: Windows AI Platform DNS Query id: 1ad89d24-c856-4a0e-8fdf-c20c7b9febe1 -version: 6 +version: 7 creation_date: '2025-08-28' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -12,7 +12,7 @@ data_source: - Sysmon EventID 22 search: | `sysmon` EventCode=22 QueryName IN ("router.huggingface.co", "api.openai.com") - | lookup update=true browser_app_list browser_process_name AS process_name OUTPUT isAllowed | search isAllowed!=true + | lookup local=t update=true browser_app_list browser_process_name AS process_name OUTPUT isAllowed | search isAllowed!=true | rename dvc as dest | stats count min(_time) as firstTime max(_time) as lastTime by answer answer_count dest process_exec process_guid process_name query query_count reply_code_id signature signature_id src user_id Image diff --git a/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml b/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml index bd2877700bf..aea125442a2 100644 --- a/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml +++ b/detections/endpoint/windows_alternate_data_stream_created_over_local_share.yml @@ -1,8 +1,8 @@ name: Windows Alternate Data Stream Created Over Local Share id: e974a5c9-cbe9-4b4a-8fba-b55e7dbc8259 -version: 1 +version: 2 creation_date: '2026-08-19' -modification_date: '2026-08-19' +modification_date: '2026-09-30' author: Onur Mustafa Erdogan, Splunk status: production type: Anomaly @@ -17,7 +17,7 @@ data_source: search: |- `wineventlog_security` EventCode=5145 - IpAddress="127.0.0.1" + IpAddress IN ("127.0.0.1", "::1") ObjectType="File" | regex RelativeTargetName="(?i)\:\w+$" | fillnull diff --git a/detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml b/detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml index f050a23a177..f5925935625 100644 --- a/detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml +++ b/detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml @@ -2,7 +2,7 @@ name: Windows Application Whitelisting Bypass Attempt via Rundll32 id: 1ef5dab0-e1f1-495d-a272-d134583c10b1 version: 6 creation_date: '2021-02-05' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -65,6 +65,10 @@ references: - https://lolbas-project.github.io/lolbas/Libraries/Ieadvpack/ - https://lolbas-project.github.io/lolbas/Libraries/Setupapi/ - https://lolbas-project.github.io/lolbas/Libraries/Syssetup/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L59 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L85 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L112 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.011/T1218.011.yaml#L138 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -96,6 +100,11 @@ analytic_story: - Living Off The Land - Compromised Windows Host asset_type: Endpoint +atomic_guid: + - d91cae26-7fc1-457b-a854-34c8aad48c89 + - 5e46a58e-cbf6-45ef-a289-ed7754603df9 + - 41fa324a-3946-401e-bbdd-d7991c628125 + - 71d771cd-d6b3-4f34-bc76-a63d47a10b19 mitre_attack_id: - T1218.011 product: diff --git a/detections/endpoint/windows_applocker_block_events.yml b/detections/endpoint/windows_applocker_block_events.yml index 35ba239a3ba..e6acb3d585c 100644 --- a/detections/endpoint/windows_applocker_block_events.yml +++ b/detections/endpoint/windows_applocker_block_events.yml @@ -1,8 +1,8 @@ name: Windows AppLocker Block Events id: e369afe8-cd35-47a3-9c1e-d813efc1f7dd -version: 10 +version: 11 creation_date: '2024-04-17' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Anomaly @@ -16,7 +16,7 @@ search: |- BY dest, PolicyName, RuleId, user, TargetProcessId, FilePath, FullFilePath, EventCode - | lookup applockereventcodes EventCode OUTPUT Description + | lookup local=t applockereventcodes EventCode OUTPUT Description | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_applocker_block_events_filter` diff --git a/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml b/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml index 0af315282ff..15e389f0588 100644 --- a/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml +++ b/detections/endpoint/windows_applocker_privilege_escalation_via_unauthorized_bypass.yml @@ -1,8 +1,8 @@ name: Windows AppLocker Privilege Escalation via Unauthorized Bypass id: bca48629-7fa2-40d3-9e5d-807564504e28 -version: 9 +version: 10 creation_date: '2024-04-17' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: TTP @@ -18,7 +18,7 @@ search: |- FullFilePath, EventCode | where attempt_count > 5 | sort - attempt_count - | lookup applockereventcodes EventCode OUTPUT Description + | lookup local=t applockereventcodes EventCode OUTPUT Description | `windows_applocker_privilege_escalation_via_unauthorized_bypass_filter` how_to_implement: The analytic is designed to be run against Windows AppLocker event logs collected from endpoints with AppLocker enabled. If using Microsoft Defender for Endpoint (MDE), modify the analytic to use EventTypes/ActionTypes that match the block events for AppLocker. The analytic requires the AppLocker event logs to be ingested into Splunk. known_false_positives: False positives are possible if legitimate users are attempting to bypass application restrictions. This could occur if a user is attempting to run an application that is not permitted by AppLocker. It is recommended to investigate the context of the bypass attempt to determine if it is malicious or not. Modify the threshold as needed to reduce false positives. diff --git a/detections/endpoint/windows_attempt_to_stop_security_service.yml b/detections/endpoint/windows_attempt_to_stop_security_service.yml index c5c5036f1fc..bb970385674 100644 --- a/detections/endpoint/windows_attempt_to_stop_security_service.yml +++ b/detections/endpoint/windows_attempt_to_stop_security_service.yml @@ -1,8 +1,8 @@ name: Windows Attempt To Stop Security Service id: 9ed27cea-4e27-4eff-b2c6-aac9e78a7517 -version: 11 +version: 12 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Rico Valdez, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -29,7 +29,7 @@ search: |- | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup security_services_lookup service as process OUTPUTNEW category, description + | lookup local=t security_services_lookup service as process OUTPUTNEW category, description | search category=security | `windows_attempt_to_stop_security_service_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. @@ -37,6 +37,7 @@ known_false_positives: No false positives have been identified at this time. sho references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ + - https://github.com/redcanaryco/atomic-red-team/blob/61080b19460f2c6431c31689d58063c5f6c1f8fb/atomics/T1562.001/T1562.001.yaml#L306 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -71,6 +72,8 @@ analytic_story: - Azorult - Trickbot asset_type: Endpoint +atomic_guid: + - a1230893-56ac-4c81-b644-2108e982f8f5 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml index 68c633e1c8a..8e479ce37e2 100644 --- a/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml +++ b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml @@ -2,7 +2,7 @@ name: Windows Autostart Execution LSASS Driver Registry Modification id: 57fb8656-141e-4d8a-9f51-62cff4ecb82a version: 10 creation_date: '2022-08-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -15,6 +15,7 @@ known_false_positives: False positives may be present on recent Windows Operatin references: - https://blog.xpnsec.com/exploring-mimikatz-part-1/ - https://github.com/oxfemale/LogonCredentialsSteal/tree/master/lsass_lib + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.008/T1547.008.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ finding: analytic_story: - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 8ecef16d-d289-46b4-917b-0dba6dc81cf1 mitre_attack_id: - T1547.008 product: diff --git a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml index c9afe2a0c6b..53232bd57ed 100644 --- a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml +++ b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml @@ -2,7 +2,7 @@ name: Windows Binary Proxy Execution Mavinject DLL Injection id: ccf4b61b-1b26-4f2e-a089-f2009c569c57 version: 13 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -31,6 +31,7 @@ references: - https://attack.mitre.org/techniques/T1218/013/ - https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-1---mavinject---inject-dll-into-running-process + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -60,6 +61,8 @@ threat_objects: analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - c426dacf-575d-4937-8611-a148a86a5e61 mitre_attack_id: - T1218.013 product: diff --git a/detections/endpoint/windows_builtin_account_name_was_changed.yml b/detections/endpoint/windows_builtin_account_name_was_changed.yml new file mode 100644 index 00000000000..5981a964fbc --- /dev/null +++ b/detections/endpoint/windows_builtin_account_name_was_changed.yml @@ -0,0 +1,79 @@ +name: Windows Builtin Account Name Was Changed +id: 65e6e8b9-c68c-460f-beb8-48cfe91b4d21 +version: 1 +creation_date: '2026-08-24' +modification_date: '2026-08-24' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects renaming of Windows built-in accounts via Event ID 4781. + It identifies renames targeting accounts with well-known reserved RIDs (500-504): Administrator, Guest, krbtgt, DefaultAccount, and WDAGUtilityAccount, by matching the TargetSid field against the S-1-5-21-*-50[0-4] pattern. + Attackers commonly rename the built-in Administrator account to evade detections that alert on the literal account name, while retaining the full privileges of the RID-500 account. + Renaming Guest, krbtgt, or other reserved accounts is highly unusual in any legitimate environment. +data_source: + - Windows Event Log Security 4781 +search: |- + `wineventlog_security` + EventCode=4781 + TargetSid="S-1-5-21-*" + + | where match(TargetSid, "S-1-5-21-.*-50[0-4]$") + + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest OldTargetUserName NewTargetUserName + TargetSid SubjectLogonId + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_builtin_account_name_was_changed_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. +known_false_positives: |- + Renaming built-in accounts is uncommon in most environments but may occur during initial system hardening or CIS benchmark compliance efforts. + Validate the source user, logon ID, and timing against expected change control windows before tuning. +references: + - https://attack.mitre.org/techniques/T1078/003/ + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4781 + - https://nvd.nist.gov/vuln/detail/cve-2026-47301 + - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca + - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations +drilldown_searches: + - name: View the detection results for - "$dest$" and "$OldTargetUserName$" + search: '%original_detection_search% | search dest = "$dest$" OldTargetUserName = "$OldTargetUserName$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Built-in account [$OldTargetUserName$] (SID [$TargetSid$]) was renamed to [$NewTargetUserName$] on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: NewTargetUserName + type: user +analytic_story: + - Windows Defense Evasion Tactics + - Compromised Windows Host +asset_type: Endpoint +mitre_attack_id: + - T1078.003 + - T1036.010 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.003/builtin_account_rename/windows_security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_cab_file_on_disk.yml b/detections/endpoint/windows_cab_file_on_disk.yml index 5d9220feba9..878f72ce355 100644 --- a/detections/endpoint/windows_cab_file_on_disk.yml +++ b/detections/endpoint/windows_cab_file_on_disk.yml @@ -1,30 +1,66 @@ name: Windows CAB File on Disk id: 622f08d0-69ef-42c2-8139-66088bc25acd -version: 11 +version: 12 creation_date: '2023-11-16' -modification_date: '2026-05-13' -author: Michael Haag, Splunk +modification_date: '2026-08-24' +author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: The following analytic detects .cab files being written to disk. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on events where the file name is '*.cab' and the action is 'write'. This activity is significant as .cab files can be used to deliver malicious payloads, including embedded .url files that execute harmful code. If confirmed malicious, this behavior could lead to unauthorized code execution and potential system compromise. Analysts should review the file path and associated artifacts for further investigation. +description: |- + The following analytic detects .cab files being written to disk. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on events where the file name is '*.cab' and the action is 'write'. + This activity can be significant as .cab files can be used to deliver malicious payloads, including embedded .url files that execute harmful code. + If confirmed malicious, this behavior could lead to unauthorized code execution and potential system compromise. + Analysts should review the file path and associated artifacts for further investigation. data_source: - Sysmon EventID 11 search: |- - | tstats `security_content_summariesonly` count values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - WHERE ( - Filesystem.file_name=*.cab - ) - BY Filesystem.action Filesystem.dest Filesystem.file_access_time - Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time - Filesystem.file_name Filesystem.file_path Filesystem.file_acl - Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product + | tstats `security_content_summariesonly` + count values(Filesystem.file_path) as file_path + min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Filesystem WHERE + + Filesystem.action IN ("created", "modified") + Filesystem.file_name="*.cab" + NOT Filesystem.file_path IN ( + "*\\AppData\\Local\\Microsoft\\*", + "*\\Windows Kits\\10\\ADK\\Installers\\*", + "C:\\Program Files (x86)\\*", + "C:\\Program Files\\*", + "C:\\ProgramData\\Microsoft\\*", + "C:\\ProgramData\\Package Cache\\*", + "C:\\Windows\\appcompat\\*", + "C:\\Windows\\Logs\\CBS\\*", + "C:\\Windows\\servicing\\*", + "C:\\Windows\\SoftwareDistribution\\*", + "C:\\Windows\\System32\\*", + "C:\\Windows\\SystemApps\\*", + "C:\\Windows\\SysWOW64\\*", + "C:\\Windows\\WinSxS\\*", + ) + + BY Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl + Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name("Filesystem")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cab_file_on_disk_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: False positives will only be present if a process legitimately writes a .cab file to disk. Modify the analytic as needed by file path. Filter as needed. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. + These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. + To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. + The logs must also be mapped to the `Processes` node of the `Endpoint` data model. + Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Some false positives are expected from user controlled folders. references: - https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2023-10-25-IOCs-from-DarkGate-activity.txt drilldown_searches: @@ -41,11 +77,16 @@ intermediate_findings: - field: dest type: system score: 20 - message: A .cab file was written to disk on endpoint $dest$. + message: The file [$file_path$] with a .cab extension was written to disk on endpoint $dest$. +threat_objects: + - field: file_path + type: file_path analytic_story: - DarkGate Malware - APT37 Rustonotto and FadeStealer asset_type: Endpoint +cve: + - CVE-2026-47301 mitre_attack_id: - T1566.001 product: diff --git a/detections/endpoint/windows_cabinet_file_extraction_via_expand.yml b/detections/endpoint/windows_cabinet_file_extraction_via_expand.yml index 8d6ee95eb72..d732490e0a7 100644 --- a/detections/endpoint/windows_cabinet_file_extraction_via_expand.yml +++ b/detections/endpoint/windows_cabinet_file_extraction_via_expand.yml @@ -2,7 +2,7 @@ name: Windows Cabinet File Extraction Via Expand id: 4e3e3b8c-6d3a-4b47-9f5a-9e3e0a0a6f2f version: 5 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -37,6 +37,7 @@ known_false_positives: | and sanctioned paths. references: - https://www.zscaler.com/blogs/security-research/apt37-targets-windows-rust-backdoor-and-python-loader + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml#L304 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -71,6 +72,8 @@ analytic_story: - APT37 Rustonotto and FadeStealer - NetSupport RMM Tool Abuse asset_type: Endpoint +atomic_guid: + - 9f8b1c54-cb76-4d5e-bb1f-2f5c0e8f5a11 mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml b/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml index f15a3995463..8e6bd9a38d5 100644 --- a/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml +++ b/detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml @@ -1,13 +1,13 @@ name: Windows Cloud Files Filter Loaded by Uncommon Process id: 77b85062-274e-43a5-9dab-c25862b85291 -version: 1 +version: 2 creation_date: '2026-05-18' -modification_date: '2026-05-18' +modification_date: '2026-10-08' author: Raven Tait, Splunk status: production type: Anomaly description: |- - The following analytic detects cldapi.dll being loaded by a process not associated with legitimate cloud sync activity. + The following analytic detects "cldapi.dll" being loaded by a process not associated with legitimate cloud sync activity. The Windows Cloud Files API (cldapi.dll) is abused by several local privilege escalation exploits. data_source: - Sysmon EventID 7 @@ -16,22 +16,25 @@ search: |- EventID=7 ImageLoaded="*\\cldapi.dll" NOT Image IN ( - "*\\box.exe", - "*\\dropbox.exe", - "*\\googledrivefs.exe", - "*\\icloud.exe", - "*\\onedrive*.exe", - "*\\Windows\\explorer.exe" - "*\\Windows\\System32\\*", - "*\\Windows\\Syswow64\\*", - "*\\Windows\\WinSxS\\*" + "*\\box.exe", + "*\\dropbox.exe", + "*\\googledrivefs.exe", + "*\\icloud.exe", + "*\\onedrive*.exe", + "C:\\Windows\\explorer.exe", + "C:\\Windows\\System32\\*", + "C:\\Windows\\Syswow64\\*", + "C:\\Windows\\WinSxS\\*" ) + | stats count min(_time) as firstTime max(_time) as lastTime - by Computer ImageLoaded EventID dest loaded_file loaded_file_path process_exec - process_guid process_hash process_id process_name process_path - service_dll_signature_exists service_dll_signature_verified signature_id user_id - vendor_product + + by dest loaded_file_path loaded_file + process_path process_name process_exec process_guid process_hash process_id + service_dll_signature_exists service_dll_signature_verified + signature signature_id user_id vendor_product + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cloud_files_filter_loaded_by_uncommon_process_filter` @@ -57,7 +60,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: Cloud Files Filter ($ImageLoaded$) loaded by suspicious process $Image$ on $dest$ + message: Cloud Files Filter [$loaded_file_path$] loaded by suspicious process [$process_path$] on [$dest$] +threat_objects: + - field: loaded_file_path + type: loaded_file analytic_story: - RedSun - BlueHammer diff --git a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml index 8ad38fc09d8..f9e7d6f0afa 100644 --- a/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml +++ b/detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml @@ -1,15 +1,14 @@ name: Windows Command Shell DCRat ForkBomb Payload id: 2bb1a362-7aa8-444a-92ed-1987e8da83e1 -version: 14 +version: 15 creation_date: '2022-07-28' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects the execution of a DCRat "forkbomb" payload, which spawns multiple cmd.exe processes that launch notepad.exe instances in quick succession. This detection leverages Endpoint Detection and Response (EDR) data, focusing on the rapid creation of cmd.exe and notepad.exe processes within a 30-second window. This activity is significant as it indicates a potential DCRat infection, a known Remote Access Trojan (RAT) with destructive capabilities. If confirmed malicious, this behavior could lead to system instability, resource exhaustion, and potential disruption of services. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` values(Processes.user) as user values(Processes.action) as action values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product dc(Processes.parent_process_id) as parent_process_id_count dc(Processes.process_id) as process_id_count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.parent_process_name= "cmd.exe" (Processes.process_name = "notepad.exe" diff --git a/detections/endpoint/windows_content_copied_from_browser_was_executed.yml b/detections/endpoint/windows_content_copied_from_browser_was_executed.yml new file mode 100644 index 00000000000..ad9d1785906 --- /dev/null +++ b/detections/endpoint/windows_content_copied_from_browser_was_executed.yml @@ -0,0 +1,97 @@ +name: Windows Content Copied from Browser was Executed +id: 5d1fdbcb-5ed9-4190-85c8-7f9026450a0b +version: 1 +creation_date: '2026-09-07' +modification_date: '2026-09-07' +author: Onur Mustafa Erdogan, Splunk +status: production +type: TTP +description: |- + The following analytic correlates modifications to the Windows RunMRU registry key with clipboard content + changes initiated by browsers. It aims to detect ClickFix scenarios in which commands copied + from a browser are subsequently executed on the Windows system through the Run dialog box. +data_source: + - Sysmon EventID 13 AND Sysmon EventID 24 +search: |- + `sysmon` + EventID IN (13, 24) + ( + registry_key_name=*RunMRU* + OR + process_name IN ( + "360se.exe", "arc.exe", "atlas.exe", "avastbrowser.exe", "avgbrowser.exe", "blpbrowser.exe", "brave.exe", "braveupdate.exe", + "chrome.exe", "chromium.exe", "coccoc.exe", "dragon.exe", "duckduckgo.exe", "epic.exe", "firefox.exe", "ghost.exe", + "iexplore.exe", "iridium.exe", "iron.exe", "maxthon.exe", "microsoftedge.exe", "microsoftedgeupdate.exe", "msedge.exe", + "msedgewebview2.exe", "opera.exe", "opera_autoupdate.exe", "perplexity.exe", "rave.exe", "safari.exe", "shift.exe", + "sidekick.exe", "thorium.exe", "torch.exe", "vivaldi.exe", "wavebrowser.exe", "whale.exe", "zen.exe" + ) + ) + | eval trimmed_command = rtrim(registry_value_data, "\1") + | eval utf16le_command = urldecode(replace(trimmed_command, "(.)", "\1%00")) + | eval sha256_process=upper(sha256(utf16le_command)) + | eval hash_command=coalesce(SHA256,sha256_process) + | stats min(_time) as firstTime max(_time) as lastTime values(process_name) as process_name + values(trimmed_command) as process values(EventID) as EventID dc(EventID) as dc_EventID count + by hash_command dest user + | search dc_EventID>1 + | eval process_name = mvfilter( + process_name IN ( + "360se.exe", "arc.exe", "atlas.exe", "avastbrowser.exe", "avgbrowser.exe", "blpbrowser.exe", "brave.exe", "braveupdate.exe", + "chrome.exe", "chromium.exe", "coccoc.exe", "dragon.exe", "duckduckgo.exe", "epic.exe", "firefox.exe", "ghost.exe", + "iexplore.exe", "iridium.exe", "iron.exe", "maxthon.exe", "microsoftedge.exe", "microsoftedgeupdate.exe", "msedge.exe", + "msedgewebview2.exe", "opera.exe", "opera_autoupdate.exe", "perplexity.exe", "rave.exe", "safari.exe", "shift.exe", + "sidekick.exe", "thorium.exe", "torch.exe", "vivaldi.exe", "wavebrowser.exe", "whale.exe", "zen.exe" + ) + ) + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_content_copied_from_browser_was_executed_filter` +how_to_implement: |- + This detection requires Sysmon event logs. Configure your environment to ingest Sysmon registry modification (Event ID 13) + and clipboard change (Event ID 24) events. Ensure that registry modification events are collected for the RunMRU registry key + and clipboard change events are collected from common browser processes. Ingest the data through the appropriate Splunk technology + add-on and normalize field names using the Splunk Common Information Model (CIM). +known_false_positives: No false positives have been identified at this time. +references: + - https://socradar.io/blog/doublecup-clickfix-loader-devicemanager-rats/ + - https://www.huntress.com/blog/clickfix-matanbuchus-astarionrat-analysis +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: The content [$process$] was copied from [$process_name$] to the clipboard and was executed through the Run dialog box on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process + type: process + - field: hash_command + type: process_hash +analytic_story: + - Fake CAPTCHA Campaigns +asset_type: Endpoint +mitre_attack_id: + - T1202 + - T1059.001 + - T1059.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/windows_browser_copy_paste/windows_browser_copy_paste.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_convertto_aadintbackdoor_execution_via_powershell_script.yml b/detections/endpoint/windows_convertto_aadintbackdoor_execution_via_powershell_script.yml index 8dfa4e8e9e6..8eb5a955e07 100644 --- a/detections/endpoint/windows_convertto_aadintbackdoor_execution_via_powershell_script.yml +++ b/detections/endpoint/windows_convertto_aadintbackdoor_execution_via_powershell_script.yml @@ -2,7 +2,7 @@ name: Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script id: 59a8662f-f616-4494-8fa1-29ae77fc2018 version: 2 creation_date: '2026-05-05' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Raven Tait, Splunk status: production type: TTP @@ -33,6 +33,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Certain administrative or security testing activities in Azure AD environments may use ConvertTo-AADIntBackdoor for legitimate federation configuration changes. Review and allow such actions from trusted administrators and approved tools. references: - https://atomicredteam.io/privilege-escalation/T1484.002/#atomic-test-1---add-federation-to-azure-ad + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1484.002/T1484.002.yaml#L5 drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -53,6 +54,8 @@ analytic_story: - Azure Active Directory Account Takeover - Azure Active Directory Privilege Escalation asset_type: Endpoint +atomic_guid: + - 8906c5d0-3ee5-4f63-897a-f6cafd3fdbb7 mitre_attack_id: - T1482 - T1078 diff --git a/detections/endpoint/windows_create_local_account.yml b/detections/endpoint/windows_create_local_account.yml index b836178454f..e19c0130d9c 100644 --- a/detections/endpoint/windows_create_local_account.yml +++ b/detections/endpoint/windows_create_local_account.yml @@ -2,7 +2,7 @@ name: Windows Create Local Account id: 3fb2e8e3-7bc0-4567-9722-c5ab9f8595eb version: 13 creation_date: '2022-10-05' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -29,6 +29,8 @@ known_false_positives: | Restrict to critical infrastructure to reduce any volume. references: - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L68 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L91 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -54,6 +56,9 @@ analytic_story: - GhostRedirector IIS Module and Rungan Backdoor - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 6657864e-0323-4206-9344-ac9cd7265a4f + - bc8be0ac-475c-4fbf-9b1d-9fffd77afbde mitre_attack_id: - T1136.001 product: diff --git a/detections/endpoint/windows_create_local_administrator_account_via_net.yml b/detections/endpoint/windows_create_local_administrator_account_via_net.yml index c424345a12b..65e79e9e660 100644 --- a/detections/endpoint/windows_create_local_administrator_account_via_net.yml +++ b/detections/endpoint/windows_create_local_administrator_account_via_net.yml @@ -2,7 +2,7 @@ name: Windows Create Local Administrator Account Via Net id: 2c568c34-bb57-4b43-9d75-19c605b98e70 version: 11 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Bhavin Patel, Splunk status: production type: Anomaly @@ -31,7 +31,8 @@ search: |- | `windows_create_local_administrator_account_via_net_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrators often leverage net.exe to create admin accounts. -references: [] +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.001/T1136.001.yaml#L156 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -66,6 +67,8 @@ analytic_story: - GhostRedirector IIS Module and Rungan Backdoor - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - fda74566-a604-4581-a4cc-fbbe21d66559 mitre_attack_id: - T1136.001 product: diff --git a/detections/endpoint/windows_credential_access_from_browser_password_store.yml b/detections/endpoint/windows_credential_access_from_browser_password_store.yml index 53e4dea2ce8..694b94d3938 100644 --- a/detections/endpoint/windows_credential_access_from_browser_password_store.yml +++ b/detections/endpoint/windows_credential_access_from_browser_password_store.yml @@ -1,15 +1,42 @@ name: Windows Credential Access From Browser Password Store id: 72013a8e-5cea-408a-9d51-5585386b4d69 -version: 23 +version: 24 creation_date: '2024-03-20' -modification_date: '2026-06-25' +modification_date: '2026-09-22' author: Teoderick Contreras, Bhavin Patel Splunk status: production type: Anomaly -description: The following analytic identifies a possible non-common browser process accessing its browser user data profile. This tactic/technique has been observed in various Trojan Stealers, such as SnakeKeylogger, which attempt to gather sensitive browser information and credentials as part of their exfiltration strategy. Detecting this anomaly can serve as a valuable pivot for identifying processes that access lists of browser user data profiles unexpectedly. This detection uses a lookup file `browser_app_list` that maintains a list of well known browser applications and the browser paths that are allowed to access the browser user data profiles. +description: |- + The following analytic identifies a possible non-common browser process accessing its browser user data profile. + This tactic/technique has been observed in various Trojan Stealers, such as SnakeKeylogger, which attempt to gather sensitive browser information and credentials as part of their exfiltration strategy. + Detecting this anomaly can serve as a valuable pivot for identifying processes that access lists of browser user data profiles unexpectedly. + This detection uses a lookup file `browser_app_list` that maintains a list of well known browser applications and the browser paths that are allowed to access the browser user data profiles. data_source: - Windows Event Log Security 4663 -search: '`wineventlog_security` EventCode=4663 | stats count by _time object_file_path object_file_name dest process_name process_path process_id EventCode | lookup browser_app_list browser_object_path as object_file_path OUTPUT browser_process_name isAllowed | stats count min(_time) as firstTime max(_time) as lastTime values(object_file_name) values(object_file_path) values(browser_process_name) as browser_process_name by dest process_name process_path process_id EventCode isAllowed | rex field=process_name "(?[^\\\\]+)$" | eval isMalicious=if(match(browser_process_name, extracted_process_name), "0", "1") | where isMalicious=1 and isAllowed="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_credential_access_from_browser_password_store_filter`' +search: |- + `wineventlog_security` + EventCode=4663 + + | stats count by _time object_file_path object_file_name + dest process_name + process_path process_id EventCode + + | lookup local=t browser_app_list browser_object_path as object_file_path OUTPUT browser_process_name isAllowed + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(object_file_name) + values(object_file_path) + values(browser_process_name) as browser_process_name + by dest process_name process_path process_id EventCode isAllowed + + | rex field=process_name "(?[^\\\\]+)$" + | eval isMalicious=if(match(browser_process_name, extracted_process_name), "0", "1") + | where isMalicious=1 and isAllowed="false" + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_credential_access_from_browser_password_store_filter` how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." This search may trigger on a browser application that is not included in the browser_app_list lookup file. known_false_positives: The lookup file `browser_app_list` may not contain all the browser applications that are allowed to access the browser user data profiles. Consider updating the lookup files to add allowed object paths for the browser applications that are not included in the lookup file. references: @@ -29,7 +56,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: A non-common browser process $process_name$ accessing browser user data folder on $dest$ + message: A non-common browser process [$process_name$] accessing browser user data folder on $dest$ +threat_objects: + - field: process_name + type: process_name analytic_story: - StealC Stealer - Salt Typhoon diff --git a/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml b/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml index 3b24d5c3456..7003854e614 100644 --- a/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml +++ b/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml @@ -2,7 +2,7 @@ name: Windows Credential Dumping LSASS Memory Createdump id: b3b7ce35-fce5-4c73-85f4-700aeada81a9 version: 14 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: False positives may be present if an application is dumping processes, filter as needed. Recommend reviewing createdump.exe usage across the fleet to better understand all usage and by what. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-11---dump-lsass-with-createdumpexe-from-net-v5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L308 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -64,6 +65,8 @@ analytic_story: - Credential Dumping - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 9d0072c8-7cca-45c4-bd14-f852cfa35cf0 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/windows_crowdstrike_rtr_script_execution.yml b/detections/endpoint/windows_crowdstrike_rtr_script_execution.yml index 801437cc581..eeaa18f1349 100644 --- a/detections/endpoint/windows_crowdstrike_rtr_script_execution.yml +++ b/detections/endpoint/windows_crowdstrike_rtr_script_execution.yml @@ -1,8 +1,8 @@ name: Windows Crowdstrike RTR Script Execution id: be2bbfff-77c9-4d65-9b7c-97726051534a -version: 2 +version: 3 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-09-28' author: Raven Tait, Splunk status: production type: Anomaly @@ -20,7 +20,7 @@ search: |- from datamodel=Endpoint.Processes where Processes.parent_process_name="dllhost.exe" - Processes.parent_process="*/Processid:{BD07DDB9-1C61-4DCE-9202-A2BA1757CDB2}*" + Processes.parent_process IN ("*/Processid:{BD07DDB9-1C61-4DCE-9202-A2BA1757CDB2}*", "unknown") Processes.process_name="powershell.exe" Processes.process="* -Version 5.1 -s -NoLogo -NoProfile -EncodedCommand*" diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index d17aeac465f..fab377f7cf4 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -2,7 +2,7 @@ name: Windows Curl Download to Suspicious Path id: c32f091e-30db-11ec-8738-acde48001122 version: 22 creation_date: '2021-10-19' -modification_date: '2026-07-20' +modification_date: '2026-10-02' author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -65,6 +65,7 @@ references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://attack.mitre.org/techniques/T1105/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L460 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -105,6 +106,8 @@ analytic_story: - Salt Typhoon - Starland RAT Campaign asset_type: Endpoint +atomic_guid: + - 2b080b99-0deb-4d51-af0f-833d37c4ca6a mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml index 6b6034e879d..5c630ac4f37 100644 --- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml +++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml @@ -2,7 +2,7 @@ name: Windows Curl Upload to Remote Destination id: 42f8f1a2-4228-11ec-aade-acde48001122 version: 18 creation_date: '2021-11-10' -modification_date: '2026-07-14' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -52,6 +52,7 @@ references: - https://everything.curl.dev/usingcurl/uploads - https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409 - https://twitter.com/d1r4c/status/1279042657508081664?s=20 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L501 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -87,6 +88,8 @@ analytic_story: - PromptLock - Axios Supply Chain Post Compromise asset_type: Endpoint +atomic_guid: + - 635c9a38-6cbf-47dc-8615-3810bc1167cf mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/windows_defender_asr_audit_events.yml b/detections/endpoint/windows_defender_asr_audit_events.yml index f6983833e1e..ad273795234 100644 --- a/detections/endpoint/windows_defender_asr_audit_events.yml +++ b/detections/endpoint/windows_defender_asr_audit_events.yml @@ -1,33 +1,46 @@ name: Windows Defender ASR Audit Events id: 0e4d46b1-22bd-4f0e-8337-ca6f60ad4bea -version: 9 +version: 10 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Anomaly -description: This detection searches for Windows Defender ASR audit events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR audit events that are generated when a process or application attempts to perform an action that would be blocked by an ASR rule, but is allowed to proceed for auditing purposes. +description: |- + This detection searches for ASR audit events that are generated when a process or application attempts to perform an action that would be blocked by an ASR rule, but is allowed to proceed for auditing purposes. data_source: - Windows Event Log Defender 1122 - Windows Event Log Defender 1125 - - Windows Event Log Defender 1126 - Windows Event Log Defender 1132 - Windows Event Log Defender 1134 search: |- - `ms_defender` EventCode IN (1122, 1125, 1126, 1132, 1134) - | stats count min(_time) as firstTime max(_time) as lastTime - BY host, Process_Name, Target_Commandline, - Path, ID, EventCode - | lookup asr_rules ID OUTPUT ASR_Rule - | fillnull value=NULL - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | rename host as dest - | `windows_defender_asr_audit_events_filter` + `ms_defender` + EventCode IN ( + 1122, + 1125, + 1132, + 1134 + ) + | fillnull value=NULL + | stats count min(_time) as firstTime + max(_time) as lastTime + by host EventCode + Parent_Commandline Process_Name Target_Commandline + Path ID RuleType + + | lookup local=t asr_rules ID OUTPUT ASR_Rule + + | rename host as dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_defender_asr_audit_events_filter` how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. Note that Audit and block Event IDs have different fields, therefore the analytic will need to be modified for each type of event. -known_false_positives: False positives are expected from legitimate applications generating events that are similar to those generated by malicious activity. For example, Event ID 1122 is generated when a process attempts to load a DLL that is blocked by an ASR rule. This can be triggered by legitimate applications that attempt to load DLLs that are not blocked by ASR rules. This is audit only. +known_false_positives: |- + Some false positives are expected initially as the ASR rules are tuned and configured. references: - https://asrgen.streamlit.app/ + - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-overview drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -42,7 +55,14 @@ intermediate_findings: - field: dest type: system score: 20 - message: ASR audit event, $ASR_Rule$, was triggered on $dest$. + message: The ASR audit event [$ASR_Rule$] was triggered on [$dest$]. +threat_objects: + - field: Parent_Commandline + type: parent_process + - field: Target_Commandline + type: process + - field: Process_Name + type: file_path analytic_story: - Windows Attack Surface Reduction asset_type: Endpoint diff --git a/detections/endpoint/windows_defender_asr_block_events.yml b/detections/endpoint/windows_defender_asr_block_events.yml index 8a05832e331..6d02f418c06 100644 --- a/detections/endpoint/windows_defender_asr_block_events.yml +++ b/detections/endpoint/windows_defender_asr_block_events.yml @@ -1,12 +1,14 @@ name: Windows Defender ASR Block Events id: 026f5f4e-e99f-4155-9e63-911ba587300b -version: 10 +version: 11 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Anomaly -description: This detection searches for Windows Defender ASR block events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR block events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule. Typically, these will be enabled in block most after auditing and tuning the ASR rules themselves. Set to TTP once tuned. +description: |- + This detection searches for ASR block events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule. + Typically, these will be enabled in block most after auditing and tuning the ASR rules themselves. data_source: - Windows Event Log Defender 1121 - Windows Event Log Defender 1126 @@ -14,20 +16,35 @@ data_source: - Windows Event Log Defender 1131 - Windows Event Log Defender 1133 search: |- - `ms_defender` EventCode IN (1121, 1126, 1129, 1131, 1133) - | stats count min(_time) as firstTime max(_time) as lastTime - BY host, Path, Parent_Commandline, - Process_Name, ID, EventCode - | lookup asr_rules ID OUTPUT ASR_Rule - | fillnull value=NULL - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | rename host as dest - | `windows_defender_asr_block_events_filter` -how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. Note that Audit and block Event IDs have different fields, therefore the analytic will need to be modified for each type of event. -known_false_positives: False positives are expected from legitimate applications generating events that are similar to those generated by malicious activity. For example, Event ID 1122 is generated when a process attempts to load a DLL that is blocked by an ASR rule. This can be triggered by legitimate applications that attempt to load DLLs that are not blocked by ASR rules. This is block only. + `ms_defender` + EventCode IN ( + 1121, + 1126, + 1129, + 1131, + 1133 + ) + | fillnull value=NULL + | stats count min(_time) as firstTime + max(_time) as lastTime + by host EventCode + Parent_Commandline Process_Name Target_Commandline + Path ID RuleType + + | lookup local=t asr_rules ID OUTPUT ASR_Rule + + | rename host as dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_defender_asr_block_events_filter` +how_to_implement: |- + The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. Note that Audit and block Event IDs have different fields, therefore the analytic will need to be modified for each type of event. +known_false_positives: |- + Some false positives are expected initially as the ASR rules are tuned and configured. references: - https://asrgen.streamlit.app/ + - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-overview drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -42,7 +59,14 @@ intermediate_findings: - field: dest type: system score: 20 - message: ASR block event, $ASR_Rule$, was triggered on $dest$. + message: The ASR block event [$ASR_Rule$] was triggered on [$dest$]. +threat_objects: + - field: Parent_Commandline + type: parent_process + - field: Target_Commandline + type: process + - field: Process_Name + type: file_path analytic_story: - Windows Attack Surface Reduction asset_type: Endpoint diff --git a/detections/endpoint/windows_defender_asr_registry_modification.yml b/detections/endpoint/windows_defender_asr_registry_modification.yml index 627268ebe1b..06c4bbcb8bb 100644 --- a/detections/endpoint/windows_defender_asr_registry_modification.yml +++ b/detections/endpoint/windows_defender_asr_registry_modification.yml @@ -1,15 +1,15 @@ name: Windows Defender ASR Registry Modification id: 6a1b6cbe-6612-44c3-92b9-1a1bd77412eb -version: 8 +version: 9 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting description: The following analytic detects modifications to Windows Defender Attack Surface Reduction (ASR) registry settings. It leverages Windows Defender Operational logs, specifically EventCode 5007, to identify changes in ASR rules. This activity is significant because ASR rules are designed to block actions commonly used by malware to exploit systems. Unauthorized modifications to these settings could indicate an attempt to weaken system defenses. If confirmed malicious, this could allow an attacker to bypass security measures, leading to potential system compromise and data breaches. data_source: - Windows Event Log Defender 5007 -search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" | rex field=Old_Value "0x(?\\d+)$" | rex field=New_Value "Rules\\\\(?[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") | stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID | lookup asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)`| rename host as dest | `security_content_ctime(lastTime)` | `windows_defender_asr_registry_modification_filter`' +search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" | rex field=Old_Value "0x(?\\d+)$" | rex field=New_Value "Rules\\\\(?[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") | stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID | lookup local=t asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)`| rename host as dest | `security_content_ctime(lastTime)` | `windows_defender_asr_registry_modification_filter`' how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. known_false_positives: False positives are expected from legitimate applications generating events that are similar to those generated by malicious activity. For example, Event ID 5007 is generated when a process attempts to modify a registry key that is related to ASR rules. This can be triggered by legitimate applications that attempt to modify registry keys that are not blocked by ASR rules. references: diff --git a/detections/endpoint/windows_defender_asr_rule_disabled.yml b/detections/endpoint/windows_defender_asr_rule_disabled.yml index 29f4af1a665..eed3e8b8c5f 100644 --- a/detections/endpoint/windows_defender_asr_rule_disabled.yml +++ b/detections/endpoint/windows_defender_asr_rule_disabled.yml @@ -1,15 +1,15 @@ name: Windows Defender ASR Rule Disabled id: 429d611b-3183-49a7-b235-fc4203c4e1cb -version: 10 +version: 11 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: TTP description: The following analytic identifies when a Windows Defender ASR rule disabled events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR rule disabled events that are generated when an ASR rule is disabled. data_source: - Windows Event Log Defender 5007 -search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" | rex field=Old_Value "0x(?\\d+)$" | rex field=New_Value "Rules\\\\(?[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") | search New_Registry_Value="Disabled" | stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID | lookup asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| rename host as dest | `windows_defender_asr_rule_disabled_filter`' +search: '`ms_defender` EventCode IN (5007) | rex field=New_Value "0x(?\\d+)$" | rex field=Old_Value "0x(?\\d+)$" | rex field=New_Value "Rules\\\\(?[A-Fa-f0-9\\-]+)\\s*=" | eval New_Registry_Value=case(New_Registry_Value=="0", "Disabled", New_Registry_Value=="1", "Block", New_Registry_Value=="2", "Audit", New_Registry_Value=="6", "Warn") | eval Old_Registry_Value=case(Old_Registry_Value=="0", "Disabled", Old_Registry_Value=="1", "Block", Old_Registry_Value=="2", "Audit", Old_Registry_Value=="6", "Warn") | search New_Registry_Value="Disabled" | stats count min(_time) as firstTime max(_time) as lastTime by host, New_Value, Old_Value, Old_Registry_Value, New_Registry_Value, ASR_ID | lookup local=t asr_rules ID AS ASR_ID OUTPUT ASR_Rule | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| rename host as dest | `windows_defender_asr_rule_disabled_filter`' how_to_implement: The following analytic requires collection of Windows Defender Operational logs in either XML or multi-line. To collect, setup a new input for the Windows Defender Operational logs. In addition, it does require a lookup that maps the ID to ASR Rule name. known_false_positives: False positives may occur if applications are typically disabling ASR rules in the environment. Monitor for changes to ASR rules to determine if this is a false positive. references: diff --git a/detections/endpoint/windows_defender_asr_rules_stacking.yml b/detections/endpoint/windows_defender_asr_rules_stacking.yml index 780f6b19932..1f0d5b29282 100644 --- a/detections/endpoint/windows_defender_asr_rules_stacking.yml +++ b/detections/endpoint/windows_defender_asr_rules_stacking.yml @@ -1,8 +1,8 @@ name: Windows Defender ASR Rules Stacking id: 425a6657-c5e4-4cbb-909e-fc9e5d326f01 -version: 8 +version: 9 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting @@ -22,7 +22,7 @@ search: |- | stats count min(_time) as firstTime max(_time) as lastTime BY host Parent_Commandline, Process_Name, Path, ID, EventCode - | lookup asr_rules ID OUTPUT ASR_Rule + | lookup local=t asr_rules ID OUTPUT ASR_Rule | fillnull value=NULL | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml b/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml new file mode 100644 index 00000000000..a5a3a0d4e98 --- /dev/null +++ b/detections/endpoint/windows_defender_intermediary_artifact_was_observed.yml @@ -0,0 +1,93 @@ +name: Windows Defender Intermediary Artifact Was Observed +id: 5234fb35-da15-4e45-8e17-3b7ae0e0fc9e +version: 1 +creation_date: '2026-09-30' +modification_date: '2026-09-30' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects creation and removal of intermediary remediation artifacts of Windows Defender, during exploitation of ShieldCrash attacks. + Exploit abuses the race condition between file validation and its remediation performed by Windows Defender. In between these steps, ShieldCrash changes the + symbolic link to redirect the remediation process to a staging directory controlled by the attacker. This detection aims to detect creation of defender artifact, + its alternate data stream, and their subsequent removal. +data_source: + - Sysmon EventID 11 AND Sysmon EventID 15 AND Sysmon EventID 23 +search: |- + `sysmon` + EventID IN (11, 15, 23) + process_name IN ( + "System", + "msmpeng.exe" + ) + user=SYSTEM + NOT TargetFilename IN ( + "C:\\Windows\\Temp\\*", + "*:Zone.Identifier", + "*:SmartScreen" + ) + + | regex TargetFilename!="(?i)\.\w{1,10}$" + + | stats count values(EventID) as EventID + values(TargetFilename) as TargetFilename + dc(EventID) as dc_EventID + dc(TargetFilename) as dc_TargetFilename + min(_time) as firstTime + max(_time) as lastTime + + by dest process_id process_name user + + | search dc_TargetFilename>1 dc_EventID>1 + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_defender_intermediary_artifact_was_observed_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting file creation, file stream creation and file deletion events from your endpoints using Sysmon. + These logs must be processed using the latest Sysmon Technical Add-on (https://splunkbase.splunk.com/app/5709). Make sure to update Sysmon configuration to include + directories you would like to monitor for these kinds of events. +known_false_positives: |- + Remediation of various container files, such as archives, might also lead to creation various defender artifacts + SmartScreen interferes with the remediation process, potentially causing additional defender artifacts to be created. +references: + - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day + - https://www.cyderes.com/howler-cell/shieldcrash-microsoft-zero-day?hs_amp=true + - https://socradar.io/blog/shieldcrash-poc-microsoft-defender-fix-bypass/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Intermediary artifacts [$TargetFilename$] were observed by [$process_name$] during Defender Remediation process on [$dest$] +threat_objects: + - field: TargetFilename + type: file_path +analytic_story: + - RoguePlanet + - Windows Privilege Escalation +asset_type: Endpoint +mitre_attack_id: + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/shieldcrash_windefender_artifacts/shieldcrash_windefender_artifacts.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_disable_change_password_through_registry.yml b/detections/endpoint/windows_disable_change_password_through_registry.yml index 9aae2524703..fa335865bff 100644 --- a/detections/endpoint/windows_disable_change_password_through_registry.yml +++ b/detections/endpoint/windows_disable_change_password_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Change Password Through Registry id: 0df33e1a-9ef6-11ec-a1ad-acde48001122 version: 14 creation_date: '2022-03-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: This windows feature may implemented by administrator to prevent normal user to change the password of a critical host or server, In this type of scenario filter is needed to minimized false positive. references: - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_heartbleed.thdobah + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L260 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ analytic_story: - Ransomware - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - d4a6da40-618f-454d-9a9e-26af552aaeb0 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml index 273cf3e2744..39eb28b1dee 100644 --- a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml +++ b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Lock Workstation Feature Through Registry id: c82adbc6-9f00-11ec-a81f-acde48001122 version: 15 creation_date: '2022-03-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: No false positives have been identified at this time. references: - https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/ - https://heimdalsecurity.com/blog/fatalrat-targets-telegram/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L274 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -35,6 +36,8 @@ analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 3dacb0d2-46ee-4c27-ac1b-f9886bf91a56 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disable_logoff_button_through_registry.yml b/detections/endpoint/windows_disable_logoff_button_through_registry.yml index 2471f816246..160d9a97553 100644 --- a/detections/endpoint/windows_disable_logoff_button_through_registry.yml +++ b/detections/endpoint/windows_disable_logoff_button_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable LogOff Button Through Registry id: b2fb6830-9ed1-11ec-9fcb-acde48001122 version: 14 creation_date: '2022-03-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -16,6 +16,7 @@ references: - https://www.hybrid-analysis.com/sample/e2d4018fd3bd541c153af98ef7c25b2bf4a66bc3bfb89e437cde89fd08a9dd7b/5b1f4d947ca3e10f22714774 - https://malwiki.org/index.php?title=DigiPop.xp - https://www.trendmicro.com/vinfo/be/threat-encyclopedia/search/js_noclose.e/2 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L244 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -35,6 +36,8 @@ analytic_story: - Ransomware - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - e246578a-c24d-46a7-9237-0213ff86fb0c mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disable_notification_center.yml b/detections/endpoint/windows_disable_notification_center.yml index b1091f67a91..22cc088717b 100644 --- a/detections/endpoint/windows_disable_notification_center.yml +++ b/detections/endpoint/windows_disable_notification_center.yml @@ -2,7 +2,7 @@ name: Windows Disable Notification Center id: 1cd983c8-8fd6-11ec-a09d-acde48001122 version: 15 creation_date: '2021-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -28,6 +28,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: admin or user may choose to disable this windows features. references: - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L216 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -52,6 +53,8 @@ analytic_story: - CISA AA23-347A - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - c0d6d67f-1f63-42cc-95c0-5fd6b20082ad mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml index a9dbf0aa07a..a9d21b8e66e 100644 --- a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml +++ b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Shutdown Button Through Registry id: 55fb2958-9ecd-11ec-a06a-acde48001122 version: 15 creation_date: '2022-03-08' -modification_date: '2026-08-05' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -51,6 +51,7 @@ known_false_positives: |- In that scenario, filtering by the machines and users allowed to modify this registry key is recommended. references: - https://github.com/redcanaryco/atomic-red-team/blob/1ba1dd8d9ce6f74700f7aec2e60de5632f667f03/atomics/T1112/T1112.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L230 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -70,6 +71,8 @@ analytic_story: - Ransomware - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 6e0d1131-2d7e-4905-8ca5-d6172f05d03d mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml index 904f5374cbf..cc5b1ad88fc 100644 --- a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml +++ b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml @@ -2,7 +2,7 @@ name: Windows Disable Windows Event Logging Disable HTTP Logging id: 23fb6787-255f-4d5b-9a66-9fd7504032b5 version: 15 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -32,6 +32,7 @@ references: - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/ - https://www.secureworks.com/research/bronze-union - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L27 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - Compromised Windows Host - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - a957fb0f-1e85-49b2-a211-413366784b1e mitre_attack_id: - T1505.004 - T1685.001 diff --git a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml index 8e2ea14afc6..e39c448c01b 100644 --- a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml +++ b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml @@ -2,7 +2,7 @@ name: Windows Disable Windows Group Policy Features Through Registry id: 63a449ae-9f04-11ec-945e-acde48001122 version: 15 creation_date: '2022-03-08' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Steven Dick, Teoderick Contreras, Splunk status: production type: Anomaly @@ -16,6 +16,13 @@ references: - https://hybrid-analysis.com/sample/ef1c427394c205580576d18ba68d5911089c7da0386f19d1ca126929d3e671ab?environmentId=120&lang=en - https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis - https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L288 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L318 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L333 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L348 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L363 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L378 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L393 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -37,6 +44,14 @@ analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 93386d41-525c-4a1b-8235-134a628dee17 + - ffbb407e-7f1d-4c95-b22e-548169db1fbd + - a450e469-ba54-4de1-9deb-9023a6111690 + - 5e27bdb4-7fd9-455d-a2b5-4b4b22c9dea4 + - 12f50e15-dbc6-478b-a801-a746e8ba1723 + - d29b7faf-7355-4036-9ed3-719bd17951ed + - 4d72d4b1-fa7b-4374-b423-0fe326da49d2 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_disableantispyware_registry.yml b/detections/endpoint/windows_disableantispyware_registry.yml index ab31e349ec2..7bc79a33f8c 100644 --- a/detections/endpoint/windows_disableantispyware_registry.yml +++ b/detections/endpoint/windows_disableantispyware_registry.yml @@ -2,7 +2,7 @@ name: Windows DisableAntiSpyware Registry id: 23150a40-9301-4195-b802-5bb4f43067fb version: 13 creation_date: '2020-11-06' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rod Soto, Jose Hernandez, Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,8 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search. references: - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1004 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1051 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -39,6 +41,9 @@ analytic_story: - Windows Defense Evasion Tactics - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 1f6743da-6ecc-4a93-b03f-dc357e4b313f + - a72cfef8-d252-48b3-b292-635d332625c3 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml index c5a13db2c68..b0f9bd96ab0 100644 --- a/detections/endpoint/windows_dism_remove_defender.yml +++ b/detections/endpoint/windows_dism_remove_defender.yml @@ -2,7 +2,7 @@ name: Windows DISM Remove Defender id: 8567da9e-47f0-11ec-99a9-acde48001122 version: 15 creation_date: '2021-12-08' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -35,6 +35,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Some legitimate administrative tools leverage `dism.exe` to manipulate packages and features of the operating system. Filter as needed. references: - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L608 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -66,6 +67,8 @@ analytic_story: - Compromised Windows Host - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - 871438ac-7d6e-432a-b27d-3e7db69faf58 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml index ce9a6ee9814..21e2d8dc1d2 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml @@ -1,25 +1,28 @@ name: Windows DLL Search Order Hijacking Hunt with Sysmon id: 79c7d1fc-64c7-91be-a616-ccda752efe81 -version: 12 +version: 13 creation_date: '2022-08-19' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting description: The following analytic identifies potential DLL search order hijacking or DLL sideloading by detecting known Windows libraries loaded from non-standard directories. It leverages Sysmon EventCode 7 to monitor DLL loads and cross-references them with a lookup of known hijackable libraries. This activity is significant as it may indicate an attempt to execute malicious code by exploiting DLL search order vulnerabilities. If confirmed malicious, this could allow attackers to gain code execution, escalate privileges, or maintain persistence within the environment. data_source: - Sysmon EventID 7 -search: '`sysmon` EventCode=7 NOT (process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*")) | lookup hijacklibs library AS loaded_file OUTPUT islibrary | search islibrary = True | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dll_search_order_hijacking_hunt_with_sysmon_filter`' +search: '`sysmon` EventCode=7 NOT (process_path IN ("*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*")) | lookup local=t hijacklibs library AS loaded_file OUTPUT islibrary | search islibrary = True | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_dll_search_order_hijacking_hunt_with_sysmon_filter`' how_to_implement: The search is written against the latest Sysmon TA 4.0 https://splunkbase.splunk.com/app/5709. For this specific event ID 7, the sysmon TA will extract the ImageLoaded name to the loaded_file field which is used in the search to compare against the hijacklibs lookup. known_false_positives: False positives will be present based on paths. Filter or add other paths to the exclusion as needed. Some applications may legitimately load libraries from non-standard paths. references: - https://hijacklibs.net + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1574.001/T1574.001.yaml#L67 analytic_story: - Qakbot - Windows Defense Evasion Tactics - Living Off The Land - Malicious Inno Setup Loader asset_type: Endpoint +atomic_guid: + - 65526037-7079-44a9-bda1-2cb624838040 mitre_attack_id: - T1574.001 product: diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index bdd740f73b4..5c0981bdc1f 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -1,8 +1,8 @@ name: Windows Domain Admin Impersonation Indicator id: 10381f93-6d38-470a-9c30-d25478e3bd3f -version: 12 +version: 13 creation_date: '2023-10-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Mauricio Velazco, Splunk status: production type: TTP @@ -16,7 +16,7 @@ search: |- BY _time TargetUserName GroupMembership action app dest signature_id user vendor_product - | lookup domain_admins username as TargetUserName OUTPUT username + | lookup local=t domain_admins username as TargetUserName OUTPUT username | fillnull value=NotDA username | search username = "NotDA" | `windows_domain_admin_impersonation_indicator_filter` diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml index bf5c2622dda..fe022fd4bb9 100644 --- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml +++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml @@ -1,8 +1,8 @@ name: Windows DotNet Binary in Non Standard Path id: fddf3b56-7933-11ec-98a6-acde48001122 -version: 14 +version: 15 creation_date: '2022-01-20' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -45,8 +45,8 @@ search: | | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup update=true is_net_windows_file filename as process_name OUTPUT netFile - | lookup update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile + | lookup local=t update=true is_net_windows_file filename as process_name OUTPUT netFile + | lookup local=t update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile | search netFile=true | `windows_dotnet_binary_in_non_standard_path_filter` how_to_implement: | @@ -65,6 +65,7 @@ references: - https://attack.mitre.org/techniques/T1036/003/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1036.003/T1036.003.yaml#L74 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -99,6 +100,8 @@ analytic_story: - Data Destruction - WhisperGate asset_type: Endpoint +atomic_guid: + - ac9d0fc3-8aa8-4ab5-b11f-682cd63b40aa mitre_attack_id: - T1036.003 - T1218.004 diff --git a/detections/endpoint/windows_edrsilencer_custom_outbound_filter_added.yml b/detections/endpoint/windows_edrsilencer_custom_outbound_filter_added.yml new file mode 100644 index 00000000000..0a1f79aff1e --- /dev/null +++ b/detections/endpoint/windows_edrsilencer_custom_outbound_filter_added.yml @@ -0,0 +1,98 @@ +name: Windows EDRSilencer Custom Outbound Filter Added +id: 67fea630-445d-4c70-a7d0-584fddb93b86 +version: 1 +creation_date: '2026-08-23' +modification_date: '2026-08-23' +author: Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + The following analytic detects the EDRSilencer-specific Windows Filtering Platform filter name "Custom Outbound Filter" when it is configured with a block action. + EDRSilencer creates WFP filters to block outbound traffic from EDR and security agent processes, impairing endpoint telemetry without requiring the tool binary to keep its original process name. + EventCode 5447 identifies creation of the runtime filter with ChangeType %%16384, while EventCode 5441 can show the same persistent filter when the Base Filtering Engine starts. +data_source: + - Windows Event Log Security 5441 + - Windows Event Log Security 5447 +search: |- + `wineventlog_security` + ( + ( + ( + EventCode=5447 + ChangeType IN ("%%16384", "Add") + ) + OR + EventCode=5441 + ) + Action IN ("%%16389", "Block") + FilterName="Custom Outbound Filter" + ) + + | eval user=coalesce(UserName,user,"unknown") + | eval filter_action=case(Action="%%16389","Block", true(), Action), + change_type=case(ChangeType="%%16384","Add", true(), ChangeType) + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(filter_action) as filter_action + values(change_type) as change_type + values(ProviderName) as provider_name + values(FilterType) as filter_type + values(FilterId) as filter_id + values(FilterKey) as filter_key + values(LayerName) as layer_name + values(LayerId) as layer_id + values(Conditions) as conditions + values(CalloutName) as callout_name + BY dest user process_id FilterName + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_edrsilencer_custom_outbound_filter_added_filter` +how_to_implement: |- + To implement this analytic, enable auditing for Windows Filtering Platform policy changes and ingest Windows Security Event Log data with EventCode 5447 and EventCode 5441. + The Splunk Add-on for Microsoft Windows should extract fields such as EventCode, ChangeType, FilterName, Conditions, and Action from XmlWinEventLog:Security events. +known_false_positives: |- + This filter name is associated with EDRSilencer behavior. + Validate whether any approved administrative tooling creates WFP block filters with the same name before tuning. +references: + - https://github.com/netero1010/EDRSilencer + - https://github.com/mthcht/awesome-lists/blob/main/Lists/Others/windows%20message%20tables/windows_messagetable_strings_list.csv + - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5447 + - https://learn.microsoft.com/en-us/windows/win32/fwp/auditing-and-logging +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: EDRSilencer WFP block filter [$FilterName$] was detected on [$dest$]. + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: FilterName + type: signature +analytic_story: + - Disabling Security Tools + - Security Solution Tampering +asset_type: Endpoint +mitre_attack_id: + - T1685 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1685/edr_silencer/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_entra_user_management_via_azure_cli.yml b/detections/endpoint/windows_entra_user_management_via_azure_cli.yml index 35796b2a16e..823b3c0e1df 100644 --- a/detections/endpoint/windows_entra_user_management_via_azure_cli.yml +++ b/detections/endpoint/windows_entra_user_management_via_azure_cli.yml @@ -2,7 +2,7 @@ name: Windows Entra User Management Via Azure CLI id: f6332409-abeb-42f8-b6a7-76201bdc7a0a version: 2 creation_date: '2026-05-05' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Raven Tait, Splunk status: production type: Anomaly @@ -47,6 +47,7 @@ known_false_positives: Legitimate IT administrators commonly use the Azure CLI f references: - https://atomicredteam.io/persistence/T1136.003/#atomic-test-3---azure-ad---create-a-new-user-via-azure-cli - https://learn.microsoft.com/en-us/cli/azure/?view=azure-cli-latest + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.003/T1136.003.yaml#L67 drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -72,6 +73,8 @@ threat_objects: analytic_story: - Azure Active Directory Persistence asset_type: Endpoint +atomic_guid: + - 228c7498-be31-48e9-83b7-9cb906504ec8 mitre_attack_id: - T1136 - T1078.004 diff --git a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml index 86a7ddb47f9..6271efedb5a 100644 --- a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml +++ b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml @@ -2,7 +2,7 @@ name: Windows ESX Admins Group Creation via Net id: 3d7df60b-3332-4667-8090-afe03e08dce0 version: 11 creation_date: '2024-07-30' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -33,6 +33,7 @@ references: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24505 - https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/ - https://www.securityweek.com/microsoft-says-ransomware-gangs-exploiting-just-patched-vmware-esxi-flaw/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1136.002/T1136.002.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ analytic_story: asset_type: Endpoint cve: - CVE-2024-37085 +atomic_guid: + - fcec2963-9951-4173-9bfa-98d8b7834e62 mitre_attack_id: - T1136.002 - T1136.001 diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index 62f1270f73b..9998dbbd779 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -2,7 +2,7 @@ name: Windows Event Log Cleared id: ad517544-aff9-4c96-bd99-d6eb43bfbb6a version: 21 creation_date: '2019-10-16' -modification_date: '2026-06-08' +modification_date: '2026-10-02' author: Rico Valdez, Michael Haag, Splunk status: production type: TTP @@ -26,6 +26,7 @@ references: - https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog-service-threads - https://attack.mitre.org/techniques/T1070/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/61080b19460f2c6431c31689d58063c5f6c1f8fb/atomics/T1070.001/T1070.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -50,6 +51,8 @@ analytic_story: - Clop Ransomware - Salat Stealer asset_type: Endpoint +atomic_guid: + - e6abb60e-26b8-41da-8aae-0c35174b0967 mitre_attack_id: - T1685.005 product: diff --git a/detections/endpoint/windows_event_logging_service_has_shutdown.yml b/detections/endpoint/windows_event_logging_service_has_shutdown.yml index d6d0895a37c..db584fffad9 100644 --- a/detections/endpoint/windows_event_logging_service_has_shutdown.yml +++ b/detections/endpoint/windows_event_logging_service_has_shutdown.yml @@ -2,7 +2,7 @@ name: Windows Event Logging Service Has Shutdown id: d696f622-6b08-4336-b456-696cb5b43ba0 version: 7 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -27,12 +27,17 @@ references: - https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog-service-threads - https://attack.mitre.org/techniques/T1070/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L149 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L170 analytic_story: - Windows Log Manipulation - Ransomware - Clop Ransomware - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 8e81d090-0cd6-4d46-863c-eec11311298f + - 85e6eff8-3ed4-4e03-ae50-aa6a404898a5 mitre_attack_id: - T1685.005 product: diff --git a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml index 4c2862a4dd3..c6c2369d6fc 100644 --- a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml +++ b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml @@ -2,7 +2,7 @@ name: Windows Event Triggered Image File Execution Options Injection id: f7abfab9-12ea-44e8-8745-475f9ca6e0a4 version: 8 creation_date: '2022-09-09' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Hunting @@ -22,9 +22,12 @@ known_false_positives: False positives may be present and tuning will be require references: - https://blog.thinkst.com/2022/09/sensitive-command-token-so-much-offense.html - https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.012/T1546.012.yaml#L53 analytic_story: - Windows Persistence Techniques asset_type: Endpoint +atomic_guid: + - 13117939-c9b2-4a43-999e-0a543df92f0d mitre_attack_id: - T1546.012 product: diff --git a/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml b/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml index be93dd54bb2..3a9363e33c4 100644 --- a/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml +++ b/detections/endpoint/windows_eventlog_cleared_via_wevtutil.yml @@ -1,27 +1,65 @@ name: Windows Eventlog Cleared Via Wevtutil id: fdb829a8-db84-4832-b64b-3e964cd44f01 -version: 7 +version: 8 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly description: | - The following analytic detects the usage of wevtutil.exe with the "clear-log" parameter in order to clear the contents of logs. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because clearing event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations. If confirmed malicious, this behavior could allow an attacker to erase evidence of their activities, making it difficult to trace their actions and understand the full scope of the compromise. + The following analytic detects the usage of wevtutil.exe with the "clear-log" parameter in order to clear the contents of logs. + Clearing the event logs can be an attempt to cover tracks after malicious actions, hindering forensic investigations. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count values(Processes.process) as process + min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name=wevtutil.exe + Processes.process IN ("* cl *", "*clear-log*") + + ``` + We exclude the following strings to avoid detection overlap and double coverage since they are already covered by the "Suspicious wevtutil Usage" detection. + ``` + NOT Processes.process IN ( + "*/Trace*", + "*AMSI/Debug*", + "*Application*", + "*CiscoSecureEndpoint*", + "*Microsoft-Windows-BitLocker*", + "*Microsoft-Windows-Bits*", + "*Microsoft-Windows-CAPI2*", + "*Microsoft-Windows-Kernel-File*", + "*Microsoft-Windows-Kernel-Process*", + "*Microsoft-Windows-LDAP*", + "*Microsoft-Windows-PowerShell*", + "*Microsoft-Windows-Sysmon*", + "*Microsoft-Windows-TerminalServices-LocalSessionManager*", + "*Microsoft-Windows-TerminalServices-RemoteConnectionManager*", + "*Microsoft-Windows-WMI-Activity*", + "*OpenSSH/*", + "*PowerShellCore/*", + "*Security*", + "*Setup*", + "*System*", + "*Windows Firewall With Advanced Security*", + "*Windows PowerShell*" + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -30,6 +68,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/61080b19460f2c6431c31689d58063c5f6c1f8fb/atomics/T1070.001/T1070.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -44,11 +83,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: Eventlog was cleared using the Wevtutil.exe utility on $dest$ by $user$ - - field: user - type: user - score: 20 - message: Eventlog was cleared using the Wevtutil.exe utility on $dest$ by $user$ + message: The EventLog was cleared using the [$process_name$] utility with the Command Line [$process$] on [$dest$] by [$user$]. +threat_objects: + - field: process + type: process analytic_story: - Windows Log Manipulation - Ransomware @@ -57,6 +95,8 @@ analytic_story: - CISA AA23-347A - ShrinkLocker asset_type: Endpoint +atomic_guid: + - e6abb60e-26b8-41da-8aae-0c35174b0967 mitre_attack_id: - T1685.005 product: diff --git a/detections/endpoint/windows_export_certificate.yml b/detections/endpoint/windows_export_certificate.yml index fde7bd5856a..2eb87319c46 100644 --- a/detections/endpoint/windows_export_certificate.yml +++ b/detections/endpoint/windows_export_certificate.yml @@ -2,7 +2,7 @@ name: Windows Export Certificate id: d8ddfa9b-b724-4df9-9dbe-f34cc0936714 version: 11 creation_date: '2023-02-03' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -22,6 +22,7 @@ how_to_implement: To implement this analytic, you must collect Microsoft-Windows known_false_positives: False positives may be generated based on an automated process or service that exports certificates on the regular. Review is required before setting to alert. Monitor for abnormal processes performing an export. references: - https://atomicredteam.io/defense-evasion/T1553.004/#atomic-test-4---install-root-ca-on-windows + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1649/T1649.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -40,6 +41,8 @@ intermediate_findings: analytic_story: - Windows Certificate Services asset_type: Endpoint +atomic_guid: + - eb121494-82d1-4148-9e2b-e624e03fbf3d mitre_attack_id: - T1552.004 - T1649 diff --git a/detections/endpoint/windows_file_download_via_certutil.yml b/detections/endpoint/windows_file_download_via_certutil.yml index b8105a3497b..1c1e9b3c7c3 100644 --- a/detections/endpoint/windows_file_download_via_certutil.yml +++ b/detections/endpoint/windows_file_download_via_certutil.yml @@ -2,7 +2,7 @@ name: Windows File Download Via CertUtil id: 7fac8d40-e370-45ea-a4a3-031bbcc18b02 version: 7 creation_date: '2021-03-24' -modification_date: '2026-07-14' +modification_date: '2026-10-09' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: TTP @@ -41,6 +41,8 @@ references: - https://web.archive.org/web/20210921110637/https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html - https://lolbas-project.github.io/lolbas/Binaries/Certutil/ - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L190 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L211 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -78,6 +80,9 @@ analytic_story: - CISA AA22-277A - Cisco Network Visibility Module Analytics asset_type: Endpoint +atomic_guid: + - dd3b61dd-7bbc-48cd-ab51-49ad1a776df0 + - ffd492e3-0455-4518-9fb1-46527c9f241b mitre_attack_id: - T1105 product: diff --git a/detections/endpoint/windows_file_download_via_powershell.yml b/detections/endpoint/windows_file_download_via_powershell.yml index 72f19c64fe8..1139e233861 100644 --- a/detections/endpoint/windows_file_download_via_powershell.yml +++ b/detections/endpoint/windows_file_download_via_powershell.yml @@ -2,7 +2,7 @@ name: Windows File Download Via PowerShell id: 58c4e56c-b5b8-46a3-b5fb-6537dca3c6de version: 10 creation_date: '2021-03-01' -modification_date: '2026-07-14' +modification_date: '2026-10-02' author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -42,6 +42,7 @@ references: - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L816 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -88,6 +89,8 @@ analytic_story: - StealC Stealer - SolarWinds WHD RCE Post Exploitation asset_type: Endpoint +atomic_guid: + - c01cad7f-7a4c-49df-985e-b190dcf6a279 mitre_attack_id: - T1059.001 - T1105 diff --git a/detections/endpoint/windows_file_share_discovery_with_powerview.yml b/detections/endpoint/windows_file_share_discovery_with_powerview.yml index f3e57138aea..0f2792ccfe0 100644 --- a/detections/endpoint/windows_file_share_discovery_with_powerview.yml +++ b/detections/endpoint/windows_file_share_discovery_with_powerview.yml @@ -2,7 +2,7 @@ name: Windows File Share Discovery With Powerview id: a44c0be1-d7ab-41e4-92fd-aa9af4fe232c version: 11 creation_date: '2023-03-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -27,6 +27,7 @@ references: - https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerView/powerview.ps1 - https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/ - https://attack.mitre.org/techniques/T1135/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml#L134 drilldown_searches: - name: View the detection results for - "$dest$" and "$user_id$" search: '%original_detection_search% | search dest = "$dest$" user_id = "$user_id$"' @@ -52,6 +53,8 @@ analytic_story: - Active Directory Privilege Escalation - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - d07e4cc1-98ae-447e-9d31-36cb430d28c4 mitre_attack_id: - T1135 product: diff --git a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml index a466d494379..6d31c42deee 100644 --- a/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml +++ b/detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml @@ -2,7 +2,7 @@ name: Windows Files and Dirs Access Rights Modification Via Icacls id: c76b796c-27e1-4520-91c4-4a58695c749e version: 15 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -37,6 +37,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1222.001/T1222.001.yaml#L31 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -61,7 +62,7 @@ analytic_story: - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint atomic_guid: - - 3309f53e-b22b-4eb6-8fd2-a6cf58b355a9 + - a8206bcc-f282-40a9-a389-05d9c0263485 mitre_attack_id: - T1222.001 product: diff --git a/detections/endpoint/windows_filtering_platform_filter_added_to_block_edr_process.yml b/detections/endpoint/windows_filtering_platform_filter_added_to_block_edr_process.yml new file mode 100644 index 00000000000..38d0ae316df --- /dev/null +++ b/detections/endpoint/windows_filtering_platform_filter_added_to_block_edr_process.yml @@ -0,0 +1,153 @@ +name: Windows Filtering Platform Filter Added To Block EDR Process +id: 8bb64b2a-299e-4ddc-a7e1-037bdc5b904a +version: 1 +creation_date: '2026-08-23' +modification_date: '2026-08-23' +author: Nasreddine Bencherchali, Splunk +status: production +type: TTP +description: |- + The following analytic detects Windows Filtering Platform filters that are added and configured to block outbound traffic for known EDR and security agent processes. + Tools such as EDRSilencer abuse WFP to disrupt outbound telemetry from EDR processes, which can bypass detections that only look for the tool process name. + This detection looks for WFP add events with a block action and EDR process names embedded in the hexdump-like Conditions field. +data_source: + - Windows Event Log Security 5447 +search: |- + `wineventlog_security` + EventCode=5447 + ChangeType IN ("%%16384", "Add") + Action IN ("%%16389", "Block") + Conditions=* + + | eval conditions_text=coalesce(Conditions,"") + | rex mode=sed field=conditions_text "s/-/ /g" + | rex mode=sed field=conditions_text "s/[0-9A-Fa-f]{8}\s+([0-9A-Fa-f]{2}\s+){1,16}//g" + | eval conditions_normalized=lower(replace(conditions_text, "[^A-Za-z0-9]", "")) + | eval edr_process=case( + like(conditions_normalized, "%msmpengexe%"), "MsMpEng.exe", + like(conditions_normalized, "%mssenseexe%"), "MsSense.exe", + like(conditions_normalized, "%senseirexe%"), "SenseIR.exe", + like(conditions_normalized, "%sensendrexe%"), "SenseNdr.exe", + like(conditions_normalized, "%sensecncproxyexe%"), "SenseCncProxy.exe", + like(conditions_normalized, "%sensesampleuploaderexe%"), "SenseSampleUploader.exe", + like(conditions_normalized, "%winlogbeatexe%"), "winlogbeat.exe", + like(conditions_normalized, "%elasticagentexe%"), "elastic-agent.exe", + like(conditions_normalized, "%elasticendpointexe%"), "elastic-endpoint.exe", + like(conditions_normalized, "%filebeatexe%"), "filebeat.exe", + like(conditions_normalized, "%xagtexe%"), "xagt.exe", + like(conditions_normalized, "%qualysagentexe%"), "QualysAgent.exe", + like(conditions_normalized, "%sentinelagentexe%"), "SentinelAgent.exe", + like(conditions_normalized, "%sentinelagentworkerexe%"), "SentinelAgentWorker.exe", + like(conditions_normalized, "%sentinelservicehostexe%"), "SentinelServiceHost.exe", + like(conditions_normalized, "%sentinelstaticengineexe%"), "SentinelStaticEngine.exe", + like(conditions_normalized, "%logprocessorserviceexe%"), "LogProcessorService.exe", + like(conditions_normalized, "%sentinelstaticenginescannerexe%"), "SentinelStaticEngineScanner.exe", + like(conditions_normalized, "%sentinelhelperserviceexe%"), "SentinelHelperService.exe", + like(conditions_normalized, "%sentinelbrowsernativehostexe%"), "SentinelBrowserNativeHost.exe", + like(conditions_normalized, "%cylancesvcexe%"), "CylanceSvc.exe", + like(conditions_normalized, "%amsvcexe%"), "AmSvc.exe", + like(conditions_normalized, "%cramtrayexe%"), "CrAmTray.exe", + like(conditions_normalized, "%crssvcexe%"), "CrsSvc.exe", + like(conditions_normalized, "%executionpreventionsvcexe%"), "ExecutionPreventionSvc.exe", + like(conditions_normalized, "%cybereasonavexe%"), "CybereasonAV.exe", + like(conditions_normalized, "%cbexe%"), "cb.exe", + like(conditions_normalized, "%repmgrexe%"), "RepMgr.exe", + like(conditions_normalized, "%reputilsexe%"), "RepUtils.exe", + like(conditions_normalized, "%repuxexe%"), "RepUx.exe", + like(conditions_normalized, "%repwavexe%"), "RepWAV.exe", + like(conditions_normalized, "%repwscexe%"), "RepWSC.exe", + like(conditions_normalized, "%taniumclientexe%"), "TaniumClient.exe", + like(conditions_normalized, "%taniumcxexe%"), "TaniumCX.exe", + like(conditions_normalized, "%taniumdetectengineexe%"), "TaniumDetectEngine.exe", + like(conditions_normalized, "%trapsexe%"), "Traps.exe", + like(conditions_normalized, "%cyserverexe%"), "cyserver.exe", + like(conditions_normalized, "%cyveraserviceexe%"), "CyveraService.exe", + like(conditions_normalized, "%cyvrfsfltexe%"), "CyvrFsFlt.exe", + like(conditions_normalized, "%fortiedrexe%"), "fortiedr.exe", + like(conditions_normalized, "%sfcexe%"), "sfc.exe", + like(conditions_normalized, "%eiconnectorexe%"), "EIConnector.exe", + like(conditions_normalized, "%ekrnexe%"), "ekrn.exe", + like(conditions_normalized, "%hurukaiexe%"), "hurukai.exe", + like(conditions_normalized, "%cetasvcexe%"), "CETASvc.exe", + like(conditions_normalized, "%wscommunicatorexe%"), "WSCommunicator.exe", + like(conditions_normalized, "%endpointbasecampexe%"), "EndpointBasecamp.exe", + like(conditions_normalized, "%tmlistenexe%"), "TmListen.exe", + like(conditions_normalized, "%ntrtscanexe%"), "Ntrtscan.exe", + like(conditions_normalized, "%tmwscsvcexe%"), "TmWSCSvc.exe", + like(conditions_normalized, "%pccntmonexe%"), "PccNTMon.exe", + like(conditions_normalized, "%tmbmsrvexe%"), "TMBMSRV.exe", + like(conditions_normalized, "%cntaosmgrexe%"), "CNTAoSMgr.exe", + like(conditions_normalized, "%tmccsfexe%"), "TmCCSF.exe" + ) + | where isnotnull(edr_process) + | eval user=coalesce(UserName,user,"unknown") + + | eval filter_action=case(Action="%%16389","Block", true(), Action), + change_type=case(ChangeType="%%16384","Add", true(), ChangeType) + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(filter_action) as filter_action + values(change_type) as change_type + values(edr_process) as edr_process + values(ProviderName) as provider_name + values(FilterType) as filter_type + values(FilterId) as filter_id + values(LayerName) as layer_name + values(LayerId) as layer_id + values(Conditions) as conditions + values(CalloutName) as callout_name + + BY dest user process_id FilterName + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_filtering_platform_filter_added_to_block_edr_process_filter` +how_to_implement: |- + To implement this analytic, enable auditing for Windows Filtering Platform policy changes and ingest Windows Security Event Log data with EventCode 5447. The Splunk Add-on for Microsoft Windows should extract fields such as EventCode, ChangeType, FilterName, Conditions, and Action from XmlWinEventLog:Security events. +known_false_positives: |- + Legitimate firewall, VPN, EDR, and Group Policy changes can add WFP block filters. + Tune by approved ProviderName, LayerName, FilterName, or known administrative windows after validating the WFP filter context. +references: + - https://github.com/netero1010/EDRSilencer + - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5447 + - https://learn.microsoft.com/en-us/windows/win32/fwp/auditing-and-logging +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Windows Filtering Platform block filter targeting [$edr_process$] was detected on [$dest$]. + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: edr_process + type: process_name + - field: FilterName + type: signature +analytic_story: + - Disabling Security Tools + - Security Solution Tampering +asset_type: Endpoint +mitre_attack_id: + - T1685 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1685/edr_silencer/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_finger_exe_connecting_to_a_remote_host.yml b/detections/endpoint/windows_finger_exe_connecting_to_a_remote_host.yml new file mode 100644 index 00000000000..40b37b55986 --- /dev/null +++ b/detections/endpoint/windows_finger_exe_connecting_to_a_remote_host.yml @@ -0,0 +1,94 @@ +name: Windows Finger.exe Connecting to a Remote Host +id: 86a5686a-7bc4-469c-9f88-2620279ede6e +version: 1 +creation_date: '2026-09-16' +modification_date: '2026-09-16' +author: Onur Mustafa Erdogan, Splunk +status: production +type: TTP +description: |- + The following analytic identifies the `finger.exe` utility being spawned with a command line containing an `@` character, indicating a remote host/server was specified. + The Finger protocol utility is largely obsolete in modern environments and has been abused by adversaries as a living-off-the-land binary (LOLBIN) to retrieve encoded payloads or establish covert command-and-control communication with an attacker-controlled finger server. + This behavior is uncommon in legitimate enterprise usage and warrants investigation. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + FROM datamodel=Endpoint.Processes WHERE + + ( + Processes.process_name="finger.exe" + OR + Processes.original_file_name="finger.exe" + ) + Processes.process="*@*" + + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_finger_exe_connecting_to_a_remote_host_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are + designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this + search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must + ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons + that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data + model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: No false positives have been identified at this time. +references: + - https://packetwatch.com/resources/threat-profile/clickfix-abuses-finger-to-deliver-castleloader + - https://lolbas-project.github.io/lolbas/Binaries/Finger/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: The [$process_path$] utility was used to connect to a remote host via the Command Line [$process$] from [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process + type: process +analytic_story: + - Command And Control + - Compromised Windows Host + - Fake CAPTCHA Campaigns + - Windows Post-Exploitation + - Living Off The Land +asset_type: Endpoint +mitre_attack_id: + - T1071 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071/finger_remote_host/finger_remote_host.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml b/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml new file mode 100644 index 00000000000..f3dc13d6c8c --- /dev/null +++ b/detections/endpoint/windows_for_loop_usage_within_cmd_exe_to_execute_commands.yml @@ -0,0 +1,98 @@ +name: Windows For Loop Usage Within Cmd.exe To Execute Commands +id: a4ce9079-fc8f-4749-982a-13197c8cf977 +version: 2 +creation_date: '2026-09-16' +modification_date: '2026-10-09' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies the use of a `for /f` loop with the `delims=` option within `cmd.exe`, a technique commonly used to parse and extract data from the output of other commands. + Adversaries and malicious scripts leverage this pattern to programmatically process command output for discovery, data extraction, or execution purposes while evading simpler detection logic. +data_source: + - Sysmon EventID 1 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.parent_process="*for /f*" + Processes.parent_process="*delims=*" + NOT Processes.user="SYSTEM" + NOT Processes.user="*$" + NOT Processes.parent_process IN ( + "*__VIARelease*", + "*:\\Program Files\\Microsoft SQL Server\\*", + "*^| findstr *" + ) + + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_for_loop_usage_within_cmd_exe_to_execute_commands_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. + These agents are designed to provide security-related telemetry from the endpoints where the agent + is installed. To implement this search, you must ingest logs that contain the process GUID, process + name, and parent process. Additionally, you must ingest complete command-line executions. These logs + must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. + The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk + Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Administrators or power users may use `for /f` loops with `delims=` in legitimate scripts for automation or troubleshooting purposes. +references: + - https://packetwatch.com/resources/threat-profile/clickfix-abuses-finger-to-deliver-castleloader +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: The [$process_name$] utility was invoked with a For loop via the Command Line [$process$] on [$dest$]. +threat_objects: + - field: process + type: process + - field: parent_process_name + type: parent_process_name +analytic_story: + - Compromised Windows Host + - Fake CAPTCHA Campaigns + - Living Off The Land + - Suspicious Command-Line Executions + - Windows Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/cmd_for_loop/cmd_for_loop.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_get_variable_exe_execution_from_windowsapps_folder.yml b/detections/endpoint/windows_get_variable_exe_execution_from_windowsapps_folder.yml index 1a5db7d7c1c..137faa5a6cb 100644 --- a/detections/endpoint/windows_get_variable_exe_execution_from_windowsapps_folder.yml +++ b/detections/endpoint/windows_get_variable_exe_execution_from_windowsapps_folder.yml @@ -2,7 +2,7 @@ name: Windows Get-Variable.EXE Execution from WindowsApps Folder id: 7edb95b6-bccf-4d8c-8ada-d1c5520cf0ed version: 2 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Raven Tait, Splunk status: production type: Anomaly @@ -38,6 +38,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Some legitimate administrative tools may use custom executables in the WindowsApps folder for persistence or automation. Verify the executable's origin before flagging to avoid false positives. references: - https://thehackernews.com/2022/04/researchers-uncover-how-colibri-malware.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1574.008/T1574.008.yaml#L5 drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Windows Persistence Techniques asset_type: Endpoint +atomic_guid: + - 1561de08-0b4b-498e-8261-e922f3494aae mitre_attack_id: - T1574.008 product: diff --git a/detections/endpoint/windows_group_discovery_via_net.yml b/detections/endpoint/windows_group_discovery_via_net.yml index eb0a473e803..1e10212df4c 100644 --- a/detections/endpoint/windows_group_discovery_via_net.yml +++ b/detections/endpoint/windows_group_discovery_via_net.yml @@ -2,7 +2,7 @@ name: Windows Group Discovery Via Net id: c5c8e0f3-147a-43da-bf04-4cfaec27dc44 version: 7 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Mauricio Velazco, Splunk status: production type: Hunting @@ -20,6 +20,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L21 analytic_story: - SolarWinds WHD RCE Post Exploitation - Windows Discovery Techniques @@ -35,6 +36,8 @@ analytic_story: - Volt Typhoon - Microsoft WSUS CVE-2025-59287 asset_type: Endpoint +atomic_guid: + - 1f454dd6-e134-44df-bebb-67de70fb6cd8 mitre_attack_id: - T1069.001 - T1069.002 diff --git a/detections/endpoint/windows_guest_account_enabled_via_net_exe.yml b/detections/endpoint/windows_guest_account_enabled_via_net_exe.yml index 47471c91e42..3fabe37f10b 100644 --- a/detections/endpoint/windows_guest_account_enabled_via_net_exe.yml +++ b/detections/endpoint/windows_guest_account_enabled_via_net_exe.yml @@ -2,7 +2,7 @@ name: Windows Guest Account Enabled Via Net.EXE id: 4f8cd681-7583-47a0-9f38-6337b7adf48a version: 2 creation_date: '2021-09-02' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Raven Tait, Splunk status: production type: Anomaly @@ -38,6 +38,8 @@ search: |- | `windows_guest_account_enabled_via_net_exe_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: The Windows guest account may be activated by IT or support teams for temporary access or troubleshooting. Filter activations related to authorized maintenance activities to reduce false alerts. +references: + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1078.001/T1078.001.yaml#L51 drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -59,6 +61,8 @@ threat_objects: analytic_story: - Windows Persistence Techniques asset_type: Endpoint +atomic_guid: + - aa6cb8c4-b582-4f8e-b677-37733914abda mitre_attack_id: - T1078.001 product: diff --git a/detections/endpoint/windows_handle_duplication_in_known_uac_bypass_binaries.yml b/detections/endpoint/windows_handle_duplication_in_known_uac_bypass_binaries.yml index f0d086a2ebd..051bcd7b7bc 100644 --- a/detections/endpoint/windows_handle_duplication_in_known_uac_bypass_binaries.yml +++ b/detections/endpoint/windows_handle_duplication_in_known_uac_bypass_binaries.yml @@ -1,15 +1,57 @@ name: Windows Handle Duplication in Known UAC-Bypass Binaries id: d7369bf5-1315-4138-b927-2dd8bb8c1da7 -version: 4 +version: 5 creation_date: '2025-11-07' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious handle duplication activity targeting known Windows utilities such as ComputerDefaults.exe, Eventvwr.exe, and others. This technique is commonly used to escalate privileges or bypass UAC by inheriting or injecting elevated tokens or handles. The detection focuses on non-standard use of DuplicateHandle or token duplication where process, thread, or token handles are copied into the context of trusted, signed utilities. Such behavior may indicate attempts to execute with elevated rights without user consent. Alerts enable rapid triage using process trees, handle data, token attributes, command-lines, and binary hashes. +description: |- + The following analytic detects duplicate-handle access to known UAC-bypass binaries from a non-standard source path. + It leverages Sysmon EventCode 10, converts GrantedAccess from hexadecimal, and checks for PROCESS_DUP_HANDLE. data_source: - Sysmon EventID 10 -search: '`sysmon` EventCode=10 TargetImage IN("*\\ComputerDefaults.exe", "*\\eventvwr.exe*", "*\\fodhelper.exe","*\\slui.exe","*\\sdclt.exe","*\\mmc.exe", "*\\colorcpl.exe","*\\wsreset.exe","*\\esentutl.exe", "*\PkgMgr.exe") AND NOT (SourceImage IN ("*C:\\Windows\\system32\\*","*C:\\Windows\\syswow64\\*","*C:\\Program Files\\*", "*C:\\Program Files (x86)\\*","%systemroot%\\*")) | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) | eval PROCESS_DUP_HANDLE = 64 | eval dup_handle_set = bit_and (g_access_decimal, PROCESS_DUP_HANDLE) | where dup_handle_set == PROCESS_DUP_HANDLE | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage GrantedAccess PROCESS_DUP_HANDLE g_access_decimal dup_handle_set Guid Opcode ProcessID SecurityID SourceProcessGUID SourceProcessId TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product CallTrace EventID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_handle_duplication_in_known_uac_bypass_binaries_filter`' +search: |- + `sysmon` + EventCode=10 + TargetImage IN( + "*\\colorcpl.exe", + "*\\ComputerDefaults.exe", + "*\\esentutl.exe", + "*\\eventvwr.exe", + "*\\fodhelper.exe", + "*\\mmc.exe", + "*\\sdclt.exe", + "*\\slui.exe", + "*\\wsreset.exe", + "*\\PkgMgr.exe" + ) + NOT SourceImage IN ( + "C:\\Windows\\System32\\*", + "C:\\Windows\\SysWOW64\\*", + "C:\\Program Files\\*", + "C:\\Program Files (x86)\\*", + "%SystemRoot%\\*" + ) + + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_DUP_HANDLE = 64 + | eval dup_handle_set = bit_and (g_access_decimal, PROCESS_DUP_HANDLE) + | where dup_handle_set == PROCESS_DUP_HANDLE + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_handle_duplication_in_known_uac_bypass_binaries_filter` how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: It is possible legitimate applications will request access to list of know abused Windows UAC binaries process, filter as needed. references: @@ -28,10 +70,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: A process $SourceImage$ is duplicating the handle token of $TargetImage$ on $dest$ + message: The process [$SourceImage$] requested duplicate-handle access [$granted_access$] to [$TargetImage$] on [$dest$] threat_objects: - - field: parent_process_name - type: parent_process_name + - field: SourceImage + type: file_path analytic_story: - Castle RAT asset_type: Endpoint diff --git a/detections/endpoint/windows_hosts_file_access.yml b/detections/endpoint/windows_hosts_file_access.yml index 04ee00db3d4..accdd50bec1 100644 --- a/detections/endpoint/windows_hosts_file_access.yml +++ b/detections/endpoint/windows_hosts_file_access.yml @@ -1,8 +1,8 @@ name: Windows Hosts File Access id: b34bcf35-5380-4b00-b208-5531303fb751 -version: 4 +version: 5 creation_date: '2026-03-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -29,7 +29,7 @@ search: | by _time object_file_path object_file_name dest process_name process_path process_id EventCode | eval process_path = lower(process_path) - | lookup browser_process_and_path browser_process_path as process_path OUTPUT is_valid_browser_path + | lookup local=t browser_process_and_path browser_process_path as process_path OUTPUT is_valid_browser_path | eval is_valid_browser_path=coalesce(is_valid_browser_path,"false") | where is_valid_browser_path = "false" | `security_content_ctime(firstTime)` diff --git a/detections/endpoint/windows_http_network_communication_from_msiexec.yml b/detections/endpoint/windows_http_network_communication_from_msiexec.yml index b9c1505e46f..7c39c7ede9e 100644 --- a/detections/endpoint/windows_http_network_communication_from_msiexec.yml +++ b/detections/endpoint/windows_http_network_communication_from_msiexec.yml @@ -2,7 +2,7 @@ name: Windows HTTP Network Communication From MSIExec id: b0fd38c7-f71a-43a2-870e-f3ca06bcdd99 version: 11 creation_date: '2022-06-17' -modification_date: '2026-07-14' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -58,6 +58,7 @@ known_false_positives: False positives will be present and filtering is required references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.007/T1218.007.yaml#L309 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -90,6 +91,8 @@ analytic_story: - Cisco Network Visibility Module Analytics - SolarWinds WHD RCE Post Exploitation asset_type: Endpoint +atomic_guid: + - 44a4bedf-ffe3-452e-bee4-6925ab125662 mitre_attack_id: - T1218.007 product: diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml index a839ad24519..fc2a6a88253 100644 --- a/detections/endpoint/windows_identify_protocol_handlers.yml +++ b/detections/endpoint/windows_identify_protocol_handlers.yml @@ -1,8 +1,8 @@ name: Windows Identify Protocol Handlers id: bd5c311e-a6ea-48ae-a289-19a3398e3648 -version: 10 +version: 11 creation_date: '2022-07-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -23,7 +23,7 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` - | lookup windows_protocol_handlers handler AS process OUTPUT handler ishandler + | lookup local=t windows_protocol_handlers handler AS process OUTPUT handler ishandler | where ishandler="TRUE" | `windows_identify_protocol_handlers_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. @@ -38,9 +38,12 @@ references: - https://techcommunity.microsoft.com/t5/windows-it-pro-blog/disabling-the-msix-ms-appinstaller-protocol-handler/ba-p/3119479 - https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug - https://parsiya.net/blog/2021-03-17-attack-surface-analysis-part-2-custom-protocol-handlers/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml#L84 analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - db020456-125b-4c8b-a4a7-487df8afb5a2 mitre_attack_id: - T1059 product: diff --git a/detections/endpoint/windows_iis_components_add_new_module.yml b/detections/endpoint/windows_iis_components_add_new_module.yml index 7d94f63810c..3fbc5d7fbcc 100644 --- a/detections/endpoint/windows_iis_components_add_new_module.yml +++ b/detections/endpoint/windows_iis_components_add_new_module.yml @@ -2,7 +2,7 @@ name: Windows IIS Components Add New Module id: 38fe731c-1f13-43d4-b878-a5bbe44807e3 version: 14 creation_date: '2022-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -36,6 +36,7 @@ references: - https://www.secureworks.com/research/bronze-union - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004 - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1505.004/T1505.004.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -64,6 +65,8 @@ analytic_story: - IIS Components - GhostRedirector IIS Module and Rungan Backdoor asset_type: Endpoint +atomic_guid: + - 53adbdfa-8200-490c-871c-d3b1ab3324b2 mitre_attack_id: - T1505.004 product: diff --git a/detections/endpoint/windows_iis_components_new_module_added.yml b/detections/endpoint/windows_iis_components_new_module_added.yml index f23fda7fc0b..e9e7758e4c2 100644 --- a/detections/endpoint/windows_iis_components_new_module_added.yml +++ b/detections/endpoint/windows_iis_components_new_module_added.yml @@ -2,7 +2,7 @@ name: Windows IIS Components New Module Added id: 55f22929-cfd3-4388-ba5c-4d01fac7ee7e version: 11 creation_date: '2022-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -28,6 +28,7 @@ references: - https://www.secureworks.com/research/bronze-union - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004 - https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1505.004/T1505.004.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -47,6 +48,8 @@ analytic_story: - IIS Components - GhostRedirector IIS Module and Rungan Backdoor asset_type: Endpoint +atomic_guid: + - 53adbdfa-8200-490c-871c-d3b1ab3324b2 mitre_attack_id: - T1505.004 product: diff --git a/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml b/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml index 15a6f78e8d8..bfc8e823e9e 100644 --- a/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml +++ b/detections/endpoint/windows_impair_defenses_disable_auto_logger_session.yml @@ -2,7 +2,7 @@ name: Windows Impair Defenses Disable Auto Logger Session id: dc6a5613-d024-47e7-9997-ab6477a483d3 version: 9 creation_date: '2020-11-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -18,6 +18,7 @@ references: - https://isc.sans.edu/diary/rss/28628 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1201 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -37,6 +38,8 @@ analytic_story: - Windows Defense Evasion Tactics - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 653c6e17-14a2-4849-851d-f1c0cc8ea9ab mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/windows_impair_defenses_disable_hvci.yml b/detections/endpoint/windows_impair_defenses_disable_hvci.yml index 01a14841644..9e676c6e08c 100644 --- a/detections/endpoint/windows_impair_defenses_disable_hvci.yml +++ b/detections/endpoint/windows_impair_defenses_disable_hvci.yml @@ -2,7 +2,7 @@ name: Windows Impair Defenses Disable HVCI id: b061dfcc-f0aa-42cc-a6d4-a87f172acb79 version: 11 creation_date: '2023-04-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives will be limited to administrative scripts disabling HVCI. Filter as needed. references: - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L913 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_important_audit_policy_disabled.yml b/detections/endpoint/windows_important_audit_policy_disabled.yml index b9eb4aba48b..ad0f602c9e0 100644 --- a/detections/endpoint/windows_important_audit_policy_disabled.yml +++ b/detections/endpoint/windows_important_audit_policy_disabled.yml @@ -1,8 +1,8 @@ name: Windows Important Audit Policy Disabled id: 1bf500e5-1226-41d9-af5d-ed1f577929f2 -version: 8 +version: 9 creation_date: '2025-02-19' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -16,7 +16,7 @@ search: |- | rename ClientProcessId as process_id | stats min(_time) as _time values(host) as dest BY AuditPolicyChanges SubcategoryGuid, process_id - | lookup advanced_audit_policy_guids GUID as SubcategoryGuid OUTPUT Category SubCategory + | lookup local=t advanced_audit_policy_guids GUID as SubcategoryGuid OUTPUT Category SubCategory | `windows_important_audit_policy_disabled_filter` how_to_implement: To implement the following query, enable the audit policy sub category "Audit Audit Policy Change", and, ensure you are ingesting EventCode `4719` from your endpoints via the appropriate Splunk Add-on for Microsoft Windows. Update the macro definition with the an accurate list of Audit sub categories that you consider important for your environment. known_false_positives: No false positives have been identified at this time. diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml index 2a70eea3f67..3ba7218fe85 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml @@ -1,15 +1,14 @@ name: Windows Indirect Command Execution Via forfiles id: 1fdf31c9-ff4d-4c48-b799-0e8666e08787 -version: 11 +version: 12 creation_date: '2022-03-04' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Eric McGinnis, Splunk status: production type: TTP description: The following analytic detects the execution of programs initiated by forfiles.exe. This command is typically used to run commands on multiple files, often within batch scripts. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where forfiles.exe is the parent process. This activity is significant because forfiles.exe can be exploited to bypass command line execution protections, making it a potential vector for malicious activity. If confirmed malicious, this could allow attackers to execute arbitrary commands, potentially leading to unauthorized access or further system compromise. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.parent_process="*forfiles* /c *" @@ -29,6 +28,7 @@ known_false_positives: Some legacy applications may be run using pcalua.exe. Sim references: - https://twitter.com/KyleHanslovan/status/912659279806640128 - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml#L27 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -48,6 +48,8 @@ analytic_story: - Living Off The Land - Windows Post-Exploitation asset_type: Endpoint +atomic_guid: + - 8b34a448-40d9-4fc3-a8c8-4bb286faf7dc mitre_attack_id: - T1202 product: diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml index f5060aafe37..3cbdbe4f1c9 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml @@ -1,15 +1,14 @@ name: Windows Indirect Command Execution Via pcalua id: 3428ac18-a410-4823-816c-ce697d26f7a8 -version: 11 +version: 12 creation_date: '2022-03-04' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Eric McGinnis, Splunk status: production type: TTP description: The following analytic detects programs initiated by pcalua.exe, the Microsoft Windows Program Compatibility Assistant. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process information. While pcalua.exe can start legitimate programs, it is significant because attackers may use it to bypass command line execution protections. If confirmed malicious, this activity could allow attackers to execute arbitrary commands, potentially leading to unauthorized actions, privilege escalation, or persistence within the environment. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.parent_process="*pcalua* -a*" @@ -29,6 +28,7 @@ known_false_positives: Some legacy applications may be run using pcalua.exe. Fi references: - https://twitter.com/KyleHanslovan/status/912659279806640128 - https://lolbas-project.github.io/lolbas/Binaries/Pcalua/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -47,6 +47,8 @@ finding: analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - cecfea7a-5f03-4cdd-8bc8-6f7c22862440 mitre_attack_id: - T1202 product: diff --git a/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml index ef5bbd798f5..c514963b3ea 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_series_of_forfiles.yml @@ -2,7 +2,7 @@ name: Windows Indirect Command Execution Via Series Of Forfiles id: bfdaabe7-3db8-48c5-80c1-220f9b8f22be version: 11 creation_date: '2022-12-07' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -29,6 +29,7 @@ references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml#L27 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -48,6 +49,8 @@ analytic_story: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint +atomic_guid: + - 8b34a448-40d9-4fc3-a8c8-4bb286faf7dc mitre_attack_id: - T1202 product: diff --git a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml index f770c33e4da..8353103cd7c 100644 --- a/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml +++ b/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml @@ -2,7 +2,7 @@ name: Windows Input Capture Using Credential UI Dll id: 406c21d6-6c75-4e9f-9ca9-48049a1dd90e version: 9 creation_date: '2022-08-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -15,10 +15,13 @@ known_false_positives: this module can be loaded by a third party application. F references: - https://docs.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-creduipromptforcredentialsa - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md#atomic-test-2---powershell---prompt-user-for-password + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1056.002/T1056.002.yaml#L16 analytic_story: - Brute Ratel C4 - APT37 Rustonotto and FadeStealer asset_type: Endpoint +atomic_guid: + - 2b162bfd-0928-4d4c-9ec3-4d9f88374b52 mitre_attack_id: - T1056.002 product: diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml index 9bbc67e9c51..76c22050810 100644 --- a/detections/endpoint/windows_installutil_in_non_standard_path.yml +++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml @@ -2,7 +2,7 @@ name: Windows InstallUtil in Non Standard Path id: dcf74b22-7933-11ec-857c-acde48001122 version: 12 creation_date: '2022-01-20' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -19,6 +19,7 @@ references: - https://attack.mitre.org/techniques/T1036/003/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.004/T1218.004.yaml#L460 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -54,6 +55,8 @@ analytic_story: - Data Destruction - WhisperGate asset_type: Endpoint +atomic_guid: + - 559e6d06-bb42-4307-bff7-3b95a8254bad mitre_attack_id: - T1036.003 - T1218.004 diff --git a/detections/endpoint/windows_installutil_uninstall_option.yml b/detections/endpoint/windows_installutil_uninstall_option.yml index 9212841d132..52534c68fd3 100644 --- a/detections/endpoint/windows_installutil_uninstall_option.yml +++ b/detections/endpoint/windows_installutil_uninstall_option.yml @@ -2,7 +2,7 @@ name: Windows InstallUtil Uninstall Option id: cfa7b9ac-43f0-11ec-9b48-acde48001122 version: 14 creation_date: '2021-11-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -18,6 +18,7 @@ references: - https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12 - https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.004/T1218.004.yaml#L265 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -49,6 +50,8 @@ analytic_story: - Compromised Windows Host - Signed Binary Proxy Execution InstallUtil asset_type: Endpoint +atomic_guid: + - 34428cfa-8e38-41e5-aff4-9e1f8f3a7b4b mitre_attack_id: - T1218.004 product: diff --git a/detections/endpoint/windows_kerberos_local_successful_logon.yml b/detections/endpoint/windows_kerberos_local_successful_logon.yml index f056478f50a..af3fb835060 100644 --- a/detections/endpoint/windows_kerberos_local_successful_logon.yml +++ b/detections/endpoint/windows_kerberos_local_successful_logon.yml @@ -1,8 +1,8 @@ name: Windows Kerberos Local Successful Logon id: 8309c3a8-4d34-48ae-ad66-631658214653 -version: 15 +version: 16 creation_date: '2022-04-28' -modification_date: '2026-07-27' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: TTP @@ -31,7 +31,7 @@ search: |- src_port status subject user user_group vendor_product - | lookup update=true domain_controllers sAMAccountName as dest OUTPUT isDC + | lookup local=t update=true domain_controllers sAMAccountName as dest OUTPUT isDC | where isnull(isDC) | fields - isDC diff --git a/detections/endpoint/windows_known_abused_dll_created.yml b/detections/endpoint/windows_known_abused_dll_created.yml index 56dbfd3b2e1..e480094ba54 100644 --- a/detections/endpoint/windows_known_abused_dll_created.yml +++ b/detections/endpoint/windows_known_abused_dll_created.yml @@ -1,15 +1,15 @@ name: Windows Known Abused DLL Created id: ea91651a-772a-4b02-ac3d-985b364a5f07 -version: 11 +version: 12 creation_date: '2024-03-20' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly description: The following analytic identifies the creation of Dynamic Link Libraries (DLLs) with a known history of exploitation in atypical locations. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and filesystem events. This activity is significant as it may indicate DLL search order hijacking or sideloading, techniques used by attackers to execute arbitrary code, maintain persistence, or escalate privileges. If confirmed malicious, this activity could allow attackers to blend in with legitimate operations, posing a severe threat to system integrity and security. data_source: - Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\users\\*","*\\Windows\Temp\\*","*\\programdata\\*") Filesystem.file_name="*.dll" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | lookup hijacklibs_loaded library AS file_name OUTPUT islibrary, ttp, comment as desc | lookup hijacklibs_loaded library AS file_name excludes as file_path OUTPUT islibrary as excluded | search islibrary = TRUE AND excluded != TRUE | where isnotnull(file_name) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_known_abused_dll_created_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\users\\*","*\\Windows\Temp\\*","*\\programdata\\*") Filesystem.file_name="*.dll" by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | lookup local=t hijacklibs_loaded library AS file_name OUTPUT islibrary, ttp, comment as desc | lookup local=t hijacklibs_loaded library AS file_name excludes as file_path OUTPUT islibrary as excluded | search islibrary = TRUE AND excluded != TRUE | where isnotnull(file_name) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_known_abused_dll_created_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` and `Filesystem` nodes of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: This analytic may flag instances where DLLs are loaded by user mode programs for entirely legitimate and benign purposes. It is important for users to be aware that false positives are not only possible but likely, and that careful tuning of this analytic is necessary to distinguish between malicious activity and normal, everyday operations of applications. This may involve adjusting thresholds, whitelisting known good software, or incorporating additional context from other security tools and logs to reduce the rate of false positives. references: diff --git a/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml b/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml index 22ae61333d5..cdede1c4363 100644 --- a/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml +++ b/detections/endpoint/windows_known_abused_dll_loaded_suspiciously.yml @@ -1,17 +1,128 @@ name: Windows Known Abused DLL Loaded Suspiciously id: dd6d1f16-adc0-4e87-9c34-06189516b803 -version: 12 +version: 13 creation_date: '2024-04-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP -description: The following analytic detects when DLLs with known abuse history are loaded from an unusual location. This activity may represent an attacker performing a DLL search order or sideload hijacking technique. These techniques are used to gain persistence as well as elevate privileges on the target system. This detection relies on Sysmon EID7 and is compatible with all Officla Sysmon TA versions. +description: |- + The following analytic detects when DLLs with known abuse history are loaded from an unusual location. + This activity may represent an attacker performing a DLL search order or sideload hijacking technique. + These techniques are used to gain persistence as well as elevate privileges on the target system. data_source: - Sysmon EventID 7 -search: '`sysmon` ImageLoaded EventCode=7 NOT ImageLoaded IN ("*\\Program Files*","*\\system32\\*", "*\\syswow64\\*","*\\winsxs\\*","*\\wbem\\*") | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded dest process_exec process_guid process_hash process_id process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product loaded_file | rename Image as process | eval process_name = case(isnotnull(process),replace(process,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)","")), loaded_file_path = case(isnotnull(loaded_file), replace(loaded_file, "(:[\w\. ]+)", "")), loaded_file = case(isnotnull(loaded_file),replace(loaded_file,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)","")), user = case(NOT user IN ("-"), replace(user, "(.*)\\\(.+)$","\2")) | lookup hijacklibs_loaded library AS loaded_file OUTPUT islibrary comment as desc | lookup hijacklibs_loaded library AS loaded_file excludes as loaded_file_path OUTPUT islibrary as excluded | search islibrary = TRUE AND excluded = false | stats count min(_time) as firstTime max(_time) as lastTime by dest loaded_file loaded_file_path process process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_known_abused_dll_loaded_suspiciously_filter`' -how_to_implement: The following analytic requires Sysmon operational logs to be imported, with EID7 being mapped to the process_name field. Modify the sysmon macro as needed to match the sourcetype or add index. -known_false_positives: DLLs being loaded by user mode programs for legitimate reasons. +search: |- + `sysmon` + ImageLoaded + EventCode=7 + + NOT ImageLoaded IN ( + "C:\\$WINDOWS.~BT\\*", + "C:\\$WinREAgent\\*", + "C:\\Windows\\SoftwareDistribution\\*", + "C:\\Windows\\SyChpe32\\*", + "C:\\Windows\\System32\\*", + "C:\\Windows\\SystemTemp\\*", + "C:\\Windows\\SysWOW64\\*", + "C:\\Windows\\WinSxS\\*" + ) + + NOT ( + ImageLoaded="C:\\Windows\\Temp\\*" + Image IN ( + "C:\\Windows\\WinSxS\\arm64*", + "C:\\Windows\\UUS\\arm64\\*" + ) + Image IN ( + "*\\TiWorker.exe", + "*\\wuaucltcore.exe" + ) + ) + + NOT ( + ImageLoaded="C:\\Windows\\Microsoft.NET\\*" + ImageLoaded="*\\cscui.dll" + ) + + NOT ( + ImageLoaded="C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*" + ImageLoaded="*\\version.dll" + ) + + NOT ( + ImageLoaded="C:\\Program Files\\WindowsApps\\Microsoft.DirectXRuntime_*" + ImageLoaded="*\\d3dx9_43.dll" + ) + + NOT ImageLoaded="C:\\Windows\\ImmersiveControlPanel\\SystemSettings.dll" + + NOT ( + ImageLoaded="C:\\Program Files\\Microsoft\\Exchange Server\\*" + ImageLoaded="*\\mswb7.dll" + ) + + NOT ( + ImageLoaded="C:\\Program Files\\Arsenal-Image-Mounter-*" + ImageLoaded IN ( + "*\\mi.dll", + "*\\miutils.dll" + ) + ) + + NOT ( + Image="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" + ImageLoaded="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" + ) + + NOT ImageLoaded="C:\\Packages\\Plugins\\Microsoft.GuestConfiguration.ConfigurationforWindows\\*" + + NOT ( + Image IN ( + "C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs*", + "C:\\Windows\\System32\\backgroundTaskHost.exe" + ) + ImageLoaded="C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs*" + ) + + NOT ( + ImageLoaded="C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs\\*" + ImageLoaded="*\\wldp.dll" + ) + + NOT ( + Image IN ( + "C:\\Program Files\\CheckPoint\\*", + "C:\\Program Files (x86)\\CheckPoint\\*" + ) + Image="*\\SmartConsole.exe" + ImageLoaded IN ( + "C:\\Program Files\\CheckPoint\\*", + "C:\\Program Files (x86)\\CheckPoint\\*" + ) + ImageLoaded="*\\PolicyManager.dll" + ) + + | lookup local=t hijacklibs_loaded library AS loaded_file OUTPUT islibrary comment as reference + | lookup local=t hijacklibs_loaded library AS loaded_file excludes AS loaded_file_path OUTPUT islibrary AS excluded + | where islibrary="TRUE" AND excluded="false" + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by dest loaded_file loaded_file_path process_exec + process_guid process_hash process_id process_name + process_path service_dll_signature_exists + service_dll_signature_verified signature + signature_id user user_id reference vendor_product + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_known_abused_dll_loaded_suspiciously_filter` +how_to_implement: |- + The following analytic requires Sysmon operational logs to be ingested, with EventID 7 being mapped to the process_name field. Modify the sysmon macro as needed to match the sourcetype or add index. +known_false_positives: |- + False positives are expected from third party applications and other legitimate system processes located in Program Files and other similar locations. Filter as needed. references: - https://attack.mitre.org/techniques/T1574/002/ - https://hijacklibs.net/api/ @@ -27,11 +138,16 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: The module [$loaded_file$] was loaded from an unusual location. + title: The module [$loaded_file$] was loaded from an unusual location [$loaded_file_path$] on [$dest$]. Which may indicate a DLL search order or sideload hijacking technique. entity: field: dest type: system score: 50 +threat_objects: + - field: process_path + type: file_path + - field: loaded_file_path + type: file_path analytic_story: - SolarWinds WHD RCE Post Exploitation - Windows Defense Evasion Tactics diff --git a/detections/endpoint/windows_ldifde_directory_object_behavior.yml b/detections/endpoint/windows_ldifde_directory_object_behavior.yml index f6cb824804e..03d828f6386 100644 --- a/detections/endpoint/windows_ldifde_directory_object_behavior.yml +++ b/detections/endpoint/windows_ldifde_directory_object_behavior.yml @@ -2,7 +2,7 @@ name: Windows Ldifde Directory Object Behavior id: 35cd29ca-f08c-4489-8815-f715c45460d3 version: 12 creation_date: '2023-05-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF - https://twitter.com/0gtweet/status/1564968845726580736?s=20 - https://strontic.github.io/xcyclopedia/library/ldifde.exe-45D28FB47E9B6ACC5DCA9FDA3E790210.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L211 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' diff --git a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml index 68e4ad1895d..87f0252f6b7 100644 --- a/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml +++ b/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml @@ -2,7 +2,7 @@ name: Windows Linked Policies In ADSI Discovery id: 510ea428-4731-4d2f-8829-a28293e427aa version: 11 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -26,6 +26,7 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - https://medium.com/@pentesttas/discover-hidden-gpo-s-on-active-directory-using-ps-adsi-a284b6814c81 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L247 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -46,6 +47,8 @@ analytic_story: - Active Directory Discovery - Industroyer2 asset_type: Endpoint +atomic_guid: + - 7ab0205a-34e4-4a44-9b04-e1541d1a57be mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml b/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml index 6f917fe2492..24259e1e79e 100644 --- a/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml +++ b/detections/endpoint/windows_lolbas_executed_outside_expected_path.yml @@ -1,8 +1,8 @@ name: Windows LOLBAS Executed Outside Expected Path id: 326fdf44-b90c-4d2e-adca-1fd140b10536 -version: 10 +version: 11 creation_date: '2024-05-03' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -36,8 +36,8 @@ search: | Processes.process_path Processes.user Processes.user_id Processes.vendor_product |`drop_dm_object_name(Processes)` - | lookup lolbas_file_path lolbas_file_name as process_name OUTPUT description as desc - | lookup lolbas_file_path lolbas_file_name as process_name lolbas_file_path as process_path OUTPUT description as is_lolbas_path + | lookup local=t lolbas_file_path lolbas_file_name as process_name OUTPUT description as desc + | lookup local=t lolbas_file_path lolbas_file_name as process_name lolbas_file_path as process_path OUTPUT description as is_lolbas_path | search desc!="false" AND is_lolbas_path="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml index 53147d54e3d..710e1709ccf 100644 --- a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml +++ b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml @@ -2,7 +2,7 @@ name: Windows Mimikatz Crypto Export File Extensions id: 3a9a6806-16a8-4cda-8d73-b49d10a05b16 version: 10 creation_date: '2023-02-09' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -25,6 +25,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present and may need to be reviewed before this can be turned into a TTP. In addition, remove .pfx (standalone) if it's too much volume. references: - https://github.com/gentilkiwi/mimikatz/blob/master/mimikatz/modules/kuhl_m_crypto.c#L628-L645 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L377 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +46,8 @@ analytic_story: - CISA AA23-347A - Windows Certificate Services asset_type: Endpoint +atomic_guid: + - 290df60e-4b5d-4a5e-b0c7-dc5348ea0c86 mitre_attack_id: - T1649 product: diff --git a/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml b/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml index c2284f8abbd..8dcdd84b190 100644 --- a/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml +++ b/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry AuthenticationLevelOverride id: 6410a403-36bb-490f-a06a-11c3be7d2a41 version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1061 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ intermediate_findings: analytic_story: - DarkGate Malware asset_type: Endpoint +atomic_guid: + - 7e7b62e9-5f83-477d-8935-48600f38a3c6 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_auto_update_notif.yml b/detections/endpoint/windows_modify_registry_auto_update_notif.yml index 081b1225948..d7edff1a2b9 100644 --- a/detections/endpoint/windows_modify_registry_auto_update_notif.yml +++ b/detections/endpoint/windows_modify_registry_auto_update_notif.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Auto Update Notif id: 4d1409df-40c7-4b11-aec4-bd0e709dfc12 version: 11 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: administrators may enable or disable this feature that may cause some false positive. references: - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L835 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,7 +34,7 @@ analytic_story: - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - 335a6b15-b8d2-4a3f-a973-ad69aa2620d7 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disable_rdp.yml b/detections/endpoint/windows_modify_registry_disable_rdp.yml index b56ea1e175a..df4afcc733f 100644 --- a/detections/endpoint/windows_modify_registry_disable_rdp.yml +++ b/detections/endpoint/windows_modify_registry_disable_rdp.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disable RDP id: 11ed764f-eb9c-4be7-bdad-2209b9d33ee1 version: 10 creation_date: '2024-07-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: administrators may enable or disable this feature that may cause some false positive. references: - https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1138 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ analytic_story: - ShrinkLocker - Windows RDP Artifacts and Defense Evasion asset_type: Endpoint +atomic_guid: + - 5f8e36de-37ca-455e-b054-a2584f043c06 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml index a0e28655d9a..37ad6574340 100644 --- a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml +++ b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disable Toast Notifications id: ed4eeacb-8d5a-488e-bc97-1ce6ded63b84 version: 11 creation_date: '2022-06-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: administrators may enable or disable this feature that ma references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L563 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ intermediate_findings: analytic_story: - Azorult asset_type: Endpoint +atomic_guid: + - 003f466a-6010-4b15-803a-cbb478a314d7 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml index 48861e46a97..09e6f55681a 100644 --- a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml +++ b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disable Win Defender Raw Write Notif id: 0e5e25c3-32f4-46f7-ba4a-5b95c3b90f5b version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: Administrators may enable or disable this feature that ma references: - https://admx.help/?Category=SystemCenterEndpointProtection&Policy=Microsoft.Policies.Antimalware::real-time_protection_disablerawwritenotification - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L796 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Azorult - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 12e03af7-79f9-4f95-af48-d3f12f28a260 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml index da42d17dcd0..906d72ca7ff 100644 --- a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml +++ b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disable WinDefender Notifications id: 8e207707-ad40-4eb3-b865-3a52aec91f26 version: 12 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: administrators may enable or disable this feature that may cause some false positive. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L796 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml index cf6e6e234c2..d50a14b0a68 100644 --- a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml +++ b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disable Windows Security Center Notif id: 27ed3e79-6d86-44dd-b9ab-524451c97a7b version: 11 creation_date: '2022-06-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: administrators may enable or disable this feature that ma references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L577 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Azorult - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 45914594-8df6-4ea9-b3cc-7eb9321a807e mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml b/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml index 101583af230..d7047f51b85 100644 --- a/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml +++ b/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry DisableRemoteDesktopAntiAlias id: 4927c6f1-4667-42e6-bd7a-f5222116386b version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L994 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ finding: analytic_story: - DarkGate Malware asset_type: Endpoint +atomic_guid: + - 61d35188-f113-4334-8245-8c6556d43909 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml b/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml index 8bbf7c95860..1fd32a56a89 100644 --- a/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml +++ b/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry DisableSecuritySettings id: 989019b4-b7aa-418a-9a17-2293e91288b6 version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1007 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ analytic_story: - DarkGate Malware - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - 4b81bcfa-fb0a-45e9-90c2-e3efe5160140 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml index afb52af6c27..c605fa982fa 100644 --- a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml +++ b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Disabling WER Settings id: 21cbcaf1-b51f-496d-a0c1-858ff3070452 version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -15,6 +15,7 @@ known_false_positives: Administrators may enable or disable this feature that ma references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L675 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Azorult - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - d2c9e41e-cd86-473d-980d-b6403562e3e1 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml index fe7158b2008..7f813886786 100644 --- a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml +++ b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry DisAllow Windows App id: 4bc788d3-c83a-48c5-a4e2-e0c6dba57889 version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. Filter as needed. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L692 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ finding: analytic_story: - Azorult asset_type: Endpoint +atomic_guid: + - 71db768a-5a9c-4047-b5e7-59e01f188e84 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml index 0f7a6e5632a..4fcbff8da43 100644 --- a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml +++ b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Do Not Connect To Win Update id: e09c598e-8dd0-4e73-b740-4b96b689199e version: 11 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: administrators may enable or disable this feature that ma references: - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsUpdate::DoNotConnectToWindowsUpdateInternetLocations + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L848 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,7 +35,7 @@ analytic_story: - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - d1de3767-99c2-4c6c-8c5a-4ba4586474c8 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_dontshowui.yml b/detections/endpoint/windows_modify_registry_dontshowui.yml index d020f7be17d..26351e0a9f0 100644 --- a/detections/endpoint/windows_modify_registry_dontshowui.yml +++ b/detections/endpoint/windows_modify_registry_dontshowui.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry DontShowUI id: 4ff9767b-fdf2-489c-83a5-c6c34412d72e version: 11 creation_date: '2022-07-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1020 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ finding: analytic_story: - DarkGate Malware asset_type: Endpoint +atomic_guid: + - 09147b61-40f6-4b2a-b6fb-9e73a3437c96 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml b/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml index 013437ecd0d..343b7fed613 100644 --- a/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml +++ b/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry EnableLinkedConnections id: 93048164-3358-4af0-8680-aa5f38440516 version: 12 creation_date: '2023-07-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. references: - https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L126 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_modify_registry_longpathsenabled.yml b/detections/endpoint/windows_modify_registry_longpathsenabled.yml index cb58e89edb6..ae6f6a9182a 100644 --- a/detections/endpoint/windows_modify_registry_longpathsenabled.yml +++ b/detections/endpoint/windows_modify_registry_longpathsenabled.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry LongPathsEnabled id: 36f9626c-4272-4808-aadd-267acce681c0 version: 12 creation_date: '2023-07-10' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. references: - https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L126 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml b/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml index 77dae0130ff..420b4c96813 100644 --- a/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml +++ b/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry MaxConnectionPerServer id: 064cd09f-1ff4-4823-97e0-45c2f5b087ec version: 11 creation_date: '2023-07-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: Administrators may enable or disable this feature that ma references: - https://asec.ahnlab.com/en/17692/ - https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/warzone#:~:text=Warzone%20RAT%20(AKA%20Ave%20Maria)%20is%20a%20remote%20access%20trojan,is%20as%20an%20information%20stealer. + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L890 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ intermediate_findings: analytic_story: - Warzone RAT asset_type: Endpoint +atomic_guid: + - 37950714-e923-4f92-8c7c-51e4b6fffbf6 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml index f99e065abb8..6d6fd1e86fd 100644 --- a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml +++ b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry No Auto Reboot With Logon User id: 6a12fa9f-580d-4627-8c7f-313e359bdc6a version: 11 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. references: - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L822 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,7 +34,7 @@ analytic_story: - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - 396f997b-c5f8-4a96-bb2c-3c8795cf459d mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_no_auto_update.yml b/detections/endpoint/windows_modify_registry_no_auto_update.yml index 566ad5c9469..4c332ede536 100644 --- a/detections/endpoint/windows_modify_registry_no_auto_update.yml +++ b/detections/endpoint/windows_modify_registry_no_auto_update.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry No Auto Update id: fbd4f333-17bb-4eab-89cb-860fa2e0600e version: 11 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. references: - https://learn.microsoft.com/de-de/security-updates/windowsupdateservices/18127499 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L809 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,7 +35,7 @@ analytic_story: - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - 01b20ca8-c7a3-4d86-af59-059f15ed5474 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml b/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml index 9c46c0f4a7c..14c926a0496 100644 --- a/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml +++ b/detections/endpoint/windows_modify_registry_on_smart_card_group_policy.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry on Smart Card Group Policy id: 1522145a-8e86-4f83-89a8-baf62a8f489d version: 9 creation_date: '2024-07-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: administrators may enable or disable this feature that may cause some false positive. references: - https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1151 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ intermediate_findings: analytic_story: - ShrinkLocker asset_type: Endpoint +atomic_guid: + - 4c4bf587-fe7f-448f-ba8d-1ecec9db88be mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_proxyenable.yml b/detections/endpoint/windows_modify_registry_proxyenable.yml index 792d6146dfd..13261230dae 100644 --- a/detections/endpoint/windows_modify_registry_proxyenable.yml +++ b/detections/endpoint/windows_modify_registry_proxyenable.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry ProxyEnable id: b27f20bd-ef20-41d1-a1e9-25dedd5bf2f5 version: 11 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1034 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ intermediate_findings: analytic_story: - DarkGate Malware asset_type: Endpoint +atomic_guid: + - eb0ba433-63e5-4a8c-a9f0-27c4192e1336 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_proxyserver.yml b/detections/endpoint/windows_modify_registry_proxyserver.yml index c94161b8658..edfd77e587f 100644 --- a/detections/endpoint/windows_modify_registry_proxyserver.yml +++ b/detections/endpoint/windows_modify_registry_proxyserver.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry ProxyServer id: 12bdaa0b-3c59-4489-aae1-bff6d67746ef version: 11 creation_date: '2023-12-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1047 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ intermediate_findings: analytic_story: - DarkGate Malware asset_type: Endpoint +atomic_guid: + - d88a3d3b-d016-4939-a745-03638aafd21b mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml index 32a3377cb70..302cd984a9b 100644 --- a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml +++ b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Suppress Win Defender Notif id: e3b42daf-fff4-429d-bec8-2a199468cea9 version: 11 creation_date: '2022-06-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: administrators may enable or disable this feature that ma references: - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L591 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Azorult - CISA AA23-347A asset_type: Endpoint +atomic_guid: + - c30dada3-7777-4590-b970-dc890b8cf113 mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_registry_tamper_protection.yml b/detections/endpoint/windows_modify_registry_tamper_protection.yml index a1444c7c9fb..9dcb2e5c5d0 100644 --- a/detections/endpoint/windows_modify_registry_tamper_protection.yml +++ b/detections/endpoint/windows_modify_registry_tamper_protection.yml @@ -2,7 +2,7 @@ name: Windows Modify Registry Tamper Protection id: 12094335-88fc-4c3a-b55f-e62dd8c93c23 version: 12 creation_date: '2023-04-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators may enable or disable this feature that may cause some false positive. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L861 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,7 +35,7 @@ analytic_story: - RedLine Stealer asset_type: Endpoint atomic_guid: - - 12e03af7-79f9-4f95-af48-d3f12f28a260 + - 3b625eaa-c10d-4635-af96-3eae7d2a2f3c mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index 377bb7c4cf9..014065e3024 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -2,7 +2,7 @@ name: Windows Modify Show Compress Color And Info Tip Registry id: b7548c2e-9a10-11ec-99e3-acde48001122 version: 15 creation_date: '2022-03-02' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: No false positives have been identified at this time. references: - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L498 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -35,6 +36,8 @@ analytic_story: - Windows Registry Abuse - Hermetic Wiper asset_type: Endpoint +atomic_guid: + - 795d3248-0394-4d4d-8e86-4e8df2a2693f mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml index 00b2ebf2c38..28d2662d68b 100644 --- a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml +++ b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml @@ -2,7 +2,7 @@ name: Windows MOF Event Triggered Execution via WMI id: e59b5a73-32bf-4467-a585-452c36ae10c1 version: 13 creation_date: '2022-07-19' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -20,6 +20,7 @@ references: - https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp - https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/ - https://www.sakshamdixit.com/wmi-events/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L86 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -50,6 +51,8 @@ analytic_story: - Living Off The Land - Compromised Windows Host asset_type: Endpoint +atomic_guid: + - 29786d7e-8916-4de6-9c55-be7b093b2706 mitre_attack_id: - T1546.003 product: diff --git a/detections/endpoint/windows_msiexec_dllregisterserver.yml b/detections/endpoint/windows_msiexec_dllregisterserver.yml index 3d5d5728659..ed67803245b 100644 --- a/detections/endpoint/windows_msiexec_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_dllregisterserver.yml @@ -2,7 +2,7 @@ name: Windows MSIExec DLLRegisterServer id: fdb59aef-d88f-4909-8369-ec2afbd2c398 version: 14 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: This analytic will need to be tuned for your environment references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.007/T1218.007.yaml#L253 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -60,6 +61,8 @@ analytic_story: - Windows System Binary Proxy Execution MSIExec - Water Gamayun asset_type: Endpoint +atomic_guid: + - 0106ffa5-fab6-4c7d-82e3-e6b8867d5e5d mitre_attack_id: - T1218.007 product: diff --git a/detections/endpoint/windows_msiexec_remote_download.yml b/detections/endpoint/windows_msiexec_remote_download.yml index b6fc68b7953..bfb1bd01bf6 100644 --- a/detections/endpoint/windows_msiexec_remote_download.yml +++ b/detections/endpoint/windows_msiexec_remote_download.yml @@ -2,7 +2,7 @@ name: Windows MSIExec Remote Download id: 6aa49ff2-3c92-4586-83e0-d83eb693dfda version: 17 creation_date: '2022-06-17' -modification_date: '2026-07-14' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -48,6 +48,7 @@ known_false_positives: | references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.007/T1218.007.yaml#L309 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -79,6 +80,8 @@ analytic_story: - StealC Stealer - SolarWinds WHD RCE Post Exploitation asset_type: Endpoint +atomic_guid: + - 44a4bedf-ffe3-452e-bee4-6925ab125662 mitre_attack_id: - T1218.007 product: diff --git a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml index 5886cd31667..8d9f150a6b8 100644 --- a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml @@ -2,7 +2,7 @@ name: Windows MSIExec Unregister DLLRegisterServer id: a27db3c5-1a9a-46df-a577-765d3f1a3c24 version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: This analytic will need to be tuned for your environment references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.007/T1218.007.yaml#L281 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Windows System Binary Proxy Execution MSIExec asset_type: Endpoint +atomic_guid: + - ab09ec85-4955-4f9c-b8e0-6851baf4d47f mitre_attack_id: - T1218.007 product: diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml index 2776bccf2e7..907bc7ac7de 100644 --- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml @@ -2,7 +2,7 @@ name: Windows Multiple Users Failed To Authenticate From Host Using NTLM id: 7ed272a4-9c77-11eb-af22-acde48001122 version: 13 creation_date: '2021-04-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: TTP @@ -22,6 +22,7 @@ references: - https://attack.mitre.org/techniques/T1110/003/ - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1110.003/T1110.003.yaml#L55 drilldown_searches: - name: View the detection results for - "$Workstation$" search: '%original_detection_search% | search Workstation = "$Workstation$"' @@ -41,6 +42,8 @@ analytic_story: - Active Directory Password Spraying - Volt Typhoon asset_type: Endpoint +atomic_guid: + - f14d956a-5b6e-4a93-847f-0c415142f07d mitre_attack_id: - T1110.003 product: diff --git a/detections/endpoint/windows_net_system_service_discovery.yml b/detections/endpoint/windows_net_system_service_discovery.yml index db8ca969a59..78a2d604241 100644 --- a/detections/endpoint/windows_net_system_service_discovery.yml +++ b/detections/endpoint/windows_net_system_service_discovery.yml @@ -2,7 +2,7 @@ name: Windows Net System Service Discovery id: dd7da098-83b8-4c48-b09d-e51aeb621e81 version: 5 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -31,10 +31,13 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://cert.gov.ua/article/6284730 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1007/T1007.yaml#L20 analytic_story: - LAMEHUG - Gh0st RAT asset_type: Endpoint +atomic_guid: + - 5f864a3f-8ce9-45c0-812c-bdf7d8aeacc3 mitre_attack_id: - T1007 product: diff --git a/detections/endpoint/windows_network_share_interaction_via_net.yml b/detections/endpoint/windows_network_share_interaction_via_net.yml index 31f9444cb5e..dc8554eb1be 100644 --- a/detections/endpoint/windows_network_share_interaction_via_net.yml +++ b/detections/endpoint/windows_network_share_interaction_via_net.yml @@ -2,7 +2,7 @@ name: Windows Network Share Interaction Via Net id: e51fbdb0-0be0-474f-92ea-d289f71a695e version: 7 creation_date: '2024-07-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Dean Luxton status: production type: Hunting @@ -36,13 +36,16 @@ how_to_implement: The detection is based on data originating from either Endpoin known_false_positives: Administrators or power users may use this command. Additional filters needs to be applied. references: - https://attack.mitre.org/techniques/T1135/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml#L79 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1021.002/T1021.002.yaml#L5 analytic_story: - Active Directory Discovery - Active Directory Privilege Escalation - Network Discovery asset_type: Endpoint atomic_guid: - - ab39a04f-0c93-4540-9ff2-83f862c385ae + - 20f1097d-81c1-405c-8380-32174d493bbb + - 3386975b-367a-4fbb-9d77-4dcf3639ffd3 mitre_attack_id: - T1135 - T1039 diff --git a/detections/endpoint/windows_network_sniffing_tool_executed.yml b/detections/endpoint/windows_network_sniffing_tool_executed.yml index 66ede70c619..c2688a50b95 100644 --- a/detections/endpoint/windows_network_sniffing_tool_executed.yml +++ b/detections/endpoint/windows_network_sniffing_tool_executed.yml @@ -2,7 +2,7 @@ name: Windows Network Sniffing Tool Executed id: 0c594353-e12d-4867-92f6-2a1b8a1faf5f version: 1 creation_date: '2026-07-30' -modification_date: '2026-07-30' +modification_date: '2026-10-02' author: Raven Tait, Splunk status: production type: Anomaly @@ -51,6 +51,8 @@ known_false_positives: |- Legitimate network administrators and security teams may use these tools for authorized network monitoring and troubleshooting. Filter based on approved software inventory and known administrative activity. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1040/T1040.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml#L86 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1040/T1040.yaml#L154 drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -80,6 +82,9 @@ analytic_story: - Windows Discovery Techniques - Network Discovery asset_type: Endpoint +atomic_guid: + - a5b2f6a0-24b4-493e-9590-c699f75723ca + - c67ba807-f48b-446e-b955-e4928cd1bf91 mitre_attack_id: - T1040 product: diff --git a/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml b/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml index 7f45ca027ab..428bde53f8e 100644 --- a/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml +++ b/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml @@ -2,7 +2,7 @@ name: Windows New Custom Security Descriptor Set On EventLog Channel id: c0e5dd5a-2117-41d5-a04c-82a762a86a38 version: 9 creation_date: '2023-01-18' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: No false positives have been identified at this time. a l references: - https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/set-event-log-security-locally-or-via-group-policy - https://attack.mitre.org/techniques/T1562/002/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L192 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -38,6 +39,8 @@ analytic_story: - LockBit Ransomware - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint +atomic_guid: + - a0cb81f8-44d0-4ac4-a8f3-c5c7f43a12c1 mitre_attack_id: - T1685.001 product: diff --git a/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml b/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml index 34dff0237d2..e8905ea4a08 100644 --- a/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml +++ b/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml @@ -2,7 +2,7 @@ name: Windows New EventLog ChannelAccess Registry Value Set id: 16eb11bc-ef42-42e8-9d0c-d21e0fa15725 version: 8 creation_date: '2024-12-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: False positives may be triggered from newly installed eve references: - https://web.archive.org/web/20220710181255/https://blog.minerva-labs.com/lockbit-3.0-aka-lockbit-black-is-here-with-a-new-icon-new-ransom-note-new-wallpaper-but-less-evasiveness - https://attack.mitre.org/techniques/T1562/002/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L170 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -38,6 +39,8 @@ analytic_story: - LockBit Ransomware - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint +atomic_guid: + - 85e6eff8-3ed4-4e03-ae50-aa6a404898a5 mitre_attack_id: - T1685.001 product: diff --git a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml index 02f70368d58..0f8ad3b931f 100644 --- a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml +++ b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml @@ -1,8 +1,8 @@ name: Windows Ngrok Reverse Proxy Usage id: e2549f2c-0aef-408a-b0c1-e0f270623436 -version: 13 +version: 14 creation_date: '2022-11-16' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -13,7 +13,7 @@ data_source: - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process_name=ngrok.exe Processes.process IN ("*start*", "*--config*","*http*","*authtoken*", "*http*", "*tcp*") + WHERE Processes.process_name=ngrok.exe Processes.process IN ("*start*", "*--config*","*http*","*authtoken*", "*tcp*") BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path diff --git a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml index 3d410e82b46..7e4a09118f1 100644 --- a/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml +++ b/detections/endpoint/windows_nirsoft_tool_bundle_file_created.yml @@ -1,14 +1,13 @@ name: Windows NirSoft Tool Bundle File Created id: a2c8e8f8-18d6-4ad4-acf4-f58903bebe41 -version: 5 +version: 6 creation_date: '2025-10-24' -modification_date: '2026-05-13' -author: Nasreddine Bencherchali, Splunk +modification_date: '2026-10-01' +author: Nasreddine Bencherchali, Onur Mustafa Erdogan, Splunk status: production type: Anomaly description: | - The following analytic detects the creation of files associated with the NirSoft - tool bundles on Windows endpoints. + The following analytic detects the creation of files associated with the NirSoft tool bundles on Windows endpoints. NirSoft is a well-known provider of free, portable utilities that can be used for various system and network tasks. However, threat actors often leverage these tools for malicious purposes, such as credential harvesting, network reconnaissance, and data exfiltration. The detection focuses on the creation of specific NirSoft tool bundle files, which may indicate that an attacker is preparing to use these utilities on a compromised system. Security teams should investigate any instances of these files being created, especially if they are found in unexpected locations or on systems that should not be using such tools. @@ -20,23 +19,17 @@ search: | min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Filesystem where + FROM datamodel=Endpoint.Filesystem WHERE ``` Increase coverage by adding additional Nirsoft tool bundle or tool filenames ``` + [ + | inputlookup nirsoft_utilities_lookup + | search original_file_name = "*.zip" + | table original_file_name + | rename original_file_name as Filesystem.file_name + ] - Filesystem.file_name IN ( - "brtools.zip", - "mailpv.zip", - "networktools.zip", - "passreccommandline.zip", - "passrecenc.zip", - "progtools.zip", - "rdpv.zip", - "systools.zip", - "webbrowserpassview.zip" - ) - - by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time + BY Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product @@ -71,7 +64,12 @@ intermediate_findings: - field: dest type: system score: 20 - message: NirSoft tool bundle file $file_name$ created on host $dest$ + message: NirSoft tool bundle file [$file_name$] created on host [$dest$]. +threat_objects: + - field: file_name + type: file_name + - field: file_path + type: file_path analytic_story: - Unusual Processes - Data Destruction @@ -88,7 +86,7 @@ security_domain: endpoint tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/nirsoft_tooling/nirsoft_file_bundle_created.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1588.002/nirsoft_tooling/nirsoft_file_bundle_created_new.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index 5900bb891c8..5d5dd6628d8 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -1,47 +1,81 @@ name: Windows NirSoft Utilities id: 5b2f4596-7d4c-11ec-88a7-acde48001122 -version: 10 +version: 12 creation_date: '2022-01-24' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production -type: Hunting +type: Anomaly description: | The following analytic identifies the execution of commonly used NirSoft utilities on Windows systems. - It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution details such as process name, parent process, and command-line arguments. This activity is significant for a SOC because NirSoft utilities, while legitimate, can be used by adversaries for malicious purposes like credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further system compromise. Note that this search does not use a where clause to filter out known benign paths, as NirSoft utilities can be executed from various locations. This might hinder performance in environments with high data volumes. Apply additional filtering as necessary to enhance this. data_source: - Sysmon EventID 1 - - Windows Event Log Security 4688 - - CrowdStrike ProcessRollup2 search: | - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + [ + | inputlookup nirsoft_utilities_lookup + | search original_file_name=*.exe + | table original_file_name + | rename original_file_name as Processes.original_file_name + ] + + BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + | `drop_dm_object_name("Processes")` + + | lookup local=t nirsoft_utilities_lookup original_file_name OUTPUT description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile - | search nirsoftFile=true | `windows_nirsoft_utilities_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +how_to_implement: |- + To successfully implement this search, ingest process creation events from your endpoints and normalize them to the Processes node of the Endpoint data model using the Splunk Common Information Model (CIM). + Ensure the normalized events populate the original_file_name field, which this search uses to identify NirSoft utilities. Supported sources might include Sysmon and CrowdStrike ProcessRollup2 when mapped to the data model. known_false_positives: False positives may be present. Filtering may be required before setting to alert. references: - https://www.cisa.gov/uscert/ncas/alerts/TA18-201A - http://www.nirsoft.net/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L623 +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: NirSoft tool [$process_name$] was executed on host [$dest$] with Command Line [$process$]. This utility [$description$]. +threat_objects: + - field: process_name + type: process_name analytic_story: - Data Destruction - WhisperGate + - Unusual Processes asset_type: Endpoint +atomic_guid: + - 81ce22fd-9612-4154-918e-8a1f285d214d mitre_attack_id: - T1588.002 product: diff --git a/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml b/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml new file mode 100644 index 00000000000..12620b32bc1 --- /dev/null +++ b/detections/endpoint/windows_node_exe_executing_js_script_in_immediate_folder.yml @@ -0,0 +1,122 @@ +name: Windows Node.exe Executing JS Script In Immediate Folder +id: b22af614-2e48-4d43-aea2-93017500ef0c +version: 1 +creation_date: '2026-09-16' +modification_date: '2026-09-16' +author: Onur Mustafa Erdogan, Splunk +status: production +type: TTP +description: |- + The following analytic identifies `node.exe` directly executing a single `.js` script located in the same directory it was launched from, where that directory is an unusual location such as a user profile, PerfLogs, ProgramData, or Temp folder. + Legitimate Node.js application, module, and package manager directories are excluded. + This pattern is commonly associated with malware loaders and second-stage payloads that leverage the Node.js runtime to execute JavaScript outside of a typical development or application context. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + ( + Processes.process_name="node.exe" + OR + Processes.original_file_name="node.exe" + ) + Processes.process="*js" + Processes.process_path IN ( + "*:\\PerfLogs\\*", + "*:\\ProgramData\\*", + "*:\\Temp\\*", + "*:\\Users\\*" + ) + ( + NOT Processes.process_path IN ( + "*\\AppData\\Roaming\\*", + "*\\node\\*", + "*\\nodejs\\*", + "*\\nvm\\*" + ) + AND + ( + NOT Processes.process_path = "*\\AppData\\Local\\*" + OR + Processes.process_path = "*\\AppData\\Local\\Temp\\*" + ) + ) + + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id + Processes.process_current_directory Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | eval process_args=split(process, " ") + | eval script_name=mvindex(process_args, 1) + | eval process_args_count=mvcount(process_args) + | regex script_name="(?i)^[^\\\/]+\.js$" + | where like(process_path, process_current_directory.process_name) AND process_args_count=2 + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_node_exe_executing_js_script_in_immediate_folder_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are + designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this + search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must + ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons + that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. + Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate custom Node.js tooling or utility scripts that are intentionally placed and executed from a user profile, PerfLogs, ProgramData, or Temp directory may trigger this analytic. +references: + - https://www.bluevoyant.com/blog/clickfix-to-nodejs-rat + - https://www.microsoft.com/en-us/security/blog/2026/05/20/mini-shai-hulud-compromised-antv-npm-packages-enable-ci-cd-credential-theft/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +finding: + title: Node.exe executed script [$script_name$] from an unusual directory on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: process + type: process + - field: script_name + type: file_name +analytic_story: + - Compromised Windows Host + - Fake CAPTCHA Campaigns + - Windows Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059.007 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.007/node_execute_js_script/node_execute_js_script.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_non_system_account_targeting_lsass.yml b/detections/endpoint/windows_non_system_account_targeting_lsass.yml index 9b2389e4f62..902254e559a 100644 --- a/detections/endpoint/windows_non_system_account_targeting_lsass.yml +++ b/detections/endpoint/windows_non_system_account_targeting_lsass.yml @@ -2,7 +2,7 @@ name: Windows Non-System Account Targeting Lsass id: b1ce9a72-73cf-11ec-981b-acde48001122 version: 14 creation_date: '2022-01-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -18,6 +18,7 @@ references: - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html - https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1 - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$user_id$" and "$dest$" search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' @@ -48,6 +49,8 @@ analytic_story: - Lokibot - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/windows_non_system_process_querying_definition_update.yml b/detections/endpoint/windows_non_system_process_querying_definition_update.yml index f2a81e01160..b428d437a8c 100644 --- a/detections/endpoint/windows_non_system_process_querying_definition_update.yml +++ b/detections/endpoint/windows_non_system_process_querying_definition_update.yml @@ -1,13 +1,14 @@ name: Windows Non-System Process Querying Definition Update id: 9d375cfd-c9a5-48ff-b875-9bcaf6b63265 -version: 1 +version: 2 creation_date: '2026-04-27' -modification_date: '2026-04-27' +modification_date: '2026-10-08' author: Raven Tait, Splunk status: production type: Anomaly description: |- - Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component. BlueHammer utilizes these definition updates as part of its exploit chain. + Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component. + BlueHammer utilizes these definition updates as part of its exploit chain. data_source: - Sysmon EventID 22 search: |- @@ -15,16 +16,27 @@ search: |- EventID="22" QueryName="*definitionupdates.microsoft.com*" NOT Image IN ( - "*:\\Program Files\\Microsoft Office\\*", - "*:\\Program Files\\Windows Defender\\*", - "*:\\ProgramData\\Microsoft\\Windows Defender\\*", - "*:\\Windows\\System32\\*", - "*:\\Windows\\SysWOW64\\*" + "C:\\Program Files\\Microsoft Office\\*", + "C:\\Program Files\\Windows Defender\\*", + "C:\\ProgramData\\Microsoft\\Windows Defender\\*", + "C:\\Windows\\System32\\*", + "C:\\Windows\\SysWOW64\\*" ) - | stats count min(_time) as firstTime max(_time) as lastTime BY answer answer_count dvc Computer process_exec process_guid process_name query query_count reply_code_id signature signature_id src user_id vendor_product QueryName QueryResults QueryStatus + + | rename Computer as dest, + Image as process_path + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by src dest answer answer_count + process_path process_name process_exec process_guid + query query_count QueryResults record_type reply_code_id + signature signature_id user_id vendor_product + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | rename Computer as dest + | `windows_non_system_process_querying_definition_update_filter` how_to_implement: |- The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. @@ -46,7 +58,7 @@ intermediate_findings: - field: dest type: system score: 20 - message: Non-System process $Image$ queried Windows Defender Definition Updates domain $QueryName$ on $dest$. + message: Non-System process [$process_path$] queried Windows Defender Definition Updates domain [$query$] on [$dest$]. threat_objects: - field: process_name type: process_name diff --git a/detections/endpoint/windows_odbcconf_hunting.yml b/detections/endpoint/windows_odbcconf_hunting.yml index c6541e4295d..600ac7ab14b 100644 --- a/detections/endpoint/windows_odbcconf_hunting.yml +++ b/detections/endpoint/windows_odbcconf_hunting.yml @@ -2,7 +2,7 @@ name: Windows Odbcconf Hunting id: 0562ad4b-fdaa-4882-b12f-7b8e0034cd72 version: 9 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Hunting @@ -30,9 +30,14 @@ known_false_positives: False positives will be present as this is meant to assis references: - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.008/T1218.008.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.008/T1218.008.yaml#L29 analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - 2430498b-06c0-4b92-a448-8ad263c388e2 + - 331ce274-f9c9-440b-9f8c-a1006e1fce0b mitre_attack_id: - T1218.008 product: diff --git a/detections/endpoint/windows_odbcconf_load_dll.yml b/detections/endpoint/windows_odbcconf_load_dll.yml index c1e6eb06967..73a269d2df5 100644 --- a/detections/endpoint/windows_odbcconf_load_dll.yml +++ b/detections/endpoint/windows_odbcconf_load_dll.yml @@ -2,7 +2,7 @@ name: Windows Odbcconf Load DLL id: 141e7fca-a9f0-40fd-a539-9aac8be41f1b version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: False positives may be present and filtering may need to references: - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.008/T1218.008.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - 2430498b-06c0-4b92-a448-8ad263c388e2 mitre_attack_id: - T1218.008 product: diff --git a/detections/endpoint/windows_odbcconf_load_response_file.yml b/detections/endpoint/windows_odbcconf_load_response_file.yml index cfb0efbea35..9a9028cbaf0 100644 --- a/detections/endpoint/windows_odbcconf_load_response_file.yml +++ b/detections/endpoint/windows_odbcconf_load_response_file.yml @@ -2,7 +2,7 @@ name: Windows Odbcconf Load Response File id: 1acafff9-1347-4b40-abae-f35aa4ba85c1 version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: False positives may be present and filtering may need to references: - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.008/T1218.008.yaml#L29 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - 331ce274-f9c9-440b-9f8c-a1006e1fce0b mitre_attack_id: - T1218.008 product: diff --git a/detections/endpoint/windows_outlook_webview_registry_modification.yml b/detections/endpoint/windows_outlook_webview_registry_modification.yml index 8793cec91b5..775ca988648 100644 --- a/detections/endpoint/windows_outlook_webview_registry_modification.yml +++ b/detections/endpoint/windows_outlook_webview_registry_modification.yml @@ -2,7 +2,7 @@ name: Windows Outlook WebView Registry Modification id: 6e1ad5d4-d9af-496a-96ec-f31c11cd09f2 version: 9 creation_date: '2024-07-30' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: False positives may occur if legitimate Outlook processes references: - https://gist.github.com/MHaggis/c6318acde2e2f691b550e3a491f49ff1 - https://github.com/trustedsec/specula/wiki + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1137.004/T1137.004.yaml#L6 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,8 @@ intermediate_findings: analytic_story: - Suspicious Windows Registry Activities asset_type: Endpoint +atomic_guid: + - 7a91ad51-e6d2-4d43-9471-f26362f5738e mitre_attack_id: - T1112 product: diff --git a/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml b/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml index a287671fc93..d12ab3f3c17 100644 --- a/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml +++ b/detections/endpoint/windows_parent_pid_spoofing_with_explorer.yml @@ -2,7 +2,7 @@ name: Windows Parent PID Spoofing with Explorer id: 17f8f69c-5d00-4c88-9c6f-493bbdef20a1 version: 13 creation_date: '2022-05-30' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: No false positives have been identified at this time. references: - https://x.com/CyberRaiju/status/1273597319322058752?s=20 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1134.004/T1134.004.yaml#L90 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -48,6 +49,8 @@ analytic_story: - Compromised Windows Host - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - cbbff285-9051-444a-9d17-c07cd2d230eb mitre_attack_id: - T1134.004 product: diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml index 2b3d0e2ab15..c4dc611bb05 100644 --- a/detections/endpoint/windows_possible_credential_dumping.yml +++ b/detections/endpoint/windows_possible_credential_dumping.yml @@ -1,17 +1,58 @@ name: Windows Possible Credential Dumping id: e4723b92-7266-11ec-af45-acde48001122 -version: 14 +version: 15 creation_date: '2022-01-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production -type: TTP -description: The following analytic detects potential credential dumping by identifying specific GrantedAccess permission requests and CallTrace DLLs targeting the LSASS process. It leverages Sysmon EventCode 10 logs, focusing on access requests to lsass.exe and call traces involving debug and native API DLLs like dbgcore.dll, dbghelp.dll, and ntdll.dll. This activity is significant as credential dumping can lead to unauthorized access to sensitive credentials. If confirmed malicious, attackers could gain elevated privileges and persist within the environment, posing a severe security risk. +type: Anomaly +description: |- + The following analytic detects possible credential dumping by identifying suspicious process access to LSASS with credential-dumping-related call traces. + It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_QUERY_LIMITED_INFORMATION (0x1000) and PROCESS_DUP_HANDLE (0x40). data_source: - Sysmon EventID 10 -search: '`sysmon` EventCode=10 TargetImage=*\\lsass.exe granted_access IN ("0x01000", "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*", "*kernelbase.dll*", "*kernel32.dll*") NOT SourceUser IN ("NT AUTHORITY\\SYSTEM", "NT AUTHORITY\\NETWORK SERVICE") | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_possible_credential_dumping_filter`' +search: |- + `sysmon` + EventCode=10 + TargetImage=*\\lsass.exe + CallTrace IN ( + "*dbgcore.dll*", + "*dbghelp.dll*", + "*kernel32.dll*", + "*kernelbase.dll*", + "*ntdll.dll*" + ) + NOT SourceUser IN ( + "NT AUTHORITY\\SYSTEM", + "NT AUTHORITY\\NETWORK SERVICE" + ) + + ``` + We looking for a value of PROCESS_QUERY_LIMITED_INFORMATION (0x1000) or PROCESS_DUP_HANDLE (0x40). + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_QUERY_LIMITED_INFORMATION = 4096 + | eval PROCESS_DUP_HANDLE = 64 + | eval query_limited_set = bit_and(g_access_decimal, PROCESS_QUERY_LIMITED_INFORMATION) + | eval duplicate_handle_set = bit_and(g_access_decimal, PROCESS_DUP_HANDLE) + | where query_limited_set == PROCESS_QUERY_LIMITED_INFORMATION + OR duplicate_handle_set == PROCESS_DUP_HANDLE + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_possible_credential_dumping_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required. -known_false_positives: False positives will occur based on GrantedAccess 0x1010 and 0x1400, filter based on source image as needed or remove them. Concern is Cobalt Strike usage of Mimikatz will generate 0x1010 initially, but later be caught. +known_false_positives: False positives will occur when legitimate tools request query-limited or duplicate-handle access to LSASS. Filter based on source image as needed. Cobalt Strike usage of Mimikatz may generate this activity. references: - https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump @@ -19,6 +60,7 @@ references: - https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1 - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/Windows/TestHarnesses/T1003.001_DumpLSASS/DumpLSASS.ps1 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5 drilldown_searches: - name: View the detection results for - "$user_id$" and "$dest$" search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' @@ -28,21 +70,15 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: A process, $SourceImage$, has loaded $TargetImage$ that are typically related to credential dumping on $dest$. Review for further details. - entity: - field: user_id - type: user - score: 50 intermediate_findings: entities: - field: dest type: system - score: 50 - message: A process, $SourceImage$, has loaded $TargetImage$ that are typically related to credential dumping on $dest$. Review for further details. + score: 20 + message: The process [$SourceImage$] requested suspicious access mask [$granted_access$] to [$TargetImage$] on [$dest$], which may indicate credential dumping. threat_objects: - field: SourceImage - type: process + type: file_path analytic_story: - Detect Zerologon Attack - CISA AA22-264A @@ -52,6 +88,8 @@ analytic_story: - CISA AA22-257A - Scattered Lapsus$ Hunters asset_type: Endpoint +atomic_guid: + - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 mitre_attack_id: - T1003.001 product: diff --git a/detections/endpoint/windows_powershell_disable_http_logging.yml b/detections/endpoint/windows_powershell_disable_http_logging.yml index 13be42e2d9b..47ae84c3fc3 100644 --- a/detections/endpoint/windows_powershell_disable_http_logging.yml +++ b/detections/endpoint/windows_powershell_disable_http_logging.yml @@ -2,7 +2,7 @@ name: Windows PowerShell Disable HTTP Logging id: 27958de0-2857-43ca-9d4c-b255cf59dcab version: 13 creation_date: '2022-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -28,6 +28,7 @@ references: - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/ - https://www.secureworks.com/research/bronze-union + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685.001/T1685.001.yaml#L27 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -47,6 +48,8 @@ analytic_story: - IIS Components - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - a957fb0f-1e85-49b2-a211-413366784b1e mitre_attack_id: - T1505.004 - T1685.001 diff --git a/detections/endpoint/windows_powershell_export_certificate.yml b/detections/endpoint/windows_powershell_export_certificate.yml index 1ca80887919..11d6e2368d3 100644 --- a/detections/endpoint/windows_powershell_export_certificate.yml +++ b/detections/endpoint/windows_powershell_export_certificate.yml @@ -2,7 +2,7 @@ name: Windows PowerShell Export Certificate id: 5e38ded4-c964-41f4-8cb6-4a1a53c6929f version: 12 creation_date: '2023-02-03' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -27,6 +27,7 @@ known_false_positives: It is possible administrators or scripts may run these co references: - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj - https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1649/T1649.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +46,8 @@ intermediate_findings: analytic_story: - Windows Certificate Services asset_type: Endpoint +atomic_guid: + - eb121494-82d1-4148-9e2b-e624e03fbf3d mitre_attack_id: - T1552.004 - T1649 diff --git a/detections/endpoint/windows_powershell_export_pfxcertificate.yml b/detections/endpoint/windows_powershell_export_pfxcertificate.yml index 891c3a563f7..d497c1abb9e 100644 --- a/detections/endpoint/windows_powershell_export_pfxcertificate.yml +++ b/detections/endpoint/windows_powershell_export_pfxcertificate.yml @@ -2,7 +2,7 @@ name: Windows PowerShell Export PfxCertificate id: ed06725f-6da6-439f-9dcc-ab30e891297c version: 14 creation_date: '2023-02-03' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -26,6 +26,7 @@ known_false_positives: It is possible administrators or scripts may run these co references: - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L325 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -46,6 +47,8 @@ analytic_story: - Windows Certificate Services - Water Gamayun asset_type: Endpoint +atomic_guid: + - 7617f689-bbd8-44bc-adcd-6f8968897848 mitre_attack_id: - T1552.004 - T1649 diff --git a/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml b/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml index d1d0f0aa91c..e023cb7ee97 100644 --- a/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml +++ b/detections/endpoint/windows_powershell_get_ciminstance_remote_computer.yml @@ -2,7 +2,7 @@ name: Windows PowerShell Get CIMInstance Remote Computer id: d8c972eb-ed84-431a-8869-ca4bd83257d1 version: 11 creation_date: '2023-03-27' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -25,6 +25,7 @@ how_to_implement: To successfully implement this analytic, you will need to enab known_false_positives: This is meant to be a low risk RBA anomaly analytic or to be used for hunting. Enable this with a low risk score and let it generate risk in the risk index. references: - https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/get-ciminstance?view=powershell-7.3 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L1104 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -43,6 +44,8 @@ intermediate_findings: analytic_story: - Active Directory Lateral Movement asset_type: Endpoint +atomic_guid: + - ac494fe5-81a4-4897-af42-e774cf005ecb mitre_attack_id: - T1059.001 product: diff --git a/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml b/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml index 82cf168718d..e81a5f975ef 100644 --- a/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml +++ b/detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml @@ -2,7 +2,7 @@ name: Windows PowerShell IIS Components WebGlobalModule Usage id: 33fc9f6f-0ce7-4696-924e-a69ec61a3d57 version: 13 creation_date: '2022-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ references: - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/ - https://www.secureworks.com/research/bronze-union - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1505.004/T1505.004.yaml#L39 drilldown_searches: - name: View the detection results for - "$Computer$" search: '%original_detection_search% | search Computer = "$Computer$"' @@ -49,6 +50,8 @@ analytic_story: - GhostRedirector IIS Module and Rungan Backdoor - IIS Components asset_type: Endpoint +atomic_guid: + - cc3381fb-4bd0-405c-a8e4-6cacfac3b06c mitre_attack_id: - T1505.004 product: diff --git a/detections/endpoint/windows_powershell_process_with_malicious_string.yml b/detections/endpoint/windows_powershell_process_with_malicious_string.yml index b9e7b2e5fa3..3093678429b 100644 --- a/detections/endpoint/windows_powershell_process_with_malicious_string.yml +++ b/detections/endpoint/windows_powershell_process_with_malicious_string.yml @@ -1,8 +1,8 @@ name: Windows PowerShell Process With Malicious String id: 5df35d50-e1a3-4a52-a337-92e69d9b1b8a -version: 9 +version: 10 creation_date: '2025-01-13' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP @@ -24,7 +24,7 @@ search: |- | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup malicious_powershell_strings command as process + | lookup local=t malicious_powershell_strings command as process | where isnotnull(match) | `windows_powershell_process_with_malicious_string_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. diff --git a/detections/endpoint/windows_powershell_scheduletask.yml b/detections/endpoint/windows_powershell_scheduletask.yml index dc161addefa..2a5eed3da25 100644 --- a/detections/endpoint/windows_powershell_scheduletask.yml +++ b/detections/endpoint/windows_powershell_scheduletask.yml @@ -2,7 +2,7 @@ name: Windows PowerShell ScheduleTask id: ddf82fcb-e9ee-40e3-8712-a50b5bf323fc version: 14 creation_date: '2023-06-12' -modification_date: '2026-07-20' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -26,6 +26,7 @@ known_false_positives: Benign administrative tasks can also trigger alerts, nece references: - https://learn.microsoft.com/en-us/powershell/module/scheduledtasks/?view=windowsserver2022-ps - https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1053.005/T1053.005.yaml#L78 drilldown_searches: - name: View the detection results for - "$Computer$" and "$user_id$" search: '%original_detection_search% | search Computer = "$Computer$" user_id = "$user_id$"' diff --git a/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml b/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml index bda2aaccd74..8556e4f6761 100644 --- a/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml +++ b/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml @@ -1,15 +1,15 @@ name: Windows PowerShell Script Block With Malicious String id: 0f09cedd-10f1-4b9f-bdea-7a8b06ea575d -version: 7 +version: 8 creation_date: '2025-01-13' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP description: The following analytic detects the execution of multiple offensive toolkits and commands by leveraging PowerShell Script Block Logging (EventCode=4104). This method captures and logs the full command sent to PowerShell, allowing for the identification of suspicious activities including several well-known tools used for credential theft, lateral movement, and persistence. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the environment. data_source: - Powershell Script Block Logging 4104 -search: '`powershell` ScriptBlockText=* EventCode=4104 | stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command values(Guid) as Guid values(Opcode) as Opcode values(Name) as Name values(Path) as Path values(ProcessID) as ProcessID values(ScriptBlockId) as ScriptBlockId values(ScriptBlockText) as ScriptBlockText by dest signature signature_id user_id vendor_product | eval command = mvjoin(command,"\n") | lookup malicious_powershell_strings command | where isnotnull(match) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_script_block_with_malicious_string_filter`' +search: '`powershell` ScriptBlockText=* EventCode=4104 | stats count min(_time) as firstTime max(_time) as lastTime list(ScriptBlockText) as command values(Guid) as Guid values(Opcode) as Opcode values(Name) as Name values(Path) as Path values(ProcessID) as ProcessID values(ScriptBlockId) as ScriptBlockId values(ScriptBlockText) as ScriptBlockText by dest signature signature_id user_id vendor_product | eval command = mvjoin(command,"\n") | lookup local=t malicious_powershell_strings command | where isnotnull(match) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_script_block_with_malicious_string_filter`' how_to_implement: The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. known_false_positives: No false positives have been identified at this time. commands with overlap. references: diff --git a/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml b/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml index cbff0e938df..750c9d8558b 100644 --- a/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml +++ b/detections/endpoint/windows_powerview_kerberos_service_ticket_request.yml @@ -2,7 +2,7 @@ name: Windows PowerView Kerberos Service Ticket Request id: 970455a1-4ac2-47e1-a9a5-9e75443ddcb9 version: 11 creation_date: '2022-06-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Gowthamaraj Rajendran, Splunk status: production type: TTP @@ -29,6 +29,7 @@ references: - https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1 - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting - https://attack.mitre.org/techniques/T1558/003 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1558.003/T1558.003.yaml#L129 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -48,6 +49,8 @@ analytic_story: - Active Directory Kerberos Attacks - Rhysida Ransomware asset_type: Endpoint +atomic_guid: + - 902f4ed2-1aba-4133-90f2-cff6d299d6da mitre_attack_id: - T1558.003 product: diff --git a/detections/endpoint/windows_private_keys_discovery.yml b/detections/endpoint/windows_private_keys_discovery.yml index 987fe3bc56a..b55f95f5e91 100644 --- a/detections/endpoint/windows_private_keys_discovery.yml +++ b/detections/endpoint/windows_private_keys_discovery.yml @@ -1,36 +1,71 @@ name: Windows Private Keys Discovery id: 5c1c2877-06c0-40ee-a1a2-db71f1372b5b -version: 12 +version: 13 creation_date: '2022-12-06' -modification_date: '2026-05-13' +modification_date: '2026-08-31' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic identifies processes that retrieve information related to private key files, often used by post-exploitation tools like winpeas. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that search for private key certificates. This activity is significant as it indicates potential attempts to locate insecurely stored credentials, which adversaries can exploit for privilege escalation, persistence, or remote service authentication. If confirmed malicious, this behavior could allow attackers to access sensitive information, escalate privileges, or maintain persistence within the compromised environment. +description: |- + The following analytic identifies processes that retrieve information related to private key files, often used by post-exploitation tools like winpeas. + This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that search for private key certificates. + This activity is significant as it indicates potential attempts to locate insecurely stored credentials, which adversaries can exploit for privilege escalation, persistence, or remote service authentication. + If confirmed malicious, this behavior could allow attackers to access sensitive information, escalate privileges, or maintain persistence within the compromised environment. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE Processes.process = "*dir *" - OR - Processes.process = "*findstr*" - AND - Processes.process IN ( "*.rdg*", "*.gpg*", "*.pgp*", "*.p12*", "*.der*", "*.csr*", "*.cer*", "*.ovpn*", "*.key*", "*.ppk*", "*.p12*", "*.pem*", "*.pfx*", "*.p7b*", "*.asc*") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.process_name IN ( + "cmd.exe", + "findstr.exe", + "powershell.exe", + "pwsh.exe" + ) + Processes.process IN ( + "*.asc*", + "*.cer*", + "*.csr*", + "*.der*", + "*.gpg*", + "*.key*", + "*.ovpn*", + "*.p12*", + "*.p12*", + "*.p7b*", + "*.pem*", + "*.pfx*", + "*.pgp*", + "*.ppk*", + "*.rdg*" + ) + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + + | regex process="(?i)[^\.\-\_\$a-zA-Z](dir\s|findstr)" + | regex process="(?i)\.(?:rdg|gpg|pgp|p12|der|csr|cer|ovpn|key|ppk|p12|pem|pfx|p7b|asc)\b" + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_private_keys_discovery_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: No false positives have been identified at this time. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Very long command line arguments may contain these keywords in irrelevant sections of the code. references: - https://attack.mitre.org/techniques/T1552/004/ - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS @@ -49,7 +84,12 @@ intermediate_findings: - field: dest type: system score: 20 - message: a process with commandline $process$ that can retrieve information related to private keys on $dest$ + message: A process with commandline [$process$] that can retrieve information related to private keys was executed on [$dest$] +threat_objects: + - field: parent_process + type: process + - field: process + type: process analytic_story: - Windows Post-Exploitation - Prestige Ransomware diff --git a/detections/endpoint/windows_process_accessing_ironlanguages_repository_on_github.yml b/detections/endpoint/windows_process_accessing_ironlanguages_repository_on_github.yml new file mode 100644 index 00000000000..fa994a611a1 --- /dev/null +++ b/detections/endpoint/windows_process_accessing_ironlanguages_repository_on_github.yml @@ -0,0 +1,93 @@ +name: Windows Process Accessing IronLanguages Repository On GitHub +id: bcdc2543-8c33-44c8-a723-5b7b93e06788 +version: 1 +creation_date: '2026-09-16' +modification_date: '2026-09-16' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies a process command line referencing the IronLanguages GitHub repository, which hosts .NET implementation of popular scripting engines. + Adversaries have downloaded these .NET implementations to avoid getting detected by security controls while executing their payloads. + This activity is uncommon in typical enterprise environments outside of software development contexts. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + FROM datamodel=Endpoint.Processes WHERE + + Processes.process="*/ironlanguages/*" + Processes.process="*github.com*" + + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_process_accessing_ironlanguages_repository_on_github_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents + are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement + this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, + you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk + Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node + of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and + speed up the data modeling process. +known_false_positives: |- + Software developers or DevOps personnel may legitimately clone or download the IronPython repository from GitHub for development purposes. + Filter as needed based on known developer hosts or users in your environment. +references: + - https://packetwatch.com/resources/threat-profile/clickfix-abuses-finger-to-deliver-castleloader + - https://github.com/IronLanguages/ironpython3 +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: '0' +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: The Process [$process_name$] with the Command Line [$process$] accessed the IronLanguages GitHub repository on [$dest$]. +threat_objects: + - field: process + type: process +analytic_story: + - Compromised Windows Host + - Fake CAPTCHA Campaigns + - Ingress Tool Transfer + - Windows Post-Exploitation +asset_type: Endpoint +mitre_attack_id: + - T1059 + - T1105 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/ironlanguage_download/ironlanguage_download.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_process_execution_in_temp_dir.yml b/detections/endpoint/windows_process_execution_in_temp_dir.yml index 0f799e87ecd..3d7554e0a29 100644 --- a/detections/endpoint/windows_process_execution_in_temp_dir.yml +++ b/detections/endpoint/windows_process_execution_in_temp_dir.yml @@ -1,8 +1,8 @@ name: Windows Process Execution in Temp Dir id: f6fbe929-4187-4ba4-901e-8a34be838443 -version: 12 +version: 13 creation_date: '2021-05-07' -modification_date: '2026-06-08' +modification_date: '2026-09-01' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -37,7 +37,7 @@ intermediate_findings: message: Suspicious process $process_name$ running from temp directory- $process_path$ on host- $dest$ threat_objects: - field: process_path - type: process_name + type: file_path analytic_story: - AgentTesla - XWorm diff --git a/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml b/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml index a9958f0f9d7..0883c32e6b0 100644 --- a/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml +++ b/detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml @@ -1,12 +1,16 @@ name: Windows Process Injection into Commonly Abused Processes id: 1e1dedc6-f6f3-41a0-9dd7-a1245904fe75 -version: 8 +version: 9 creation_date: '2023-02-24' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: 0xC0FFEEEE, Github Community status: production type: Anomaly -description: The following analytic detects process injection into executables that are commonly abused using Sysmon EventCode 10. It identifies suspicious GrantedAccess requests (0x40 and 0x1fffff) to processes such as notepad.exe, wordpad.exe and calc.exe, excluding common system paths like System32, Syswow64, and Program Files. This behavior is often associated with the SliverC2 framework by BishopFox. Monitoring this activity is crucial as it may indicate an initial payload attempting to execute malicious code. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment. +description: |- + The following analytic detects potential process injection attempts into executables that are commonly abused leveraging Sysmon EventCode 10. + It identifies Access Mask requests (0x40 and 0x1fffff) to processes such as notepad.exe, wordpad.exe and calc.exe, excluding common system paths like System32, Syswow64, and Program Files. + This activity was associated with the SliverC2 framework by BishopFox. + Monitoring this activity may indicate an initial payload attempting to execute malicious code. data_source: - Sysmon EventID 10 search: |- @@ -16,11 +20,7 @@ search: |- "*\\backgroundtaskhost.exe", "*\\calc.exe", "*\\CalculatorApp.exe", - "*\\chrome.exe", "*\\dllhost.exe", - "*\\edge.exe", - "*\\firefox.exe", - "*\\lsass.exe", "*\\mspaint.exe", "*\\notepad.exe", "*\\regsvr32.exe", @@ -40,23 +40,32 @@ search: |- "*:\\Windows\\SysWOW64\\*" ) - GrantedAccess IN ( - "0x1f3fff", - "0x1fffff", - "0x40" - ) + ``` + Convert GrantedAccess from hexadecimal to decimal. The original access values represent PROCESS_DUP_HANDLE, modern full process access, and legacy full process access. + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_DUP_HANDLE = 64 + | eval PROCESS_ALL_ACCESS = 2097151 + | eval PROCESS_ALL_ACCESS_LEGACY = 2047999 + | eval duplicate_handle_set = bit_and(g_access_decimal, PROCESS_DUP_HANDLE) + | eval full_access_set = bit_and(g_access_decimal, PROCESS_ALL_ACCESS) + | eval legacy_full_access_set = bit_and(g_access_decimal, PROCESS_ALL_ACCESS_LEGACY) + | where duplicate_handle_set == PROCESS_DUP_HANDLE + OR full_access_set == PROCESS_ALL_ACCESS + OR legacy_full_access_set == PROCESS_ALL_ACCESS_LEGACY - | stats values(user) as user - min(_time) as firstTime - max(_time) as lastTime count - by dest user_id parent_process_name parent_process_guid - process_name process_guid process_id signature SourceImage - TargetImage GrantedAccess CallTrace + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product | eval CallTrace=split(CallTrace, "|") + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | table firstTime lastTime dest user_id parent_process_name parent_process_guid process_name process_guid process_id signature SourceImage TargetImage GrantedAccess CallTrace | `windows_process_injection_into_commonly_abused_processes_filter` how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: False positives may be present based on SourceImage paths, particularly those with a legitimate reason for accessing lsass.exe or regsvr32.exe. If removing the paths is important, realize svchost and many native binaries inject into processes consistently. Restrict or tune as needed. @@ -78,12 +87,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: An instance of $SourceImage$ injecting into $TargetImage$ was identified on endpoint $dest$. + message: The process [$SourceImage$] requested a potentially malicious process injection related access mask [$granted_access$] to [$TargetImage$] on [$dest$]. threat_objects: - field: SourceImage - type: process - - field: TargetImage - type: process + type: file_path analytic_story: - BishopFox Sliver Adversary Emulation Framework - Earth Alux diff --git a/detections/endpoint/windows_proxy_execution_of__net_utilities_via_scripts.yml b/detections/endpoint/windows_proxy_execution_of__net_utilities_via_scripts.yml index 96aadbd7434..c8fcafe4e29 100644 --- a/detections/endpoint/windows_proxy_execution_of__net_utilities_via_scripts.yml +++ b/detections/endpoint/windows_proxy_execution_of__net_utilities_via_scripts.yml @@ -1,8 +1,8 @@ name: Windows Proxy Execution of .NET Utilities via Scripts id: eb59cf01-1874-4d16-b7e4-54a6eb9b3118 -version: 2 +version: 3 creation_date: '2026-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -11,8 +11,6 @@ description: |- That pattern is consistent with adversaries using trusted .NET binaries as a proxy to run code while hiding execution behind script parents in low-trust folders, behavior associated with techniques such as signed binary proxy execution. data_source: - Sysmon EventID 1 - - Windows Event Log Security 4688 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/windows_proxy_via_netsh.yml b/detections/endpoint/windows_proxy_via_netsh.yml index 0f29361b67d..1d1515e80c4 100644 --- a/detections/endpoint/windows_proxy_via_netsh.yml +++ b/detections/endpoint/windows_proxy_via_netsh.yml @@ -2,7 +2,7 @@ name: Windows Proxy Via Netsh id: c137bfe8-6036-4cff-b77b-4e327dd0a1cf version: 11 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Some VPN applications are known to launch netsh.exe. Outside of these instances, it is unusual for an executable to launch netsh.exe and run commands. references: - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1090.001/T1090.001.yaml#L81 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' diff --git a/detections/endpoint/windows_proxy_via_registry.yml b/detections/endpoint/windows_proxy_via_registry.yml index 23e5d18f0e7..11bd729a263 100644 --- a/detections/endpoint/windows_proxy_via_registry.yml +++ b/detections/endpoint/windows_proxy_via_registry.yml @@ -2,7 +2,7 @@ name: Windows Proxy Via Registry id: 0270455b-1385-4579-9ac5-e77046c508ae version: 12 creation_date: '2023-05-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: No false positives have been identified at this time. references: - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1090.001/T1090.001.yaml#L81 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_pua_named_pipe.yml b/detections/endpoint/windows_pua_named_pipe.yml index bbcf80eff0a..68a592e092c 100644 --- a/detections/endpoint/windows_pua_named_pipe.yml +++ b/detections/endpoint/windows_pua_named_pipe.yml @@ -1,8 +1,8 @@ name: Windows PUA Named Pipe id: 95b11d20-e2c6-46a5-b526-8629f5f0860a -version: 5 +version: 6 creation_date: '2025-12-08' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: Anomaly @@ -38,7 +38,7 @@ search: | count by dest dvc process_exec process_guid process_id process_path signature signature_id vendor_product pipe_name user_id Image process_name - | lookup pua_named_pipes pua_pipe_name AS pipe_name OUTPUT tool, description + | lookup local=t pua_named_pipes pua_pipe_name AS pipe_name OUTPUT tool, description | where isnotnull(tool) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_registry_bootexecute_modification.yml b/detections/endpoint/windows_registry_bootexecute_modification.yml index 4e2d65a3570..c730c2797a7 100644 --- a/detections/endpoint/windows_registry_bootexecute_modification.yml +++ b/detections/endpoint/windows_registry_bootexecute_modification.yml @@ -2,7 +2,7 @@ name: Windows Registry BootExecute Modification id: eabbac3a-45aa-4659-920f-6b8cff383fb8 version: 12 creation_date: '2023-05-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Teoderick Contreras, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present and will need to be filtered. references: - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.001/T1547.001.yaml#L404 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -32,6 +33,8 @@ finding: analytic_story: - Windows BootKits asset_type: Endpoint +atomic_guid: + - 6e1666d5-3f2b-4b9a-80aa-f011322380d4 mitre_attack_id: - T1542 - T1547.001 diff --git a/detections/endpoint/windows_registry_certificate_added.yml b/detections/endpoint/windows_registry_certificate_added.yml index c1eb7a475bc..5cd9cd3a76f 100644 --- a/detections/endpoint/windows_registry_certificate_added.yml +++ b/detections/endpoint/windows_registry_certificate_added.yml @@ -2,7 +2,7 @@ name: Windows Registry Certificate Added id: 5ee98b2f-8b9e-457a-8bdc-dd41aaba9e87 version: 12 creation_date: '2022-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Teodeerick Contreras, Splunk status: production type: Anomaly @@ -15,6 +15,7 @@ known_false_positives: False positives will be limited to a legitimate business references: - https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec - https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1553.004 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1553.004/T1553.004.yaml#L116 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -34,6 +35,8 @@ analytic_story: - Windows Drivers - Windows Registry Abuse asset_type: Endpoint +atomic_guid: + - 76f49d86-5eb1-461a-a032-a480f86652f1 mitre_attack_id: - T1553.004 product: diff --git a/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml b/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml index d09656e8646..fb9e911b686 100644 --- a/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml +++ b/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml @@ -2,7 +2,7 @@ name: Windows Registry Dotnet ETW Disabled Via ENV Variable id: 55502381-5cce-491b-9277-7cb1d10bc0df version: 11 creation_date: '2021-10-07' -modification_date: '2026-08-05' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -42,6 +42,10 @@ references: - https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 - https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/ - https://attack.mitre.org/techniques/T1562/006/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1621 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1630 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1639 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml#L1649 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -67,6 +71,11 @@ analytic_story: - Windows Registry Abuse - Windows Defense Evasion Tactics asset_type: Endpoint +atomic_guid: + - fdac1f79-b833-4bab-b4a1-11b1ed676a4b + - b42c1f8c-399b-47ae-8fd8-763181395fee + - 110b4281-43fe-405f-a184-5d8eaf228ebf + - 4d61779d-be7f-425c-b560-0cafb2522911 mitre_attack_id: - T1685 product: diff --git a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml index f5d8d1aea6e..dcafbddd166 100644 --- a/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml +++ b/detections/endpoint/windows_registry_modification_for_safe_mode_persistence.yml @@ -2,7 +2,7 @@ name: Windows Registry Modification for Safe Mode Persistence id: c6149154-c9d8-11eb-9da7-acde48001122 version: 14 creation_date: '2022-03-31' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Michael Haag, Splunk status: production type: TTP @@ -17,6 +17,8 @@ references: - https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1112/T1112.md - https://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L533 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L548 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -37,6 +39,9 @@ analytic_story: - Windows Registry Abuse - Windows Drivers asset_type: Endpoint +atomic_guid: + - 1dd59fb3-1cb3-4828-805d-cf80b4c3bbb5 + - c173c948-65e5-499c-afbe-433722ed5bd4 mitre_attack_id: - T1547.001 product: diff --git a/detections/endpoint/windows_remote_create_service.yml b/detections/endpoint/windows_remote_create_service.yml index 644c9a52270..9feb7c268c2 100644 --- a/detections/endpoint/windows_remote_create_service.yml +++ b/detections/endpoint/windows_remote_create_service.yml @@ -2,7 +2,7 @@ name: Windows Remote Create Service id: 0dc44d03-8c00-482d-ba7c-796ba7ab18c9 version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -16,6 +16,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Note that false positives may occur, and filtering may be necessary, especially when it comes to remote service creation by administrators or software management utilities. references: - https://attack.mitre.org/techniques/T1543/003/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1543.003/T1543.003.yaml#L145 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -45,6 +46,8 @@ analytic_story: - CISA AA23-347A - BlackSuit Ransomware asset_type: Endpoint +atomic_guid: + - fb4151a2-db33-4f8c-b7f8-78ea8790f961 mitre_attack_id: - T1543.003 product: diff --git a/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml new file mode 100644 index 00000000000..1a57af52043 --- /dev/null +++ b/detections/endpoint/windows_renamed_command_interpreter_was_executed.yml @@ -0,0 +1,102 @@ +name: Windows Renamed Command Interpreter was Executed +id: 6f4611be-076e-4fa8-bc78-466588a71442 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies a Windows command interpreter process being executed where it's process name does not match it's original file name attribute. + Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code. +data_source: + - Sysmon EventID 1 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) AS firstTime + max(_time) AS lastTime + + FROM datamodel=Endpoint.Processes WHERE + + [ + | inputlookup renamed_windows_command_interpreter_binaries + | rename original_file_name as Processes.original_file_name + | table Processes.original_file_name + ] + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | eval process_name_norm=replace(lower(process_name), "\.exe$", ""), + original_file_name_norm=replace(lower(original_file_name), "\.exe$", "") + | where process_name_norm != original_file_name_norm + + | lookup local=t renamed_windows_command_interpreter_binaries original_file_name OUTPUT description + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_renamed_command_interpreter_was_executed_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents + are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement + this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, + you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk + Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node + of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and + speed up the data modeling process. +known_false_positives: |- + 3rd party software binaries sharing the same name as Windows command interpreter binaries may trigger false positives. +references: + - https://attack.mitre.org/techniques/T1036/ + - https://attack.mitre.org/techniques/T1036/003/ + - https://attack.mitre.org/techniques/T1059/ + - https://redcanary.com/threat-detection-report/techniques/rename-system-utilities/ +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Command Interpreter [$original_file_name$] was renamed as [$process_path$] and later executed on [$dest$] +threat_objects: + - field: process_path + type: file_path +analytic_story: + - Living Off The Land + - Masquerading - Rename System Utilities + - Suspicious Command-Line Executions + - Windows Defense Evasion Tactics + - Water Gamayun +asset_type: Endpoint +mitre_attack_id: + - T1036.003 + - T1059 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/renamed_command_interpreter/renamed_command_interpreter.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml new file mode 100644 index 00000000000..2a8a53caf77 --- /dev/null +++ b/detections/endpoint/windows_renamed_lolbas_binary_was_executed.yml @@ -0,0 +1,108 @@ +name: Windows Renamed LOLBAS Binary was Executed +id: 10c3850e-810d-41b4-a197-2f14d7883579 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Steven Dick, Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies a LOLBAS process being executed where it's process name does not match it's original file name attribute. + Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code. + The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. +data_source: + - Sysmon EventID 1 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) AS firstTime + max(_time) AS lastTime + + FROM datamodel=Endpoint.Processes WHERE + + [ + | inputlookup renamed_lolbas_binaries + | rename original_file_name as Processes.original_file_name + | table Processes.original_file_name + ] + + NOT Processes.process_name IN ( + "excelcnv.exe", + "installutil64.exe", + "protoc~1.exe", + "regwrite.exe", + "vzshadow.exe" + ) + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | eval process_name_norm=replace(lower(process_name), "\.exe$", ""), + original_file_name_norm=replace(lower(original_file_name), "\.exe$", "") + | where process_name_norm != original_file_name_norm + + | lookup local=t renamed_lolbas_binaries original_file_name OUTPUT description + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_renamed_lolbas_binary_was_executed_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents + are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement + this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, + you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk + Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node + of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and + speed up the data modeling process. +known_false_positives: |- + 3rd party software binaries sharing the same name as LOLBAS utilities may trigger false positives. +references: + - https://attack.mitre.org/techniques/T1036/ + - https://attack.mitre.org/techniques/T1036/003/ + - https://redcanary.com/threat-detection-report/techniques/rename-system-utilities/ +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: LOLBAS utility [$original_file_name$] was renamed as [$process_path$] and later executed on [$dest$] +threat_objects: + - field: process_path + type: file_path +analytic_story: + - Living Off The Land + - Masquerading - Rename System Utilities + - Windows Defense Evasion Tactics + - Water Gamayun +asset_type: Endpoint +mitre_attack_id: + - T1036.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/renamed_lolbas_binary/renamed_lolbas_binary.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml new file mode 100644 index 00000000000..640c8aa4ae3 --- /dev/null +++ b/detections/endpoint/windows_renamed_popular_3rd_party_software_was_executed.yml @@ -0,0 +1,100 @@ +name: Windows Renamed Popular 3rd Party Software was Executed +id: cf6713c7-ac6b-4963-83a6-39f24ed10aa8 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies a popular 3rd party software process being executed where it's process name does not match it's original file name attribute. + Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code. +data_source: + - Sysmon EventID 1 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) AS firstTime + max(_time) AS lastTime + + FROM datamodel=Endpoint.Processes WHERE + + [ + | inputlookup renamed_popular_3rd_party_binaries + | rename original_file_name as Processes.original_file_name + | table Processes.original_file_name + ] + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | eval process_name_norm=replace(lower(process_name), "\.exe$", ""), + original_file_name_norm=replace(lower(original_file_name), "\.exe$", "") + | where process_name_norm != original_file_name_norm + + | lookup local=t renamed_popular_3rd_party_binaries original_file_name OUTPUT description + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_renamed_popular_3rd_party_software_was_executed_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents + are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement + this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, + you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk + Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node + of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and + speed up the data modeling process. +known_false_positives: |- + 3rd party software binaries might have overlapping executable names. +references: + - https://attack.mitre.org/techniques/T1036/ + - https://attack.mitre.org/techniques/T1036/003/ + - https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/ + - https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/ +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Windows 3rd Party software [$original_file_name$] was renamed as [$process_path$] and later executed on [$dest$] +threat_objects: + - field: process_path + type: file_path +analytic_story: + - Living Off The Land + - Masquerading - Rename System Utilities + - Windows Defense Evasion Tactics + - Water Gamayun +asset_type: Endpoint +mitre_attack_id: + - T1036.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/renamed_3rd_party_software/renamed_3rd_party_software.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_renamed_python_binary_was_executed.yml b/detections/endpoint/windows_renamed_python_binary_was_executed.yml new file mode 100644 index 00000000000..e1b2655e8e2 --- /dev/null +++ b/detections/endpoint/windows_renamed_python_binary_was_executed.yml @@ -0,0 +1,103 @@ +name: Windows Renamed Python Binary was Executed +id: 6735153f-2da0-4eba-a428-288898613837 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Onur Mustafa Erdogan, Splunk +status: production +type: Anomaly +description: |- + The following analytic identifies a Python process being executed where it's process name does not match + it's original file name attribute. Processes that have been renamed and executed may be an indicator that + an adversary is attempting to evade defenses or execute malicious code. +data_source: + - Sysmon EventID 1 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) AS firstTime + max(_time) AS lastTime + + FROM datamodel=Endpoint.Processes WHERE + + Processes.original_file_name IN ( + "py*", + "python*", + "ipyw*" + ) + + NOT Processes.process_name IN ("dwagent.exe", "WinUtils.exe") + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path + Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + + | eval original_file_name=lower(original_file_name) + + | regex original_file_name="(?i)^(?:py|pyw|python|pythonw|python32|python64|pythonw32|pythonw64|ipyw32|ipyw64|python3|pythonw3|python3\.\w+|pythonw3\.\w+)\.exe$" + + | regex process_name!="(?i)^(?:py|pyw|pip|pip3|python|pythonw|python32|python64|pythonw32|pythonw64|ipyw32|ipyw64|python3|pythonw3|python3\.\w+|pythonw3\.\w+|pip3\.\w+|idle3\.\w+)\.exe$" + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_renamed_python_binary_was_executed_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents + are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement + this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, + you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk + Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node + of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and + speed up the data modeling process. +known_false_positives: Various Python implementations might have a different executable name, which could trigger false positives. +references: + - https://attack.mitre.org/techniques/T1036/ + - https://attack.mitre.org/techniques/T1036/003/ + - https://attack.mitre.org/techniques/T1059/006/ + - https://www.microsoft.com/en-us/security/blog/2026/02/05/clickfix-variant-crashfix-deploying-python-rat-trojan/ +drilldown_searches: + - name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: Python binary [$original_file_name$] was renamed as [$process_path$] and later executed on [$dest$] +threat_objects: + - field: process_name + type: process_name +analytic_story: + - Living Off The Land + - Masquerading - Rename System Utilities + - Windows Defense Evasion Tactics + - Water Gamayun +asset_type: Endpoint +mitre_attack_id: + - T1036.003 + - T1059.006 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/renamed_python_binary/renamed_python_binary.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_rmm_named_pipe.yml b/detections/endpoint/windows_rmm_named_pipe.yml index 9e40b67134e..fdb9a4bf18e 100644 --- a/detections/endpoint/windows_rmm_named_pipe.yml +++ b/detections/endpoint/windows_rmm_named_pipe.yml @@ -1,8 +1,8 @@ name: Windows RMM Named Pipe id: c07c7138-edf5-4a16-8b24-3842599235bf -version: 5 +version: 6 creation_date: '2025-12-08' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: Anomaly @@ -37,7 +37,7 @@ search: | count by dest dvc process_exec process_guid process_id process_path signature signature_id vendor_product pipe_name user_id Image process_name - | lookup suspicious_rmm_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, description + | lookup local=t suspicious_rmm_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, description | where isnotnull(tool) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml index f0b4a4123e1..924a74e51c6 100644 --- a/detections/endpoint/windows_root_domain_linked_policies_discovery.yml +++ b/detections/endpoint/windows_root_domain_linked_policies_discovery.yml @@ -2,7 +2,7 @@ name: Windows Root Domain linked policies Discovery id: 80ffaede-1f12-49d5-a86e-b4b599b68b3c version: 11 creation_date: '2021-08-25' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -26,6 +26,7 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - https://medium.com/@pentesttas/discover-hidden-gpo-s-on-active-directory-using-ps-adsi-a284b6814c81 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1087.002/T1087.002.yaml#L260 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -46,6 +47,8 @@ analytic_story: - Active Directory Discovery - Industroyer2 asset_type: Endpoint +atomic_guid: + - 00c652e2-0750-4ca6-82ff-0204684a6fe4 mitre_attack_id: - T1087.002 product: diff --git a/detections/endpoint/windows_runmru_command_execution.yml b/detections/endpoint/windows_runmru_command_execution.yml index 7768f86cb8d..035fa471453 100644 --- a/detections/endpoint/windows_runmru_command_execution.yml +++ b/detections/endpoint/windows_runmru_command_execution.yml @@ -2,7 +2,7 @@ name: Windows RunMRU Command Execution id: a15aa1ab-2b79-467f-8201-65e0f32d5b1a version: 11 creation_date: '2024-11-13' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: Anomaly @@ -17,6 +17,7 @@ references: - https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71 - https://www.forensafe.com/blogs/runmrukey.html - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/registry/registry_set/registry_set_runmru_command_execution.yml + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml#L79 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml b/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml new file mode 100644 index 00000000000..dff7ccf275d --- /dev/null +++ b/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml @@ -0,0 +1,88 @@ +name: Windows SCCM Adsource DLL Was Planted In SMS Provider Directory +id: 4f55b07b-7aeb-47f4-a234-b222a902276b +version: 1 +creation_date: '2026-08-20' +modification_date: '2026-08-20' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects the creation or modification of adsource.dll or other staging files with the name adsource_*.dll within the SCCM SMS Provider bin directory, consistent with exploitation of CVE-2026-47301. + This abuses a DLL side-loading vulnerability in the Microsoft Configuration Manager SMS Provider component. + An attacker can plant a malicious adsource.dll in the SCCMProvider bin\X64 path, causing the SMS Provider service to load the attacker-controlled library in a privileged context. + The presence of renamed dlls alongside adsource.dll is a strong indicator of the classic DLL hijacking pattern where the legitimate library has been renamed so the malicious replacement can proxy calls to it. + If confirmed malicious, this activity represents a privilege escalation vector that can result in SYSTEM-level code execution on any host running the SCCM SMS Provider role. +data_source: + - Sysmon EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Filesystem where + + Filesystem.action IN ("created", "modified") + Filesystem.file_name IN ( + "adsource.dll", + "adsource_*.dll" + ) + Filesystem.file_path="*Microsoft Configuration Manager\\bin\\X64\\*" + + BY Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl + Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_sccm_adsource_dll_was_planted_in_sms_provider_directory_filter` +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. If you are using Sysmon, you must have EventID 11 (FileCreate) enabled, and the FileCreate section of the configuration must include TargetFilename paths ending in .dll or "Microsoft Configuration Manager\bin\X64\" folder. +known_false_positives: |- + Legitimate SCCM upgrades or hotfix installations may create or replace adsource.dll in the bin\X64 directory. + Validate the file hash and digital signature of any detected adsource.dll against the expected version for the installed SCCM build before tuning. +references: + - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca + - https://nvd.nist.gov/vuln/detail/cve-2026-47301 + - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Suspicious SCCM adsource DLL [$file_name$] detected at [$file_path$] on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: file_name + type: file_name + - field: file_path + type: file_path +analytic_story: + - Windows Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2026-47301 +mitre_attack_id: + - T1574.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/sccm_adsource_dll/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml b/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml new file mode 100644 index 00000000000..e93cc7f6930 --- /dev/null +++ b/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml @@ -0,0 +1,110 @@ +name: Windows SCCM Smsexec Spawned a Suspicious Child Process +id: 72091a05-3008-4330-b43e-f5e070134ec1 +version: 1 +creation_date: '2026-08-24' +modification_date: '2026-08-24' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects shells, scripting engines, and common post-exploitation utilities spawned as child processes of smsexec.exe. + smsexec.exe is the core SCCM SMS Executive service process and has no legitimate reason to launch interactive shells or scripting interpreters. + An attacker who plants a malicious adsource.dll in the SCCMProvider bin\X64 directory will obtain code execution in the SCCM service context, typically resulting in a SYSTEM-level child process being spawned under smsexec.exe. + If confirmed malicious, this activity represents successful exploitation of the SCCM SMS Executive service and should be treated as a full host compromise. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.parent_process_name="smsexec.exe" + Processes.process_name IN ( + "bitsadmin.exe", + "certutil.exe", + "cmd.exe", + "conhost.exe", + "cscript.exe", + "curl.exe", + "mshta.exe", + "net.exe", + "net1.exe", + "powershell.exe", + "pwsh.exe", + "reg.exe", + "regsvr32.exe", + "rundll32.exe", + "wmic.exe", + "wscript.exe" + ) + + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_sccm_smsexec_spawned_a_suspicious_child_process_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + smsexec.exe is not expected to spawn interactive shells or scripting engines under normal operating conditions. + False positives are unlikely. Validate the full command line and file hash of any match before tuning. +references: + - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca + - https://attack.mitre.org/techniques/T1574/001/ + - https://attack.mitre.org/techniques/T1068/ + - https://nvd.nist.gov/vuln/detail/cve-2026-47301 + - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 50 + message: Suspicious child process [$process_name$] with Command Line [$process$] spawned by [$parent_process_path$] on [$dest$] +threat_objects: + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Windows Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2026-47301 +mitre_attack_id: + - T1574.001 + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/sccm_adsource_dll/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml index 3694b15b214..2da9f7d1039 100644 --- a/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml +++ b/detections/endpoint/windows_scheduled_task_service_spawned_shell.yml @@ -1,8 +1,8 @@ name: Windows Scheduled Task Service Spawned Shell id: d8120352-3b62-4e3c-8cb6-7b47584dd5e8 -version: 12 +version: 13 creation_date: '2023-07-11' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Steven Dick status: production type: TTP @@ -13,7 +13,6 @@ description: | If confirmed malicious, this could allow attackers to execute arbitrary code, maintain persistence, or escalate privileges within the environment. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml index 8b118547037..876973cadb7 100644 --- a/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_command.yml @@ -1,8 +1,8 @@ name: Windows Scheduled Task with Suspicious Command id: 1f44c126-c26a-4dd3-83bb-0f9a0f03ecc3 -version: 9 +version: 10 creation_date: '2025-02-07' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP @@ -11,7 +11,7 @@ data_source: - Windows Event Log Security 4698 - Windows Event Log Security 4700 - Windows Event Log Security 4702 -search: "`wineventlog_security` EventCode IN (4698,4700,4702)\n| eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent)\n| xmlkv TaskContent\n| stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, TaskName, Command, Enabled, Hidden, EventCode\n| lookup windows_suspicious_tasks task_command as Command \n| where tool == \"shell command use\" OR tool == \"suspicious paths\"\n| eval command=TaskName, process=Command+if(isnotnull(Arguments),\" \".Arguments,\"\"), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode \n| `security_content_ctime(firstTime)` \n| `security_content_ctime(lastTime)`\n| `windows_scheduled_task_with_suspicious_command_filter` " +search: "`wineventlog_security` EventCode IN (4698,4700,4702)\n| eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent)\n| xmlkv TaskContent\n| stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, Caller_User_Name, TaskName, Command, Enabled, Hidden, EventCode\n| lookup local=t windows_suspicious_tasks task_command as Command \n| where tool == \"shell command use\" OR tool == \"suspicious paths\"\n| eval command=TaskName, process=Command+if(isnotnull(Arguments),\" \".Arguments,\"\"), src_user=Author, user = Caller_User_Name, dest = Computer, signature_id = EventCode \n| `security_content_ctime(firstTime)` \n| `security_content_ctime(lastTime)`\n| `windows_scheduled_task_with_suspicious_command_filter` " how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required. known_false_positives: False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately. Windows Defender, Google Chrome, and MS Edge updates may trigger this detection. references: diff --git a/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml index 872660b4e0d..e4e43f175d1 100644 --- a/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml +++ b/detections/endpoint/windows_scheduled_task_with_suspicious_name.yml @@ -1,8 +1,8 @@ name: Windows Scheduled Task with Suspicious Name id: 9e9ab4e3-c9d0-4967-a197-6d755e8a7e6e -version: 9 +version: 10 creation_date: '2025-02-07' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: TTP @@ -16,7 +16,7 @@ search: |- | eval TaskContent = case(isnotnull(TaskContentNew),TaskContentNew,true(),TaskContent) | xmlkv TaskContent | stats count min(_time) as firstTime max(_time) as lastTime latest(Arguments) as Arguments latest(Author) as Author by Computer, TaskName, Command, Enabled, Hidden,Caller_User_Name, EventCode - | lookup windows_suspicious_tasks task_name as TaskName + | lookup local=t windows_suspicious_tasks task_name as TaskName | where isnotnull(tool_type) | eval command=TaskName, process=Command+if(isnotnull(Arguments)," ".Arguments,""), src_user=Author, user = Caller_User_Name, dest = Computer | `security_content_ctime(firstTime)` diff --git a/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml b/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml index cc80df82e7f..6f28e045505 100644 --- a/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml +++ b/detections/endpoint/windows_scmanager_security_descriptor_tampering_via_sc_exe.yml @@ -2,7 +2,7 @@ name: Windows ScManager Security Descriptor Tampering Via Sc.EXE id: 04023928-0381-4935-82cb-03372b2ef644 version: 9 creation_date: '2024-12-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: TTP @@ -36,6 +36,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/8ac5c4f84692b11ea2832d18d3dc6f1ce7fb4e41/atomics/T1569.002/T1569.002.md#atomic-test-7---modifying-acl-of-service-control-manager-via-sdet - https://0xv1n.github.io/posts/scmanager/ - https://attack.mitre.org/techniques/T1569/002/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1569.002/T1569.002.yaml#L208 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -63,6 +64,8 @@ threat_objects: analytic_story: - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint +atomic_guid: + - bf07f520-3909-4ef5-aa22-877a50f2f77b mitre_attack_id: - T1569.002 product: diff --git a/detections/endpoint/windows_sensitive_group_discovery_with_net.yml b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml index 352d9aea298..0628f561ccf 100644 --- a/detections/endpoint/windows_sensitive_group_discovery_with_net.yml +++ b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml @@ -2,7 +2,7 @@ name: Windows Sensitive Group Discovery With Net id: d9eb7cda-5622-4722-bc88-7f2442f4b5af version: 9 creation_date: '2021-08-26' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Mauricio Velazco, Splunk status: production type: Anomaly @@ -33,6 +33,7 @@ references: - https://adsecurity.org/?p=3658 - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.002/T1069.002.yaml#L35 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -56,6 +57,8 @@ analytic_story: - IcedID - Microsoft WSUS CVE-2025-59287 asset_type: Endpoint +atomic_guid: + - 0afb5163-8181-432e-9405-4322710c0c37 mitre_attack_id: - T1069.002 product: diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml index c4d05fdf286..37af44ada55 100644 --- a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -2,7 +2,7 @@ name: Windows Sensitive Registry Hive Dump Via CommandLine id: 5aaff29d-0cce-405b-9ee8-5d06b49d045e version: 11 creation_date: '2021-05-12' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Patrick Bareiss, Nasreddine Bencherchali, Splunk status: production type: TTP @@ -49,6 +49,8 @@ references: - https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.002/T1003.002.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.002/T1003.002.yaml#L176 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -85,6 +87,9 @@ analytic_story: - Windows Registry Abuse - Seashell Blizzard asset_type: Endpoint +atomic_guid: + - 5c2571d0-1572-416d-9676-812e64ca9f44 + - 21df41be-cdd8-4695-a650-c3981113aa3c mitre_attack_id: - T1003.002 product: diff --git a/detections/endpoint/windows_service_create_with_tscon.yml b/detections/endpoint/windows_service_create_with_tscon.yml index 3e5a52271b7..7702b9a3d68 100644 --- a/detections/endpoint/windows_service_create_with_tscon.yml +++ b/detections/endpoint/windows_service_create_with_tscon.yml @@ -2,7 +2,7 @@ name: Windows Service Create with Tscon id: c13b3d74-6b63-4db5-a841-4206f0370077 version: 15 creation_date: '2023-03-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: False positives may arise in the RDP Hijacking analytic w references: - https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1563.002/T1563.002.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1563.002/T1563.002.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -61,6 +62,8 @@ analytic_story: - Compromised Windows Host - Windows RDP Artifacts and Defense Evasion asset_type: Endpoint +atomic_guid: + - a37ac520-b911-458e-8aed-c5f1576d9f46 mitre_attack_id: - T1543.003 - T1563.002 diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_name.yml b/detections/endpoint/windows_service_created_with_suspicious_service_name.yml index feff939ffab..99789981a91 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_name.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_name.yml @@ -1,8 +1,8 @@ name: Windows Service Created with Suspicious Service Name id: 35eb6d19-a497-400c-93c5-645562804b11 -version: 9 +version: 10 creation_date: '2025-02-07' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -14,7 +14,7 @@ search: |- | stats values(ImagePath) as process, count, min(_time) as firstTime, max(_time) as lastTime values(EventCode) as signature by Computer, ServiceName, StartType, ServiceType, UserID | eval process_name = replace(mvindex(split(process,"\\"),-1), "\"", "") | rename Computer as dest, ServiceName as object_name, ServiceType as object_type, UserID as user_id - | lookup windows_suspicious_services service_name as object_name + | lookup local=t windows_suspicious_services service_name as object_name | where isnotnull(tool_name) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index f2509cb3cc7..6a955fbe973 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -2,7 +2,7 @@ name: Windows Service Creation Using Registry Entry id: 25212358-948e-11ec-ad47-acde48001122 version: 20 creation_date: '2022-02-23' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: Third party tools may used this technique to create services but not so common. references: - https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1574.011/T1574.011.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1574.011/T1574.011.yaml#L22 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -45,6 +46,8 @@ analytic_story: - Brute Ratel C4 - Gh0st RAT asset_type: Endpoint +atomic_guid: + - f38e9eea-e1d7-4ba6-b716-584791963827 mitre_attack_id: - T1574.011 product: diff --git a/detections/endpoint/windows_service_execution_remcom.yml b/detections/endpoint/windows_service_execution_remcom.yml index be8ac4dd2b7..a98b4246e48 100644 --- a/detections/endpoint/windows_service_execution_remcom.yml +++ b/detections/endpoint/windows_service_execution_remcom.yml @@ -2,7 +2,7 @@ name: Windows Service Execution RemCom id: 7e3d68db-ea4d-419b-adbd-e14a525ecf09 version: 8 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -17,6 +17,7 @@ known_false_positives: False positives may be present based on Administrative us references: - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ - https://github.com/kavika13/RemCom + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1569.002/T1569.002.yaml#L158 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -46,6 +47,8 @@ threat_objects: analytic_story: - Active Directory Discovery asset_type: Endpoint +atomic_guid: + - a5d8cdeb-be90-43a9-8b26-cc618deac1e0 mitre_attack_id: - T1569.002 product: diff --git a/detections/endpoint/windows_service_stop_attempt.yml b/detections/endpoint/windows_service_stop_attempt.yml index 6008781baf6..800a48499cb 100644 --- a/detections/endpoint/windows_service_stop_attempt.yml +++ b/detections/endpoint/windows_service_stop_attempt.yml @@ -2,7 +2,7 @@ name: Windows Service Stop Attempt id: dd0f07ea-f08f-4d88-96e5-cb58156e82b6 version: 8 creation_date: '2022-11-30' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -34,6 +34,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Windows OS or software may stop and restart services due to some critical update. references: - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml#L25 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -49,6 +50,8 @@ analytic_story: - Scattered Lapsus$ Hunters - Gh0st RAT asset_type: Endpoint +atomic_guid: + - 41274289-ec9c-4213-bea4-e43c4aa57954 mitre_attack_id: - T1489 product: diff --git a/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml b/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml index 57fb47d17da..1c849a2aa44 100644 --- a/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml +++ b/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml @@ -1,38 +1,47 @@ name: Windows Set Account Password Policy To Unlimited Via Net id: 11f93009-8083-43fd-82a7-821fcbdc8342 -version: 7 +version: 8 creation_date: '2022-06-24' -modification_date: '2026-05-13' +modification_date: '2026-08-11' author: Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: The following analytic detects the use of net.exe to update user account policies to set passwords as non-expiring. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving "/maxpwage:unlimited" or "/maxpwage:49710", which achieve a similar outcome theoretically. This activity is significant as it can indicate an attempt to maintain persistence, escalate privileges, evade defenses, or facilitate lateral movement. If confirmed malicious, this behavior could allow an attacker to maintain long-term access to compromised accounts, potentially leading to further exploitation and unauthorized access to sensitive information. +description: |- + The following analytic detects the use of net.exe or net1.exe to configure the Windows maximum password age policy as unlimited. + It leverages process creation telemetry from Endpoint Detection and Response (EDR) agents and identifies executions of the `net accounts` command using the `/maxpwage:unlimited` option. + When specified, Windows configures the maximum password age with an unlimited value, effectively preventing passwords governed by the affected password policy from expiring. + This behavior is significant because an adversary may modify password expiration settings to weaken credential security controls and maintain access to compromised accounts for an extended period. + If confirmed malicious, this activity may indicate an attempt to establish or maintain persistence by preventing expected password rotation from invalidating credentials under the affected password policy. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: |- - | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes - WHERE `process_net` - AND - Processes.process="* accounts *" - AND - (Processes.process="* /maxpwage:unlimited" - OR - Processes.process="/maxpwage:49710") - BY Processes.action Processes.dest Processes.original_file_name - Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path - Processes.process Processes.process_exec Processes.process_guid - Processes.process_hash Processes.process_id Processes.process_integrity_level - Processes.process_name Processes.process_path Processes.user - Processes.user_id Processes.vendor_product + | tstats `security_content_summariesonly` + values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime + + FROM datamodel=Endpoint.Processes WHERE + + `process_net` + Processes.process="* accounts *" + Processes.process IN ("* /maxpwage:unlimited*") + + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_set_account_password_policy_to_unlimited_via_net_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: This behavior is not commonly seen in production environment and not advisable, filter as needed. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + This behavior is not commonly seen in production environment and not advisable, investigate the activity and determine if it is malicious. Apply additional filters to reduce false positives as needed. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ - https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/net-commands-on-operating-systems @@ -51,6 +60,11 @@ intermediate_findings: type: system score: 20 message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to make non-expiring password on host user accounts. +threat_objects: + - field: parent_process + type: parent_process + - field: process + type: process analytic_story: - Ransomware - BlackByte Ransomware diff --git a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml index 62ee6a86437..7f30fc9011f 100644 --- a/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml +++ b/detections/endpoint/windows_snake_malware_file_modification_crmlog.yml @@ -2,7 +2,7 @@ name: Windows Snake Malware File Modification Crmlog id: 27187e0e-c221-471d-a7bd-04f698985ff6 version: 9 creation_date: '2023-05-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present as the file pattern does match legitimate files on disk. It is possible other native tools write the same file name scheme. references: - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml#L208 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml index 6dd8cab6f1f..58cf6a4b3c8 100644 --- a/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml +++ b/detections/endpoint/windows_snake_malware_kernel_driver_comadmin.yml @@ -2,7 +2,7 @@ name: Windows Snake Malware Kernel Driver Comadmin id: 628d9c7c-3242-43b5-9620-7234c080a726 version: 9 creation_date: '2023-05-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present, filter as needed. references: - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547.006/T1547.006.yaml#L110 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml index f4a4d3beb98..8b662a65d1a 100644 --- a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml +++ b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml @@ -2,7 +2,7 @@ name: Windows Snake Malware Registry Modification wav OpenWithProgIds id: 13cf8b79-805d-443c-bf52-f55bd7610dfd version: 11 creation_date: '2023-05-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: False positives may be present and will require tuning based on program Ids in large organizations. references: - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1112/T1112.yaml#L876 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_snake_malware_service_create.yml b/detections/endpoint/windows_snake_malware_service_create.yml index ec9bf5438b4..9417bdc3bd3 100644 --- a/detections/endpoint/windows_snake_malware_service_create.yml +++ b/detections/endpoint/windows_snake_malware_service_create.yml @@ -2,7 +2,7 @@ name: Windows Snake Malware Service Create id: 64eb091f-8cab-4b41-9b09-8fb4942377df version: 9 creation_date: '2023-05-11' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin known_false_positives: False positives should be limited as this is a strict primary indicator used by Snake Malware. references: - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1569.002/T1569.002.yaml#L192 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' diff --git a/detections/endpoint/windows_sqlcmd_execution.yml b/detections/endpoint/windows_sqlcmd_execution.yml index 49330409033..05f388a9050 100644 --- a/detections/endpoint/windows_sqlcmd_execution.yml +++ b/detections/endpoint/windows_sqlcmd_execution.yml @@ -2,7 +2,7 @@ name: Windows SQLCMD Execution id: 4e7c2f85-8f02-4bd2-a48b-5ec98a2c5f72 version: 5 creation_date: '2025-02-13' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Hunting @@ -28,10 +28,13 @@ references: - https://attack.mitre.org/techniques/T1213/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md#atomic-test-32---file-download-with-sqlcmdexe - https://unit42.paloaltonetworks.com/espionage-campaign-targets-south-asian-entities/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1105/T1105.yaml#L900 analytic_story: - SQL Server Abuse - GhostRedirector IIS Module and Rungan Backdoor asset_type: Endpoint +atomic_guid: + - 6934c16e-0b3a-4e7f-ab8c-c414acd32181 mitre_attack_id: - T1059.003 product: diff --git a/detections/endpoint/windows_ssh_proxy_command.yml b/detections/endpoint/windows_ssh_proxy_command.yml index d8d2fc28bf9..02812d7a620 100644 --- a/detections/endpoint/windows_ssh_proxy_command.yml +++ b/detections/endpoint/windows_ssh_proxy_command.yml @@ -1,8 +1,8 @@ name: Windows SSH Proxy Command id: ac520039-21f1-4567-b528-5b7133dba76f -version: 6 +version: 7 creation_date: '2025-03-24' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, AJ King, Nasreddine Bencherchali, Splunk, Jesse Hunter, Splunk Community Contributor status: production type: Anomaly @@ -12,7 +12,6 @@ description: | This technique can be used by attackers to execute arbitrary commands through SSH proxy configurations, potentially enabling command & control activities or remote code execution. The detection focuses on commonly abused Windows scripting engines and web requests that may indicate malicious activity when spawned through SSH proxy commands. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml b/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml index f4c330f6da8..88962307ce9 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml @@ -2,7 +2,7 @@ name: Windows Steal Authentication Certificates CryptoAPI id: 905d5692-6d7c-432f-bc7e-a6b4f464d40e version: 10 creation_date: '2023-02-09' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -22,6 +22,7 @@ how_to_implement: To implement this analytic, one will need to enable the Micros known_false_positives: False positives may be present in some instances of legitimate applications requiring to export certificates. Filter as needed. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-vista/cc749296(v=ws.10) + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1649/T1649.yaml#L5 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -41,6 +42,8 @@ analytic_story: - Windows Certificate Services - Hellcat Ransomware asset_type: Endpoint +atomic_guid: + - eb121494-82d1-4148-9e2b-e624e03fbf3d mitre_attack_id: - T1649 product: diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml index 0b54ae8603d..c1ba66028d4 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml @@ -2,7 +2,7 @@ name: Windows Steal Authentication Certificates Export Certificate id: e39dc429-c2a5-4f1f-9c3c-6b211af6b332 version: 12 creation_date: '2023-02-03' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ known_false_positives: Filtering may be requried based on automated utilities an references: - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj - https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1649/T1649.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -57,6 +58,8 @@ threat_objects: analytic_story: - Windows Certificate Services asset_type: Endpoint +atomic_guid: + - eb121494-82d1-4148-9e2b-e624e03fbf3d mitre_attack_id: - T1649 product: diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml index bdddbd21249..703769f961c 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml @@ -2,7 +2,7 @@ name: Windows Steal Authentication Certificates Export PfxCertificate id: 391329f3-c14b-4b8d-8b37-ac5012637360 version: 12 creation_date: '2023-02-03' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ known_false_positives: Filtering may be requried based on automated utilities an references: - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1552.004/T1552.004.yaml#L325 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -57,6 +58,8 @@ threat_objects: analytic_story: - Windows Certificate Services asset_type: Endpoint +atomic_guid: + - 7617f689-bbd8-44bc-adcd-6f8968897848 mitre_attack_id: - T1649 product: diff --git a/detections/endpoint/windows_subinacl_execution.yml b/detections/endpoint/windows_subinacl_execution.yml index 1618c7539e6..26d5dd45645 100644 --- a/detections/endpoint/windows_subinacl_execution.yml +++ b/detections/endpoint/windows_subinacl_execution.yml @@ -2,7 +2,7 @@ name: Windows SubInAcl Execution id: 12491419-1a6f-4af4-afc3-4e2052f0610e version: 9 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Nasreddine Bencherchali, Michael Haag, Splunk status: production type: Anomaly @@ -34,6 +34,7 @@ known_false_positives: No false positives have been identified at this time. sho references: - https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf - https://attack.mitre.org/techniques/T1222/001/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1222.001/T1222.001.yaml#L144 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Defense Evasion or Unauthorized Access Via SDDL Tampering asset_type: Endpoint +atomic_guid: + - a8568b10-9ab9-4140-a523-1c72e0176924 mitre_attack_id: - T1222.001 product: diff --git a/detections/endpoint/windows_suspicious_c2_named_pipe.yml b/detections/endpoint/windows_suspicious_c2_named_pipe.yml index 270a890fcb7..1654dfc0f83 100644 --- a/detections/endpoint/windows_suspicious_c2_named_pipe.yml +++ b/detections/endpoint/windows_suspicious_c2_named_pipe.yml @@ -1,8 +1,8 @@ name: Windows Suspicious C2 Named Pipe id: 90599d85-dc2a-4d4c-8c59-9485c3665828 -version: 6 +version: 7 creation_date: '2025-12-08' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: TTP @@ -37,7 +37,7 @@ search: | count by dest dvc process_exec process_guid process_id process_path signature signature_id vendor_product pipe_name user_id Image process_name - | lookup suspicious_c2_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, description + | lookup local=t suspicious_c2_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, description | where isnotnull(tool) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_suspicious_named_pipe.yml b/detections/endpoint/windows_suspicious_named_pipe.yml index c77859e3b85..38cc4205615 100644 --- a/detections/endpoint/windows_suspicious_named_pipe.yml +++ b/detections/endpoint/windows_suspicious_named_pipe.yml @@ -1,8 +1,8 @@ name: Windows Suspicious Named Pipe id: 3a76d52f-a007-4a65-a37d-f313c2c83f31 -version: 5 +version: 6 creation_date: '2025-12-08' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: TTP @@ -38,7 +38,7 @@ search: | count by dest dvc process_exec process_guid process_id process_path pipe_name user_id process_name signature signature_id vendor_product - | lookup suspicious_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, type, description + | lookup local=t suspicious_named_pipes suspicious_pipe_name AS pipe_name OUTPUT tool, type, description | where isnotnull(tool) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml index bae7c631445..4cf1735d21c 100644 --- a/detections/endpoint/windows_suspicious_process_file_path.yml +++ b/detections/endpoint/windows_suspicious_process_file_path.yml @@ -1,8 +1,8 @@ name: Windows Suspicious Process File Path id: ecddae4e-3d4b-41e2-b3df-e46a88b38521 -version: 28 +version: 29 creation_date: '2021-05-07' -modification_date: '2026-08-14' +modification_date: '2026-09-01' author: Teoderick Contreras, Splunk status: production type: TTP @@ -37,7 +37,7 @@ finding: score: 50 threat_objects: - field: process_path - type: process_name + type: file_path analytic_story: - StealC Stealer - PlugX diff --git a/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml b/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml index 7719a175dbc..667888e72b3 100644 --- a/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml +++ b/detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml @@ -1,8 +1,8 @@ name: Windows Suspicious React or Next.js Child Process id: baa80bc8-7c9c-4395-b458-b69feb92830a -version: 5 +version: 6 creation_date: '2025-12-08' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -13,7 +13,6 @@ description: | Such activity might be a strong indicator of exploitation of the aforementioned vulnerability. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: | | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes diff --git a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 080690f079f..6cd471d6f50 100644 --- a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -2,7 +2,7 @@ name: Windows System Binary Proxy Execution Compiled HTML File Decompile id: 2acf0e19-4149-451c-a3f3-39cd3c77e37d version: 15 creation_date: '2022-09-01' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Michael Haag, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://redcanary.com/blog/introducing-atomictestharnesses/ - https://attack.mitre.org/techniques/T1218/001/ - https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218.001/T1218.001.yaml#L191 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - Compromised Windows Host - APT37 Rustonotto and FadeStealer asset_type: Endpoint +atomic_guid: + - 20cb05e0-1fa5-406d-92c1-84da4ba01813 mitre_attack_id: - T1218.001 product: diff --git a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml index ea161433fb1..a0660e5aa91 100644 --- a/detections/endpoint/windows_system_network_connections_discovery_netsh.yml +++ b/detections/endpoint/windows_system_network_connections_discovery_netsh.yml @@ -2,7 +2,7 @@ name: Windows System Network Connections Discovery Netsh id: abfb7cc5-c275-4a97-9029-62cd8d4ffeca version: 12 creation_date: '2022-12-06' -modification_date: '2026-06-25' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -41,6 +41,7 @@ references: - https://attack.mitre.org/techniques/T1049/ - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1016/T1016.yaml#L21 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -64,6 +65,8 @@ analytic_story: - VIP Keylogger - Phantom Stealer asset_type: Endpoint +atomic_guid: + - 038263cb-00f4-4b0a-98ae-0696c67e1752 mitre_attack_id: - T1049 product: diff --git a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml index 6cdd11a4d42..42e84f9ed2e 100644 --- a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml +++ b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml @@ -2,7 +2,7 @@ name: Windows System Script Proxy Execution Syncappvpublishingserver id: 8dd73f89-682d-444c-8b41-8e679966ad3c version: 12 creation_date: '2022-06-17' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -30,6 +30,7 @@ known_false_positives: False positives may be present if the vbscript syncappvpu references: - https://lolbas-project.github.io/lolbas/Scripts/Syncappvpublishingserver/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1216/T1216.md#atomic-test-1---syncappvpublishingserver-signed-script-powershell-command-execution + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1216.002/T1216.002.yaml#L5 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,6 +60,8 @@ threat_objects: analytic_story: - Living Off The Land asset_type: Endpoint +atomic_guid: + - 275d963d-3f36-476c-8bef-a2a3960ee6eb mitre_attack_id: - T1216 - T1218 diff --git a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml index 0e00d651980..2d254087fea 100644 --- a/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml +++ b/detections/endpoint/windows_system_time_discovery_w32tm_delay.yml @@ -2,7 +2,7 @@ name: Windows System Time Discovery W32tm Delay id: b2cc69e7-11ba-42dc-a269-59c069a48870 version: 11 creation_date: '2022-07-27' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -31,6 +31,7 @@ references: - https://cert.gov.ua/article/405538 - https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1124/T1124.yaml#L42 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -49,6 +50,8 @@ intermediate_findings: analytic_story: - DarkCrystal RAT asset_type: Endpoint +atomic_guid: + - d5d5a6b0-0f92-42d8-985d-47aafa2dd4db mitre_attack_id: - T1124 product: diff --git a/detections/endpoint/windows_system_user_discovery_via_quser.yml b/detections/endpoint/windows_system_user_discovery_via_quser.yml index 3e67a3b86f3..94d79507ab5 100644 --- a/detections/endpoint/windows_system_user_discovery_via_quser.yml +++ b/detections/endpoint/windows_system_user_discovery_via_quser.yml @@ -2,7 +2,7 @@ name: Windows System User Discovery Via Quser id: 0c3f3e09-e47a-410e-856f-a02a5c5fafb0 version: 8 creation_date: '2022-12-13' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -33,11 +33,16 @@ references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1033/T1033.yaml#L30 analytic_story: - Prestige Ransomware - Crypto Stealer - Windows Post-Exploitation asset_type: Endpoint +atomic_guid: + - 4c4959bf-addf-4b4a-be86-8d09cc1857aa + - 2a9b677d-a230-44f4-ad86-782df1ef108c mitre_attack_id: - T1033 product: diff --git a/detections/endpoint/windows_terminating_lsass_process.yml b/detections/endpoint/windows_terminating_lsass_process.yml index 1dc7294e2e6..94b634ef688 100644 --- a/detections/endpoint/windows_terminating_lsass_process.yml +++ b/detections/endpoint/windows_terminating_lsass_process.yml @@ -1,30 +1,42 @@ name: Windows Terminating Lsass Process id: 7ab3c319-a4e7-4211-9e8c-40a049d0dba6 -version: 15 +version: 16 creation_date: '2022-03-28' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects a suspicious process attempting to terminate the Lsass.exe process. It leverages Sysmon EventCode 10 logs to identify processes granted PROCESS_TERMINATE access to Lsass.exe. This activity is significant because Lsass.exe is a critical process responsible for enforcing security policies and handling user credentials. If confirmed malicious, this behavior could indicate an attempt to perform credential dumping, privilege escalation, or evasion of security policies, potentially leading to unauthorized access and persistence within the environment. +description: |- + The following analytic detects a process requesting PROCESS_TERMINATE access to Lsass.exe. + It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_TERMINATE (0x1). data_source: - Sysmon EventID 10 search: |- - `sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess = 0x1 - | stats count min(_time) as firstTime max(_time) as lastTime - BY CallTrace EventID GrantedAccess - Guid Opcode ProcessID - SecurityID SourceImage SourceProcessGUID - SourceProcessId TargetImage TargetProcessGUID - TargetProcessId UserID dest - granted_access parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path - process_exec process_guid process_id - process_name process_path signature - signature_id user_id vendor_product - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `windows_terminating_lsass_process_filter` + `sysmon` + EventCode=10 + TargetImage="*\\lsass.exe" + + ``` + PROCESS_TERMINATE is 0x1. + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_TERMINATE = 1 + | eval terminate_set = bit_and(g_access_decimal, PROCESS_TERMINATE) + | where terminate_set == PROCESS_TERMINATE + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_terminating_lsass_process_filter` how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. known_false_positives: No false positives have been identified at this time. references: @@ -43,10 +55,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: a process $SourceImage$ terminates Lsass process on $dest$ + message: A process [$SourceImage$] requested PROCESS_TERMINATE access [$granted_access$] to Lsass.exe on [$dest$]. threat_objects: - field: TargetImage - type: process + type: file_path analytic_story: - Data Destruction - Double Zero Destructor diff --git a/detections/endpoint/windows_time_based_evasion.yml b/detections/endpoint/windows_time_based_evasion.yml index 8356037e58d..f8cfd97a98d 100644 --- a/detections/endpoint/windows_time_based_evasion.yml +++ b/detections/endpoint/windows_time_based_evasion.yml @@ -1,8 +1,8 @@ name: Windows Time Based Evasion id: 34502357-deb1-499a-8261-ffe144abf561 -version: 14 +version: 15 creation_date: '2023-09-19' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Teoderick Contreras, Splunk status: production type: TTP @@ -13,7 +13,6 @@ description: |- If confirmed malicious, this activity could indicate an active infection attempting to evade detection, potentially leading to further compromise and persistence within the environment. data_source: - Sysmon EventID 1 - - CrowdStrike ProcessRollup2 search: |- | tstats `security_content_summariesonly` count min(_time) as firstTime diff --git a/detections/endpoint/windows_tinycc_shellcode_execution.yml b/detections/endpoint/windows_tinycc_shellcode_execution.yml index 4b2ce5bd041..0d0bbec806c 100644 --- a/detections/endpoint/windows_tinycc_shellcode_execution.yml +++ b/detections/endpoint/windows_tinycc_shellcode_execution.yml @@ -1,35 +1,43 @@ name: Windows TinyCC Shellcode Execution id: fdb6774e-e465-4912-86e3-63cf9ab91491 -version: 3 +version: 4 creation_date: '2026-03-16' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Michael Haag, Splunk status: production type: TTP description: | - Detects abuse of Tiny-C-Compiler (TinyCC) for shellcode execution, where tcc.exe is renamed to masquerade as svchost.exe and used to compile and execute C source files containing shellcode. This technique was observed in the Lotus Blossom Chrysalis backdoor campaign, where attackers renamed tcc.exe to svchost.exe and executed conf.c containing Metasploit block_api shellcode with the flags -nostdlib -run. - TinyCC is a legitimate C compiler, but its ability to compile and execute code on-the-fly makes it attractive to attackers seeking to evade detection. The combination of a renamed compiler binary executing from non-standard locations with suspicious flags is a strong indicator of malicious activity. + Detects abuse of Tiny-C-Compiler (TinyCC) for shellcode execution, where tcc.exe is renamed to masquerade as svchost.exe and used to compile and execute C source files containing shellcode. + This technique was observed in the Lotus Blossom Chrysalis backdoor campaign, where attackers renamed "tcc.exe" to "svchost.exe", and executed a file named "conf.c" containing Metasploit block_api shellcode with the flags -nostdlib -run. + TinyCC is a legitimate C compiler, but its ability to compile and execute code on-the-fly makes it attractive to attackers seeking to evade detection. + The combination of a renamed compiler binary executing from non-standard locations with suspicious flags is a strong indicator of malicious activity. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes where - Processes.process_name IN ("svchost.exe", "tcc.exe") - Processes.process="* -nostdlib*" - Processes.process="* -run*" - Processes.process IN ("*.c", "*conf.c*") - NOT Processes.process_path IN ( + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_name IN ("svchost.exe", "tcc.exe") + Processes.process="* -nostdlib*" + Processes.process="* -run*" + Processes.process IN ("*.c", "*conf.c*") + NOT Processes.process_path IN ( "*:\\Windows\\System32\\*", "*:\\Windows\\SysWOW64\\*" - ) - by Processes.action Processes.dest Processes.user Processes.process Processes.parent_process - Processes.parent_process_exec Processes.parent_process_guid - Processes.parent_process_id Processes.parent_process_name - Processes.parent_process_path Processes.process_name Processes.process_id - Processes.process_exec Processes.process_guid Processes.process_hash - Processes.process_integrity_level Processes.process_path - Processes.original_file_name Processes.user_id Processes.vendor_product + ) + + By Processes.action Processes.dest Processes.user Processes.process Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name + Processes.parent_process_path Processes.process_name Processes.process_id + Processes.process_exec Processes.process_guid Processes.process_hash + Processes.process_integrity_level Processes.process_path + Processes.original_file_name Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -61,7 +69,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: TinyCC compiler execution on $dest$ by user $user$ from $process_path$, indicating potential malicious code execution. + title: TinyCC compiler execution on [$dest$] by user [$user$] from [$process_path$] via the CommandLine [$process$] from the ParentProcess [$parent_process$], indicating potential malicious code execution. entity: field: user type: user @@ -71,7 +79,7 @@ intermediate_findings: - field: dest type: system score: 50 - message: TinyCC compiler execution on $dest$ by user $user$ from $process_path$, indicating potential malicious code execution. + message: TinyCC compiler execution on [$dest$] by user [$user$] from [$process_path$] via the CommandLine [$process$] from the ParentProcess [$parent_process$], indicating potential malicious code execution. threat_objects: - field: process type: process diff --git a/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml b/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml index ccdf81a36d6..31d8f46e31e 100644 --- a/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml +++ b/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml @@ -1,15 +1,39 @@ name: Windows Unsecured Outlook Credentials Access In Registry id: 36334123-077d-47a2-b70c-6c7b3cc85049 -version: 14 +version: 15 creation_date: '2024-02-22' -modification_date: '2026-06-25' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects unauthorized access to Outlook credentials stored in the Windows registry. It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles. This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts. If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk. +description: |- + The following analytic detects unauthorized access to Outlook credentials stored in the Windows registry. + It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles. + This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts. + If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk. data_source: - Windows Event Log Security 4663 -search: '`wineventlog_security` EventCode=4663 object_file_path IN ("*\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676*", "*\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676*") AND process_name != *\\outlook.exe | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unsecured_outlook_credentials_access_in_registry_filter`' +search: |- + `wineventlog_security` + EventCode=4663 + object_file_path IN ( + "*\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676*", + "*\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676*" + ) + NOT process_name IN ( + "*\\HxOutlook.exe", + "*\\Outlook.exe" + ) + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by EventCode object_file_name object_file_path + process_name process_path process_id dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_unsecured_outlook_credentials_access_in_registry_filter` how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." known_false_positives: third party software may access this outlook registry. references: @@ -29,7 +53,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: A suspicious process $process_name$ accessing outlook credentials registry on $dest$ + message: A suspicious process [$process_name$] accessing outlook credentials registry [$object_file_path$] on [$dest$]. +threat_objects: + - field: process_name + type: process_name analytic_story: - StealC Stealer - Snake Keylogger diff --git a/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml b/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml index 8d84834feda..bd0469d430a 100644 --- a/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml +++ b/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml @@ -1,13 +1,13 @@ name: Windows Unusual File Creation in Confluence Directory id: aa9d80d9-ed47-44da-aceb-2909ca4dc19e -version: 2 +version: 3 creation_date: '2021-09-02' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Raven Tait, Splunk status: production type: Anomaly description: |- - Detects executable file formats being created within the Confluence main directory. + The following analytic detects executable file formats being created within the Confluence main directory. This can be indicative of exploitation of the Confluence web services to stage malware. This won't catch adversaries who modify the output location outside the Confluence directory when exploiting. data_source: @@ -32,7 +32,7 @@ search: |- "*.vbs" ) - by Filesystem.dest Filesystem.file_create_time Filesystem.process_path + by Filesystem.dest Filesystem.file_create_time Filesystem.process_path Filesystem.process_name Filesystem.process_guid Filesystem.process_id Filesystem.file_path Filesystem.action Filesystem.file_name Filesystem.user Filesystem.vendor_product @@ -40,8 +40,15 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unusual_file_creation_in_confluence_directory_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Some legitimate administrative or development activities may create executable files in the Confluence directory. Review and filter based on approved maintenance processes. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Some legitimate administrative or development activities may create executable files in the Confluence directory. + Review and filter based on approved maintenance processes. +references: + - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-289a + - https://confluence.atlassian.com/security/cve-2023-22515-broken-access-control-vulnerability-in-confluence-data-center-and-server-1295682276.html + - https://www.rapid7.com/blog/post/2023/10/04/etr-cve-2023-22515-zero-day-privilege-escalation-in-confluence-server-and-data-center/ drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -56,7 +63,7 @@ intermediate_findings: - field: dest type: system score: 20 - message: Executable file created under a Confluence path at $file_path$ on $dest$. + message: The process [$process_name$] created an executable file under a Confluence path at [$file_path$] on [$dest$]. threat_objects: - field: file_path type: file_path diff --git a/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml b/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml index a029952d943..aef8ef031fe 100644 --- a/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml +++ b/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml @@ -1,8 +1,8 @@ name: Windows Unusual SysWOW64 Process Run System32 Executable id: e4602172-db86-4315-86df-da66fb40bcde -version: 6 +version: 7 creation_date: '2022-12-06' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -32,7 +32,7 @@ intermediate_findings: message: a 32 bit process execute 64 bit executable on [$dest$]. threat_objects: - field: process_path - type: process_name + type: file_path analytic_story: - DarkGate Malware - Salt Typhoon diff --git a/detections/endpoint/windows_vulnerable_driver_installed.yml b/detections/endpoint/windows_vulnerable_driver_installed.yml index e2832a332f5..6f5d12c6d4d 100644 --- a/detections/endpoint/windows_vulnerable_driver_installed.yml +++ b/detections/endpoint/windows_vulnerable_driver_installed.yml @@ -1,8 +1,8 @@ name: Windows Vulnerable Driver Installed id: 1dda7586-57be-4a1b-8de1-a9ad802b9a7f -version: 10 +version: 12 creation_date: '2020-01-19' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Dean Luxton status: production type: TTP @@ -12,7 +12,7 @@ data_source: search: |- `wineventlog_system` EventCode=7045 ServiceType="kernel mode driver" | table _time dest EventCode ImagePath ServiceName ServiceType - | lookup loldrivers driver_name AS ImagePath OUTPUT is_driver driver_description + | lookup local=t loldrivers driver_name AS ImagePath OUTPUT is_driver driver_description | search is_driver = TRUE | `windows_vulnerable_driver_installed_filter` how_to_implement: Ensure the Splunk is collecting XmlWinEventLog:System events and the EventCode 7045 is being ingested. @@ -38,6 +38,9 @@ finding: field: dest type: system score: 50 +threat_objects: + - field: ImagePath + type: file_path analytic_story: - Windows Drivers - Void Manticore diff --git a/detections/endpoint/windows_vulnerable_driver_loaded.yml b/detections/endpoint/windows_vulnerable_driver_loaded.yml index 8f9d32b5501..26fcf996f6b 100644 --- a/detections/endpoint/windows_vulnerable_driver_loaded.yml +++ b/detections/endpoint/windows_vulnerable_driver_loaded.yml @@ -1,8 +1,8 @@ name: Windows Vulnerable Driver Loaded id: a2b1f1ef-221f-4187-b2a4-d4b08ec745f4 -version: 10 +version: 11 creation_date: '2022-12-31' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: Hunting @@ -15,7 +15,7 @@ search: |- BY ImageLoaded dest dvc process_hash process_path signature signature_id user_id vendor_product - | lookup loldrivers driver_name AS ImageLoaded OUTPUT is_driver driver_description + | lookup local=t loldrivers driver_name AS ImageLoaded OUTPUT is_driver driver_description | search is_driver = TRUE | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml index b3ff2e6f634..7f894ff9bfa 100644 --- a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml +++ b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml @@ -1,8 +1,8 @@ name: Windows Wermgr Alternate Data Stream in Temp Dir id: 65222e9b-9d0b-4bfe-8da1-199b98e1d44a -version: 1 +version: 3 creation_date: '2026-06-11' -modification_date: '2026-06-11' +modification_date: '2026-10-12' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -20,9 +20,10 @@ search: |- | stats count min(_time) as firstTime max(_time) as lastTime - by dest dvc file_hash file_name file_path process_exec - process_guid process_id process_name process_path - signature signature_id user_id vendor_product Contents Image + by dest file_hash file_name file_path + process_path process_name process_exec process_guid process_id + user_id user Contents + signature signature_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -47,7 +48,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: A [$process_name$] created a wermgr.exe alternate stream in the temp directory on $dest$ by $user$ + message: The process [$process_name$] owned by [$user$] created a Wermgr.exe alternate data stream in [$file_path$] on [$dest$] +threat_objects: + - field: file_path + type: file_path analytic_story: - RoguePlanet asset_type: Endpoint diff --git a/detections/endpoint/windows_wmi_impersonate_token.yml b/detections/endpoint/windows_wmi_impersonate_token.yml index 014c341e645..5c9648a1bbd 100644 --- a/detections/endpoint/windows_wmi_impersonate_token.yml +++ b/detections/endpoint/windows_wmi_impersonate_token.yml @@ -1,15 +1,53 @@ name: Windows WMI Impersonate Token id: cf192860-2d94-40db-9a51-c04a2e8a8f8b -version: 10 +version: 11 creation_date: '2022-10-26' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects potential WMI token impersonation activities in a process or command. It leverages Sysmon EventCode 10 to identify instances where `wmiprvse.exe` has a duplicate handle or full granted access in a target process. This behavior is significant as it is commonly used by malware like Qakbot for privilege escalation or defense evasion. If confirmed malicious, this activity could allow an attacker to gain elevated privileges, evade defenses, and maintain persistence within the environment. +description: |- + The following analytic detects WMI token impersonation by identifying `wmiprvse.exe` requesting the query, VM, and duplicate-handle rights associated with WMI process access. + It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_QUERY_INFORMATION (0x400), PROCESS_QUERY_LIMITED_INFORMATION (0x1000), PROCESS_VM_OPERATION (0x8), PROCESS_VM_READ (0x10), PROCESS_VM_WRITE (0x20), PROCESS_DUP_HANDLE (0x40), and PROCESS_ALL_ACCESS (0x1f3fff). data_source: - Sysmon EventID 10 -search: '`sysmon` EventCode=10 SourceImage = "*\\wmiprvse.exe" GrantedAccess IN ("0x1478", "0x1fffff") | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_wmi_impersonate_token_filter`' +search: |- + `sysmon` + EventCode=10 + SourceImage="*\\wmiprvse.exe" + + ``` + The 0x1478 mask combines query, VM, and duplicate-handle rights; + The 0x1fffff mas is full process access. + Additional requested rights are allowed. + ``` + | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16) + | eval PROCESS_QUERY_INFORMATION = 1024 + | eval PROCESS_QUERY_LIMITED_INFORMATION = 4096 + | eval PROCESS_VM_OPERATION = 8 + | eval PROCESS_VM_READ = 16 + | eval PROCESS_VM_WRITE = 32 + | eval PROCESS_DUP_HANDLE = 64 + | eval WMI_REQUIRED_ACCESS = PROCESS_QUERY_INFORMATION + PROCESS_QUERY_LIMITED_INFORMATION + PROCESS_VM_OPERATION + PROCESS_VM_READ + PROCESS_VM_WRITE + PROCESS_DUP_HANDLE + | eval PROCESS_ALL_ACCESS = 2097151 + | eval wmi_access_set = bit_and(g_access_decimal, WMI_REQUIRED_ACCESS) + | eval full_access_set = bit_and(g_access_decimal, PROCESS_ALL_ACCESS) + | where wmi_access_set == WMI_REQUIRED_ACCESS + OR full_access_set == PROCESS_ALL_ACCESS + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY user_id dest + signature_id signature granted_access Opcode + SourceImage SourceProcessGUID SourceProcessId + TargetImage TargetProcessGUID TargetProcessId + CallTrace vendor_product + + | eval CallTrace=split(CallTrace, "|") + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_wmi_impersonate_token_filter` how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. known_false_positives: administrator may execute impersonate wmi object script for auditing. Filter is needed. references: @@ -29,7 +67,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: wmiprvse.exe process having a duplicate or full Granted Access $GrantedAccess$ to $TargetImage$ process on $dest$ + message: The [$SourceImage$] requested the access mask [$granted_access$] from [$TargetImage$] on [$dest$]. This may indicate WMI token impersonation. +threat_objects: + - field: SourceImage + type: file_path analytic_story: - Qakbot - Water Gamayun diff --git a/detections/endpoint/windows_wmi_process_call_create.yml b/detections/endpoint/windows_wmi_process_call_create.yml index 3e93492d9ef..72ddb7df02c 100644 --- a/detections/endpoint/windows_wmi_process_call_create.yml +++ b/detections/endpoint/windows_wmi_process_call_create.yml @@ -2,7 +2,7 @@ name: Windows WMI Process Call Create id: 0661c2de-93de-11ec-9833-acde48001122 version: 9 creation_date: '2022-02-22' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -32,6 +32,7 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/2b804d25418004a5f1ba50e9dc637946ab8733c7/atomics/T1047/T1047.md - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L85 analytic_story: - Volt Typhoon - Qakbot @@ -40,6 +41,8 @@ analytic_story: - CISA AA23-347A - Cactus Ransomware asset_type: Endpoint +atomic_guid: + - b3bdfc91-b33e-4c6d-a5c8-d64bee0276b3 mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/windows_wmi_reconnaissance_class_query.yml b/detections/endpoint/windows_wmi_reconnaissance_class_query.yml index 414b2eb0dd1..5170634032b 100644 --- a/detections/endpoint/windows_wmi_reconnaissance_class_query.yml +++ b/detections/endpoint/windows_wmi_reconnaissance_class_query.yml @@ -2,7 +2,7 @@ name: Windows WMI Reconnaissance Class Query id: 5e38bd3e-5da7-483d-aa61-27f7e8c27ad1 version: 3 creation_date: '2026-03-16' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -64,6 +64,9 @@ how_to_implement: | known_false_positives: Administrators may execute this command for testing or auditing. references: - https://malpedia.caad.fkie.fraunhofer.de/details/py.blankgrabber + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L24 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1047/T1047.yaml#L43 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -91,6 +94,10 @@ threat_objects: analytic_story: - BlankGrabber Stealer asset_type: Endpoint +atomic_guid: + - c107778c-dcf5-47c5-af2e-1d058a3df3ea + - 5750aa16-0e59-4410-8b9a-8a47ca2788e2 + - 718aebaa-d0e0-471a-8241-c5afa69c7414 mitre_attack_id: - T1047 product: diff --git a/detections/endpoint/windows_wmic_shadowcopy_delete.yml b/detections/endpoint/windows_wmic_shadowcopy_delete.yml index aad14e502be..26a3b9d0b51 100644 --- a/detections/endpoint/windows_wmic_shadowcopy_delete.yml +++ b/detections/endpoint/windows_wmic_shadowcopy_delete.yml @@ -2,7 +2,7 @@ name: Windows WMIC Shadowcopy Delete id: 0a8c4b26-a4e2-4ef1-b0d9-62af6d36bdc8 version: 5 creation_date: '2025-03-18' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, AJ King, Splunk status: production type: Anomaly @@ -20,6 +20,7 @@ known_false_positives: Legitimate system maintenance or backup operations may oc references: - https://any.run/malware-trends/cactus - https://attack.mitre.org/techniques/T1490/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1490/T1490.yaml#L29 drilldown_searches: - name: View the detection results for - "$dest$" and "$process_name$" search: '%original_detection_search% | search dest = "$dest$" process_name = "$process_name$"' @@ -45,6 +46,8 @@ analytic_story: - Volt Typhoon - Suspicious WMI Use asset_type: Endpoint +atomic_guid: + - 6a3ff8dd-f49c-4272-a658-11c2fe58bd88 mitre_attack_id: - T1490 product: diff --git a/detections/endpoint/windows_wmic_systeminfo_discovery.yml b/detections/endpoint/windows_wmic_systeminfo_discovery.yml index e91dc6acd9f..e1c8573531c 100644 --- a/detections/endpoint/windows_wmic_systeminfo_discovery.yml +++ b/detections/endpoint/windows_wmic_systeminfo_discovery.yml @@ -2,7 +2,7 @@ name: Windows Wmic Systeminfo Discovery id: 97937ece-cb13-4dbc-9684-c0dc3afd400a version: 5 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -29,6 +29,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D known_false_positives: Administrators may execute this command for testing or auditing. references: - https://cert.gov.ua/article/6284730 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml#L381 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -58,6 +59,8 @@ analytic_story: - BlankGrabber Stealer - Lotus Blossom Chrysalis Backdoor asset_type: Endpoint +atomic_guid: + - 8851b73a-3624-4bf7-8704-aa312411565c mitre_attack_id: - T1082 product: diff --git a/detections/endpoint/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml index 12a5ee8fb33..43eb55bf2d1 100644 --- a/detections/endpoint/wmi_permanent_event_subscription.yml +++ b/detections/endpoint/wmi_permanent_event_subscription.yml @@ -1,43 +1,93 @@ name: WMI Permanent Event Subscription id: 71bfdb13-f200-4c6c-b2c9-a2e07adf437d -version: 10 +version: 11 creation_date: '2020-04-29' -modification_date: '2026-05-13' -author: Rico Valdez, Splunk -status: experimental -type: TTP -description: The following analytic detects the creation of permanent event subscriptions using Windows Management Instrumentation (WMI). It leverages Sysmon EventID 5 data to identify instances where the event consumers are not the expected "NTEventLogEventConsumer." This activity is significant because it suggests an attacker is attempting to achieve persistence by running malicious scripts or binaries in response to specific system events. If confirmed malicious, this could lead to severe impacts such as data theft, ransomware deployment, or other damaging outcomes. Investigate the associated scripts or binaries to identify the source of the attack. -data_source: [] +modification_date: '2026-10-09' +author: Rico Valdez, Nasreddine Bencherchali, Splunk +status: production +type: Anomaly +description: |- + Detects permanent WMI event subscriptions that are containing `CommandLineEventConsumer` or `ActiveScriptEventConsumer`. Due to their command execution capabilties, given WMI consumers are often leveraged by adversaries for both execution and persistence purposes. +data_source: + - Windows Event Log WMI Activity 5861 search: |- `wmi` EventCode=5861 - Binding - | rex field=Message "Consumer =\s+(?[^;|^$]+)" - | search consumer!="NTEventLogEventConsumer=\"SCM Event Log Consumer\"" + | spath input=_raw output=possible_cause path=Event.UserData.Operation_ESStoConsumerBinding.PossibleCause + | spath input=_raw output=consumer_xml path=Event.UserData.Operation_ESStoConsumerBinding.CONSUMER + | eval possible_cause=coalesce(possible_cause, Message) + | rex field=Message "(?i)Consumer\s*=\s*(?[^;\r\n]+)" + | eval consumer=coalesce(consumer_xml, consumer_message) + | where isnull(consumer) OR consumer!="NTEventLogEventConsumer=\"SCM Event Log Consumer\"" + | rex field=possible_cause "(?ms)instance of __EventFilter\s+\{(?.*?)\};\s*Perm\. Consumer:" + | rex field=event_filter "(?m)^\s*Name\s*=\s*\"(?[^\"]*)\"\s*;" + | rex field=event_filter "(?m)^\s*Query\s*=\s*\"(?.*?)\"\s*;" + | rex field=event_filter "(?m)^\s*EventNamespace\s*=\s*\"(?[^\"]*)\"\s*;" + | rex field=event_filter "(?m)^\s*QueryLanguage\s*=\s*\"(?[^\"]*)\"\s*;" + | rex field=possible_cause "(?s)Perm\. Consumer:\s+instance of (?[A-Za-z0-9_]+)\s+\{(?.*?)\};\s*\Z" + | rex field=consumer_properties "(?m)^\s*Name\s*=\s*\"(?[^\"]*)\"\s*;" + | rex field=consumer_properties "(?m)^\s*CommandLineTemplate\s*=\s*\"(?.*?)\"\s*;" + | rex field=consumer_properties "(?m)^\s*RunInteractively\s*=\s*(?[^;]+)\s*;" + | rex field=consumer_properties "(?m)^\s*ScriptingEngine\s*=\s*\"(?[^\"]*)\"\s*;" + | rex field=consumer_properties "(?ms)^\s*ScriptText\s*=\s*\"(?.*?)\"\s*;\s*$" + | where consumer_type IN ("CommandLineEventConsumer", "ActiveScriptEventConsumer") + | eval command=coalesce(command_line_template, script_text) + | fillnull value=NULL | stats count min(_time) as firstTime max(_time) as lastTime - by ComputerName, consumer, Message + values(consumer) as consumer + values(consumer_type) as consumer_type + values(consumer_name) as consumer_name + values(command_line_template) as command_line_template + values(run_interactively) as run_interactively + values(scripting_engine) as scripting_engine + values(script_text) as script_text + values(command) as command + by Computer, filter_name, filter_query, filter_event_namespace, filter_query_language | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | rename ComputerName as dest + | rename Computer as dest | `wmi_permanent_event_subscription_filter` -how_to_implement: To successfully implement this search, you must be ingesting the Windows WMI activity logs. This can be done by adding a stanza to inputs.conf on the system generating logs with a title of [WinEventLog://Microsoft-Windows-WMI-Activity/Operational]. -known_false_positives: Although unlikely, administrators may use event subscriptions for legitimate purposes. -references: [] -finding: - title: WMI Permanent Event Subscription detected on $dest$ - entity: - field: dest - type: system - score: 50 +how_to_implement: |- + Ingest Microsoft-Windows-WMI-Activity/Operational events and ensure EventCode, Computer, and the raw XML event are available. + The search uses spath to extract the binding details, then regex to parse the embedded __EventFilter and the supported CommandLineEventConsumer and ActiveScriptEventConsumer properties. For non-XML rendered events, Message is used as a fallback for the consumer details. +known_false_positives: |- + Administrators and software may use permanent WMI event subscriptions. Review the consumer, filter query, and creator context; tune known authorized subscriptions with the detection filter macro. +references: + - https://learn.microsoft.com/en-us/windows/win32/wmisdk/binding-an-event-filter-with-a-logical-consumer + - https://learn.microsoft.com/en-us/windows/win32/wmisdk/commandlineeventconsumer + - https://learn.microsoft.com/en-us/windows/win32/wmisdk/activescripteventconsumer + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L44 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L86 +intermediate_findings: + entities: + - field: dest + type: system + score: 20 + message: WMI event filter [$filter_name$] in [$filter_event_namespace$] watches [$filter_query$] and is bound to [$consumer_type$] [$consumer_name$] on [$dest$], which can execute [$command$]. +threat_objects: + - field: command + type: command analytic_story: - Suspicious WMI Use asset_type: Endpoint +atomic_guid: + - 3c64f177-28e2-49eb-a799-d767b24dd1e0 + - fecd0dfd-fb55-45fa-a10b-6250272d0832 + - 29786d7e-8916-4de6-9c55-be7b093b2706 mitre_attack_id: - - T1047 + - T1546.003 product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud category: endpoint security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team_wmi_subscription/wmi.log + source: XmlWinEventLog:Microsoft-Windows-WMI-Activity/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index f876f349a24..14db112d4c3 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -1,33 +1,43 @@ name: WMI Permanent Event Subscription - Sysmon id: ad05aae6-3b2a-4f73-af97-57bd26cee3b9 -version: 12 +version: 13 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-10-09' author: Rico Valdez, Michael Haag, Splunk status: production -type: TTP -description: The following analytic identifies the creation of WMI permanent event subscriptions, which can be used to establish persistence or perform privilege escalation. It leverages Sysmon data, specifically EventCodes 19, 20, and 21, to detect the creation of WMI EventFilters, EventConsumers, and FilterToConsumerBindings. This activity is significant as it may indicate an attacker setting up mechanisms to execute code with elevated SYSTEM privileges when specific events occur. If confirmed malicious, this could allow the attacker to maintain persistence, escalate privileges, and execute arbitrary code, posing a severe threat to the environment. +type: Anomaly +description: |- + Detects the creation, modification or deletion of a WMI permanent event subscription using Sysmon EventID 21. data_source: - Sysmon EventID 21 search: |- - `sysmon` EventCode=21 - | stats count min(_time) as firstTime max(_time) as lastTime - BY dest dvc object - object_attrs object_category object_path - signature signature_id src - status user user_id - vendor_product Consumer ConsumerNoQuotes - Filter FilterNoQuotes - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `wmi_permanent_event_subscription___sysmon_filter` -how_to_implement: To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity (eventID= 19, 20, 21). In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields. -known_false_positives: Although unlikely, administrators may use event subscriptions for legitimate purposes. + `sysmon` + EventCode=21 + Operation IN ( + Created, + Deleted, + Modified + ) + + | stats count min(_time) as firstTime + max(_time) as lastTime + BY dest user Consumer Filter + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `wmi_permanent_event_subscription___sysmon_filter` +how_to_implement: |- + To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity (eventID= 19, 20, 21). In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields. +known_false_positives: |- + Administrators and software may create authorized WMI subscriptions. Review the consumer and filter paths, then tune known authorized subscriptions with the detection filter macro. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ - https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/WMI-events.md - https://in.security/2019/04/03/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/ + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L5 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L44 + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L86 drilldown_searches: - name: View the detection results for - "$dest$" and "$user$" search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' @@ -37,21 +47,19 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: WMI Permanent Event Subscription detected on $dest$ by $user$ - entity: - field: user - type: user - score: 50 intermediate_findings: entities: - field: dest type: system score: 50 - message: WMI Permanent Event Subscription detected on $dest$ by $user$ + message: A WMI consumer-to-filter binding was on [$dest$] by [$user$] consumer - [$Consumer$] was bound to filter [$Filter$]. analytic_story: - Suspicious WMI Use asset_type: Endpoint +atomic_guid: + - 3c64f177-28e2-49eb-a799-d767b24dd1e0 + - fecd0dfd-fb55-45fa-a10b-6250272d0832 + - 29786d7e-8916-4de6-9c55-be7b093b2706 mitre_attack_id: - T1546.003 product: diff --git a/detections/endpoint/wmic_group_discovery.yml b/detections/endpoint/wmic_group_discovery.yml index 2afa39f3c54..f8a291d67da 100644 --- a/detections/endpoint/wmic_group_discovery.yml +++ b/detections/endpoint/wmic_group_discovery.yml @@ -2,7 +2,7 @@ name: Wmic Group Discovery id: 83317b08-155b-11ec-8e00-acde48001122 version: 12 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: Anomaly @@ -30,6 +30,7 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://attack.mitre.org/techniques/T1069/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1069.001/T1069.001.yaml#L83 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -58,6 +59,8 @@ analytic_story: - Active Directory Discovery - LAMEHUG asset_type: Endpoint +atomic_guid: + - 7413be50-be8e-430f-ad4d-07bf197884b2 mitre_attack_id: - T1069.001 product: diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml index 62ae6bd88a3..c3688205fd8 100644 --- a/detections/endpoint/wmic_xsl_execution_via_url.yml +++ b/detections/endpoint/wmic_xsl_execution_via_url.yml @@ -2,7 +2,7 @@ name: WMIC XSL Execution via URL id: 787e9dd0-4328-11ec-a029-acde48001122 version: 14 creation_date: '2021-11-12' -modification_date: '2026-07-14' +modification_date: '2026-10-02' author: Michael Haag, Splunk status: production type: TTP @@ -53,6 +53,7 @@ references: - https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-4---wmic-bypass-using-remote-xsl-file - https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN-201017061100.html + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1220/T1220.yaml#L126 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -84,6 +85,8 @@ analytic_story: - Suspicious WMI Use - Cisco Network Visibility Module Analytics asset_type: Endpoint +atomic_guid: + - 7f5be499-33be-4129-a560-66021f379b9b mitre_attack_id: - T1220 product: diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml index d37e6117534..5497c015bc5 100644 --- a/detections/endpoint/xsl_script_execution_with_wmic.yml +++ b/detections/endpoint/xsl_script_execution_with_wmic.yml @@ -2,7 +2,7 @@ name: XSL Script Execution With WMIC id: 004e32e2-146d-11ec-a83f-acde48001122 version: 13 creation_date: '2021-09-14' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Splunk status: production type: TTP @@ -32,6 +32,7 @@ references: - https://attack.mitre.org/groups/G0046/ - https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-3---wmic-bypass-using-local-xsl-file + - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1220/T1220.yaml#L92 drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -62,6 +63,8 @@ analytic_story: - FIN7 - Suspicious WMI Use asset_type: Endpoint +atomic_guid: + - 1b237334-3e21-4a0c-8178-b8c996124988 mitre_attack_id: - T1220 product: diff --git a/detections/network/3cx_supply_chain_attack_network_indicators.yml b/detections/network/3cx_supply_chain_attack_network_indicators.yml index 6c02019581c..946c2451347 100644 --- a/detections/network/3cx_supply_chain_attack_network_indicators.yml +++ b/detections/network/3cx_supply_chain_attack_network_indicators.yml @@ -1,8 +1,8 @@ name: 3CX Supply Chain Attack Network Indicators id: 791b727c-deec-4fbe-a732-756131b3c5a1 -version: 11 +version: 12 creation_date: '2023-04-11' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Michael Haag, Splunk status: production type: TTP @@ -22,7 +22,7 @@ search: | | `drop_dm_object_name(DNS)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup 3cx_ioc_domains domain as query OUTPUT Description isIOC + | lookup local=t 3cx_ioc_domains domain as query OUTPUT Description isIOC | search isIOC=true | `3cx_supply_chain_attack_network_indicators_filter` how_to_implement: To successfully implement this search you need to be ingesting information into the `Network Resolution` datamodel in the `DNS` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA''s are installed. diff --git a/detections/network/cisco_secure_firewall___binary_file_type_download.yml b/detections/network/cisco_secure_firewall___binary_file_type_download.yml index 52fa1549919..1eb6a299ddb 100644 --- a/detections/network/cisco_secure_firewall___binary_file_type_download.yml +++ b/detections/network/cisco_secure_firewall___binary_file_type_download.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Binary File Type Download id: 24b2c2e3-2ff7-4a23-b814-87f8a62028cd -version: 8 +version: 9 creation_date: '2025-04-09' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -16,7 +16,7 @@ data_source: search: | `cisco_secure_firewall` EventType=FileEvent FileDirection="Download" FileType IN ("ISHIELD_MSI", "BINHEX", "BINARY_DATA", "ELF", "MACHO", "JARPACK", "TORRENT", "AUTORUN", "EICAR", "LNK", "SCR", "UNIX_SCRIPT") - | lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description + | lookup local=t cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description | stats count min(_time) as firstTime max(_time) as lastTime values(uri) as uri values(ClientApplication) as ClientApplication diff --git a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml index 7103a3112fe..68cbf8d2749 100644 --- a/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml +++ b/detections/network/cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint id: c43f7b49-2dab-4e76-892e-7f971c2f20f1 -version: 7 +version: 8 creation_date: '2025-04-03' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: TTP @@ -12,7 +12,7 @@ data_source: - Cisco Secure Firewall Threat Defense Connection Event search: | `cisco_secure_firewall` EventType=* SSL_CertFingerprint=* - | lookup sslbl_ssl_certificate_blacklist SHA1 as SSL_CertFingerprint OUTPUT Listingdate, Listingreason + | lookup local=t sslbl_ssl_certificate_blacklist SHA1 as SSL_CertFingerprint OUTPUT Listingdate, Listingreason | where isnotnull(Listingreason) | stats min(_time) as firstTime max(_time) as lastTime values(dest) as dest diff --git a/detections/network/cisco_secure_firewall___file_download_over_uncommon_port.yml b/detections/network/cisco_secure_firewall___file_download_over_uncommon_port.yml index 301f42145e7..a6b4cb4e230 100644 --- a/detections/network/cisco_secure_firewall___file_download_over_uncommon_port.yml +++ b/detections/network/cisco_secure_firewall___file_download_over_uncommon_port.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - File Download Over Uncommon Port id: f26445a8-a6a2-4855-bec0-0c39e52e5b8f -version: 8 +version: 9 creation_date: '2025-04-09' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -12,7 +12,7 @@ data_source: - Cisco Secure Firewall Threat Defense File Event search: | `cisco_secure_firewall` EventType=FileEvent FileDirection="Download" NOT dest_port IN (80, 443) - | lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description + | lookup local=t cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description | stats count min(_time) as firstTime max(_time) as lastTime values(file_name) as file_name values(uri) as uri diff --git a/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml b/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml index 871d3190a60..518f8f97ff4 100644 --- a/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml +++ b/detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Intrusion Events by Threat Activity id: b71e57e8-c571-4ff1-ae13-bc4384a9e891 -version: 10 +version: 11 creation_date: '2025-05-12' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Bhavin Patel, Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -40,11 +40,11 @@ data_source: search: | `cisco_secure_firewall` EventType=IntrusionEvent | stats count AS total_alerts, dc(signature_id) AS sig_count, values(SnortRuleGroups) AS snort_rule_groups, values(connection_id) AS connection_id, values(rule) AS rule, values(dest_port) AS dest_port, values(transport) AS transport, values(app) AS app, values(signature) AS signature, values(src) AS src BY _time dest signature_id - | lookup cisco_snort_ids_to_threat_mapping signature_id OUTPUT threat, category, message + | lookup local=t cisco_snort_ids_to_threat_mapping signature_id OUTPUT threat, category, message | where isnotnull(threat) | bin _time span=1d | stats count AS Total_Alerts, dc(signature_id) AS sig_count, values(signature_id) AS signature_id, values(category) AS category, values(message) AS message, values(snort_rule_groups) AS snort_rule_groups, values(connection_id) AS connection_id, values(rule) AS rule, values(dest_port) AS dest_port, values(transport) AS transport, values(app) AS app, values(signature) AS signature, values(src) AS src BY _time dest threat - | lookup threat_snort_count threat OUTPUT description, distinct_count_snort_ids + | lookup local=t threat_snort_count threat OUTPUT description, distinct_count_snort_ids | table _time, dest, src, threat, category, message, description, signature_id, signature, snort_rule_groups, sig_count, distinct_count_snort_ids, connection_id, rule, dest_port, transport, app | where sig_count >= distinct_count_snort_ids | `cisco_secure_firewall___intrusion_events_by_threat_activity_filter` diff --git a/detections/network/cisco_secure_firewall___malware_file_downloaded.yml b/detections/network/cisco_secure_firewall___malware_file_downloaded.yml index c4280c02106..b32cf7b6ae5 100644 --- a/detections/network/cisco_secure_firewall___malware_file_downloaded.yml +++ b/detections/network/cisco_secure_firewall___malware_file_downloaded.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Malware File Downloaded id: 3cc93f52-5aa6-4b7f-83b9-3430b1436813 -version: 8 +version: 9 creation_date: '2025-04-09' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -12,7 +12,7 @@ data_source: - Cisco Secure Firewall Threat Defense File Event search: | `cisco_secure_firewall` EventType=FileEvent SHA_Disposition="Malware" FileDirection="Download" - | lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description + | lookup local=t cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description | stats count min(_time) as firstTime max(_time) as lastTime values(uri) as uri values(ClientApplication) as ClientApplication diff --git a/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml b/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml index 64793a40b67..8b32c0275e8 100644 --- a/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml +++ b/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Remote Access Software Usage Traffic id: ac54d39e-a75d-4f42-971d-006db3a0423a -version: 9 +version: 10 creation_date: '2025-05-28' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -26,7 +26,7 @@ search: | count by src ClientApplication action | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools appName AS ClientApplication OUTPUT category, appDescription as Description + | lookup local=t cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools appName AS ClientApplication OUTPUT category, appDescription as Description | search category IN ("remote administration", "remote desktop control") | `remote_access_software_usage_exceptions` | `cisco_secure_firewall___remote_access_software_usage_traffic_filter` diff --git a/detections/network/cisco_secure_firewall___repeated_malware_downloads.yml b/detections/network/cisco_secure_firewall___repeated_malware_downloads.yml index 12bf62ba6f7..972b7aeb41c 100644 --- a/detections/network/cisco_secure_firewall___repeated_malware_downloads.yml +++ b/detections/network/cisco_secure_firewall___repeated_malware_downloads.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Repeated Malware Downloads id: aeff2bb5-3483-48d4-9be8-c8976194be1e -version: 10 +version: 11 creation_date: '2025-04-09' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -12,7 +12,7 @@ data_source: - Cisco Secure Firewall Threat Defense File Event search: | `cisco_secure_firewall` EventType=FileEvent SHA_Disposition="Malware" FileDirection="Download" - | lookup cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description + | lookup local=t cisco_secure_firewall_filetype_lookup Name as FileType OUTPUT Description | bin _time span=5m | stats count min(_time) as firstTime max(_time) as lastTime values(uri) as uri diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml index 6d14e36bc2c..c3a4f069d99 100644 --- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml +++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml @@ -1,8 +1,8 @@ name: Detect hosts connecting to dynamic domain providers id: a1e761ac-1344-4dbd-88b2-3f34c912d359 -version: 13 +version: 14 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Bhavin Patel, Splunk status: production type: TTP @@ -18,8 +18,8 @@ search: | DNS.reply_code_id DNS.src DNS.vendor_product | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` - | lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default - | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local + | lookup local=t update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default + | lookup local=t update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local | eval isDynDNS = coalesce(isDynDNS_local,isDynDNS_default) |fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True | `detect_hosts_connecting_to_dynamic_domain_providers_filter` diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml index 1171d0c58f2..dc927f67a6f 100644 --- a/detections/network/detect_remote_access_software_usage_dns.yml +++ b/detections/network/detect_remote_access_software_usage_dns.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage DNS id: a16b797d-e309-41bd-8ba0-5067dae2e4be -version: 14 +version: 15 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -22,7 +22,7 @@ search: | | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup remote_access_software remote_domain AS query OUTPUT isutility, description as signature, + | lookup local=t remote_access_software remote_domain AS query OUTPUT isutility, description as signature, comment_reference as desc, category | eval dest = query | search isutility = True diff --git a/detections/network/detect_remote_access_software_usage_traffic.yml b/detections/network/detect_remote_access_software_usage_traffic.yml index 17fe2236b8d..f0883920752 100644 --- a/detections/network/detect_remote_access_software_usage_traffic.yml +++ b/detections/network/detect_remote_access_software_usage_traffic.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage Traffic id: 885ea672-07ee-475a-879e-60d28aa5dd42 -version: 16 +version: 17 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -30,7 +30,7 @@ search: | | `drop_dm_object_name("All_Traffic")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup remote_access_software remote_appid AS app OUTPUT isutility, description as signature, comment_reference as desc, category + | lookup local=t remote_access_software remote_appid AS app OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_traffic_filter` diff --git a/detections/network/dns_kerberos_coercion.yml b/detections/network/dns_kerberos_coercion.yml index c5ec0f6c163..3b6869045af 100644 --- a/detections/network/dns_kerberos_coercion.yml +++ b/detections/network/dns_kerberos_coercion.yml @@ -1,8 +1,8 @@ name: DNS Kerberos Coercion id: 8551252d-b5b6-4b6e-8a82-51460aeb29a3 -version: 5 +version: 6 creation_date: '2025-11-18' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Raven Tait, Splunk status: production type: TTP @@ -42,6 +42,9 @@ finding: field: src type: system score: 50 +threat_objects: + - field: query + type: dns_query analytic_story: - Compromised Windows Host - Suspicious DNS Traffic diff --git a/detections/network/http_c2_framework_user_agent.yml b/detections/network/http_c2_framework_user_agent.yml index a442d265c5b..db8c77cf01a 100644 --- a/detections/network/http_c2_framework_user_agent.yml +++ b/detections/network/http_c2_framework_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP C2 Framework User Agent id: 229dc225-6abe-4d28-89fd-edf874086162 -version: 5 +version: 6 creation_date: '2026-01-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Ravent Tait, Splunk status: production type: TTP @@ -15,7 +15,7 @@ search: |- BY Web.http_user_agent Web.http_method, Web.url, Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` - | lookup suspicious_c2_user_agents c2_user_agent AS http_user_agent OUTPUT tool, description + | lookup local=t suspicious_c2_user_agents c2_user_agent AS http_user_agent OUTPUT tool, description | where isnotnull(tool) | stats count min(firstTime) as first_seen max(lastTime) as last_seen BY tool url http_user_agent diff --git a/detections/network/http_malware_user_agent.yml b/detections/network/http_malware_user_agent.yml index df79a6ba052..5490fc528f5 100644 --- a/detections/network/http_malware_user_agent.yml +++ b/detections/network/http_malware_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP Malware User Agent id: 8c4866e4-f488-4253-8537-7dc4f954c292 -version: 5 +version: 6 creation_date: '2026-01-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: TTP @@ -15,7 +15,7 @@ search: |- BY Web.http_user_agent Web.http_method, Web.url, Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` - | lookup malware_user_agents malware_user_agent AS http_user_agent OUTPUT malware + | lookup local=t malware_user_agents malware_user_agent AS http_user_agent OUTPUT malware | where isnotnull(malware) | stats count min(firstTime) as first_seen max(lastTime) as last_seen BY malware url http_user_agent diff --git a/detections/network/http_post_request_with_encoded_payload.yml b/detections/network/http_post_request_with_encoded_payload.yml new file mode 100644 index 00000000000..f05fb1a082d --- /dev/null +++ b/detections/network/http_post_request_with_encoded_payload.yml @@ -0,0 +1,89 @@ +name: HTTP POST Request with Encoded Payload +id: 0590881d-7b81-48dd-9674-1f23f7db5d40 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex-encoded bytes or base64-encoded strings. + It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex escape sequences or sixteen or more consecutive base64 character groups. + This activity is significant as adversaries commonly use hex or base64 encoding to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads. +data_source: + - Zeek HTTP +search: |- + `zeek_http` + method="POST" + post_body="*" + + | eval dest_port=coalesce(dest_port, 'id.resp_p'), + dest=coalesce(dest, dest_ip, 'id.resp_h'), + src=coalesce(src, src_ip, 'id.orig_h') + + | eval _hex=if(match(post_body, "(?:\\\\x[0-9a-fA-F]{2}){8,}|(?:%[0-9a-fA-F]{2}){8,}"), 1, 0) + | eval _b64=if(match(post_body, "(?:[A-Za-z0-9+/]{4}){16,}={0,2}"), 1, 0) + + | where _hex=1 OR _b64=1 + + | eval encoding_type=case(_hex=1 AND _b64=1, "Hexadecimal + Base64", _hex=1, "Hexadecimal", _b64=1, "Base64") + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(encoding_type) as encoding_type + values(post_body) as post_body + + by src dest dest_port uri method status_code + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `http_post_request_with_encoded_payload_filter` +how_to_implement: |- + Zeek HTTP logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466). + The "post_body" field must be populated, which requires Zeek to be configured with the HTTP post body extraction policy. + Configure the `zeek_http` macro to match the sourcetype used by your Zeek add-on. +known_false_positives: |- + Legitimate applications may POST base64-encoded data, particularly APIs that transmit binary content. + Review the destination, URI, and post body content to confirm whether the activity is expected. +references: + - https://attack.mitre.org/techniques/T1071/001/ + - https://attack.mitre.org/techniques/T1132/001/ + - https://docs.zeek.org/en/master/logs/http.html +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$id.orig_h$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: An HTTP POST request with an encoded body of type [$encoding_type$] was detected from [$src$] to [$dest$] over port [$dest_port$] to URI - [$uri$]. +threat_objects: + - field: uri + type: uri +analytic_story: + - Command And Control + - Data Exfiltration +asset_type: Network +mitre_attack_id: + - T1071.001 + - T1132.001 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: network +security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.001/zeek_http_encoded_post/http.log + sourcetype: zeek:http + source: http.log + test_type: unit diff --git a/detections/network/http_pua_user_agent.yml b/detections/network/http_pua_user_agent.yml index a20df5452a6..b05dd3386e3 100644 --- a/detections/network/http_pua_user_agent.yml +++ b/detections/network/http_pua_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP PUA User Agent id: 21af5447-734f-4549-956b-7a255cb2b032 -version: 5 +version: 6 creation_date: '2026-01-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: Anomaly @@ -15,7 +15,7 @@ search: |- BY Web.http_user_agent Web.http_method, Web.url, Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` - | lookup pua_user_agents pua_user_agent AS http_user_agent OUTPUT tool + | lookup local=t pua_user_agents pua_user_agent AS http_user_agent OUTPUT tool | where isnotnull(tool) | stats count min(firstTime) as first_seen max(lastTime) as last_seen BY tool url http_user_agent diff --git a/detections/network/http_rmm_user_agent.yml b/detections/network/http_rmm_user_agent.yml index dde34ab9e5d..1ad50d30cb3 100644 --- a/detections/network/http_rmm_user_agent.yml +++ b/detections/network/http_rmm_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP RMM User Agent id: 61884b02-0dcf-44c5-9094-db33bac09fa6 -version: 5 +version: 6 creation_date: '2026-01-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: Anomaly @@ -15,7 +15,7 @@ search: |- BY Web.http_user_agent Web.http_method, Web.url, Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` - | lookup rmm_user_agents rmm_user_agent AS http_user_agent OUTPUT tool + | lookup local=t rmm_user_agents rmm_user_agent AS http_user_agent OUTPUT tool | where isnotnull(tool) | stats count min(firstTime) as first_seen max(lastTime) as last_seen BY tool url http_user_agent diff --git a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml index 3e03807d675..800abe5718a 100644 --- a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml +++ b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml @@ -1,8 +1,8 @@ name: Internal Horizontal Port Scan NMAP Top 20 id: 3141a041-4f57-4277-9faa-9305ca1f8e5b -version: 12 +version: 13 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Dean Luxton status: production type: TTP @@ -77,6 +77,9 @@ finding: field: src_ip type: system score: 50 +threat_objects: + - field: src_ip + type: ip_address analytic_story: - Network Discovery - Cisco Secure Firewall Threat Defense Analytics diff --git a/detections/network/prohibited_network_traffic_allowed.yml b/detections/network/prohibited_network_traffic_allowed.yml index 155b55babb0..d305d4f139f 100644 --- a/detections/network/prohibited_network_traffic_allowed.yml +++ b/detections/network/prohibited_network_traffic_allowed.yml @@ -1,30 +1,56 @@ name: Prohibited Network Traffic Allowed id: ce5a0962-849f-4720-a678-753fe6674479 -version: 14 +version: 16 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Rico Valdez, Splunk status: production -type: TTP -description: The following analytic detects instances where network traffic, identified by port and transport layer protocol as prohibited in the "lookup_interesting_ports" table, is allowed. It uses the Network_Traffic data model to cross-reference traffic data against predefined security policies. This activity is significant for a SOC as it highlights potential misconfigurations or policy violations that could lead to unauthorized access or data exfiltration. If confirmed malicious, this could allow attackers to bypass network defenses, leading to potential data breaches and compromising the organization's security posture. +type: Anomaly +description: |- + The following analytic detects instances where network traffic, identified by port and transport layer protocol as prohibited in the "lookup_interesting_ports" table, is allowed. + It uses the Network_Traffic data model to cross-reference traffic data against predefined security policies. + This activity is significant for a SOC as it highlights potential misconfigurations or policy violations that could lead to unauthorized access or data exfiltration. + If confirmed malicious, this could allow attackers to bypass network defenses, leading to potential data breaches and compromising the organization's security posture. data_source: - Cisco Secure Firewall Threat Defense Connection Event search: |- - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Traffic - WHERE All_Traffic.action IN ("allowed", "allow") [ - | inputlookup interesting_ports_lookup where is_prohibited="true" - | table dest_port transport - | dedup dest_port transport - | rename dest_port as All_Traffic.dest_port - | rename transport as All_Traffic.transport] by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action All_Traffic.dvc All_Traffic.src_port All_Traffic.vendor_product All_Traffic.rule - | lookup update=true interesting_ports_lookup dest_port as All_Traffic.dest_port transport as All_Traffic.transport OUTPUT app is_prohibited note + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + values(All_Traffic.src_port) as src_port + values(All_Traffic.action) as action + values(All_Traffic.rule) as rule + + FROM datamodel=Network_Traffic WHERE + + All_Traffic.action IN ("allowed", "allow") + [ + | inputlookup interesting_ports_lookup where is_prohibited="true" + | table dest_port transport + | dedup dest_port transport + | rename dest_port as All_Traffic.dest_port + | rename transport as All_Traffic.transport + ] + + by All_Traffic.src_ip All_Traffic.dest_ip + All_Traffic.dest_port All_Traffic.dvc + All_Traffic.transport All_Traffic.vendor_product + + | lookup local=t update=true interesting_ports_lookup dest_port as All_Traffic.dest_port transport as All_Traffic.transport OUTPUT app is_prohibited note + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")` | `prohibited_network_traffic_allowed_filter` -how_to_implement: In order to properly run this search, Splunk needs to ingest data from firewalls or other network control devices that mediate the traffic allowed into an environment. This is necessary so that the search can identify an 'action' taken on the traffic of interest. The search requires the Network_Traffic data model be populated. -known_false_positives: No false positives have been identified at this time. -references: [] +how_to_implement: |- + In order to properly run this search, Splunk needs to ingest data from firewalls or other network control devices that mediate the traffic allowed into an environment. + This is necessary so that the search can identify an 'action' taken on the traffic of interest. + The search also requires the Network_Traffic data model be populated. +known_false_positives: |- + The "interesting_ports_lookup" lookup considers communication to ports like 20, 21 for FTP, 23 for Telnet, 110 for POP3, etc. as prohibited traffic. Which may result in a lot of alerts in certain environments that still rely on these ports for legitimate traffic. Tune as needed. +references: + - https://securityscorecard.com/blog/ftp-security-risks/ + - https://secoraconsulting.com/blog/telnet-security-risks/ drilldown_searches: - name: View the detection results for - "$src_ip$" search: '%original_detection_search% | search src_ip = "$src_ip$"' @@ -34,12 +60,12 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: Potentially Prohibited Network Traffic allowed from $src_ip$ - entity: - field: src_ip - type: system - score: 50 +intermediate_findings: + entities: + - field: src_ip + type: system + score: 20 + message: Potentially Prohibited Network Traffic on Port [$dest_port$] via Protocol [$transport$] allowed from [$src_ip$]. threat_objects: - field: dest_ip type: ip_address @@ -57,13 +83,10 @@ product: - Splunk Cloud category: network security_domain: network -baselines: - - Count of Unique IPs Connecting to Ports tests: - name: Cisco Secure Firewall True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events.log source: not_applicable sourcetype: cisco:sfw:estreamer - description: PORTED MANUAL TEST - This detection uses a builtin lookup from Enterprise Security. - test_type: experimental + test_type: unit diff --git a/detections/network/unusual_ssh_client_banner.yml b/detections/network/unusual_ssh_client_banner.yml new file mode 100644 index 00000000000..5bd366d59ea --- /dev/null +++ b/detections/network/unusual_ssh_client_banner.yml @@ -0,0 +1,102 @@ +name: Unusual SSH Client Banner +id: 93d0f598-d65f-4c97-b030-5bb0af51a226 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects SSH connections presenting client banners that do not match known, common SSH client software by leveraging Zeek ssh logs. + Unusual or unknown SSH client banners may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement. +data_source: + - Zeek SSH +search: |- + `zeek_ssh` + client="*" + NOT client IN ( + "SSH-2.0-AsyncSSH*", + "SSH-2.0-Bitvise*", + "SSH-2.0-Cisco*", + "SSH-2.0-CyberArk*", + "SSH-2.0-dropbear*", + "SSH-2.0-FileZilla*", + "SSH-2.0-Go*", + "SSH-2.0-JSCH*", + "SSH-2.0-Juniper*", + "SSH-2.0-libssh*", + "SSH-2.0-MobaXterm*", + "SSH-2.0-OpenSSH*", + "SSH-2.0-paramiko*", + "SSH-2.0-PuTTY*", + "SSH-2.0-Renci.SshNet*", + "SSH-2.0-SecureCRT*", + "SSH-2.0-ssh2*", + "SSH-2.0-TTSSH*", + "SSH-2.0-WinSCP*", + "SSH-2.0-Xshell*" + ) + + | eval dest_port=coalesce(dest_port, 'id.resp_p'), + dest=coalesce(dest, dest_ip, 'id.resp_h'), + src=coalesce(src, src_ip, 'id.orig_h') + + | fillnull value=NULL + + | stats count min(_time) as firstTime + max(_time) as lastTime + values(client) as client + values(post_body) as post_body + + by src dest dest_port + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `unusual_ssh_client_banner_filter` +how_to_implement: |- + Zeek SSH logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466). + The client field should be populated from the SSH handshake banner. + Configure the `zeek_ssh` macro to match the sourcetype used by your Zeek add-on. +known_false_positives: |- + Legitimate but uncommon SSH client software not included will generate false positives. + Review the client banner and tune the filter accordingly. +references: + - https://docs.zeek.org/en/master/logs/ssh.html + - https://attack.mitre.org/techniques/T1021/004/ + - https://attack.mitre.org/techniques/T1572/ +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$id.orig_h$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: An unusual SSH client banner [$client$] was observed from [$src$] connecting to [$dest$] over port [$dest_port$]. +threat_objects: [] +analytic_story: + - Ingress Tool Transfer + - Command And Control +asset_type: Network +mitre_attack_id: + - T1021.004 + - T1572 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: network +security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/zeek_ssh_unusual_client/ssh.log + sourcetype: zeek:ssh + source: ssh.log + test_type: unit diff --git a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml index 95a935dad41..f844c996807 100644 --- a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml +++ b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml @@ -1,8 +1,8 @@ name: Citrix ADC Exploitation CVE-2023-3519 id: 76ac2dcb-333c-4a77-8ae9-2720cfae47a8 -version: 9 +version: 10 creation_date: '2023-07-21' -modification_date: '2026-05-13' +modification_date: '2026-09-01' author: Michael Haag, Splunk status: production type: Hunting @@ -21,16 +21,18 @@ search: |- Web.http_method=POST Web.url IN ( "*/cgi/logout", + "*/cgi/samlart?samlart=*", + "*/cgi/samlauth", + "*/gwtest/formssso?event=start&target=*", + "*/netscaler/ns_gui/vpn/*", "*/saml/activelogin", - "*/saml/login", - "/cgi/samlart?samlart=*", - "/cgi/samlauth", - "/gwtest/formssso?event=start&target=*", - "/netscaler/ns_gui/vpn/*" + "*/saml/login" ) - BY Web.http_user_agent, Web.status + + BY Web.http_user_agent Web.status Web.http_method Web.url Web.url_length Web.src Web.dest + | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/web/crushftp_authentication_bypass_exploitation.yml b/detections/web/crushftp_authentication_bypass_exploitation.yml index f86f476bc0c..58545166f2e 100644 --- a/detections/web/crushftp_authentication_bypass_exploitation.yml +++ b/detections/web/crushftp_authentication_bypass_exploitation.yml @@ -1,8 +1,8 @@ name: CrushFTP Authentication Bypass Exploitation id: 82eb7f64-d219-4e21-acfe-956de84c1a35 -version: 6 +version: 7 creation_date: '2025-04-14' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Michael Haag, Splunk status: production type: TTP @@ -37,6 +37,9 @@ intermediate_findings: type: system score: 50 message: Potential CrushFTP authentication bypass exploitation from IP $src_ip$ as user $user$ +threat_objects: + - field: process + type: process analytic_story: - CrushFTP Vulnerabilities - Hellcat Ransomware diff --git a/detections/web/crushftp_max_simultaneous_users_from_ip.yml b/detections/web/crushftp_max_simultaneous_users_from_ip.yml index 2417444f997..58f97fc476a 100644 --- a/detections/web/crushftp_max_simultaneous_users_from_ip.yml +++ b/detections/web/crushftp_max_simultaneous_users_from_ip.yml @@ -1,8 +1,8 @@ name: CrushFTP Max Simultaneous Users From IP id: 75dfd9f4-ca64-45d0-9422-4bde6d26a59e -version: 5 +version: 6 creation_date: '2025-04-14' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Michael Haag, Splunk status: production type: Anomaly @@ -31,6 +31,9 @@ intermediate_findings: type: system score: 20 message: Potential brute force or automated attack against CrushFTP detected from IP $src_ip$ +threat_objects: + - field: src_ip + type: ip_address analytic_story: - CrushFTP Vulnerabilities asset_type: Web Server diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml index 1a8700de2a4..228dd2e6a28 100644 --- a/detections/web/detect_remote_access_software_usage_url.yml +++ b/detections/web/detect_remote_access_software_usage_url.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage URL id: 9296f515-073c-43a5-88ec-eda5a4626654 -version: 16 +version: 17 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -35,7 +35,7 @@ search: | | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("Web")` - | lookup remote_access_software remote_domain AS url_domain OUTPUT isutility, description as signature, comment_reference + | lookup local=t remote_access_software remote_domain AS url_domain OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = True | `remote_access_software_usage_exceptions` diff --git a/detections/web/http_scripting_tool_user_agent.yml b/detections/web/http_scripting_tool_user_agent.yml index 629822d8ddf..2a3328ef834 100644 --- a/detections/web/http_scripting_tool_user_agent.yml +++ b/detections/web/http_scripting_tool_user_agent.yml @@ -1,8 +1,8 @@ name: HTTP Scripting Tool User Agent id: 04430b4e-5ca8-4e88-98b5-d6bcf54f8393 -version: 6 +version: 7 creation_date: '2025-10-21' -modification_date: '2026-06-15' +modification_date: '2026-09-22' author: Raven Tait, Splunk status: production type: Anomaly @@ -22,7 +22,7 @@ search: |- | `security_content_ctime(lastTime)` | `drop_dm_object_name(Web)` | eval http_user_agent = lower(http_user_agent) - | lookup scripting_tools_user_agents tool_user_agent AS http_user_agent OUTPUT tool + | lookup local=t scripting_tools_user_agents tool_user_agent AS http_user_agent OUTPUT tool | where isnotnull(tool) | stats count min(firstTime) as first_seen diff --git a/detections/web/log4shell_jndi_payload_injection_attempt.yml b/detections/web/log4shell_jndi_payload_injection_attempt.yml index a1ea25c3f5f..e6c6582a0f7 100644 --- a/detections/web/log4shell_jndi_payload_injection_attempt.yml +++ b/detections/web/log4shell_jndi_payload_injection_attempt.yml @@ -1,8 +1,8 @@ name: Log4Shell JNDI Payload Injection Attempt id: c184f12e-5c90-11ec-bf1f-497c9a704a72 -version: 9 +version: 10 creation_date: '2021-12-13' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Jose Hernandez status: production type: Anomaly @@ -38,6 +38,11 @@ intermediate_findings: type: system score: 20 message: CVE-2021-44228 Log4Shell triggered for host $dest$ +threat_objects: + - field: http_user_agent + type: http_user_agent + - field: url + type: url analytic_story: - Log4Shell CVE-2021-44228 - CISA AA22-257A diff --git a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml index bfe6480c262..7f045881426 100644 --- a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml +++ b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml @@ -1,13 +1,14 @@ name: Log4Shell JNDI Payload Injection with Outbound Connection id: 69afee44-5c91-11ec-bf1f-497c9a704a72 -version: 9 +version: 10 creation_date: '2021-12-13' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Jose Hernandez status: production type: Anomaly description: The following analytic detects Log4Shell JNDI payload injections via outbound connections. It identifies suspicious LDAP lookup functions in web logs, such as `${jndi:ldap://PAYLOAD_INJECTED}`, and correlates them with network traffic to known malicious IP addresses. This detection leverages the Web and Network_Traffic data models in Splunk. Monitoring this activity is crucial as it targets vulnerabilities in Java web applications using log4j, potentially leading to remote code execution. If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, and compromise sensitive data within the affected environment. -data_source: [] +data_source: + - Splunk Stream IP search: |- | from datamodel Web.Web | rex field=_raw max_match=0 "[jJnNdDiI]{4}(\:|\%3A|\/|\%2F)(?\w+)(\:\/\/|\%3A\%2F\%2F)(\$\{.*?\}(\.)?)?(?[a-zA-Z0-9\.\-\_\$]+)" | join affected_host type=inner [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic by All_Traffic.dest | `drop_dm_object_name(All_Traffic)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename dest AS affected_host] @@ -37,6 +38,11 @@ intermediate_findings: type: system score: 20 message: CVE-2021-44228 Log4Shell triggered for host $dest$ +threat_objects: + - field: http_user_agent + type: http_user_agent + - field: url + type: url analytic_story: - Log4Shell CVE-2021-44228 - CISA AA22-320A diff --git a/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml b/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml index 154858839f1..bae64a63da9 100644 --- a/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml +++ b/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml @@ -1,8 +1,8 @@ name: Nginx ConnectWise ScreenConnect Authentication Bypass id: b3f7a803-e802-448b-8eb2-e796b223bccc -version: 11 +version: 12 creation_date: '2024-02-22' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Michael Haag, Splunk status: production type: TTP @@ -41,6 +41,11 @@ finding: field: dest type: system score: 50 +threat_objects: + - field: http_user_agent + type: http_user_agent + - field: url + type: url analytic_story: - ConnectWise ScreenConnect Vulnerabilities - Seashell Blizzard diff --git a/detections/web/plain_http_post_exfiltrated_data.yml b/detections/web/plain_http_post_exfiltrated_data.yml index e6432c5fffc..4a01f107873 100644 --- a/detections/web/plain_http_post_exfiltrated_data.yml +++ b/detections/web/plain_http_post_exfiltrated_data.yml @@ -1,8 +1,8 @@ name: Plain HTTP POST Exfiltrated Data id: e2b36208-a364-11eb-8909-acde48001122 -version: 13 +version: 14 creation_date: '2021-04-22' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: TTP @@ -37,6 +37,9 @@ finding: field: src_ip type: system score: 50 +threat_objects: + - field: dest_ip + type: ip_address analytic_story: - Data Exfiltration - Command And Control diff --git a/detections/web/unusual_http_request_method.yml b/detections/web/unusual_http_request_method.yml new file mode 100644 index 00000000000..de653940668 --- /dev/null +++ b/detections/web/unusual_http_request_method.yml @@ -0,0 +1,104 @@ +name: Unusual HTTP Request Method +id: c086ad2b-a747-4c61-9c90-d6ffdcaefbe8 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects Zeek HTTP requests using methods outside a configurable allowlist of standard and commonly used HTTP methods. + Unusual methods can indicate protocol abuse, exploitation attempts, or command-and-control traffic. + Review the method, source, destination, and URI to assess the activity. +data_source: + - Zeek HTTP +search: |- + `zeek_http` + method=* + NOT method IN ( + "ACL", + "CCM_POST", + "CONNECT", + "COPY", + "DELETE", + "GET", + "HEAD", + "LOCK", + "MKCOL", + "MOVE", + "OPTIONS", + "PATCH", + "POST", + "PRI", + "PROPFIND", + "PROPPATCH", + "PUT", + "REPORT", + "SEARCH", + "TRACE", + "unknown", + "UNLOCK" + ) + + | eval dest_port=coalesce(dest_port, 'id.resp_p'), + dest=coalesce(dest, dest_ip, 'id.resp_h'), + src=coalesce(src, src_ip, 'id.orig_h') + + | stats count min(_time) as firstTime max(_time) as lastTime + values(method) as method + values(uri) as uri + values(status_code) as status_code + + by src dest dest_port + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `unusual_http_request_method_filter` +how_to_implement: |- + Zeek HTTP logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466). + Configure the `zeek_http` macro to match the sourcetype used by your Zeek add-on. +known_false_positives: |- + Some legitimate applications and frameworks may use non-standard HTTP methods. + Review the method and destination to determine whether the traffic is expected, then add confirmed legitimate methods to the allowlist. +references: + - https://attack.mitre.org/techniques/T1071/001/ + - https://attack.mitre.org/techniques/T1190/ + - https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods +drilldown_searches: + - name: View the detection results for - "$src$" + search: '%original_detection_search% | search src = "$src$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$id.orig_h$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: An unusual HTTP method [$method$] ws observed from [$src$] to [$dest$] over port [$dest_port$] to URI - [$uri$]. +threat_objects: + - field: uri + type: uri +analytic_story: + - Command And Control + - HTTP Request Smuggling +asset_type: Web Server +mitre_attack_id: + - T1071.001 + - T1190 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: web +security_domain: network +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071/zeek_http_unusual_method/http.log + sourcetype: zeek:http + source: http.log + test_type: unit diff --git a/detections/web/unusually_long_content_type_length.yml b/detections/web/unusually_long_content_type_length.yml index f5b0a3f1ed7..d7975e1a33b 100644 --- a/detections/web/unusually_long_content_type_length.yml +++ b/detections/web/unusually_long_content_type_length.yml @@ -1,8 +1,8 @@ name: Unusually Long Content-Type Length id: 57a0a2bf-353f-40c1-84dc-29293f3c35b7 -version: 7 +version: 8 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Bhavin Patel, Splunk status: experimental type: Anomaly @@ -29,6 +29,11 @@ intermediate_findings: type: system score: 20 message: Unusually Long Content-Type Length ($http_content_type_length$ characters) In Web Request from $src$ +threat_objects: + - field: http_user_agent + type: http_user_agent + - field: url + type: url analytic_story: - Apache Struts Vulnerability asset_type: Web Server diff --git a/install.yml b/install.yml index 1abe7d5b2bf..cb3196171aa 100644 --- a/install.yml +++ b/install.yml @@ -3,7 +3,7 @@ apps: hardcoded_path: dist/DA-ESS-ContentUpdate.tar.gz - appid: SplunkEnterpriseSecuritySuite url: https://splunkbase.splunk.com/app/263 - version: 8.6.1 + version: 8.7.1 - appid: Splunk_TA_microsoft-iis url: https://splunkbase.splunk.com/app/3185 version: 2.0.0 @@ -12,10 +12,10 @@ apps: version: 2.3.4 - appid: Splunk_TA_stream url: https://splunkbase.splunk.com/app/5238 - version: 8.1.6 + version: 8.1.7 - appid: Splunk_TA_stream_wire_data url: https://splunkbase.splunk.com/app/5234 - version: 8.1.6 + version: 8.1.7 - appid: TA-Zscaler_CIM url: https://splunkbase.splunk.com/app/3865 version: 4.1.5 @@ -24,13 +24,13 @@ apps: version: 1.3.2 - appid: Splunk_TA_google-cloudplatform url: https://splunkbase.splunk.com/app/3088 - version: 5.1.1 + version: 5.2.0 - appid: utbox url: https://splunkbase.splunk.com/app/2734 version: 1.9.4 - appid: SA-admon url: https://splunkbase.splunk.com/app/6853 - version: 1.1.2 + version: 1.1.3 - appid: TA-crowdstrike-falcon-event-streams url: https://splunkbase.splunk.com/app/5082 version: 3.7.2 @@ -39,4 +39,4 @@ apps: version: 4.0.4 - appid: Splunk_SA_CIM url: https://splunkbase.splunk.com/app/1621 - version: 8.6.0 + version: 8.7.0 diff --git a/lookups/csv/detection_subcategory_map.csv b/lookups/csv/detection_subcategory_map.csv new file mode 100644 index 00000000000..25cf98922bf --- /dev/null +++ b/lookups/csv/detection_subcategory_map.csv @@ -0,0 +1,31 @@ +ai_system,data_sources,detection_name,detection_status,detection_type,analytic_stories,rmf_function,subcategory_ids,mapping_confidence,mapping_source,mapping_reason +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Cross Region Possible Inference Abuse,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude excessive use of tokens,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE|MANAGE,Measure 2.7|Manage 4.1|Manage 4.3,high,generated_rule,AI security and resilience evaluation signal; Post-deployment monitoring and response signal; Incident tracking or response signal +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Hostile Prompt Sentiment,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.6,high,generated_rule,Prompt-behavior and harmful-content measurement signal +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Possible Prompt Injection,production,Hunting,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Sensitive Data in Prompts,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal +AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Unusually Large Prompts,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal +Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Security Alerts by Application Name,production,Anomaly,Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal +Local LLM Frameworks,CrowdStrike ProcessRollup2|Sysmon EventID 1|Windows Event Log Security 4688,Windows Local LLM Framework Execution,production,Hunting,Suspicious Local LLM Frameworks,GOVERN|MAP,Govern 1.6|Map 4.1|Map 4.2,high,generated_rule,"AI system or access inventory signal; AI component, model, or service discovery signal; AI system operating context signal" +Local LLM Frameworks,Sysmon EventID 11,LLM Model File Creation,production,Hunting,Suspicious Local LLM Frameworks,GOVERN|MAP,Govern 1.6|Map 4.1,high,generated_rule,"AI system or access inventory signal; AI component, model, or service discovery signal" +Local LLM Frameworks,Sysmon EventID 22,Local LLM Framework DNS Query,production,Hunting,Suspicious Local LLM Frameworks,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" +M365 Copilot,M365 Copilot Graph API,M365 Copilot Application Usage Pattern Anomalies,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal +M365 Copilot,M365 Copilot Graph API,M365 Copilot Failed Authentication Patterns,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal +M365 Copilot,M365 Copilot Graph API,M365 Copilot Non Compliant Devices Accessing M365 Copilot,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,GOVERN,Govern 1.6,high,generated_rule,AI system or access inventory signal +M365 Copilot,M365 Copilot Graph API,M365 Copilot Session Origin Anomalies,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Agentic Jailbreak Attack,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Impersonation Jailbreak Attack,production,TTP,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Information Extraction Jailbreak Attack,production,TTP,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7|Measure 2.10,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal; Sensitive information or data-protection signal +M365 Copilot,M365 Exported eDiscovery Prompts,M365 Copilot Jailbreak Attempts,production,Anomaly,Suspicious Microsoft 365 Copilot Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +MCP,MCP Server,MCP Filesystem Server Suspicious Extension Write,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal +MCP,MCP Server,MCP Github Suspicious Operation,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal +MCP,MCP Server,MCP Postgres Suspicious Query,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.7,high,generated_rule,AI security and resilience evaluation signal +MCP,MCP Server,MCP Prompt Injection,production,TTP,Suspicious MCP Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal +MCP,MCP Server,MCP Sensitive System File Search,production,Hunting,Suspicious MCP Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal +Ollama,Ollama Server,Ollama Abnormal Network Connectivity,production,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" +Ollama,Ollama Server,Ollama Excessive API Requests,production,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal +Ollama,Ollama Server,Ollama Long-Running Inference Requests,production,Anomaly,Suspicious Ollama Activities,MEASURE,Measure 2.4,high,generated_rule,Production AI functionality and behavior monitoring signal +Ollama,Ollama Server,Ollama Possible API Endpoint Scan Reconnaissance,production,Anomaly,Suspicious Ollama Activities,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal" +Ollama,Ollama Server,Ollama Possible Memory Exhaustion Resource Abuse,production,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.1,high,generated_rule,Production behavior monitoring signal; Post-deployment monitoring and response signal +Ollama,Ollama Server,Ollama Repeated Application Errors,production,Anomaly,Suspicious Ollama Activities,MEASURE|MANAGE,Measure 2.4|Manage 4.3,high,generated_rule,Production behavior monitoring and incident/error tracking signal diff --git a/lookups/csv/detection_subcategory_map.yml b/lookups/csv/detection_subcategory_map.yml new file mode 100644 index 00000000000..dbf0a875df0 --- /dev/null +++ b/lookups/csv/detection_subcategory_map.yml @@ -0,0 +1,8 @@ +name: detection_subcategory_map +id: 41c7e6c8-b835-4dd8-b7ed-b1f5d8476e84 +version: 3 +creation_date: '2026-09-02' +modification_date: '2026-10-13' +author: Nasreddine Bencherchali, Rod Soto, Splunk Threat Research Team +lookup_type: csv +description: Generated mapping of AI-related ESCU detections to NIST AI RMF subcategory IDs for dashboard coverage reporting. diff --git a/lookups/csv/hijacklibs_loaded.csv b/lookups/csv/hijacklibs_loaded.csv index d3523b22ad7..3a14253534b 100644 --- a/lookups/csv/hijacklibs_loaded.csv +++ b/lookups/csv/hijacklibs_loaded.csv @@ -1,887 +1,887 @@ islibrary,library,excludes,ttp,comment -TRUE,aclui.dll,*\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ -TRUE,aclui.dll,*\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ -TRUE,acrodistdll.dll,*\Program Files\Adobe\Acrobat *,T1574.002,https://go.recordedfuture.com/hubfs/reports/cta-2022-1223.pdf +TRUE,aclui.dll,*:\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ +TRUE,aclui.dll,*:\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ +TRUE,acrodistdll.dll,*:\Program Files\Adobe\Acrobat *,T1574.002,https://go.recordedfuture.com/hubfs/reports/cta-2022-1223.pdf TRUE,acrodistdll.dll,*\Acrobat\acrodistdll*,T1574.002,https://go.recordedfuture.com/hubfs/reports/cta-2022-1223.pdf -TRUE,activeds.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,activeds.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,adsldpc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,adsldpc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,aepic.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,aepic.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,apphelp.dll,*\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,apphelp.dll,*\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,applicationframe.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,applicationframe.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,appvpolicy.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,appwiz.cpl,*\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ -TRUE,appwiz.cpl,*\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ -TRUE,appxalluserstore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,appxalluserstore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,appxdeploymentclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,appxdeploymentclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,archiveint.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,archiveint.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ashldres.dll,*\Program Files\McAfee.com\VSO*,T1574.002,https://www.sophos.com/en-us/medialibrary/PDFs/technical%20papers/sophos-rotten-tomato-campaign.pdf -TRUE,atl.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,atl.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,atltracetoolui.dll,*\Program Files\Microsoft Visual Studio 11.0\Common7\Tools*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,audioses.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,audioses.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,auditpolcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,auditpolcore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,authfwcfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,authfwcfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,authz.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,authz.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,avrt.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,avrt.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,activeds.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,activeds.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,adsldpc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,adsldpc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,aepic.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,aepic.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,apphelp.dll,*:\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,apphelp.dll,*:\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,applicationframe.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,applicationframe.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,appvpolicy.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,appwiz.cpl,*:\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ +TRUE,appwiz.cpl,*:\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ +TRUE,appxalluserstore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,appxalluserstore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,appxdeploymentclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,appxdeploymentclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,archiveint.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,archiveint.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ashldres.dll,*:\Program Files\McAfee.com\VSO*,T1574.002,https://www.sophos.com/en-us/medialibrary/PDFs/technical%20papers/sophos-rotten-tomato-campaign.pdf +TRUE,atl.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,atl.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,atltracetoolui.dll,*:\Program Files\Microsoft Visual Studio 11.0\Common7\Tools*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,audioses.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,audioses.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,auditpolcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,auditpolcore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,authfwcfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,authfwcfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,authz.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,authz.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,avrt.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,avrt.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows TRUE,basicnetutils.dll,*\Appdata\local\Temp\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ -TRUE,basicnetutils.dll,*\Program Files\BAIDU\BAIDUPINYIN\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ -TRUE,batmeter.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,batmeter.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,bcd.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcd.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcp47langs.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcp47langs.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcp47mrm.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcp47mrm.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bcrypt.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,bcrypt.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,bderepair.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bootmenuux.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,bootux.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,cabinet.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cabinet.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cabview.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,cabview.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,certcli.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,certcli.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,certenroll.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,certenroll.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cfgmgr32.dll,*\Windows\System32\*,T1574.002, -TRUE,cfgmgr32.dll,*\Windows\SysWOW64\*,T1574.002, +TRUE,basicnetutils.dll,*:\Program Files\BAIDU\BAIDUPINYIN\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ +TRUE,batmeter.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,batmeter.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,bcd.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcd.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcp47langs.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcp47langs.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcp47mrm.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcp47mrm.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bcrypt.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,bcrypt.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,bderepair.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bootmenuux.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,bootux.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,cabinet.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cabinet.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cabview.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,cabview.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,certcli.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,certcli.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,certenroll.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,certenroll.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cfgmgr32.dll,*:\Windows\System32\*,T1574.002, +TRUE,cfgmgr32.dll,*:\Windows\SysWOW64\*,T1574.002, TRUE,chrome_frame_helper.dll,*\Appdata\local\Google\Chrome\Application*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ -TRUE,chrome_frame_helper.dll,*\Program Files\Google\Chrome\Application*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ +TRUE,chrome_frame_helper.dll,*:\Program Files\Google\Chrome\Application*,T1574.002,https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ TRUE,ciscosparklauncher.dll,*\Appdata\local\CiscoSparkLauncher*,T1574.002,https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ TRUE,ciscosparklauncher.dll,*\AppData\Local\Programs\Cisco Spark\*,T1574.002,https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ -TRUE,classicexplorer32.dll,*\Program Files\Classic Shell*,T1574.002,https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets -TRUE,classicexplorer32.dll,*\Program Files\Open-Shell*,T1574.002,https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets -TRUE,cldapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cldapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,clipc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,clipc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,clusapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,clusapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cmpbk32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cmpbk32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cmutil.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,cmutil.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,coloradapterclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,coloradapterclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,colorui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,colorui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,comdlg32.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,comdlg32.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,commfunc.dll,*\Program Files\Lenovo\Communications Utility*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ -TRUE,configmanager2.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,connect.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,connect.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,coredplus.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,coremessaging.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,coremessaging.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,coreuicomponents.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,coreuicomponents.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,credui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,credui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptbase.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptbase.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptdll.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptdll.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptsp.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,cryptsp.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,cryptui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptxml.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cryptxml.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cscapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cscapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,cscobj.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,cscobj.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,cscui.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,cscui.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,d2d1.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d2d1.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10_1.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10_1.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10_1core.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10_1core.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10core.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10core.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10warp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d10warp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d11.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d11.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d12.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d12.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d9.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3d9.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\windows kits\10\bin\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\windows kits\10\bin\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\windows kits\10\redist\d3d\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\windows kits\10\redist\d3d\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\wireshark*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\cisco systems\cisco jabber*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\microsoft\edge\application\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Program Files\Google\Chrome\Application\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,classicexplorer32.dll,*:\Program Files\Classic Shell*,T1574.002,https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets +TRUE,classicexplorer32.dll,*:\Program Files\Open-Shell*,T1574.002,https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets +TRUE,cldapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cldapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,clipc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,clipc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,clusapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,clusapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cmpbk32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cmpbk32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cmutil.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,cmutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,coloradapterclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,coloradapterclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,colorui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,colorui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,comdlg32.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,comdlg32.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,commfunc.dll,*:\Program Files\Lenovo\Communications Utility*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ +TRUE,configmanager2.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,connect.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,connect.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,coredplus.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,coremessaging.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,coremessaging.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,coreuicomponents.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,coreuicomponents.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,credui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,credui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptbase.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptbase.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptdll.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptdll.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptsp.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,cryptsp.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,cryptui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptxml.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cryptxml.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cscapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cscapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,cscobj.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,cscobj.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,cscui.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,cscui.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,d2d1.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d2d1.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10_1.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10_1.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10_1core.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10_1core.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10core.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10core.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10warp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d10warp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d11.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d11.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d12.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d12.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d9.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3d9.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\windows kits\10\bin\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\windows kits\10\bin\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\windows kits\10\redist\d3d\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\windows kits\10\redist\d3d\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\wireshark*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\cisco systems\cisco jabber*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\microsoft\edge\application\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Program Files\Google\Chrome\Application\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows TRUE,d3dcompiler_47.dll,*\Appdata\local\microsoft\teams\stage*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dcompiler_47.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,d3dcompiler_47.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows TRUE,d3dcompiler_47.dll,*\Microsoft\Teams\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,d3dx9_43.dll,*\Windows\System32\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ -TRUE,d3dx9_43.dll,*\Windows\SysWOW64\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ -TRUE,dataexchange.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,dataexchange.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,davclnt.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,davclnt.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\arm*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\arm\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\arm64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\arm64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\x64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\windows kits\10\debuggers\x86\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Program Files\microsoft office\root\office*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgcore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgeng.dll,*\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 -TRUE,dbgeng.dll,*\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 -TRUE,dbgeng.dll,*\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 -TRUE,dbgeng.dll,*\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\arm*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\arm\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\arm64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\arm64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\x64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\windows kits\10\debuggers\x86\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\cisco systems\cisco jabber*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\microsoft office\root\office*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Program Files\microsoft office\root\vfs\programfilesx86\microsoft analysis services\as oledb\140*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbghelp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dbgmodel.dll,*\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,dbgmodel.dll,*\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,dbgmodel.dll,*\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,dcntel.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dcomp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dcomp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,defragproxy.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,defragproxy.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,desktopshellext.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,desktopshellext.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,deviceassociation.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,deviceassociation.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devicecredential.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devicecredential.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devicepairing.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,devicepairing.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,devobj.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devobj.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devrtl.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,devrtl.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcmonitor.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcmonitor.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcsvc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcsvc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcsvc6.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dhcpcsvc6.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,directmanipulation.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,directmanipulation.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,dismapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dismapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dismcore.dll,*\Windows\System32\dism*,T1574.001,https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/ -TRUE,dismcore.dll,*\Windows\SysWOW64\dism*,T1574.001,https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/ -TRUE,dmcfgutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmcfgutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmcmnutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmcmnutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmcommandlineutils.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dmcommandlineutils.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dmenrollengine.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmenrollengine.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmenterprisediagnostics.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmiso8601utils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmiso8601utils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmoleaututils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmoleaututils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmprocessxmlfiltered.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmprocessxmlfiltered.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmpushproxy.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmpushproxy.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmxmlhelputils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dmxmlhelputils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dnsapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dnsapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dot3api.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dot3api.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dot3cfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dot3cfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dpx.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dpx.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,drprov.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,drprov.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,drvstore.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,drvstore.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dsclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsparse.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsparse.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsprop.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dsprop.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dsreg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsreg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsrole.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dsrole.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dui70.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dui70.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,duser.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,duser.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dusmapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dusmapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dwmapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dwmapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dwmcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dwrite.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dwrite.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dxcore.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dxcore.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,dxgi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dxgi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dxva2.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dxva2.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,dynamoapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,eappcfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,eappcfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,eappprxy.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,eappprxy.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,edgeiso.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,edgeiso.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,edputil.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,edputil.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,efsadu.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,efsadu.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,efsutil.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,efsutil.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,esent.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,esent.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,execmodelproxy.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,execmodelproxy.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,explorerframe.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,explorerframe.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,facesdk.dll,*\Program Files\luxand\facesdk\bin\win64*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,fastprox.dll,*\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,fastprox.dll,*\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,faultrep.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,faultrep.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fddevquery.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,fddevquery.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,feclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,feclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fhcfg.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,fhcfg.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,fhsvcctl.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,firewallapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,firewallapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,flightsettings.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,flightsettings.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,fltlib.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fltlib.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,formdll.dll,*\Program Files\Common Files\Microsoft Shared\NoteSync Forms*,T1574.002,https://any.run/report/d9c7f6d4ec08d961c20dac1b6422b3fbec5c6a8d9dc67d1f604835b36c5f224e/ae068531-92db-497d-b0cb-c0b1af5476f1 -TRUE,framedynos.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,framedynos.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,fveapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fveapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fveskybackup.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,fvewiz.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,fwbase.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwbase.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwcfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwcfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwpolicyiomgr.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwpolicyiomgr.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwpuclnt.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fwpuclnt.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fxsapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fxsapi.dll,*\Windows\System32\driverstore\filerepository\prnms002.inf_*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fxsapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fxsst.dll,*\Windows\System32\*,T1574.001,https://www.fireeye.com/blog/threat-research/2011/06/fxsst.html/ -TRUE,fxstiff.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,fxstiff.dll,*\Windows\System32\driverstore\filerepository\prnms002.inf_*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,getuname.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,getuname.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,gflagsui.dll,*\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,glib-2.0.dll,*\Program Files\VMware\VMware Tools*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ -TRUE,glib-2.0.dll,*\Program Files\VMware\VMware Workstation*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ -TRUE,glib-2.0.dll,*\Program Files\VMware\VMware Player*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ -TRUE,gpapi.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,gpapi.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,hha.dll,*\Windows\System32\*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ -TRUE,hha.dll,*\Windows\SysWOW64\*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ -TRUE,hha.dll,*\Program Files\HTML Help Workshop*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ -TRUE,hid.dll,*\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,hid.dll,*\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,hnetmon.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,hnetmon.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,hpcustpartui.dll,*\Program Files\HP*,T1574.002,https://www.trellix.com/en-us/about/newsroom/stories/research/operation-harvest-a-deep-dive-into-a-long-term-campaign.html -TRUE,hpqhvsei.dll,*\Program Files\HP*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,httpapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,httpapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,icmp.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,icmp.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,idstore.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,idstore.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ieadvpack.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ieadvpack.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iedkcs32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iedkcs32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iernonce.dll,*\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ -TRUE,iernonce.dll,*\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ -TRUE,iertutil.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iertutil.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ifmon.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ifmon.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ifsutil.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,ifsutil.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,inproclogger.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iphlpapi.dll,*\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iphlpapi.dll,*\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iri.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iri.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iscsidsc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iscsidsc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iscsiexe.dll,*\Windows\System32\*,T1574.001,https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC -TRUE,iscsiexe.dll,*\Windows\SysWOW64\*,T1574.001,https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC -TRUE,iscsium.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iscsium.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,isv.exe_rsaenh.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,isv.exe_rsaenh.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,iumbase.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,iumsdk.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,iviewers.dll,*\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,iviewers.dll,*\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,iviewers.dll,*\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,iviewers.dll,*\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,joinutil.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,joinutil.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,kdstub.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ksuser.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ksuser.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ktmw32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ktmw32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ldvpocx.ocx,*\Program Files\Symantec_Client_Security\Symantec AntiVirus*,T1574.002,https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox -TRUE,ldvpocx.ocx,*\Program Files\Symantec AntiVirus*,T1574.002,https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox +TRUE,d3dx9_43.dll,*:\Windows\System32\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ +TRUE,d3dx9_43.dll,*:\Windows\SysWOW64\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ +TRUE,dataexchange.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,dataexchange.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,davclnt.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,davclnt.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\arm*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\arm\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\arm64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\arm64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\x64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\windows kits\10\debuggers\x86\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Program Files\microsoft office\root\office*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgcore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgeng.dll,*:\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 +TRUE,dbgeng.dll,*:\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 +TRUE,dbgeng.dll,*:\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 +TRUE,dbgeng.dll,*:\Program Files\Windows Kits\*,T1574.002,https://twitter.com/mrexodia/status/1630320327967252483 +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\arm*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\arm\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\arm64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\arm64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\x64*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\x64\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\x86*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\windows kits\10\debuggers\x86\srcsrv*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\cisco systems\cisco jabber*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\microsoft office\root\office*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Program Files\microsoft office\root\vfs\programfilesx86\microsoft analysis services\as oledb\140*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbghelp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dbgmodel.dll,*:\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,dbgmodel.dll,*:\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,dbgmodel.dll,*:\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,dcntel.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dcomp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dcomp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,defragproxy.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,defragproxy.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,desktopshellext.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,desktopshellext.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,deviceassociation.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,deviceassociation.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devicecredential.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devicecredential.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devicepairing.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,devicepairing.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,devobj.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devobj.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devrtl.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,devrtl.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcmonitor.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcmonitor.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcsvc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcsvc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcsvc6.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dhcpcsvc6.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,directmanipulation.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,directmanipulation.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,dismapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dismapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dismcore.dll,*:\Windows\System32\dism*,T1574.001,https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/ +TRUE,dismcore.dll,*:\Windows\SysWOW64\dism*,T1574.001,https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/ +TRUE,dmcfgutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmcfgutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmcmnutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmcmnutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmcommandlineutils.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dmcommandlineutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dmenrollengine.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmenrollengine.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmenterprisediagnostics.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmiso8601utils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmiso8601utils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmoleaututils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmoleaututils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmprocessxmlfiltered.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmprocessxmlfiltered.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmpushproxy.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmpushproxy.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmxmlhelputils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dmxmlhelputils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dnsapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dnsapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dot3api.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dot3api.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dot3cfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dot3cfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dpx.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dpx.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,drprov.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,drprov.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,drvstore.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,drvstore.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dsclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsparse.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsparse.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsprop.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dsprop.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dsreg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsreg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsrole.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dsrole.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dui70.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dui70.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,duser.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,duser.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dusmapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dusmapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dwmapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dwmapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dwmcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dwrite.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dwrite.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dxcore.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dxcore.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,dxgi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dxgi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dxva2.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dxva2.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,dynamoapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,eappcfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,eappcfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,eappprxy.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,eappprxy.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,edgeiso.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,edgeiso.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,edputil.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,edputil.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,efsadu.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,efsadu.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,efsutil.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,efsutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,esent.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,esent.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,execmodelproxy.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,execmodelproxy.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,explorerframe.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,explorerframe.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,facesdk.dll,*:\Program Files\luxand\facesdk\bin\win64*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,fastprox.dll,*:\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,fastprox.dll,*:\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,faultrep.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,faultrep.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fddevquery.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,fddevquery.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,feclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,feclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fhcfg.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,fhcfg.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,fhsvcctl.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,firewallapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,firewallapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,flightsettings.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,flightsettings.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,fltlib.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fltlib.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,formdll.dll,*:\Program Files\Common Files\Microsoft Shared\NoteSync Forms*,T1574.002,https://any.run/report/d9c7f6d4ec08d961c20dac1b6422b3fbec5c6a8d9dc67d1f604835b36c5f224e/ae068531-92db-497d-b0cb-c0b1af5476f1 +TRUE,framedynos.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,framedynos.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,fveapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fveapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fveskybackup.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,fvewiz.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,fwbase.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwbase.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwcfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwcfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwpolicyiomgr.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwpolicyiomgr.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwpuclnt.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fwpuclnt.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fxsapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fxsapi.dll,*:\Windows\System32\driverstore\filerepository\prnms002.inf_*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fxsapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fxsst.dll,*:\Windows\System32\*,T1574.001,https://www.fireeye.com/blog/threat-research/2011/06/fxsst.html/ +TRUE,fxstiff.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,fxstiff.dll,*:\Windows\System32\driverstore\filerepository\prnms002.inf_*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,getuname.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,getuname.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,gflagsui.dll,*:\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,glib-2.0.dll,*:\Program Files\VMware\VMware Tools*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ +TRUE,glib-2.0.dll,*:\Program Files\VMware\VMware Workstation*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ +TRUE,glib-2.0.dll,*:\Program Files\VMware\VMware Player*,T1574.002,https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ +TRUE,gpapi.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,gpapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,hha.dll,*:\Windows\System32\*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ +TRUE,hha.dll,*:\Windows\SysWOW64\*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ +TRUE,hha.dll,*:\Program Files\HTML Help Workshop*,T1574.002,https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/ +TRUE,hid.dll,*:\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,hid.dll,*:\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,hnetmon.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,hnetmon.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,hpcustpartui.dll,*:\Program Files\HP*,T1574.002,https://www.trellix.com/en-us/about/newsroom/stories/research/operation-harvest-a-deep-dive-into-a-long-term-campaign.html +TRUE,hpqhvsei.dll,*:\Program Files\HP*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,httpapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,httpapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,icmp.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,icmp.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,idstore.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,idstore.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ieadvpack.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ieadvpack.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iedkcs32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iedkcs32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iernonce.dll,*:\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ +TRUE,iernonce.dll,*:\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ +TRUE,iertutil.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iertutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ifmon.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ifmon.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ifsutil.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,ifsutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,inproclogger.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iphlpapi.dll,*:\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iphlpapi.dll,*:\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iri.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iri.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iscsidsc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iscsidsc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iscsiexe.dll,*:\Windows\System32\*,T1574.001,https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC +TRUE,iscsiexe.dll,*:\Windows\SysWOW64\*,T1574.001,https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC +TRUE,iscsium.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iscsium.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,isv.exe_rsaenh.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,isv.exe_rsaenh.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,iumbase.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,iumsdk.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,iviewers.dll,*:\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,iviewers.dll,*:\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,iviewers.dll,*:\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,iviewers.dll,*:\Program Files\Windows Kits\10\bin\*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,joinutil.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,joinutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,kdstub.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ksuser.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ksuser.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ktmw32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ktmw32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ldvpocx.ocx,*:\Program Files\Symantec_Client_Security\Symantec AntiVirus*,T1574.002,https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox +TRUE,ldvpocx.ocx,*:\Program Files\Symantec AntiVirus*,T1574.002,https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox TRUE,libcares-2.dll,*\git\mingw64\*,T1574.002,https://www.trellix.com/en-au/blogs/research/hiding-in-plain-sight-multi-actor-ahost-exe-attacks/ -TRUE,libvlc.dll,*\Program Files\VideoLAN\VLC*,T1574.002,https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ -TRUE,licensemanagerapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,licensemanagerapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,licensingdiagspp.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,licensingdiagspp.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,linkinfo.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,linkinfo.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,lmiguardiandll.dll,*\Program Files\LogMeIn*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 -TRUE,lmiguardiandll.dll,*\Program Files\LogMeIn\x86*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 -TRUE,lmiguardiandll.dll,*\Program Files\LogMeIn\x64*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 -TRUE,loadperf.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,loadperf.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,lockdown.dll,*\Program Files\McAfee\VirusScan Enterprise*,T1574.002,https://twitter.com/thepacketrat/status/1520878930449817600 -TRUE,lockhostingframework.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,log.dll,*\Program Files\Bitdefender Antivirus Free*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,logoncli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,logoncli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,logoncontroller.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,logoncontroller.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,lpksetupproxyserv.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,lpksetupproxyserv.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,lrwizdll.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,magnification.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,magnification.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,maintenanceui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mapistub.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mapistub.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mbaexmlparser.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,mdmdiagnostics.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mfc42u.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,mfc42u.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,mfcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mfcore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mfplat.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mfplat.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,midimap.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,midimap.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mintdh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,miutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,miutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mlang.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mlang.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mmdevapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mmdevapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mobilenetworking.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mobilenetworking.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mozglue.dll,*\Program Files\SeaMonkey*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,mozglue.dll,*\Program Files\Mozilla Firefox*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,mozglue.dll,*\Program Files\Mozilla Thunderbird*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,libvlc.dll,*:\Program Files\VideoLAN\VLC*,T1574.002,https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ +TRUE,licensemanagerapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,licensemanagerapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,licensingdiagspp.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,licensingdiagspp.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,linkinfo.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,linkinfo.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,lmiguardiandll.dll,*:\Program Files\LogMeIn*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 +TRUE,lmiguardiandll.dll,*:\Program Files\LogMeIn\x86*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 +TRUE,lmiguardiandll.dll,*:\Program Files\LogMeIn\x64*,T1574.002,https://twitter.com/StopMalvertisin/status/1610961056163311619 +TRUE,loadperf.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,loadperf.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,lockdown.dll,*:\Program Files\McAfee\VirusScan Enterprise*,T1574.002,https://twitter.com/thepacketrat/status/1520878930449817600 +TRUE,lockhostingframework.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,log.dll,*:\Program Files\Bitdefender Antivirus Free*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,logoncli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,logoncli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,logoncontroller.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,logoncontroller.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,lpksetupproxyserv.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,lpksetupproxyserv.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,lrwizdll.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,magnification.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,magnification.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,maintenanceui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mapistub.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mapistub.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mbaexmlparser.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,mdmdiagnostics.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mfc42u.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,mfc42u.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,mfcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mfcore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mfplat.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mfplat.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,midimap.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,midimap.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mintdh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,miutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,miutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mlang.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mlang.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mmdevapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mmdevapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mobilenetworking.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mobilenetworking.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mozglue.dll,*:\Program Files\SeaMonkey*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,mozglue.dll,*:\Program Files\Mozilla Firefox*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,mozglue.dll,*:\Program Files\Mozilla Thunderbird*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 TRUE,mozglue.dll,*\AppData\Local\Mozilla Firefox\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,mpclient.dll,*\Program Files\Windows Defender*,T1574.002,https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/ +TRUE,mpclient.dll,*:\Program Files\Windows Defender*,T1574.002,https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/ TRUE,mpclient.dll,*\ProgramData\Microsoft\Windows Defender\Platform\*,T1574.002,https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/ -TRUE,mpr.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mpr.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mprapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mprapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mpsvc.dll,*\Program Files\Windows Defender\*,T1574.002,https://www.mcafee.com/blogs/other-blogs/mcafee-labs/revil-ransomware-uses-dll-sideloading/ +TRUE,mpr.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mpr.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mprapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mprapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mpsvc.dll,*:\Program Files\Windows Defender\*,T1574.002,https://www.mcafee.com/blogs/other-blogs/mcafee-labs/revil-ransomware-uses-dll-sideloading/ TRUE,mpsvc.dll,*\ProgramData\Microsoft\Windows Defender\Platform\*,T1574.002,https://www.mcafee.com/blogs/other-blogs/mcafee-labs/revil-ransomware-uses-dll-sideloading/ -TRUE,mrmcorer.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mrmcorer.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msacm32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msacm32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mscms.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mscms.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mscoree.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mscoree.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mscorsvc.dll,*\Windows\Microsoft.NET\Framework\v*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,mscorsvc.dll,*\Windows\Microsoft.NET\Framework64\v*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,msctf.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,msctf.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,msctfmonitor.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msctfmonitor.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msdrm.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msdrm.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msdtctm.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msftedit.dll,*\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ -TRUE,msftedit.dll,*\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ -TRUE,msi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msiso.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,msiso.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,msutb.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msutb.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,msvcp110_win.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,msvcp110_win.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,msvcr100.dll,*\Windows\System32\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,msvcr100.dll,*\Windows\SysWOW64\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,mswb7.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mswb7.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mswsock.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mswsock.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,msxml3.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,msxml3.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,mtxclu.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,mtxclu.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,napinsp.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,napinsp.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ncrypt.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ncrypt.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ndfapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ndfapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netapi32.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netapi32.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netid.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netid.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netiohlp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netiohlp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netjoin.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netjoin.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netplwiz.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netplwiz.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netprofm.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,netprofm.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,netprovfw.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netprovfw.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,netsetupapi.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,netsetupapi.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,netshell.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netshell.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nettrace.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,netutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,networkexplorer.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,networkexplorer.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,newdev.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,newdev.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ninput.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ninput.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nlaapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nlaapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nlansp_c.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,nlansp_c.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,npmproxy.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,npmproxy.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,nshhttp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nshhttp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nshipsec.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nshipsec.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nshwfp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,nshwfp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ntdsapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ntdsapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ntlanman.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ntlanman.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ntlmshared.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ntlmshared.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ntmarta.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ntmarta.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ntshrui.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ntshrui.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,nvsmartmax.dll,*\Program Files\NVIDIA Corporation\Display*,T1574.002,https://www.cybereason.com/blog/research/deadringer-exposing-chinese-threat-actors-targeting-major-telcos -TRUE,oleacc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,oleacc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,omadmapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,omadmapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,onex.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,onex.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,opcservices.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,opcservices.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,mrmcorer.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mrmcorer.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msacm32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msacm32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mscms.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mscms.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mscoree.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mscoree.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mscorsvc.dll,*:\Windows\Microsoft.NET\Framework\v*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,mscorsvc.dll,*:\Windows\Microsoft.NET\Framework64\v*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,msctf.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,msctf.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,msctfmonitor.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msctfmonitor.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msdrm.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msdrm.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msdtctm.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msftedit.dll,*:\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ +TRUE,msftedit.dll,*:\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ +TRUE,msi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msiso.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,msiso.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,msutb.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msutb.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,msvcp110_win.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,msvcp110_win.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,msvcr100.dll,*:\Windows\System32\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,msvcr100.dll,*:\Windows\SysWOW64\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,mswb7.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mswb7.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mswsock.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mswsock.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,msxml3.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,msxml3.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,mtxclu.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,mtxclu.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,napinsp.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,napinsp.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ncrypt.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ncrypt.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ndfapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ndfapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netapi32.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netapi32.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netid.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netid.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netiohlp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netiohlp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netjoin.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netjoin.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netplwiz.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netplwiz.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netprofm.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,netprofm.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,netprovfw.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netprovfw.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,netsetupapi.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,netsetupapi.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,netshell.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netshell.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nettrace.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,netutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,networkexplorer.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,networkexplorer.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,newdev.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,newdev.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ninput.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ninput.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nlaapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nlaapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nlansp_c.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,nlansp_c.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,npmproxy.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,npmproxy.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,nshhttp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nshhttp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nshipsec.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nshipsec.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nshwfp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,nshwfp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ntdsapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ntdsapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ntlanman.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ntlanman.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ntlmshared.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ntlmshared.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ntmarta.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ntmarta.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ntshrui.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ntshrui.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,nvsmartmax.dll,*:\Program Files\NVIDIA Corporation\Display*,T1574.002,https://www.cybereason.com/blog/research/deadringer-exposing-chinese-threat-actors-targeting-major-telcos +TRUE,oleacc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,oleacc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,omadmapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,omadmapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,onex.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,onex.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,opcservices.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,opcservices.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ TRUE,opera_elf.dll,*\Appdata\local\programs\opera\*,T1574.002,https://twitter.com/ShitSecure/status/1566127363389329412 -TRUE,osbaseln.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,osbaseln.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,osksupport.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,osuninst.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,osuninst.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,outllib.dll,*\Program Files\Microsoft Office\OFFICE*,T1574.002,https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6 -TRUE,outllib.dll,*\Program Files\Microsoft Office\Root\OFFICE*,T1574.002,https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6 -TRUE,p2p.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,p2p.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,p2pnetsh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,p2pnetsh.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,p9np.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,p9np.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,pcaui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,pcaui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,pdh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,pdh.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,peerdistsh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,peerdistsh.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,pkeyhelper.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,pla.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,pla.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,playsndsrv.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,playsndsrv.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,pnrpnsp.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,pnrpnsp.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,policymanager.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,policymanager.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,polstore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,polstore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,powrprof.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,powrprof.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,printui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,printui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,prntvpt.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,prntvpt.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,profapi.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,profapi.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,propsys.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,propsys.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,proximitycommon.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,proximitycommon.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,proximityservicepal.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,prvdmofcomp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,prvdmofcomp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,puiapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,puiapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,python39.dll,*\Program Files\Python39*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,osbaseln.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,osbaseln.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,osksupport.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,osuninst.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,osuninst.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,outllib.dll,*:\Program Files\Microsoft Office\OFFICE*,T1574.002,https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6 +TRUE,outllib.dll,*:\Program Files\Microsoft Office\Root\OFFICE*,T1574.002,https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6 +TRUE,p2p.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,p2p.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,p2pnetsh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,p2pnetsh.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,p9np.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,p9np.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,pcaui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,pcaui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,pdh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,pdh.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,peerdistsh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,peerdistsh.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,pkeyhelper.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,pla.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,pla.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,playsndsrv.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,playsndsrv.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,pnrpnsp.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,pnrpnsp.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,policymanager.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,policymanager.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,polstore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,polstore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,powrprof.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,powrprof.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,printui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,printui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,prntvpt.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,prntvpt.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,profapi.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,profapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,propsys.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,propsys.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,proximitycommon.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,proximitycommon.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,proximityservicepal.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,prvdmofcomp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,prvdmofcomp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,puiapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,puiapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,python39.dll,*:\Program Files\Python39*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 TRUE,python39.dll,*\Appdata\local\Temp\*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,python39.dll,*\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\VC\SecurityIssueAnalysis\python*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 +TRUE,python39.dll,*:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\VC\SecurityIssueAnalysis\python*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 TRUE,python39.dll,*\Users\anaconda3*,T1574.002,https://twitter.com/SBousseaden/status/1530595156055011330 -TRUE,qrt.dll,*\Program Files\F-Secure\Anti-Virus*,T1574.002,https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/ -TRUE,radcui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,radcui.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasapi32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasapi32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasdlg.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,rasdlg.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,rasgcw.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,rasgcw.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,rasman.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasman.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasmontr.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rasmontr.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rastls.dll,*\Program Files\Symantec\Network Connected Devices Auto Setup*,T1574.002,https://st.drweb.com/static/new-www/news/2020/october/Study_of_the_ShadowPad_APT_backdoor_and_its_relation_to_PlugX_en.pdf -TRUE,rcdll.dll,*\Program Files\Windows Kits\10\bin\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,reagent.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,reagent.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,regapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,regapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,reseteng.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,resetengine.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,resutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,resutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rjvplatform.dll,*\Windows\System32\SystemResetPlatform*,T1574.002,https://twitter.com/0gtweet/status/1666716511988330499 -TRUE,rjvplatform.dll,*\Windows\SysWOW64\SystemResetPlatform*,T1574.002,https://twitter.com/0gtweet/status/1666716511988330499 -TRUE,rmclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rmclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rpcnsh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rpcnsh.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rsaenh.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,rsaenh.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,rtutils.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rtutils.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rtworkq.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,rtworkq.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,qrt.dll,*:\Program Files\F-Secure\Anti-Virus*,T1574.002,https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/ +TRUE,radcui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,radcui.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasapi32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasapi32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasdlg.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,rasdlg.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,rasgcw.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,rasgcw.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,rasman.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasman.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasmontr.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rasmontr.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rastls.dll,*:\Program Files\Symantec\Network Connected Devices Auto Setup*,T1574.002,https://st.drweb.com/static/new-www/news/2020/october/Study_of_the_ShadowPad_APT_backdoor_and_its_relation_to_PlugX_en.pdf +TRUE,rcdll.dll,*:\Program Files\Windows Kits\10\bin\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,reagent.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,reagent.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,regapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,regapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,reseteng.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,resetengine.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,resutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,resutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rjvplatform.dll,*:\Windows\System32\SystemResetPlatform*,T1574.002,https://twitter.com/0gtweet/status/1666716511988330499 +TRUE,rjvplatform.dll,*:\Windows\SysWOW64\SystemResetPlatform*,T1574.002,https://twitter.com/0gtweet/status/1666716511988330499 +TRUE,rmclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rmclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rpcnsh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rpcnsh.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rsaenh.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,rsaenh.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,rtutils.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rtutils.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rtworkq.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,rtworkq.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows TRUE,rzlog4cpp_logger.dll,*\Appdata\local\razer\InGameEngine\cache\RzFpsApplet*,T1574.002,https://www.mandiant.com/resources/blog/china-nexus-espionage-southeast-asia -TRUE,safestore32.dll,*\Program Files\Sophos\Sophos Anti-Virus*,T1574.002,https://symantec.broadcom.com/hubfs/Attacks-Against-Government-Sector.pdf -TRUE,samcli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,samcli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,samlib.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,samlib.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sapi_onecore.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,sapi_onecore.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,sas.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sas.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,scansetting.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,scansetting.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,scecli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,scecli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,schedcli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,schedcli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,secur32.dll,*\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,secur32.dll,*\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,security.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,security.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,sensapi.dll,*\Windows\System32\*,T1574.002,https://twitter.com/AndrewOliveau/status/1682185200862625792 -TRUE,sensapi.dll,*\Windows\SysWOW64\*,T1574.002,https://twitter.com/AndrewOliveau/status/1682185200862625792 -TRUE,shell32.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,shell32.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,shfolder.dll,*\Windows\System32\*,T1574.002,https://twitter.com/dissectmalware/status/978017957480628226 -TRUE,shfolder.dll,*\Windows\SysWOW64\*,T1574.002,https://twitter.com/dissectmalware/status/978017957480628226 -TRUE,siteadv.dll,*\Program Files\SiteAdvisor\*,T1574.002,https://www.nortonlifelock.com/sites/default/files/2021-10/OPERATION%20EXORCIST%20White%20Paper.pdf -TRUE,slc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,slc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,smadhook32c.dll,*\Program Files\Smadav*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,snmpapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,snmpapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,spectrumsyncclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,spp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,spp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sppc.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sppc.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sppcext.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,sppcext.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,srclient.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srclient.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srmtrace.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,srmtrace.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,srpapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srpapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srvcli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,srvcli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ssp.exe_rsaenh.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ssp.exe_rsaenh.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ssp_isv.exe_rsaenh.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,ssp_isv.exe_rsaenh.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,sspicli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sspicli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ssshim.dll,*\Windows\System32\*,T1574.002,https://twitter.com/0gtweet/status/1363107343018385410 -TRUE,ssshim.dll,*\Windows\SysWOW64\*,T1574.002,https://twitter.com/0gtweet/status/1363107343018385410 -TRUE,staterepository.core.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,staterepository.core.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,structuredquery.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,structuredquery.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,sxshared.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,sxshared.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,symsrv.dll,*\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,systemsettingsthresholdadminflowui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tapi32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tapi32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tbs.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tbs.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tdh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tdh.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,textshaping.dll,*\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,textshaping.dll,*\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,timesync.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tmdbglog.dll,*\Program Files\Trend Micro\Titanium*,T1574.002,https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-tools-and-connections/ -TRUE,tosbtkbd.dll,*\Program Files\Toshiba\Bluetooth Toshiba Stack*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis -TRUE,tpmcoreprovisioning.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,tpmcoreprovisioning.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,tquery.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tquery.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tsworkspace.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,tsworkspace.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ttdrecord.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,ttdrecord.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,twext.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,twext.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,twinapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,twinapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables -TRUE,twinui.appcore.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,twinui.appcore.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,uianimation.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,uianimation.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,uiautomationcore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uiautomationcore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uireng.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uireng.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uiribbon.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,uiribbon.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,umpdc.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,umpdc.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,unattend.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,safestore32.dll,*:\Program Files\Sophos\Sophos Anti-Virus*,T1574.002,https://symantec.broadcom.com/hubfs/Attacks-Against-Government-Sector.pdf +TRUE,samcli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,samcli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,samlib.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,samlib.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sapi_onecore.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,sapi_onecore.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,sas.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sas.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,scansetting.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,scansetting.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,scecli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,scecli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,schedcli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,schedcli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,secur32.dll,*:\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,secur32.dll,*:\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,security.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,security.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,sensapi.dll,*:\Windows\System32\*,T1574.002,https://twitter.com/AndrewOliveau/status/1682185200862625792 +TRUE,sensapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://twitter.com/AndrewOliveau/status/1682185200862625792 +TRUE,shell32.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,shell32.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,shfolder.dll,*:\Windows\System32\*,T1574.002,https://twitter.com/dissectmalware/status/978017957480628226 +TRUE,shfolder.dll,*:\Windows\SysWOW64\*,T1574.002,https://twitter.com/dissectmalware/status/978017957480628226 +TRUE,siteadv.dll,*:\Program Files\SiteAdvisor\*,T1574.002,https://www.nortonlifelock.com/sites/default/files/2021-10/OPERATION%20EXORCIST%20White%20Paper.pdf +TRUE,slc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,slc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,smadhook32c.dll,*:\Program Files\Smadav*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,snmpapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,snmpapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,spectrumsyncclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,spp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,spp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sppc.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sppc.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sppcext.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,sppcext.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,srclient.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srclient.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srmtrace.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,srmtrace.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,srpapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srpapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srvcli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,srvcli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ssp.exe_rsaenh.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ssp.exe_rsaenh.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ssp_isv.exe_rsaenh.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,ssp_isv.exe_rsaenh.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,sspicli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sspicli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ssshim.dll,*:\Windows\System32\*,T1574.002,https://twitter.com/0gtweet/status/1363107343018385410 +TRUE,ssshim.dll,*:\Windows\SysWOW64\*,T1574.002,https://twitter.com/0gtweet/status/1363107343018385410 +TRUE,staterepository.core.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,staterepository.core.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,structuredquery.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,structuredquery.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,sxshared.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,sxshared.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,symsrv.dll,*:\Program Files\Windows Kits\10\Debuggers\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,systemsettingsthresholdadminflowui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tapi32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tapi32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tbs.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tbs.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tdh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tdh.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,textshaping.dll,*:\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,textshaping.dll,*:\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,timesync.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tmdbglog.dll,*:\Program Files\Trend Micro\Titanium*,T1574.002,https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-tools-and-connections/ +TRUE,tosbtkbd.dll,*:\Program Files\Toshiba\Bluetooth Toshiba Stack*,T1574.002,https://www.secureworks.com/research/shadowpad-malware-analysis +TRUE,tpmcoreprovisioning.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,tpmcoreprovisioning.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,tquery.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tquery.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tsworkspace.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,tsworkspace.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ttdrecord.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,ttdrecord.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,twext.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,twext.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,twinapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,twinapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/save-the-environment-variables +TRUE,twinui.appcore.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,twinui.appcore.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,uianimation.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,uianimation.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,uiautomationcore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uiautomationcore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uireng.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uireng.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uiribbon.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,uiribbon.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,umpdc.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,umpdc.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,unattend.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ TRUE,unityplayer.dll,*\Appdata\local\Temp\*,T1574.002,https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/ -TRUE,updatepolicy.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,updatepolicy.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,upshared.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,urlmon.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,urlmon.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,userenv.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,userenv.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,utildll.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,utildll.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uxinit.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uxinit.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uxtheme.dll,*\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,uxtheme.dll,*\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vaultcli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vaultcli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vdsutil.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,vdsutil.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,vender.dll,*\Program Files\ASUS\GPU TweakII*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,vender.dll,*\Program Files\ASUS\VGA COM\*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,version.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,version.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,vftrace.dll,*\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true -TRUE,vftrace.dll,*\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x64*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true -TRUE,vftrace.dll,*\Program Files\CyberArk\Endpoint Privilege Manager\Agent*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true -TRUE,virtdisk.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,virtdisk.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,updatepolicy.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,updatepolicy.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,upshared.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,urlmon.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,urlmon.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,userenv.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,userenv.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,utildll.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,utildll.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uxinit.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uxinit.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uxtheme.dll,*:\Windows\System32\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,uxtheme.dll,*:\Windows\SysWOW64\*,T1574.001,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vaultcli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vaultcli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vdsutil.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,vdsutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,vender.dll,*:\Program Files\ASUS\GPU TweakII*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,vender.dll,*:\Program Files\ASUS\VGA COM\*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,version.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,version.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,vftrace.dll,*:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true +TRUE,vftrace.dll,*:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x64*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true +TRUE,vftrace.dll,*:\Program Files\CyberArk\Endpoint Privilege Manager\Agent*,T1574.002,https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true +TRUE,virtdisk.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,virtdisk.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows TRUE,vivaldi_elf.dll,*\Appdata\local\Vivaldi\Application*,T1574.002,https://securityintelligence.com/posts/vizom-malware-targets-brazilian-bank-customers-remote-overlay/ TRUE,vivaldi_elf.dll,*\Appdata\local\Vivaldi\Application\*,T1574.002,https://securityintelligence.com/posts/vizom-malware-targets-brazilian-bank-customers-remote-overlay/ -TRUE,vntfxf32.dll,*\Program Files\Venta\VentaFax & Voice*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ -TRUE,vsodscpl.dll,*\Program Files\McAfee\VirusScan Enterprise*,T1574.002,https://eiploader.wordpress.com/2011/03/28/digitally-signed-malware-without-stealing-certificates/ -TRUE,vssapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vssapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vsstrace.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,vsstrace.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wbemprox.dll,*\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wbemprox.dll,*\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wbemsvc.dll,*\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wbemsvc.dll,*\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wcmapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wcmapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wcnnetsh.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wdi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wdi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wdscore.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wdscore.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,webservices.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,webservices.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wecapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wecapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wer.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wer.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wevtapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wevtapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,whhelper.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,whhelper.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wimgapi.dll,*\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ -TRUE,wimgapi.dll,*\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ -TRUE,wimgapi.dll,*\Program Files\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\arm64\DISM*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ -TRUE,winbio.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winbio.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winbrand.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winbrand.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windows.storage.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windows.storage.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windows.storage.search.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windows.storage.search.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windows.ui.immersive.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,windows.ui.immersive.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,windowscodecs.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windowscodecs.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windowscodecsext.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windowscodecsext.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windowsperformancerecordercontrol.dll,*\Program Files\windows kits\10\windows performance toolkit*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windowsperformancerecordercontrol.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windowsperformancerecordercontrol.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,windowsperformancerecorderui.dll,*\Program Files\Windows Kits\10\Windows Performance Toolkit*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,windowsudk.shellcommon.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,windowsudk.shellcommon.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,winhttp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winhttp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wininet.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wininet.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winipsec.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winipsec.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winmde.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winmm.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winmm.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winnsi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winnsi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winrnr.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,winrnr.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,winscard.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winscard.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winsqlite3.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winsqlite3.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winsta.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winsta.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,winsync.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winsync.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,winutils.dll,*\Program Files\Palo Alto Networks\Traps*,T1574.002,https://research.checkpoint.com/2023/rorschach-a-new-sophisticated-and-fast-ransomware/ -TRUE,wkscli.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wkscli.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wlanapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wlanapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wlancfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wlancfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wldp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wldp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wlidprov.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wlidprov.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wmiclnt.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wmiclnt.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wmidcom.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wmidcom.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wmiutils.dll,*\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wmiutils.dll,*\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wmpdui.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wmsgapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wmsgapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wofutil.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wofutil.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wpdshext.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wpdshext.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wsc.dll,*\Program Files\AVAST Software\Avast*,T1574.001,https://github.com/netero1010/Vulnerability-Disclosure/tree/main/CVE-2022-AVAST2 -TRUE,wscapi.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,wscapi.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,wsdapi.dll,*\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,wsdapi.dll,*\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -TRUE,wshbth.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wshbth.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,wshelper.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wshelper.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wsmsvc.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,wsmsvc.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,wtsapi32.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wtsapi32.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wwancfg.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wwancfg.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wwapi.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,wwapi.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,xmllite.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,xmllite.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,xolehlp.dll,*\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,xolehlp.dll,*\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows -TRUE,xpsservices.dll,*\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,xpsservices.dll,*\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ -TRUE,xwizards.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,xwizards.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,xwtpw32.dll,*\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables -TRUE,xwtpw32.dll,*\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,vntfxf32.dll,*:\Program Files\Venta\VentaFax & Voice*,T1574.002,https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/ +TRUE,vsodscpl.dll,*:\Program Files\McAfee\VirusScan Enterprise*,T1574.002,https://eiploader.wordpress.com/2011/03/28/digitally-signed-malware-without-stealing-certificates/ +TRUE,vssapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vssapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vsstrace.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,vsstrace.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wbemprox.dll,*:\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wbemprox.dll,*:\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wbemsvc.dll,*:\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wbemsvc.dll,*:\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wcmapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wcmapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wcnnetsh.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wdi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wdi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wdscore.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wdscore.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,webservices.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,webservices.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wecapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wecapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wer.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wer.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wevtapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wevtapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,whhelper.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,whhelper.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wimgapi.dll,*:\Windows\System32\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ +TRUE,wimgapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ +TRUE,wimgapi.dll,*:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\arm64\DISM*,T1574.002,https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/ +TRUE,winbio.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winbio.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winbrand.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winbrand.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windows.storage.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windows.storage.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windows.storage.search.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windows.storage.search.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windows.ui.immersive.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,windows.ui.immersive.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,windowscodecs.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windowscodecs.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windowscodecsext.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windowscodecsext.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windowsperformancerecordercontrol.dll,*:\Program Files\windows kits\10\windows performance toolkit*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windowsperformancerecordercontrol.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windowsperformancerecordercontrol.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,windowsperformancerecorderui.dll,*:\Program Files\Windows Kits\10\Windows Performance Toolkit*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,windowsudk.shellcommon.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,windowsudk.shellcommon.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,winhttp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winhttp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wininet.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wininet.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winipsec.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winipsec.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winmde.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winmm.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winmm.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winnsi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winnsi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winrnr.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,winrnr.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,winscard.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winscard.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winsqlite3.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winsqlite3.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winsta.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winsta.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,winsync.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winsync.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,winutils.dll,*:\Program Files\Palo Alto Networks\Traps*,T1574.002,https://research.checkpoint.com/2023/rorschach-a-new-sophisticated-and-fast-ransomware/ +TRUE,wkscli.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wkscli.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wlanapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wlanapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wlancfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wlancfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wldp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wldp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wlidprov.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wlidprov.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wmiclnt.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wmiclnt.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wmidcom.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wmidcom.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wmiutils.dll,*:\Windows\System32\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wmiutils.dll,*:\Windows\SysWOW64\wbem*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wmpdui.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wmsgapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wmsgapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wofutil.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wofutil.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wpdshext.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wpdshext.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wsc.dll,*:\Program Files\AVAST Software\Avast*,T1574.001,https://github.com/netero1010/Vulnerability-Disclosure/tree/main/CVE-2022-AVAST2 +TRUE,wscapi.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,wscapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,wsdapi.dll,*:\Windows\System32\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,wsdapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +TRUE,wshbth.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wshbth.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,wshelper.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wshelper.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wsmsvc.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,wsmsvc.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,wtsapi32.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wtsapi32.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wwancfg.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wwancfg.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wwapi.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,wwapi.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,xmllite.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,xmllite.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,xolehlp.dll,*:\Windows\System32\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,xolehlp.dll,*:\Windows\SysWOW64\*,T1574.002,https://wietze.github.io/blog/hijacking-dlls-in-windows +TRUE,xpsservices.dll,*:\Windows\System32\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,xpsservices.dll,*:\Windows\SysWOW64\*,T1574.002,https://securityintelligence.com/posts/windows-features-dll-sideloading/ +TRUE,xwizards.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,xwizards.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,xwtpw32.dll,*:\Windows\System32\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables +TRUE,xwtpw32.dll,*:\Windows\SysWOW64\*,T1574.007,https://wietze.github.io/blog/save-the-environment-variables diff --git a/lookups/csv/nirsoft_utilities_lookup.csv b/lookups/csv/nirsoft_utilities_lookup.csv new file mode 100644 index 00000000000..ba62fd11e72 --- /dev/null +++ b/lookups/csv/nirsoft_utilities_lookup.csv @@ -0,0 +1,592 @@ +original_file_name,description +acm.exe,"Disable/enable ActiveX components on Internet Explorer browser." +acm.zip,"ZIP Bundle for acm.exe" +AddrView.exe,"Extract URL addresses from HTML pages." +addrview.zip,"ZIP Bundle for AddrView.exe" +AdvancedRun.exe,"Run a program with different settings that you choose." +advancedrun.zip,"ZIP Bundle for AdvancedRun.exe" +AllThreadsView.exe,"Displays a list of all running threads in Windows" +allthreadsview.zip,"ZIP Bundle for AllThreadsView.exe" +AlternateStreamView.exe,"Find all hidden alternate streams stored in the file system." +alternatestreamview.zip,"ZIP Bundle for AlternateStreamView.exe" +AltStreamDump.exe,"Dumps the list of NTFS alternate streams" +altstreamdump.zip,"ZIP Bundle for AltStreamDump.exe" +AppAudioConfig.exe,"View/change audio settings of applications" +appaudioconfig.zip,"ZIP Bundle for AppAudioConfig.exe" +AppCompatibilityView.exe,"List of all programs that run with different compatibility setting" +appcompatibilityview.zip,"ZIP Bundle for AppCompatibilityView.exe" +AppCrashView.exe,"Displays the details of all application crashes occurred in your system. " +appcrashview.zip,"ZIP Bundle for AppCrashView.exe" +AppNetworkCounter.exe,"Displays number of TCP/UDP bytes and packets sent/received by every application" +appnetworkcounter.zip,"ZIP Bundle for AppNetworkCounter.exe" +AppReadWriteCounter.exe,"Displays read/write operations of every application running on your system." +appreadwritecounter.zip,"ZIP Bundle for AppReadWriteCounter.exe" +AppResourcesUsageView.exe,"View application resources usage information of Windows 10/11 " +appresourcesusageview.zip,"ZIP Bundle for AppResourcesUsageView.exe" +awatch.exe,"displays useful information about your network adapters." +awatch.zip,"ZIP Bundle for awatch.exe" +axhelper.exe,"view essential information about ActiveX components installed on your computer." +axhelper.zip,"ZIP Bundle for axhelper.exe" +BatteryHistoryView.exe,"Displays battery history information on Windows 11/10." +batteryhistoryview.zip,"ZIP Bundle for BatteryHistoryView.exe" +BatteryInfoView.exe,"Displays battery information on laptops and netbooks." +batteryinfoview.zip,"ZIP Bundle for BatteryInfoView.exe" +BlueScreenView.exe,"Show information about blue screen crashes occurred in your system." +bluescreenview.zip,"ZIP Bundle for BlueScreenView.exe" +BluetoothCL.exe,"Show bluetooth devices list" +bluetoothcl.zip,"ZIP Bundle for BluetoothCL.exe" +BluetoothLEView.exe,"Monitors the activity of Bluetooth Low Energy devices around you." +bluetoothleview.zip,"ZIP Bundle for BluetoothLEView.exe" +BluetoothLogView.exe,"Creates a log of Bluetooth activity in your area." +bluetoothlogview.zip,"ZIP Bundle for BluetoothLogView.exe" +BluetoothView.exe,"Monitors the activity of Bluetooth devices around you." +bluetoothview.zip,"ZIP Bundle for BluetoothView.exe" +BootPerformanceView.exe,"Displays the performance information of the boot process on Windows 11/10/8/7" +bootperformanceview.zip,"ZIP Bundle for BootPerformanceView.exe" +BrowserAddonsView.exe,"Displays the details of all Web browser addons/plugins installed in your system." +browseraddonsview.zip,"ZIP Bundle for BrowserAddonsView.exe" +BrowserAutoFillView.exe,"View form autofill text stored by Chrome and Firefox Web browsers" +browserautofillview.zip,"ZIP Bundle for BrowserAutoFillView.exe" +BrowserDownloadsView.exe,"Displays the details of downloaded files of Chrome and Firefox Web browsers" +browserdownloadsview.zip,"ZIP Bundle for BrowserDownloadsView.exe" +BrowsingHistoryView.exe,"View browsing history of popular Web browsers " +browsinghistoryview.zip,"ZIP Bundle for BrowsingHistoryView.exe" +brtools.zip,"ZIP Bundle for MozillaHistoryView.exe" +BulkFileChanger.exe,"Change date/time/attributes of multiple files." +bulkfilechanger.zip,"ZIP Bundle for BulkFileChanger.exe" +BulletsPassView.exe,"Reveals the passwords stored behind the bullets." +bulletspassview.zip,"ZIP Bundle for BulletsPassView.exe" +ChromeCacheView.exe,"Chrome Browser Cache Viewer" +chromecacheview.zip,"ZIP Bundle for ChromeCacheView.exe" +ChromeCookiesView.exe,"Alternative to the standard internal cookies viewer of Google Chrome" +chromecookiesview.zip,"ZIP Bundle for ChromeCookiesView.exe" +ChromeHistoryView.exe,"View the browsing history of Chrome Web browser" +chromehistoryview.zip,"ZIP Bundle for ChromeHistoryView.exe" +ChromePass.exe,"Password recovery tool for Google Chrome Web browser. " +chromepass.zip,"ZIP Bundle for ChromePass.exe" +CleanAfterMe.exe,"Clean files and Registry values in your system." +cleanafterme.zip,"ZIP Bundle for CleanAfterMe.exe" +Clipboardic.exe,"Small and simple clipboard manager." +clipboardic.zip,"ZIP Bundle for Clipboardic.exe" +ControlMyMonitor.exe,"View and modify the settings of your monitor." +controlmymonitor.zip,"ZIP Bundle for ControlMyMonitor.exe" +CountryTraceRoute.exe,"Fast Traceroute utility with IP country information." +countrytraceroute.zip,"ZIP Bundle for CountryTraceRoute.exe" +cports.exe,"Displays the list of all currently opened TCP/UDP ports on your computer." +cports.exe,"Package of network monitoring tools for Windows" +cports.zip,"ZIP Bundle for cports.exe" +CProcess.exe,"Displays the list of all processes currently running on your system." +cprocess.zip,"ZIP Bundle for CProcess.exe" +CredentialsFileView.exe,"Decrypts Credentials files of Windows." +credentialsfileview.zip,"ZIP Bundle for CredentialsFileView.exe" +CredHistView.exe,"Decrypt the CREDHIST file of Windows" +credhistview.zip,"ZIP Bundle for CredHistView.exe" +CSVFileView.exe,"CSV/Tab-delimited file viewer and converter" +csvfileview.zip,"ZIP Bundle for CSVFileView.exe" +ctie.exe,"Add/delete toolbar buttons and menu items in Internet Explorer." +ctie.zip,"ZIP Bundle for ctie.exe" +CustomExplorerToolbar.exe,"Add Copy/Cut/Paste buttons to the Explorer toolbar of Windows 7." +customexplorertoolbar.zip,"ZIP Bundle for CustomExplorerToolbar.exe" +DataProtectionDecryptor.exe,"Decrypt DPAPI-encrypted data of Windows." +dataprotectiondecryptor.zip,"ZIP Bundle for DataProtectionDecryptor.exe" +DeviceIOView.exe,"Watch the data transfer between a software or service and a device driver." +deviceioview.zip,"ZIP Bundle for DeviceIOView.exe" +DevManView.exe,"Alternative to the standard Device Manager of Windows." +devmanview.zip,"ZIP Bundle for DevManView.exe" +DHCPLogView.exe,"Displays DHCP requests sent by every device connect to your network." +dhcplogview.zip,"ZIP Bundle for DHCPLogView.exe" +Dialupass.exe,"NirSoft Dialupass utility." +dialupass.zip,"ZIP Bundle for Dialupass.exe" +DiskCountersView.exe,"Show disk drive read/write counters." +diskcountersview.zip,"ZIP Bundle for DiskCountersView.exe" +DiskSmartView.exe,"Retrieves S.M.A.R.T information from IDE/SATA disks." +disksmartview.zip,"ZIP Bundle for DiskSmartView.exe" +dllexp.exe,"Lists DLL exported functions and their memory addresses - for debugging." +dllexp.exe,"Small utilities package that can be used by programmers for debugging." +dllexp.zip,"ZIP Bundle for dllexp.exe" +DNSDataView.exe,"Retrieve the DNS records (MX, NS, A, SOA) of the specified domains. " +dnsdataview.zip,"ZIP Bundle for DNSDataView.exe" +DNSLookupView.exe,"DNS Lookup Viewer for Windows 11/10" +dnslookupview.zip,"ZIP Bundle for DNSLookupView.exe" +DNSQuerySniffer.exe,"Network sniffer utility that shows the DNS queries sent on your system. " +dnsquerysniffer.zip,"ZIP Bundle for DNSQuerySniffer.exe" +DomainHostingView.exe,"Displays extensive information about a domain." +DomainHostingView.exe,"Package of domain/ip address lookup tools for Windows" +domainhostingview.zip,"ZIP Bundle for DomainHostingView.exe" +domainlookuptools.zip,"ZIP Bundle for DomainHostingView.exe" +DotNetResourcesExtract.exe,"Extract embedded resources from .NET applications." +dotnetresourcesextract.zip,"ZIP Bundle for DotNetResourcesExtract.exe" +DownTester.exe,"Test your Internet download speed." +downtester.zip,"ZIP Bundle for DownTester.exe" +DriveLetterView.exe,"View and change drive letter assignments " +driveletterview.zip,"ZIP Bundle for DriveLetterView.exe" +DriverView.exe,"Displays the list of all device drivers currently loaded on your system." +driverview.zip,"ZIP Bundle for DriverView.exe" +DumpEDID.exe,"Dump EDID information into the console window." +dumpedid.zip,"ZIP Bundle for DumpEDID.exe" +EdgeCookiesView.exe,"Display cookies from new versions of MS-Edge" +edgecookiesview.zip,"ZIP Bundle for EdgeCookiesView.exe" +EncryptedRegView.exe,"Scans the Registry and decrypts the data encrypted with DPAPI." +encryptedregview.zip,"ZIP Bundle for EncryptedRegView.exe" +ESEDatabaseView.exe,"View the content of ESE database files (.edb files)" +esedatabaseview.zip,"ZIP Bundle for ESEDatabaseView.exe" +EventLogChannelsView.exe,"View, Disable, Enable Event Log Channels." +eventlogchannelsview.zip,"ZIP Bundle for EventLogChannelsView.exe" +EventLogSourcesView.exe,"Displays the list of all event log sources installed on your system. " +eventlogsourcesview.zip,"ZIP Bundle for EventLogSourcesView.exe" +ExecutedProgramsList.exe,"Displays programs and batch files that you previously executed on your system." +executedprogramslist.zip,"ZIP Bundle for ExecutedProgramsList.exe" +ExifDataView.exe,"Displays the Exif data stored inside .jpg image files" +exifdataview.zip,"ZIP Bundle for ExifDataView.exe" +ExtPassword.exe,"External Drive Password Recovery" +extpassword.zip,"ZIP Bundle for ExtPassword.exe" +FastResolver.exe,"Resolves multiple host names into IP addresses/MAC Addresses and vice versa. " +fastresolver.zip,"ZIP Bundle for FastResolver.exe" +faview.exe,"displays the list of all your Favorties/bookmarks in a single page." +faview.zip,"ZIP Bundle for faview.exe" +FBCacheView.exe,"Shows Facebook images stored in the cache of your Web browser." +fbcacheview.zip,"ZIP Bundle for FBCacheView.exe" +FileAccessErrorView.exe,"Displays file access error information" +fileaccesserrorview.zip,"ZIP Bundle for FileAccessErrorView.exe" +FileActivityWatch.exe,"Displays information about read/write/delete operations on your system." +fileactivitywatch.zip,"ZIP Bundle for FileActivityWatch.exe" +FileTypesMan.exe,"Alternative to the File Types manager of Windows." +filetypesman.zip,"ZIP Bundle for FileTypesMan.exe" +FirefoxDownloadsView.exe,"Displayed the list of downloaded files in Firefox" +firefoxdownloadsview.zip,"ZIP Bundle for FirefoxDownloadsView.exe" +FirmwareTablesView.exe,"Displays a list of firmware tables (ACPI, SMBIOS) stored on your system." +firmwaretablesview.zip,"ZIP Bundle for FirmwareTablesView.exe" +FlashCookiesView.exe,"View Flash cookies stored in your computer." +flashcookiesview.zip,"ZIP Bundle for FlashCookiesView.exe" +FolderChangesView.exe,"Monitor folder/drive changes." +folderchangesview.zip,"ZIP Bundle for FolderChangesView.exe" +FolderTimeUpdate.exe,"Updates the Modified Time of folders." +foldertimeupdate.zip,"ZIP Bundle for FolderTimeUpdate.exe" +folrep.exe,"Scans your disk, and displays a report about each folder." +folrep.zip,"ZIP Bundle for folrep.exe" +FreeSpaceLogView.exe,"View log of free disk space on Windows" +freespacelogview.zip,"ZIP Bundle for FreeSpaceLogView.exe" +FullEventLogView.exe,"Event log viewer for Windows 10/8/7/Vista." +fulleventlogview.zip,"ZIP Bundle for FullEventLogView.exe" +FullUpdatesHistoryView.exe,"Displays the history of Windows 11 updates on your system. " +fullupdateshistoryview.zip,"ZIP Bundle for FullUpdatesHistoryView.exe" +gacview.exe,"Alternative to the standard .NET assembly viewer on Windows Explorer." +gacview.zip,"ZIP Bundle for gacview.exe" +GDIView.exe,"Displays the list of GDI handles opened by every process" +gdiview.zip,"ZIP Bundle for GDIView.exe" +GetNir.exe,"Command line tool to extract values from tab-delimited and comma-delimited data" +getnir.zip,"ZIP Bundle for GetNir.exe" +GUIPropView.exe,"Displays extensive information about all windows currently opened on your system" +guipropview.zip,"ZIP Bundle for GUIPropView.exe" +HandleCountersView.exe,"Shows handle counter for every process" +handlecountersview.zip,"ZIP Bundle for HandleCountersView.exe" +HashMyFiles.exe,"Calculate the MD5/SHA1 hashes of your files" +hashmyfiles.zip,"ZIP Bundle for HashMyFiles.exe" +HeapMemView.exe,"View the content of all memory blocks allocated in the heap." +heapmemview.zip,"ZIP Bundle for HeapMemView.exe" +HostedNetworkStarter.exe,"Create a wifi hotspot with your wireless network adapter" +hostednetworkstarter.zip,"ZIP Bundle for HostedNetworkStarter.exe" +HotKeysList.exe,"Displays the list of hot keys that are currently registered on your system." +hotkeyslist.zip,"ZIP Bundle for HotKeysList.exe" +HtmlAsText.exe,"Converts HTML documents to simple text files." +htmlastext.zip,"ZIP Bundle for HtmlAsText.exe" +HtmlDocEdit.exe,"Simple HTML designer/editor" +htmldocedit.zip,"ZIP Bundle for HtmlDocEdit.exe" +HTTPNetworkSniffer.exe,"Captures and displays HTTP requests/responses." +httpnetworksniffer.zip,"ZIP Bundle for HTTPNetworkSniffer.exe" +iconsext.exe,"Extract icons and cursors from executbale files (EXE, DLL, OCX, CPL, etc.)" +iconsext.zip,"ZIP Bundle for iconsext.exe" +IECacheView.exe,"List all files currently stored in the cache of Internet Explorer." +iecacheview.zip,"ZIP Bundle for IECacheView.exe" +iecv.exe,"Displays the cookies that Internet Explorer stores on your computer" +iecv.zip,"ZIP Bundle for iecv.exe" +IEDesignMode.exe,"Switch the active Internet Explorer window to design mode. " +iedesignmode.zip,"ZIP Bundle for IEDesignMode.exe" +iehv.exe,"Displays the list of Web sites that you visited with IE Web browser." +iehv.zip,"ZIP Bundle for iehv.exe" +iepv.exe,"Recover passwords stored by Internet Explorer (Versions 4.0 - 8.0)" +iepv.zip,"ZIP Bundle for iepv.exe" +ImageCacheViewer.exe,"Displays images stored in the cache of your Web browsers." +imagecacheviewer.zip,"ZIP Bundle for ImageCacheViewer.exe" +InjectedDLL.exe,"Display the list of injected DLLs." +injecteddll.zip,"ZIP Bundle for InjectedDLL.exe" +InsideClipboard.exe,"Displays the content of all formats stored in the clipboard." +insideclipboard.zip,"ZIP Bundle for InsideClipboard.exe" +InstalledAppView.exe,"View installed Windows 10 apps" +installedappview.zip,"ZIP Bundle for InstalledAppView.exe" +InstalledCodec.exe,"List Codec drivers and DirectShow filters installed on your system." +installedcodec.zip,"ZIP Bundle for InstalledCodec.exe" +InstalledDriversList.exe,"Lists all device drivers that are currently installed on your system." +installeddriverslist.zip,"ZIP Bundle for InstalledDriversList.exe" +InstalledPackagesView.exe,"Displays installed MSI packages on your system." +installedpackagesview.zip,"ZIP Bundle for InstalledPackagesView.exe" +IPInfoOffline.exe,"view country information about IP addresses." +ipinfooffline.zip,"ZIP Bundle for IPInfoOffline.exe" +IPNeighborsView.exe,"View the IP neighbor table on Windows 10/8/7/Vista" +ipneighborsview.zip,"ZIP Bundle for IPNeighborsView.exe" +IPNetInfo.exe,"NirSoft IPNetInfo utility." +ipnetinfo.zip,"ZIP Bundle for ipnetinfo.exe" +IPPathTableView.exe,"IP Path Table Viewer" +ippathtableview.zip,"ZIP Bundle for IPPathTableView.exe" +jrview.exe,"Displays the installed Java Runtime Environments." +jrview.zip,"ZIP Bundle for jrview.exe" +jsae.exe,"Creates Javascript animation from image files on your local drive." +jsae.zip,"ZIP Bundle for jsae.exe" +JumpListsView.exe,"Displays the information stored by the Jump Lists feature of Windows 7." +jumplistsview.zip,"ZIP Bundle for JumpListsView.exe" +KeyboardStateView.exe,"Shows the current state and virtual key code of every key you press." +keyboardstateview.zip,"ZIP Bundle for KeyboardStateView.exe" +LANIPScanner.exe,"Local network scanner for Windows" +lanipscanner.zip,"ZIP Bundle for LANIPScanner.exe" +LastActivityView.exe,"View the latest computer activity." +lastactivityview.zip,"ZIP Bundle for LastActivityView.exe" +LiveContactsView.exe,"View the details of all contacts in your Windows Live Messenger." +livecontactsview.zip,"ZIP Bundle for LiveContactsView.exe" +LiveTcpUdpWatch.exe,"Displays live information about all TCP and UDP activity on your system." +livetcpudpwatch.zip,"ZIP Bundle for LiveTcpUdpWatch.exe" +LoadedDllsView.exe,"Displays all DLL files loaded on your system." +loadeddllsview.zip,"ZIP Bundle for LoadedDllsView.exe" +LostMyPassword.exe,"Password recovery tool for Windows" +lostmypassword.zip,"ZIP Bundle for LostMyPassword.exe" +LSASecretsDump.exe,"Dump the LSA secrets from the Registry." +lsasecretsdump.zip,"ZIP Bundle for LSASecretsDump.exe" +LSASecretsView.exe,"Displays the list of all LSA secrets stored in the Registry on your computer. " +lsasecretsview.zip,"ZIP Bundle for LSASecretsView.exe" +MACAddressView.exe,"MAC address lookup tool" +macaddressview.zip,"ZIP Bundle for MACAddressView.exe" +MadPassExt.exe,"Extract the secret DPAPI password generated for your Microsoft account" +madpassext.zip,"ZIP Bundle for MadPassExt.exe" +mailpv.exe,"Recovers email passwords" +mailpv.zip,"ZIP Bundle for mailpv.exe" +ManageWirelessNetworks.exe,"Alternative tool to the standard Manage Wireless Networks of Windows " +managewirelessnetworks.zip,"ZIP Bundle for ManageWirelessNetworks.exe" +mDNSView.exe,"Displays all mDNS records published by devcies connected to your local network." +mdnsview.zip,"ZIP Bundle for mDNSView.exe" +MMCSnapInsView.exe,"Displays the details of all MMC snap-ins installed on your system." +mmcsnapinsview.zip,"ZIP Bundle for MMCSnapInsView.exe" +mmview.exe,"Lists the installed Codec, and allows you to disable/enable them." +mmview.zip,"ZIP Bundle for mmview.exe" +MobileFileSearch.exe,"Search files inside a mobile device plugged to the USB port on your computer" +mobilefilesearch.zip,"ZIP Bundle for MobileFileSearch.exe" +MonitorInfoView.exe,"displays essential information about your monitor." +monitorinfoview.zip,"ZIP Bundle for MonitorInfoView.exe" +MozillaCacheView.exe,"Displays the list of files stored in the cache of Mozilla-based Web browsers." +mozillacacheview.zip,"ZIP Bundle for MozillaCacheView.exe" +MozillaHistoryView.exe,"Displays the list of visited Web sites in Firefox/Mozilla/Netscape Web browsers." +MozillaHistoryView.exe,"Package of Web browser tools for Windows" +mozillahistoryview.zip,"ZIP Bundle for MozillaHistoryView.exe" +mspass.exe,"Password Recovery package for Windows." +mspass.exe,"Recovers the passwords of instant messenger programs" +mspass.zip,"ZIP Bundle for mspass.exe" +MUICacheView.exe,"Edit/delete MUICache items in your system" +muicacheview.zip,"ZIP Bundle for MUICacheView.exe" +MultiMonitorTool.exe,"Enable, disable, and set the primary monitor in Multi-Monitor system." +multimonitortool.zip,"ZIP Bundle for MultiMonitorTool.exe" +mweather.exe,"Decode METAR weather reports, and display them in a simple weather report table." +mweather.zip,"ZIP Bundle for mweather.exe" +MyEventViewer.exe,"MyEventViewer is a simple alternative to the standard event viewer of Windows." +myeventviewer.zip,"ZIP Bundle for MyEventViewer.exe" +MyLastSearch.exe,"View your latest searches with Google, Yahoo, and MSN" +mylastsearch.zip,"ZIP Bundle for MyLastSearch.exe" +myuninst.exe,"Alternative utility to the standard Add/Remove applet of Windows." +myuninst.zip,"ZIP Bundle for myuninst.exe" +MZCacheView.exe,"List all files currently stored in the cache of Firefox/Mozilla browser." +mzcacheview.zip,"ZIP Bundle for MZCacheView.exe" +mzcv.exe,"alternative to the standard Cookie Manager provided by Firefox and Mozilla." +mzcv.zip,"ZIP Bundle for mzcv.exe" +NetBScanner.exe,"Scans all computers in the IP addresses range you choose, using NetBIOS protocol" +netbscanner.zip,"ZIP Bundle for NetBScanner.exe" +NetConnectChoose.exe,"Set default Internet connection and view general connection information." +netconnectchoose.zip,"ZIP Bundle for NetConnectChoose.exe" +netpass.exe,"Recover network passwords on Windows XP/2003/Vista." +netpass.zip,"ZIP Bundle for netpass.exe" +NetResView.exe,"displays the list of all network resources on your LAN." +netresview.zip,"ZIP Bundle for NetResView.exe" +NetRouteView.exe,"GUI alternative to the standard route utility of Windows." +netrouteview.zip,"ZIP Bundle for NetRouteView.exe" +NetworkConnectLog.exe,"Shows a log of connected/disconnected computers on your network." +networkconnectlog.zip,"ZIP Bundle for NetworkConnectLog.exe" +NetworkCountersWatch.exe,"Displays system counters for every network interface on your system." +networkcounterswatch.zip,"ZIP Bundle for NetworkCountersWatch.exe" +NetworkInterfacesView.exe,"Displays the list of all network adapters/interfaces installed on your system." +networkinterfacesview.zip,"ZIP Bundle for NetworkInterfacesView.exe" +NetworkLatencyView.exe,"Calculates the network latency (in milliseconds) for every new TCP connection." +networklatencyview.zip,"ZIP Bundle for NetworkLatencyView.exe" +NetworkOpenedFiles.exe,"Displays the files that are currently opened by other computers on your network." +networkopenedfiles.zip,"ZIP Bundle for NetworkOpenedFiles.exe" +networktools.zip,"ZIP Bundle for cports.exe" +NetworkTrafficView.exe,"Displays network traffic statistics on your network adapter" +networktrafficview.zip,"ZIP Bundle for NetworkTrafficView.exe" +NetworkUsageView.exe,"Displays network usage information for Windows 8 and Windows 10" +networkusageview.zip,"ZIP Bundle for NetworkUsageView.exe" +nircmd.exe,"Do many useful tasks from command-line." +nircmd.zip,"ZIP Bundle for nircmd.exe" +nirext.exe,"Adds 3 useful context menu extensions to your Windows Explorer environment." +nirext.zip,"ZIP Bundle for nirext.exe" +NK2Edit.exe,"Full NK2 (AutoComplete) editor for Microsoft Outlook" +nk2edit.zip,"ZIP Bundle for NK2Edit.exe" +nk2view.exe,"View the content of Outlook AutoComplete .NK2 file." +nk2view.zip,"ZIP Bundle for nk2view.exe" +NTFSLinksView.exe,"View the list of NTFS symbolic links/junctions in selected folder." +ntfslinksview.zip,"ZIP Bundle for NTFSLinksView.exe" +OfficeIns.exe,"displays the details of all installed Microsoft Office add-ins on your computer." +officeins.zip,"ZIP Bundle for OfficeIns.exe" +OfflineRegistryFinder.exe,"Find data in external Registry files" +offlineregistryfinder.zip,"ZIP Bundle for OfflineRegistryFinder.exe" +OfflineRegistryView.exe,"View offline Registry files" +offlineregistryview.zip,"ZIP Bundle for OfflineRegistryView.exe" +ofview.zip,"ZIP Bundle for OpenedFilesView.exe" +OpenedFilesView.exe,"Displays the list of all opened files on your system." +OpenSaveFilesView.exe,"Displays list of files that you previously opened." +opensavefilesview.zip,"ZIP Bundle for OpenSaveFilesView.exe" +OpenWithView.exe,"Disable/enable items in the Open With dialog-box of Windows." +openwithview.zip,"ZIP Bundle for OpenWithView.exe" +OperaCacheView.exe,"Cache viewer for Opera Web browser." +operacacheview.zip,"ZIP Bundle for OperaCacheView.exe" +OperaPassView.exe,"Password recovery tool for Opera Web browser." +operapassview.zip,"ZIP Bundle for OperaPassView.exe" +OutlookAccountsView.exe,"View POP3/IMAP/SMTP passwords and account settings of Outlook" +outlookaccountsview.zip,"ZIP Bundle for OutlookAccountsView.exe" +OutlookAddressBookView.exe,"Displays the details of all recipients stored in the address books of Outlook" +outlookaddressbookview.zip,"ZIP Bundle for OutlookAddressBookView.exe" +OutlookAttachView.exe,"Extract multiple attachments from Outlook." +outlookattachview.zip,"ZIP Bundle for OutlookAttachView.exe" +OutlookStatView.exe,"Display a general statistics of your Outlook emails." +outlookstatview.zip,"ZIP Bundle for OutlookStatView.exe" +outlooktools.zip,"ZIP Bundle for nk2edit.exe" +passreccommandline.zip,"ZIP Bundle for PassRecCommandLine.exe" +passrecenc.zip,"ZIP Bundle for PassRecEnc.exe" +passrecpk.zip,"ZIP Bundle for mspass.exe" +passrecview.zip,"ZIP Bundle for PassRecView.exe" +PasswordFox.exe,"View passwords stored in Firefox Web browser." +passwordfox.zip,"ZIP Bundle for PasswordFox.exe" +PasswordHashesView.exe,"Displays the SHA1 and NTLM hashes of login passwords for currently logged-in users." +passwordhashesview.zip,"ZIP Bundle for PasswordHashesView.exe" +PasswordScan.exe,"Displays security information about passwords stored in your system." +passwordscan.zip,"ZIP Bundle for PasswordScan.exe" +PingInfoView.exe,"ping multiple host names and IP addresses." +pinginfoview.zip,"ZIP Bundle for PingInfoView.exe" +PocketAsterisk.exe,"Reveals the passwords stored behind the asterisks (***)" +pocketasterisk.zip,"ZIP Bundle for PocketAsterisk.exe" +PreviousFilesRecovery.exe,"find and recovery files from Windows shadow copies" +previousfilesrecovery.zip,"ZIP Bundle for PreviousFilesRecovery.exe" +ProcessActivityView.exe,"Show the file activity for selected process." +processactivityview.zip,"ZIP Bundle for ProcessActivityView.exe" +ProcessTCPSummary.exe,"Displays TCP connections summary" +processtcpsummary.zip,"ZIP Bundle for ProcessTCPSummary.exe" +ProcessThreadsView.exe,"Displays extensive information about all threads of the process that you choose." +processthreadsview.zip,"ZIP Bundle for ProcessThreadsView.exe" +ProductKeyScanner.exe,"Find product keys stored in the Registry of Windows Operating system" +productkeyscanner.zip,"ZIP Bundle for ProductKeyScanner.exe" +ProduKey.exe,"Displays the CD-Keys of MS-Office/Windows installed on your computer." +ProduKey.exe,"Package of system tools for Windows" +produkey.zip,"ZIP Bundle for ProduKey.exe" +progtools.zip,"ZIP Bundle for dllexp.exe" +PropertySystemView.exe,"View/edit file properties" +propertysystemview.zip,"ZIP Bundle for PropertySystemView.exe" +pspv.exe,"reveals the passwords stored on your computer by Internet Explorer." +pspv.zip,"ZIP Bundle for pspv.exe" +PstPassword.exe,"Recover lost password of Outlook PST file." +pstpassword.zip,"ZIP Bundle for PstPassword.exe" +QuickSetDNS.exe,"Change the DNS servers that are used for your Internet connection." +quicksetdns.zip,"ZIP Bundle for QuickSetDNS.exe" +rdpv.exe,"Reveals the password stored by Microsoft Remote Desktop utility." +rdpv.zip,"ZIP Bundle for rdpv.exe" +RecentFilesView.exe,"Display the list of recently opened files" +recentfilesview.zip,"ZIP Bundle for RecentFilesView.exe" +RegDllView.exe,"RegDllView is a small utility that displays the list of all registered files." +regdllview.zip,"ZIP Bundle for RegDllView.exe" +RegFileExport.exe,"Export offline Registry file to .reg file" +regfileexport.zip,"ZIP Bundle for RegFileExport.exe" +RegFromApp.exe,"Creates .reg file according to Registry changes made by application." +regfromapp.zip,"ZIP Bundle for RegFromApp.exe" +RegHiveBackup.exe,"Backs up Registry files and user Registry hives to a specified folder." +reghivebackup.zip,"ZIP Bundle for RegHiveBackup.exe" +RegistryChangesView.exe,"Compares 2 snapshots of Windows Registry." +registrychangesview.zip,"ZIP Bundle for RegistryChangesView.exe" +RegScanner.exe,"Package of 5 Windows Registry tools for advanced users" +RegScanner.exe,"Scan and find values in the Registry" +regscanner.zip,"ZIP Bundle for RegScanner.exe" +regtools.zip,"ZIP Bundle for RegScanner.exe" +ResourcesExtract.exe,"Extract embedded resources from .NET applications." +ResourcesExtract.exe,"Extract resources from dll/ocx/exe files." +resourcesextract.zip,"ZIP Bundle for ResourcesExtract.exe" +RouterPassView.exe,"Recover passwords from router config file." +routerpassview.zip,"ZIP Bundle for RouterPassView.exe" +RTMPDumpHelper.exe,"Download RTMP streams in conjunction with RTMPDump toolkit." +rtmpdumphelper.zip,"ZIP Bundle for RTMPDumpHelper.exe" +RunAsDate.exe,"Run a program with the specified date." +runasdate.zip,"ZIP Bundle for RunAsDate.exe" +RunFromProcess.exe,"Run a program from another process that you choose." +runfromprocess.zip,"ZIP Bundle for RunFromProcess.exe" +RuntimeClassesView.exe,"Displays the list of Windows Runtime (WinRT) classes" +runtimeclassesview.zip,"ZIP Bundle for RuntimeClassesView.exe" +SafariCacheView.exe,"Cache viewer/extractor for Safari Web browser" +safaricacheview.zip,"ZIP Bundle for SafariCacheView.exe" +SafariHistoryView.exe,"History viewer for Safari Web browser" +safarihistoryview.zip,"ZIP Bundle for SafariHistoryView.exe" +SearchFilterView.exe,"view the search filters installed on your system." +searchfilterview.zip,"ZIP Bundle for SearchFilterView.exe" +SearchMyFiles.exe,"Alternative to the standard Search For Files And Folders module of Windows." +searchmyfiles.zip,"ZIP Bundle for SearchMyFiles.exe" +SecurityQuestionsView.exe,"View Windows 10 security questions" +securityquestionsview.zip,"ZIP Bundle for SecurityQuestionsView.exe" +SecuritySoftView.exe,"Displays the list of AntiVirus/AntiSpyware/ Firewall programs on your system." +securitysoftview.zip,"ZIP Bundle for SecuritySoftView.exe" +SeqDownload.exe,"Download sequence of images from the Web, and create animation from them." +seqdownload.zip,"ZIP Bundle for SeqDownload.exe" +serviwin.exe,"displays the list of installed drivers and services on your system." +serviwin.zip,"ZIP Bundle for serviwin.exe" +ShadowCopyView.exe,"View shadow copies on your system" +shadowcopyview.zip,"ZIP Bundle for ShadowCopyView.exe" +ShellBagsView.exe,"Displays the list of all folder settings saved by Windows. " +shellbagsview.zip,"ZIP Bundle for ShellBagsView.exe" +ShellMenuNew.exe,"Disable/Enable items in the New submenu of Explorer." +shellmenunew.zip,"ZIP Bundle for ShellMenuNew.exe" +shexview.exe,"Displays the details of shell extensions installed on your computer." +shexview.zip,"ZIP Bundle for shexview.exe" +shman.exe,"Lists all shortcuts on your desktop/start menu." +shman.zip,"ZIP Bundle for shman.exe" +shmnview.exe,"Disable/enable static menu items in context menu of Explorer." +shmnview.zip,"ZIP Bundle for shmnview.exe" +ShutdownPerformanceView.exe,"Displays the performance information of Windows shutdown process" +shutdownperformanceview.zip,"ZIP Bundle for ShutdownPerformanceView.exe" +SimpleCodeGenerator.exe,"QR Code Generator for Windows" +simplecodegenerator.zip,"ZIP Bundle for SimpleCodeGenerator.exe" +SimpleProgramDebugger.exe,"Displays debugging events of a running program." +simpleprogramdebugger.zip,"ZIP Bundle for SimpleProgramDebugger.exe" +SimpleWMIView.exe,"Displays the result of WMI queries in a simple table" +simplewmiview.zip,"ZIP Bundle for SimpleWMIView.exe" +SiteShoter.exe,"Save a screenshot of any Web page into a file." +siteshoter.zip,"ZIP Bundle for SiteShoter.exe" +SkypeContactsView.exe,"Displays the list of Skype contacts stored in the local database file of Skype." +skypecontactsview.zip,"ZIP Bundle for SkypeContactsView.exe" +SkypeLogView.exe,"View log files created by Skype" +skypelogview.zip,"ZIP Bundle for SkypeLogView.exe" +smsniff.exe,"Captures TCP/IP packets and view the captured data as sequence of conversations." +smsniff.zip,"ZIP Bundle for smsniff.exe" +SniffPass.exe,"capture the passwords that pass through your network adapter." +sniffpass.zip,"ZIP Bundle for SniffPass.exe" +SocketSniff.exe,"Watch the Windows Sockets (WinSock) activity of the selected process." +socketsniff.zip,"ZIP Bundle for SocketSniff.exe" +SoundVolumeView.exe,"A package of 6 tools for Windows related to video/audio." +SoundVolumeView.exe,"View/change sound levels & save/load sound level profiles on Windows Vista/7/8" +soundvolumeview.zip,"ZIP Bundle for SoundVolumeView.exe" +SpecialFoldersView.exe,"Easily jump to special folders in your system." +specialfoldersview.zip,"ZIP Bundle for SpecialFoldersView.exe" +strun.exe,"Displays the list of all applications that are loaded on startup." +strun.zip,"ZIP Bundle for strun.exe" +svcl.exe,"Sound volume command-line tool for Windows" +svcl.zip,"ZIP Bundle for svcl.exe" +sysexp.exe,"Grab the data stored in list-views, tree-views, list boxes, and combo boxes." +sysexp.zip,"ZIP Bundle for sysexp.exe" +systools.zip,"ZIP Bundle for ProduKey.exe" +TableTextCompare.exe,"Compare tab-delimited or comma-delimited (csv) files." +tabletextcompare.zip,"ZIP Bundle for TableTextCompare.exe" +TaskSchedulerView.exe,"View/Disable/Enable tasks from the Task Scheduler of Windows." +taskschedulerview.zip,"ZIP Bundle for TaskSchedulerView.exe" +TCPConnectProblemView.exe,"Monitor TCP connection problems." +tcpconnectproblemview.zip,"ZIP Bundle for TCPConnectProblemView.exe" +TcpLogView.exe,"Monitors the opened TCP connections on your system." +tcplogview.zip,"ZIP Bundle for TcpLogView.exe" +TimeZonesView.exe,"Displays all world time zones." +timezonesview.zip,"ZIP Bundle for TimeZonesView.exe" +TurnedOnTimesView.exe,"View the time/date ranges that your computer was turned on." +turnedontimesview.zip,"ZIP Bundle for TurnedOnTimesView.exe" +UninstallView.exe,"Shows installed programs on your system and allows you to uninstall them." +uninstallview.zip,"ZIP Bundle for UninstallView.exe" +URLProtocolView.exe,"View/disable/enable the URL protocols installed on your system" +urlprotocolview.zip,"ZIP Bundle for URLProtocolView.exe" +URLStringGrabber.exe,"Grab URL strings of Web sites from Internet Explorer" +urlstringgrabber.zip,"ZIP Bundle for URLStringGrabber.exe" +USBDeview.exe,"Lists all installed USB devices that you previously used." +usbdeview.zip,"ZIP Bundle for USBDeview.exe" +USBDriveLog.exe,"USB Drive Log For Windows 10" +usbdrivelog.zip,"ZIP Bundle for USBDriveLog.exe" +USBLogView.exe,"Records the details of any USB device that is plugged/unplugged into your system" +usblogview.zip,"ZIP Bundle for USBLogView.exe" +UserAssistView.exe,"This utility decrypt and displays the list of all UserAssist entries" +userassistview.zip,"ZIP Bundle for UserAssistView.exe" +UserProfilesView.exe,"View user profiles information on your system." +userprofilesview.zip,"ZIP Bundle for UserProfilesView.exe" +VaultPasswordView.exe,"Decrypts passwords stored in Windows Vault" +vaultpasswordview.zip,"ZIP Bundle for VaultPasswordView.exe" +videoaudiotools.zip,"ZIP Bundle for SoundVolumeView.exe" +VideoCacheView.exe,"Extract Web site video files from the cache of your Web browser" +videocacheview.zip,"ZIP Bundle for VideoCacheView.exe" +VNCPassView.exe,"Recover the passwords stored by the VNC tool." +vncpassview.zip,"ZIP Bundle for VNCPassView.exe" +volumouse.exe,"Adjust the volume of your speaker with the wheel of your mouse." +volumouse.zip,"ZIP Bundle for volumouse.exe" +WakeMeOnLan.exe,"Turn on one or more computers remotely by sending Wake-on-LAN (WOL) packet" +wakemeonlan.zip,"ZIP Bundle for WakeMeOnLan.exe" +WebBrowserBookmarksView.exe,"View all bookmarks of Chrome and Firefox Web browsers." +webbrowserbookmarksview.zip,"ZIP Bundle for WebBrowserBookmarksView.exe" +WebBrowserPassView.exe,"Recover lost passwords from your Web browser." +webbrowserpassview.zip,"ZIP Bundle for WebBrowserPassView.exe" +WebCacheImageInfo.exe,"Shows EXIF information of the images stored in Web browser cache." +webcacheimageinfo.zip,"ZIP Bundle for WebCacheImageInfo.exe" +WebCamImageSave.exe,"Capture still images from your WebCam." +webcamimagesave.zip,"ZIP Bundle for WebCamImageSave.exe" +WebCookiesSniffer.exe,"Captures Web site cookies and displays them in a simple table" +webcookiessniffer.zip,"ZIP Bundle for WebCookiesSniffer.exe" +WebSiteSniffer.exe,"Capture Web site files and save them on your hard drive." +websitesniffer.zip,"ZIP Bundle for WebSiteSniffer.exe" +WebVideoCap.exe,"Capture Flash Video files and RTSP streams while watching them in a Web browser." +webvideocap.zip,"ZIP Bundle for WebVideoCap.exe" +WhatInStartup.exe,"disable/enable/delete programs that are loaded at Windows startup." +whatinstartup.zip,"ZIP Bundle for WhatInStartup.exe" +WhatIsHang.exe,"Get information about Windows software that hangs." +whatishang.zip,"ZIP Bundle for WhatIsHang.exe" +WhoisCL.exe,"Get WHOIS information about a registered domain from command-line." +whoiscl.zip,"ZIP Bundle for WhoisCL.exe" +WhoIsConnectedSniffer.exe,"Shows who connects to your network by listening to network packets." +whoisconnectedsniffer.zip,"ZIP Bundle for WhoIsConnectedSniffer.exe" +whoistd.exe,"NirSoft WhoisTD utility." +whoistd.zip,"ZIP Bundle for whoistd.exe" +whosip.exe,"find all available information about an IP address from command-line." +whosip.zip,"ZIP Bundle for whosip.exe" +WifiChannelMonitor.exe,"Captures wifi traffic in monitor mode and displays AP/clients information." +wifichannelmonitor.zip,"ZIP Bundle for WifiChannelMonitor.exe" +WifiDiagnosticsView.exe,"Wifi diagnostics tool for Windows" +wifidiagnosticsview.zip,"ZIP Bundle for WifiDiagnosticsView.exe" +WifiHistoryView.exe,"Displays the history of connections to wireless networks on your computer. " +wifihistoryview.zip,"ZIP Bundle for WifiHistoryView.exe" +WifiInfoView.exe,"Displays extensive information about wireless networks in your area." +wifiinfoview.zip,"ZIP Bundle for WifiInfoView.exe" +WinCrashReport.exe,"Displays a report about crashed Windows application." +wincrashreport.zip,"ZIP Bundle for WinCrashReport.exe" +WinDefLogView.exe,"Windows Defender Log Viewer" +windeflogview.zip,"ZIP Bundle for WinDefLogView.exe" +WinDefThreatsView.exe,"View Windows Defender threats of local and remote computer" +windefthreatsview.zip,"ZIP Bundle for WinDefThreatsView.exe" +WinFontsView.exe,"Display sample of all fonts installed on your system." +winfontsview.zip,"ZIP Bundle for WinFontsView.exe" +winlister.exe,"This utility displays the list of opened windows on your system. " +winlister.zip,"ZIP Bundle for winlister.exe" +WinLogOnView.exe,"Displays logon/logoff times on Windows Vista/7/8/2008" +winlogonview.zip,"ZIP Bundle for WinLogOnView.exe" +WinMailPassRec.exe,"Password Recovery For Windows Mail App of Windows 10 and Windows 11" +winmailpassrec.zip,"ZIP Bundle for WinMailPassRec.exe" +WinPrefetchView.exe,"View the Prefetch files (.pf) stored in your system." +winprefetchview.zip,"ZIP Bundle for WinPrefetchView.exe" +WinsockServicesView.exe,"View/Disable/Enable Winsock service providers installed on your system." +winsockservicesview.zip,"ZIP Bundle for WinsockServicesView.exe" +WinUpdatesView.exe,"Displays the history of Windows updates for your system." +winupdatesview.zip,"ZIP Bundle for WinUpdatesView.exe" +WirelessConnectionInfo.exe,"Displays general information and statistics about the active wifi connection." +wirelessconnectioninfo.zip,"ZIP Bundle for WirelessConnectionInfo.exe" +WirelessKeyDump.exe,"dumps the list of all wireless keys stored by Windows" +wirelesskeydump.zip,"ZIP Bundle for WirelessKeyDump.exe" +WirelessKeyView.exe,"recovers lost wireless network keys (WEP/WPA) stored in your computer." +wirelesskeyview.zip,"ZIP Bundle for WirelessKeyView.exe" +WirelessNetConsole.exe,"View wireless networks information (console application)" +wirelessnetconsole.zip,"ZIP Bundle for WirelessNetConsole.exe" +WirelessNetView.exe,"Monitor the activity of wireless networks around you." +wirelessnetview.zip,"ZIP Bundle for WirelessNetView.exe" +WNetWatcher.exe,"Shows who is connected to your wireless network." +wnetwatcher.zip,"ZIP Bundle for WNetWatcher.exe" +wul.exe,"Displays the list of all Windows updates (Service Packs and Hotfixes)." +wul.zip,"ZIP Bundle for wul.exe" +zipinst.exe,"Install applications that do not provide an installation module." +zipinst.zip,"ZIP Bundle for zipinst.exe" diff --git a/lookups/csv/nirsoft_utilities_lookup.yml b/lookups/csv/nirsoft_utilities_lookup.yml new file mode 100644 index 00000000000..ebd1525ea4c --- /dev/null +++ b/lookups/csv/nirsoft_utilities_lookup.yml @@ -0,0 +1,12 @@ +name: nirsoft_utilities_lookup +id: 9ebf4dba-02a9-4f64-9f06-f02d4023c52a +version: 1 +creation_date: '2026-10-01' +modification_date: '2026-10-01' +author: Splunk Threat Research Team +lookup_type: csv +description: A subset of utilities provided by NirSoft that may be used by adversaries. +match_type: + - WILDCARD(original_file_name) +min_matches: 1 +case_sensitive_match: false diff --git a/lookups/csv/nist_ai_rmf_subcategories.csv b/lookups/csv/nist_ai_rmf_subcategories.csv new file mode 100644 index 00000000000..55c4da35deb --- /dev/null +++ b/lookups/csv/nist_ai_rmf_subcategories.csv @@ -0,0 +1,73 @@ +"function","category_id","category_text","subcategory_id","subcategory_text" +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.1","Legal and regulatory requirements involving AI are understood, managed, and documented." +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.2","The characteristics of trustworthy AI are integrated into organizational policies, processes, procedures, and practices." +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.3","Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization's risk tolerance." +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.4","The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities." +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.5","Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review." +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.6","Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities." +"GOVERN","Govern 1","Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","Govern 1.7","Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization's trustworthiness." +"GOVERN","Govern 2","Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained for mapping, measuring, and managing AI risks.","Govern 2.1","Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization." +"GOVERN","Govern 2","Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained for mapping, measuring, and managing AI risks.","Govern 2.2","The organization's personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements." +"GOVERN","Govern 2","Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained for mapping, measuring, and managing AI risks.","Govern 2.3","Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment." +"GOVERN","Govern 3","Workforce diversity, equity, inclusion, and accessibility processes are prioritized in the mapping, measuring, and managing of AI risks throughout the lifecycle.","Govern 3.1","Decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds)." +"GOVERN","Govern 3","Workforce diversity, equity, inclusion, and accessibility processes are prioritized in the mapping, measuring, and managing of AI risks throughout the lifecycle.","Govern 3.2","Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems." +"GOVERN","Govern 4","Organizational teams are committed to a culture that considers and communicates AI risk.","Govern 4.1","Organizational policies and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts." +"GOVERN","Govern 4","Organizational teams are committed to a culture that considers and communicates AI risk.","Govern 4.2","Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly." +"GOVERN","Govern 4","Organizational teams are committed to a culture that considers and communicates AI risk.","Govern 4.3","Organizational practices are in place to enable AI testing, identification of incidents, and information sharing." +"GOVERN","Govern 5","Processes are in place for robust engagement with relevant AI actors.","Govern 5.1","Organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks." +"GOVERN","Govern 5","Processes are in place for robust engagement with relevant AI actors.","Govern 5.2","Mechanisms are established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation." +"GOVERN","Govern 6","Policies and procedures are in place to address AI risks and benefits arising from third-party software and data and other supply chain issues.","Govern 6.1","Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party's intellectual property or other rights." +"GOVERN","Govern 6","Policies and procedures are in place to address AI risks and benefits arising from third-party software and data and other supply chain issues.","Govern 6.2","Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk." +"MANAGE","Manage 1","AI risks based on assessments and other analytical output from the MAP and MEASURE functions are prioritized, responded to, and managed.","Manage 1.1","A determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed." +"MANAGE","Manage 1","AI risks based on assessments and other analytical output from the MAP and MEASURE functions are prioritized, responded to, and managed.","Manage 1.2","Treatment of documented AI risks is prioritized based on impact, likelihood, and available resources or methods." +"MANAGE","Manage 1","AI risks based on assessments and other analytical output from the MAP and MEASURE functions are prioritized, responded to, and managed.","Manage 1.3","Responses to the AI risks deemed high priority, as identified by the map function, are developed, planned, and documented. Risk response options can include mitigating, transferring, avoiding, or accepting." +"MANAGE","Manage 1","AI risks based on assessments and other analytical output from the MAP and MEASURE functions are prioritized, responded to, and managed.","Manage 1.4","Negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users are documented." +"MANAGE","Manage 2","Strategies to maximize AI benefits and minimize negative impacts are planned, prepared, implemented, documented, and informed by input from relevant AI actors.","Manage 2.1","Resources required to manage AI risks are taken into account - along with viable non-AI alternative systems, approaches, or methods - to reduce the magnitude or likelihood of potential impacts." +"MANAGE","Manage 2","Strategies to maximize AI benefits and minimize negative impacts are planned, prepared, implemented, documented, and informed by input from relevant AI actors.","Manage 2.2","Mechanisms are in place and applied to sustain the value of deployed AI systems." +"MANAGE","Manage 2","Strategies to maximize AI benefits and minimize negative impacts are planned, prepared, implemented, documented, and informed by input from relevant AI actors.","Manage 2.3","Procedures are followed to respond to and recover from a previously unknown risk when it is identified." +"MANAGE","Manage 2","Strategies to maximize AI benefits and minimize negative impacts are planned, prepared, implemented, documented, and informed by input from relevant AI actors.","Manage 2.4","Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use." +"MANAGE","Manage 3","AI risks and benefits from third-party entities are managed.","Manage 3.1","AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented." +"MANAGE","Manage 3","AI risks and benefits from third-party entities are managed.","Manage 3.2","Pre-trained models which are used for development are monitored as part of AI system regular monitoring and maintenance." +"MANAGE","Manage 4","Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored regularly.","Manage 4.1","Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management." +"MANAGE","Manage 4","Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored regularly.","Manage 4.2","Measurable activities for continual improvements are integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors." +"MANAGE","Manage 4","Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored regularly.","Manage 4.3","Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented." +"MAP","Map 1","Context is established and understood.","Map 1.1","Intended purposes, potentially beneficial uses, context-specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented. Considerations include: the specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes, uses, and risks across the development or product AI lifecycle; and related TEVV and system metrics." +"MAP","Map 1","Context is established and understood.","Map 1.2","Interdisciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation is documented. Opportunities for interdisciplinary collaboration are prioritized." +"MAP","Map 1","Context is established and understood.","Map 1.3","The organization's mission and relevant goals for AI technology are understood and documented." +"MAP","Map 1","Context is established and understood.","Map 1.4","The business value or context of business use has been clearly defined or - in the case of assessing existing AI systems - re-evaluated." +"MAP","Map 1","Context is established and understood.","Map 1.5","Organizational risk tolerances are determined and documented." +"MAP","Map 1","Context is established and understood.","Map 1.6","System requirements (e.g., 'the system shall respect the privacy of its users') are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks." +"MAP","Map 2","Categorization of the AI system is performed.","Map 2.1","The specific tasks and methods used to implement the tasks that the AI system will support are defined (e.g., classifiers, generative models, recommenders)." +"MAP","Map 2","Categorization of the AI system is performed.","Map 2.2","Information about the AI system's knowledge limits and how system output may be utilized and overseen by humans is documented. Documentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions." +"MAP","Map 2","Categorization of the AI system is performed.","Map 2.3","Scientific integrity and TEVV considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation." +"MAP","Map 3","AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood.","Map 3.1","Potential benefits of intended AI system functionality and performance are examined and documented." +"MAP","Map 3","AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood.","Map 3.2","Potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness - as connected to organizational risk tolerance - are examined and documented." +"MAP","Map 3","AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood.","Map 3.3","Targeted application scope is specified and documented based on the system's capability, established context, and AI system categorization." +"MAP","Map 3","AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood.","Map 3.4","Processes for operator and practitioner proficiency with AI system performance and trustworthiness - and relevant technical standards and certifications - are defined, assessed, and documented." +"MAP","Map 3","AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood.","Map 3.5","Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the govern function." +"MAP","Map 4","Risks and benefits are mapped for all components of the AI system including third-party software and data.","Map 4.1","Approaches for mapping AI technology and legal risks of its components - including the use of third-party data or software - are in place, followed, and documented, as are risks of infringement of a third party's intellectual property or other rights." +"MAP","Map 4","Risks and benefits are mapped for all components of the AI system including third-party software and data.","Map 4.2","Internal risk controls for components of the AI system, including third-party AI technologies, are identified and documented." +"MAP","Map 5","Impacts to individuals, groups, communities, organizations, and society are characterized.","Map 5.1","Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented." +"MAP","Map 5","Impacts to individuals, groups, communities, organizations, and society are characterized.","Map 5.2","Practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts are in place and documented." +"MEASURE","Measure 1","Appropriate methods and metrics are identified and applied.","Measure 1.1","Approaches and metrics for measurement of AI risks enumerated during the map function are selected for implementation starting with the most significant AI risks. The risks or trustworthiness characteristics that will not - or cannot - be measured are properly documented." +"MEASURE","Measure 1","Appropriate methods and metrics are identified and applied.","Measure 1.2","Appropriateness of AI metrics and effectiveness of existing controls are regularly assessed and updated, including reports of errors and potential impacts on affected communities." +"MEASURE","Measure 1","Appropriate methods and metrics are identified and applied.","Measure 1.3","Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. Domain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.1","Test sets, metrics, and details about the tools used during TEVV are documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.10","Privacy risk of the AI system - as identified in the map function - is examined and documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.11","Fairness and bias - as identified in the map function - are evaluated and results are documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.12","Environmental impact and sustainability of AI model training and management activities - as identified in the map function - are assessed and documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.13","Effectiveness of the employed TEVV metrics and processes in the measure function are evaluated and documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.2","Evaluations involving human subjects meet applicable requirements (including human subject protection) and are representative of the relevant population." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.3","AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s). Measures are documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.4","The functionality and behavior of the AI system and its components - as identified in the map function - are monitored when in production." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.5","The AI system to be deployed is demonstrated to be valid and reliable. Limitations of the generalizability beyond the conditions under which the technology was developed are documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.6","The AI system is evaluated regularly for safety risks - as identified in the map function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.7","AI system security and resilience - as identified in the map function - are evaluated and documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.8","Risks associated with transparency and accountability - as identified in the map function - are examined and documented." +"MEASURE","Measure 2","AI systems are evaluated for trustworthy characteristics.","Measure 2.9","The AI model is explained, validated, and documented, and AI system output is interpreted within its context - as identified in the map function - to inform responsible use and governance." +"MEASURE","Measure 3","Mechanisms for tracking identified AI risks over time are in place.","Measure 3.1","Approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts." +"MEASURE","Measure 3","Mechanisms for tracking identified AI risks over time are in place.","Measure 3.2","Risk tracking approaches are considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available." +"MEASURE","Measure 3","Mechanisms for tracking identified AI risks over time are in place.","Measure 3.3","Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics." +"MEASURE","Measure 4","Feedback about efficacy of measurement is gathered and assessed.","Measure 4.1","Measurement approaches for identifying AI risks are connected to deployment context(s) and informed through consultation with domain experts and other end users. Approaches are documented." +"MEASURE","Measure 4","Feedback about efficacy of measurement is gathered and assessed.","Measure 4.2","Measurement results regarding AI system trustworthiness in deployment context(s) and across the AI lifecycle are informed by input from domain experts and relevant AI actors to validate whether the system is performing consistently as intended. Results are documented." +"MEASURE","Measure 4","Feedback about efficacy of measurement is gathered and assessed.","Measure 4.3","Measurable performance improvements or declines based on consultations with relevant AI actors, including affected communities, and field data about context-relevant risks and trustworthiness characteristics are identified and documented." diff --git a/lookups/csv/nist_ai_rmf_subcategories.yml b/lookups/csv/nist_ai_rmf_subcategories.yml new file mode 100644 index 00000000000..2381c3c4ef5 --- /dev/null +++ b/lookups/csv/nist_ai_rmf_subcategories.yml @@ -0,0 +1,8 @@ +name: nist_ai_rmf_subcategories +id: ac42b14f-4f89-45c9-bc3d-728109b3b3b1 +version: 1 +creation_date: '2026-09-02' +modification_date: '2026-09-02' +author: Nasreddine Bencherchali, Rod Soto, Splunk Threat Research Team +lookup_type: csv +description: NIST AI RMF function, category, and subcategory reference data used by the NIST AI RMF Control Coverage dashboard. diff --git a/lookups/csv/renamed_lolbas_binaries.csv b/lookups/csv/renamed_lolbas_binaries.csv new file mode 100644 index 00000000000..ba83e577f1f --- /dev/null +++ b/lookups/csv/renamed_lolbas_binaries.csv @@ -0,0 +1,147 @@ +original_file_name,description +acccheckconsole.exe,Verifies UI accessibility requirements +addinutil.exe,.NET Tool used for updating cache files for Microsoft Office Add-Ins. +adplus.exe,Debugging tool included with Windows Debugging Tools +agentexecutor.exe,Intune Management Extension included on Intune Managed Devices +appcert.exe,Windows App Certification Kit command-line tool. +appinstaller.exe,Tool used for installation of AppX/MSIX applications on Windows 10 +appvlp.exe,Application Virtualization Utility Included with Microsoft Office 2016 +aspnet_compiler.exe,ASP.NET Compilation Tool +at.exe,Schedule periodic tasks +atbroker.exe,Helper binary for Assistive Technology (AT) +bitsadmin.exe,Used for managing background intelligent transfer +cdb.exe,Debugging tool included with Windows Debugging Tools. +certoc.exe,Used for installing certificates +certreq.exe,Used for requesting and managing certificates +certutil.exe,Windows binary used for handling certificates +cmdkey.exe,"creates, lists, and deletes stored user names and passwords or credentials." +cmdl32.exe,Microsoft Connection Manager Auto-Download +cmstp.exe,Installs or removes a Connection Manager service profile. +colorcpl.exe,Binary that handles color management +conhost.exe,Console Window host +control.exe,Console Window host +csc.exe,Binary file used by .NET to compile C# code +cscript.exe,Binary used to execute scripts in Windows +csi.exe,Command line interface included with Visual Studio. +curl.exe,Used for transferring data to or from a server; bundled with Windows 10 1803+ and can be used to download or upload files (not in repo lookup - added manually) +customshellhost.exe,A host process that is used by custom shells when using Windows in Kiosk mode. +datasvcutil.exe,DataSvcUtil.exe is a command-line tool provided by WCF Data Services that consumes an Open Data Protocol (OData) feed and generates the client data service classes that are needed to access a data service from a .NET Framework client application. +desktopimgdownldr.exe,Windows binary used to configure lockscreen/desktop image +devicecredentialdeployment.exe,Device Credential Deployment +devinit.exe,Visual Studio 2019 tool +devtoolslauncher.exe,Binary will execute specified binary. Part of VS/VScode installation. +dfsvc.exe,ClickOnce engine in Windows used by .NET +diantz.exe,Binary that package existing files into a cabinet (.cab) file +diskshadow.exe,Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS). +dnscmd.exe,A command-line interface for managing DNS servers +dotnet.exe,dotnet.exe comes with .NET Framework +dsdbutil.exe,Dsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line utility to export Active Directory. +dumpminitool.exe,Dump tool part Visual Studio 2022 +dxcap.exe,DirectX diagnostics/debugger included with Visual Studio. +esentutl.exe,Binary for working with Microsoft Joint Engine Technology (JET) database +eventvwr.exe,Displays Windows Event Logs in a GUI window. +excel.exe,Microsoft Office binary +expand.exe,Binary that expands one or more compressed files +extexport.exe,Load a DLL located in the C:\test folder with a specific name. +extrac32.exe,"Extract to ADS, copy or overwrite a file with Extrac32.exe" +findstr.exe,"Write to ADS, discover, or download files with Findstr.exe" +finger.exe,Displays information about a user or users on a specified remote computer that is running the Finger service or daemon +fltmc.exe,Filter Manager Control Program used by Windows +forfiles.exe,Selects and executes a command on a file or set of files. This command is useful for batch processing. +fsi.exe,64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK. +fsianycpu.exe,32/64-bit FSharp (F#) Interpreter included with Visual Studio. +fsutil.exe,File System Utility +ftp.exe,A binary designed for connecting to FTP servers +gfxdownloadwrapper.exe,"Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path." +gpscript.exe,Used by group policy to process scripts +hh.exe,Binary used for processing chm files in Windows +ie4uinit.exe,Executes commands from a specially prepared ie4uinit.inf file. +iediagcmd.exe,Diagnostics Utility for Internet Explorer +ieexec.exe,The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL. +ilasm.exe,used for compile c# code into dll or exe. +imewdbld.exe,Microsoft IME Open Extended Dictionary Module +infdefaultinstall.exe,Binary used to perform installation based on content inside inf files +installutil.exe,The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies +jsc.exe,Binary file used by .NET to compile javascript code to .exe or .dll format +ldifde.exe,"Creates, modifies, and deletes LDAP directory objects." +makecab.exe,Binary to package existing files into a cabinet (.cab) file +manage-bde.wsf,Script for managing BitLocker +mavinject.exe,Used by App-v in Windows +mftrace.exe,Trace log generation tool for Media Foundation Tools. +microsoft.nodejstools.pressanykey.exe,Part of the NodeJS Visual Studio tools. +microsoft.workflow.compiler.exe,A utility included with .NET that is capable of compiling and executing C# or VB.net code. +mmc.exe,Load snap-ins to locally and remotely manage Windows systems +msaccess.exe,Microsoft Office binary +msbuild.exe,Used to compile and execute code +msconfig.exe,"MSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup process to help the user determine the cause of a problem with Windows" +msdeploy.exe,Microsoft tool used to deploy Web Applications. +msdt.exe,Microsoft diagnostics tool +mshta.exe,Used by Windows to execute html applications. (.hta) +msiexec.exe,Used by Windows to execute msi files +msohtmed.exe,Microsoft Office binary +mspub.exe,Microsoft Office binary +netsh.exe,Netsh is a Windows tool used to manipulate network interface settings. +ntdsutil.exe,Command line utility used to export Active Directory. +odbcconf.exe,Used in Windows for managing ODBC connections +offlinescannershell.exe,Windows Defender Offline Shell +pcalua.exe,Program Compatibility Assistant +pcwrun.exe,Program Compatibility Wizard +pktmon.exe,Capture Network Packets on the windows 10 with October 2018 Update or later. +pnputil.exe,Used for installing drivers +powerpnt.exe,Microsoft Office binary +presentationhost.exe,File is used for executing Browser applications +print.exe,Used by Windows to send files to the printer +printbrm.exe,Printer Migration Command-Line Tool +protocolhandler.exe,Microsoft Office binary +provlaunch.exe,Launcher process +psr.exe,"Windows Problem Steps Recorder, used to record screen and clicks." +rasautou.exe,Windows Remote Access Dialer +rdrleakdiag.exe,Microsoft Windows resource leak diagnostic tool +reg.exe,Used to manipulate the registry +regasm.exe,Part of .NET +regedit.exe,Used by Windows to manipulate registry +regini.exe,Used to manipulate the registry +register-cimprovider.exe,Used to register new wmi providers +regsvcs.exe,Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies +regsvr32.exe,Used by Windows to register dlls +replace.exe,Used to replace file with another file +rpcping.exe,Used to verify rpc connection +rundll32.exe,Used by Windows to execute dll files +runexehelper.exe,Launcher process +runonce.exe,Executes a Run Once Task that has been configured in the registry +sc.exe,Used by Windows to manage services +schtasks.exe,Schedule periodic tasks +scriptrunner.exe,Execute binary through proxy binary to evade defensive counter measures +setres.exe,Configures display settings +settingsynchost.exe,Host Process for Setting Synchronization +sqldumper.exe,Debugging utility included with Microsoft SQL. +sqlps.exe,"Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons." +sqltoolsps.exe,Tool included with Microsoft SQL that loads SQL Server cmdlts. A replacement for sqlps.exe. Successor to sqlps.exe in SQL Server 2016+. +stordiag.exe,Storage diagnostic tool +syncappvpublishingserver.exe,Used by App-v to get App-v server lists +tar.exe,Used by Windows to extract and create archives. +testwindowremoteagent.exe,TestWindowRemoteAgent.exe is the command-line tool to establish RPC +ttdinject.exe,Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe) +tttracer.exe,Used by Windows 1809 and newer to Debug Time Travel +unregmp2.exe,Microsoft Windows Media Player Setup Utility +vbc.exe,Binary file used for compile vbs code +verclsid.exe,Used to verify a COM object before it is instantiated by Windows Explorer +visualuiaverifynative.exe,A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls. +vsdiagnostics.exe,Command-line tool used for performing diagnostics. +vshadow.exe,VShadow is a command-line tool that can be used to create and manage volume shadow copies. +vsiisexelauncher.exe,Binary will execute specified binary. Part of VS/VScode installation. +vsjitdebugger.exe,Just-In-Time (JIT) debugger included with Visual Studio +vsls-agent.exe,Agent for Visual Studio Live Share (Code Collaboration) +vstest.console.exe,VSTest.Console.exe is the command-line tool to run tests +wab.exe,Windows address book manager +wbadmin.exe,Windows Backup Administration utility +wfc.exe,The Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK). +winproj.exe,Microsoft Project Executable +winword.exe,Microsoft Office binary +wlrmdr.exe,Windows Logon Reminder executable +wmic.exe,The WMI command-line (WMIC) utility provides a command-line interface for WMI +workfolders.exe,Work Folders +wscript.exe,Used by Windows to execute scripts +wsreset.exe,Used to reset Windows Store settings according to its manifest file +wuauclt.exe,Windows Update Client +xwizard.exe,Execute custom class that has been added to the registry or download a file with Xwizard.exe diff --git a/lookups/csv/renamed_lolbas_binaries.yml b/lookups/csv/renamed_lolbas_binaries.yml new file mode 100644 index 00000000000..e76d3c31694 --- /dev/null +++ b/lookups/csv/renamed_lolbas_binaries.yml @@ -0,0 +1,14 @@ +name: renamed_lolbas_binaries +id: 8fcee872-392f-41ab-95fb-a50f8557b03e +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Splunk Threat Research Team +lookup_type: csv +description: A list of LOLBAS binaries and detailed information regarding their usage +default_match: 'false' +match_type: + - WILDCARD(original_file_name) +min_matches: 1 +max_matches: 1 +case_sensitive_match: false diff --git a/lookups/csv/renamed_popular_3rd_party_binaries.csv b/lookups/csv/renamed_popular_3rd_party_binaries.csv new file mode 100644 index 00000000000..d2a52926d0d --- /dev/null +++ b/lookups/csv/renamed_popular_3rd_party_binaries.csv @@ -0,0 +1,43 @@ +original_file_name,description +7z.exe,7-Zip +7zg.exe,7-Zip +7zfm.exe,7-Zip +7za.exe,7-Zip +winrar*.exe,WinRAR +rar.exe,WinRAR +unrar.exe,WinRAR +peazip.exe,PeaZip +anydesk.exe,AnyDesk +teamviewer*.exe,TeamViewer +tv_w32.exe,TeamViewer +tv_x64.exe,TeamViewer +screenconnect*.exe,ConnectWise ScreenConnect +ateraagent.exe,Atera +srserver.exe,Splashtop +splashtopstreamer.exe,Splashtop +lmiguardiansvc.exe,LogMeIn +logmein.exe,LogMeIn +basupsrvc.exe,N-able Take Control +tcclient.exe,N-able Take Control +action1_agent.exe,Action1 +rutserv.exe,Remote Utilities +rfusclient.exe,Remote Utilities +advanced_ip_scanner*.exe,Advanced IP Scanner +advanced_port_scanner*.exe,Advanced Port Scanner +netscan.exe,SoftPerfect Network Scanner +ipscan.exe,Angry IP Scanner +adfind*.exe,AdFind +processhacker.exe,Process Hacker +systeminformer.exe,System Informer +winscp*.exe,WinSCP +rclone.exe,Rclone +plink.exe,PuTTY +putty*.exe,PuTTY +mobaxterm.exe,MobaXterm +ngrok.exe,Ngrok +cloudflared.exe,Cloudflared +chisel.exe,Chisel +webbrowserpassview.exe,NirSoft WebBrowserPassView +mailpv.exe,NirSoft Mail PassView +autoit3.exe,AutoIt +aut2exe.exe,AutoIt diff --git a/lookups/csv/renamed_popular_3rd_party_binaries.yml b/lookups/csv/renamed_popular_3rd_party_binaries.yml new file mode 100644 index 00000000000..0c684fe5e13 --- /dev/null +++ b/lookups/csv/renamed_popular_3rd_party_binaries.yml @@ -0,0 +1,14 @@ +name: renamed_popular_3rd_party_binaries +id: 83a56371-0a0f-4486-be21-8dc1d4d25e97 +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Splunk Threat Research Team +lookup_type: csv +description: A list of popular 3rd party Windows binaries and their software names +default_match: 'false' +match_type: + - WILDCARD(original_file_name) +min_matches: 1 +max_matches: 1 +case_sensitive_match: false diff --git a/lookups/csv/renamed_windows_command_interpreter_binaries.csv b/lookups/csv/renamed_windows_command_interpreter_binaries.csv new file mode 100644 index 00000000000..8809169991f --- /dev/null +++ b/lookups/csv/renamed_windows_command_interpreter_binaries.csv @@ -0,0 +1,14 @@ +original_file_name,description +bash.exe,"Bourne Again Shell interpreter; ships with WSL/Git for Windows/Cygwin and executes shell scripts and commands." +cmd.exe,"The native Windows command-line interpreter used to execute batch scripts and commands." +powershell.exe,"Windows PowerShell (v5.1 and earlier) command-line shell and scripting engine, heavily used for administration and living-off-the-land attacks." +powershell_ise.exe,"PowerShell Integrated Scripting Environment; GUI host for writing and running PowerShell scripts." +psexec*.c,"Sysinternals tool for executing processes on remote systems; frequently abused for lateral movement." +psexec*.exe,"Sysinternals tool for executing processes on remote systems; frequently abused for lateral movement." +psexec64.exe,"64-bit build of the Sysinternals PsExec remote execution tool." +pwsh.exe,"PowerShell (Core) 6+ cross-platform command-line shell and scripting engine, successor to powershell.exe." +pwsh.dll,"PowerShell (Core) 6+ cross-platform command-line shell and scripting engine, successor to powershell.exe." +sh.exe,"POSIX-compatible shell interpreter, typically bundled with Git for Windows/WSL/Cygwin, used to run shell scripts." +windowsterminal.exe,"Modern Windows Terminal application host that runs command-line shells (cmd, PowerShell, WSL) in tabs." +wsl.exe,"Windows Subsystem for Linux launcher; runs a Linux distribution/shell and executes Linux binaries or scripts on Windows." +wt.exe,"Windows Terminal executable, invoked via the wt command; launches and hosts terminal shell sessions." diff --git a/lookups/csv/renamed_windows_command_interpreter_binaries.yml b/lookups/csv/renamed_windows_command_interpreter_binaries.yml new file mode 100644 index 00000000000..0e364ef511c --- /dev/null +++ b/lookups/csv/renamed_windows_command_interpreter_binaries.yml @@ -0,0 +1,14 @@ +name: renamed_windows_command_interpreter_binaries +id: 2517d9fc-a1ee-4303-9a5b-15eaee7f418b +version: 1 +creation_date: '2026-09-23' +modification_date: '2026-09-23' +author: Splunk Threat Research Team +lookup_type: csv +description: A list of Windows command interpreter binaries and detailed information regarding their usage +default_match: 'false' +match_type: + - WILDCARD(original_file_name) +min_matches: 1 +max_matches: 1 +case_sensitive_match: false diff --git a/macros/base64decode.yml b/macros/base64decode.yml index 99fe5b4f96b..75877181140 100644 --- a/macros/base64decode.yml +++ b/macros/base64decode.yml @@ -1,10 +1,10 @@ name: base64decode id: fc2a1c3c-3251-418d-b411-7e62303e2cb3 -version: 1 +version: 2 creation_date: '2024-01-10' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Splunk Threat Research Team description: Content based conversion of UTF8/UTF16 based base64 encoding. Not a full implementation, but good enough for context without additional app installation. -definition: 'eval b64x_split=split($b64in$,"") | lookup char_conversion_matrix base64char as b64x_split OUTPUT base64bin as b64x_bin | eval b64x_join=mvjoin(b64x_bin,"") | rex field=b64x_join "(?.{8})" max_match=0 | lookup char_conversion_matrix bin as b64x_by8 output ascii as b64x_out | eval $b64in$_decode=mvjoin(b64x_out,"") | fields - b64x_* | eval $b64in$_decode = replace(replace($b64in$_decode,":NUL:",""),":SPACE:"," ") | rex field=$b64in$_decode mode=sed "s/\x00//g"' +definition: 'eval b64x_split=split($b64in$,"") | lookup local=t char_conversion_matrix base64char as b64x_split OUTPUT base64bin as b64x_bin | eval b64x_join=mvjoin(b64x_bin,"") | rex field=b64x_join "(?.{8})" max_match=0 | lookup local=t char_conversion_matrix bin as b64x_by8 output ascii as b64x_out | eval $b64in$_decode=mvjoin(b64x_out,"") | fields - b64x_* | eval $b64in$_decode = replace(replace($b64in$_decode,":NUL:",""),":SPACE:"," ") | rex field=$b64in$_decode mode=sed "s/\x00//g"' arguments: - b64in diff --git a/macros/circleci.yml b/macros/deprecated/circleci.yml similarity index 100% rename from macros/circleci.yml rename to macros/deprecated/circleci.yml diff --git a/macros/o365_messagetrace.yml b/macros/o365_messagetrace.yml index 390f0117419..2b530a58f26 100644 --- a/macros/o365_messagetrace.yml +++ b/macros/o365_messagetrace.yml @@ -1,8 +1,8 @@ name: o365_messagetrace id: 1ead5eb3-85e8-40fb-9eb4-6936843f08d6 -version: 1 +version: 2 creation_date: '2025-01-23' -modification_date: '2026-05-13' +modification_date: '2026-09-23' author: Splunk Threat Research Team description: Customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. -definition: sourcetype IN ("ms:o365:reporting:messagetrace","o365:reporting:messagetrace") +definition: sourcetype IN ("ms:o365:reporting:messagetrace","o365:reporting:messagetrace","o365:graph:messagetrace") diff --git a/macros/remote_access_software_usage_exceptions.yml b/macros/remote_access_software_usage_exceptions.yml index 882b3c7b887..adeff11e2b3 100644 --- a/macros/remote_access_software_usage_exceptions.yml +++ b/macros/remote_access_software_usage_exceptions.yml @@ -1,8 +1,8 @@ name: remote_access_software_usage_exceptions id: 4b0c9d7e-6fe2-404d-87b0-80e11c9a11f1 -version: 1 +version: 2 creation_date: '2024-07-09' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Splunk Threat Research Team description: Macro used with remote access monitoring content to define exception lookup and usage. Returns filtered results based on contents of remote_access_software_usage_exception.csv -definition: 'eval exception_asset = CASE(isnotnull(src),src,isnotnull(dest),dest) | lookup update=true asset_lookup_by_str asset as exception_asset OUTPUTNEW asset as asset_temp_field | eval asset_temp_field = CASE(isnull(asset_temp_field),exception_asset,true(),asset_temp_field ) | lookup remote_access_software_exceptions asset as asset_temp_field software as signature OUTPUT exception as rmm_exception, exception_date as rmm_exception_date, exception_ttl_days as rmm_exception_ttl_days, comment as rmm_exception_comment | eval rmm_exception = mvdedup(mvfilter(NOT match(rmm_exception,"false"))), rmm_exception_date = mvdedup(mvfilter(NOT match(rmm_exception_date,"false"))), rmm_exception_ttl_days = mvdedup(mvfilter(NOT match(rmm_exception_ttl_days,"false"))), rmm_exception_comment = mvdedup(mvfilter(NOT match(rmm_exception_comment,"false"))), rmm_exception_end_date = relative_time(strptime(rmm_exception_date, "%Y-%m-%d"), "+"+rmm_exception_ttl_days+"d"), rmm_exception_end = CASE((now() >= rmm_exception_end_date),"TRUE",(now() < rmm_exception_end_date),"FALSE",(match(rmm_exception,"(?i)true") AND isnull(rmm_exception_ttl_days)),"UNLIMITED") | search NOT (rmm_exception = TRUE AND rmm_exception_end IN ("FALSE","UNLIMITED")) | fields - asset_temp_field,exception_asset' +definition: 'eval exception_asset = CASE(isnotnull(src),src,isnotnull(dest),dest) | lookup local=t update=true asset_lookup_by_str asset as exception_asset OUTPUTNEW asset as asset_temp_field | eval asset_temp_field = CASE(isnull(asset_temp_field),exception_asset,true(),asset_temp_field ) | lookup local=t remote_access_software_exceptions asset as asset_temp_field software as signature OUTPUT exception as rmm_exception, exception_date as rmm_exception_date, exception_ttl_days as rmm_exception_ttl_days, comment as rmm_exception_comment | eval rmm_exception = mvdedup(mvfilter(NOT match(rmm_exception,"false"))), rmm_exception_date = mvdedup(mvfilter(NOT match(rmm_exception_date,"false"))), rmm_exception_ttl_days = mvdedup(mvfilter(NOT match(rmm_exception_ttl_days,"false"))), rmm_exception_comment = mvdedup(mvfilter(NOT match(rmm_exception_comment,"false"))), rmm_exception_end_date = relative_time(strptime(rmm_exception_date, "%Y-%m-%d"), "+"+rmm_exception_ttl_days+"d"), rmm_exception_end = CASE((now() >= rmm_exception_end_date),"TRUE",(now() < rmm_exception_end_date),"FALSE",(match(rmm_exception,"(?i)true") AND isnull(rmm_exception_ttl_days)),"UNLIMITED") | search NOT (rmm_exception = TRUE AND rmm_exception_end IN ("FALSE","UNLIMITED")) | fields - asset_temp_field,exception_asset' diff --git a/macros/suspicious_writes.yml b/macros/suspicious_writes.yml index 40c6421b8dc..a86d06c69cb 100644 --- a/macros/suspicious_writes.yml +++ b/macros/suspicious_writes.yml @@ -1,8 +1,8 @@ name: suspicious_writes id: 6983de37-2a08-4c42-80a2-fe404edd19b4 -version: 1 +version: 2 creation_date: '2019-10-16' -modification_date: '2026-05-13' +modification_date: '2026-09-22' author: Splunk Threat Research Team description: This macro limites the output to file names that have been marked as suspicious -definition: lookup suspicious_writes_lookup file as file_name OUTPUT note as "Reference" | search "Reference" != False +definition: lookup local=t suspicious_writes_lookup file as file_name OUTPUT note as "Reference" | search "Reference" != False diff --git a/macros/zeek_http.yml b/macros/zeek_http.yml new file mode 100644 index 00000000000..f2428481eed --- /dev/null +++ b/macros/zeek_http.yml @@ -0,0 +1,8 @@ +name: zeek_http +id: 5deefc82-d7b0-4c6a-a9e3-fce5ebbd4291 +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Splunk Threat Research Team +description: Customer specific Splunk configuration for Zeek HTTP logs. Update the sourcetype to match your environment. +definition: sourcetype="zeek:http" diff --git a/macros/zeek_ssh.yml b/macros/zeek_ssh.yml new file mode 100644 index 00000000000..090cc48ace9 --- /dev/null +++ b/macros/zeek_ssh.yml @@ -0,0 +1,8 @@ +name: zeek_ssh +id: 915ebcdf-ef44-4815-936a-901ee7dde6dc +version: 1 +creation_date: '2026-10-12' +modification_date: '2026-10-12' +author: Splunk Threat Research Team +description: Customer specific Splunk configuration for Zeek SSH logs. Update the sourcetype to match your environment. +definition: sourcetype="zeek:ssh" diff --git a/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml b/removed/detections/detect_f5_tmui_rce_cve_2020_5902.yml similarity index 84% rename from detections/web/detect_f5_tmui_rce_cve_2020_5902.yml rename to removed/detections/detect_f5_tmui_rce_cve_2020_5902.yml index 888745f0821..0d8c5cdcc7c 100644 --- a/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml +++ b/removed/detections/detect_f5_tmui_rce_cve_2020_5902.yml @@ -1,10 +1,10 @@ name: Detect F5 TMUI RCE CVE-2020-5902 id: 810e4dbc-d46e-11ea-87d0-0242ac130003 -version: 9 +version: 10 creation_date: '2020-08-04' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Shannon Davis, Splunk -status: experimental +status: removed type: TTP description: The following analytic identifies remote code execution (RCE) attempts targeting F5 BIG-IP, BIG-IQ, and Traffix SDC devices, specifically exploiting CVE-2020-5902. It uses regex to detect patterns in syslog data that match known exploit strings such as "hsqldb;" and directory traversal sequences. This activity is significant because successful exploitation can allow attackers to execute arbitrary commands on the affected devices, leading to full system compromise. If confirmed malicious, this could result in unauthorized access, data exfiltration, or further lateral movement within the network. data_source: [] @@ -33,3 +33,7 @@ product: - Splunk Cloud category: web security_domain: network +deprecation_info: + reason: Detection deprecated as it is targeting a 6 years old CVE that is no longer relevant, since the OS version targeted is no longer supported by F5. As well, the fact that the detection has been set to experimental since 2020. + removed_in_version: 6.8.0 + replacement_content: [] diff --git a/detections/endpoint/linux_adding_crontab_using_list_parameter.yml b/removed/detections/linux_adding_crontab_using_list_parameter.yml similarity index 91% rename from detections/endpoint/linux_adding_crontab_using_list_parameter.yml rename to removed/detections/linux_adding_crontab_using_list_parameter.yml index 379e5c61832..c2f250d80ac 100644 --- a/detections/endpoint/linux_adding_crontab_using_list_parameter.yml +++ b/removed/detections/linux_adding_crontab_using_list_parameter.yml @@ -1,10 +1,10 @@ name: Linux Adding Crontab Using List Parameter id: 52f6d751-1fd4-4c74-a4c9-777ecfeb5c58 -version: 11 +version: 12 creation_date: '2021-12-21' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Teoderick Contreras, Bhavin Patel, Splunk -status: production +status: removed type: Hunting description: The following analytic detects suspicious modifications to cron jobs on Linux systems using the crontab command with list parameters. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it may indicate an attempt to establish persistence or execute malicious code on a schedule. If confirmed malicious, the impact could include unauthorized code execution, data destruction, or other damaging outcomes. Further investigation should analyze the added cron job, its associated command, and any related processes. data_source: @@ -60,3 +60,8 @@ tests: source: not_applicable sourcetype: cisco:isovalent:processExec test_type: unit +deprecation_info: + reason: Detection deprecated as its name and description are not matching the behavior of the search. The search is looking for crontab command with list parameter, not adding a new cron job. + removed_in_version: 6.8.0 + replacement_content: + - Linux Crontab Enumeration diff --git a/detections/endpoint/lolbas_with_network_traffic.yml b/removed/detections/lolbas_with_network_traffic.yml similarity index 92% rename from detections/endpoint/lolbas_with_network_traffic.yml rename to removed/detections/lolbas_with_network_traffic.yml index 21fafb429e7..43a341fe4e6 100644 --- a/detections/endpoint/lolbas_with_network_traffic.yml +++ b/removed/detections/lolbas_with_network_traffic.yml @@ -1,10 +1,10 @@ name: LOLBAS With Network Traffic id: 2820f032-19eb-497e-8642-25b04a880359 -version: 18 +version: 19 creation_date: '2023-02-02' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Steven Dick -status: production +status: removed type: TTP description: The following analytic identifies the use of Living Off the Land Binaries and Scripts (LOLBAS) with network traffic. It leverages data from the Network Traffic data model to detect when native Windows binaries, often abused by adversaries, initiate network connections. This activity is significant as LOLBAS are frequently used to download malicious payloads, enabling lateral movement, command-and-control, or data exfiltration. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to organizational security. data_source: @@ -144,3 +144,9 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated due to high false positive rates from certain LOLBAS binaries with common legitimate network behavior. This broad analytic is being split into more manageable anomaly analytics with separate process groups and common-port tuning. + removed_in_version: 6.8.0 + replacement_content: + - LOLBAS Rare Network Connection + - LOLBAS Network Connection On Uncommon Port diff --git a/removed/stories/lateral_movement.yml b/removed/stories/lateral_movement.yml index c719981403e..e3583c0a181 100644 --- a/removed/stories/lateral_movement.yml +++ b/removed/stories/lateral_movement.yml @@ -1,8 +1,8 @@ name: Lateral Movement id: 399d65dc-1f08-499b-a259-abd9051f38ad -version: 3 +version: 4 creation_date: '2023-02-21' -modification_date: '2026-05-13' +modification_date: '2026-08-26' author: David Dorsey, Splunk status: removed description: "DEPRECATED IN FAVOR OF ACTIVE DIRECTORY LATERAL MOVEMENT. Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts." @@ -21,4 +21,4 @@ deprecation_info: reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity removed_in_version: 5.2.0 replacement_content: - - Compromised User Account + - Active Directory Lateral Movement diff --git a/requirements.txt b/requirements.txt index 628e150e83f..4bbb0e2cf01 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1 +1 @@ -contentctl-ng==1.0.2 +contentctl-ng==1.1.1 diff --git a/response_templates/GenericIncidentResponse_v4.json b/response_templates/GenericIncidentResponse_v4.json new file mode 100644 index 00000000000..4d0deb91728 --- /dev/null +++ b/response_templates/GenericIncidentResponse_v4.json @@ -0,0 +1 @@ +{"id": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c", "create_time": 1788276134.3671353, "update_time": 1788280100.5796342, "name": "Generic Incident Response", "description": "Use%20this%20as%20a%20starting%20point.%20This%20will%20guide%20you%20to%20visualizations%20and%20dashboards%20within%20Splunk%20Enterprise%20Security%20that%20you%20would%20use%20to%20research%20and%20interrogate%20different%20data%20types%20like%20Authentication,%20Endpoint%20or%20Network.%20%20The%20Suggested%20Integrations(connectors)%20are%20just%20that,%20either%20built%20into%20Splunk%20SOAR%20or%20commonly%20used%20by%20customers.%20The%20Actions%20included%20will%20need%20to%20be%20reviewed,%20removed,%20validated,%20or%20added%20based%20on%20what%20tools%20your%20organizations%20use.%20%20Before%20implementing%20be%20sure%20to%20add%20roles%20and%20approvals%20to%20ensure%20proper%20review%20occurs%20in%20the%20incident%20response%20workflow%20", "template_status": "published", "creator": "splunker", "updated_by": "splunker", "is_default": false, "version": 4, "phases": [{"id": "c8c1bb29-a14c-4230-ba02-283f98645b90", "create_time": 1788276680.0027182, "update_time": 1788280100.5278718, "name": "Initial%20Reporting%20and%20Awareness%20", "order": 1, "tasks": [{"id": "76fd8383-b2f7-47d8-b952-49a60105c23f", "create_time": 1764758755.9055116, "update_time": 1788280100.527043, "name": "Ensure%20Investigations%20are%20mirrored%20in%20the%20core%20enterprise%20tracking%20system.", "order": 1, "tag": "69c9baf1-bd12-4b09-b6b6-a77df9428682", "description": "Open%20Incident%20to%20track%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "3ff21177-da2b-4c47-acc7-b44d4dd0dc2a", "create_time": 1788276603.7561357, "update_time": 1788280100.5271513, "last_job_id": 0, "name": "create ticket - ServiceNow", "action": "2471", "description": "Create a new ticket/record", "type": "create ticket", "app_id": 147, "asset": 29, "parameters": [{"table": "", "fields": "", "vault_id": "", "description": "", "short_description": ""}]}, {"id": "71f70831-5652-41d8-a05e-6d4c7221b81d", "create_time": 1788276680.0023613, "update_time": 1788280100.5271919, "last_job_id": 0, "name": "create ticket - Salesforce", "action": "2933", "description": "Create a new Case", "type": "create ticket", "app_id": 144, "asset": 34, "parameters": [{"subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "45052d6d-ffd0-4491-9434-af7c69b6544d", "create_time": 1788276680.0023906, "update_time": 1788280100.5272317, "last_job_id": 0, "name": "create ticket - Jira", "action": "2285", "description": "Create a ticket (issue)", "type": "create ticket", "app_id": 80, "asset": 31, "parameters": [{"fields": "", "summary": "", "assignee": "", "priority": "", "vault_id": "", "issue_type": "", "description": "", "project_key": "", "assignee_account_id": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c62f8956-c622-4c11-a664-9d68661f2df1", "create_time": 1764758755.905616, "update_time": 1788280100.5275803, "name": "Alert%20Appropriate%20Parties%20that%20Incident%20Response%20Is%20Starting", "order": 2, "tag": "8ca56a2a-f0d7-43c1-96e3-06bac95deffe", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "b7f1588d-09e9-4fe8-b72a-27c599eb2a8d", "create_time": 1788277531.9986718, "update_time": 1788280100.527657, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "70c65ce6-06b9-4fbc-9f9b-362f2f4a4817", "create_time": 1788277531.9986978, "update_time": 1788280100.5276885, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "24d8b79b-e9a5-43a3-a971-fcbf1d4f02d7", "create_time": 1788277531.998722, "update_time": 1788280100.5277174, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4ff61fec-6cb7-4dd8-9b63-ca3ea2e1a18d", "create_time": 1788277531.9987452, "update_time": 1788280100.5277452, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "5b82f7e8-0e65-46e0-916c-d0c487e5b65a", "create_time": 1788277531.9987676, "update_time": 1788280100.5277727, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "8af7ff80-2510-4ec6-aa55-d88d3406b5f8", "create_time": 1788277531.9987895, "update_time": 1788280100.5278, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "816cf263-fcdd-45d6-8f5f-f4c5c3f638bd", "create_time": 1788276680.0036306, "update_time": 1788280100.528886, "name": "Analysis", "order": 2, "tasks": [{"id": "2444a355-821e-4485-86c5-03c836cba7c5", "create_time": 1764758755.9059348, "update_time": 1788280100.5279753, "name": "Research intelligence resources", "order": 1, "tag": "595d75bb-316e-4dec-bfc6-6729d3e7b280", "description": "Review%20Intelligence%20resources%20including%20Splunk%20Attack%20Analyzer%20and%20Cisco%20Talos%20in%20the%20Intelligence%20Tab%20of%20investigation%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Splunk%20Attack%20Analyzer%0A2.%20Cisco%20Talos%20Intelligence%0A3.%20VirusTotal%20v3%0A4.%20PhishTank%20(preconfigured)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0d079a95-c063-4b33-87ba-25fe661a9ece", "create_time": 1774295034.6502967, "update_time": 1788280100.5280461, "last_job_id": 0, "name": "detonate file - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8939", "description": "Submit File for Scanning", "type": "detonate file", "app_id": 283, "asset": 23, "parameters": [{"file": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "efe8365d-975e-4aa6-a26e-6eeca46a39e4", "create_time": 1774295034.650387, "update_time": 1788280100.5280788, "last_job_id": 0, "name": "detonate url - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8940", "description": "Submit New URL for Scanning", "type": "detonate url", "app_id": 283, "asset": 23, "parameters": [{"url": "", "ph_0": "", "profile": "", "user_agent": "", "internet_region": "", "archive_password": "", "custom_user_agent": ""}]}, {"id": "60f5815d-8d11-490d-870c-3e174acc2cdd", "create_time": 1774295034.650461, "update_time": 1788280100.5281093, "last_job_id": 0, "name": "get job summary - Splunk Attack Analyzer Connector for Splunk SOAR", "action": "8937", "description": "Get a job summary for a submitted job", "type": "get job summary", "app_id": 283, "asset": 23, "parameters": [{"job_id": "", "timeout": ""}]}, {"id": "592359f5-15f0-405f-bd1b-94feeef818a1", "create_time": 1774295034.6505318, "update_time": 1788280100.5281377, "last_job_id": 0, "name": "domain reputation - Cisco Talos Intelligence", "action": "7850", "description": "Query domain info", "type": "domain reputation", "app_id": 61, "asset": 11, "parameters": [{"domain": ""}]}, {"id": "28f35544-23b8-4302-89ff-6ca0004c1809", "create_time": 1774295034.6506045, "update_time": 1788280100.5281668, "last_job_id": 0, "name": "ip reputation - Cisco Talos Intelligence", "action": "7849", "description": "Query IP info", "type": "ip reputation", "app_id": 61, "asset": 11, "parameters": [{"ip": ""}]}, {"id": "e970c5c0-d3f1-4f83-9cc7-a640ac3573ba", "create_time": 1774295034.6506772, "update_time": 1788280100.5281966, "last_job_id": 0, "name": "url reputation - Cisco Talos Intelligence", "action": "7851", "description": "Query URL info", "type": "url reputation", "app_id": 61, "asset": 11, "parameters": [{"url": ""}]}, {"id": "4fdc630a-1b12-4391-b43d-cdd2e203cdb9", "create_time": 1774295034.6507487, "update_time": 1788280100.5282252, "last_job_id": 0, "name": "domain reputation - VirusTotal v3", "action": "8999", "description": "Queries VirusTotal for domain info", "type": "domain reputation", "app_id": 323, "asset": 28, "parameters": [{"domain": ""}]}, {"id": "4ad7addc-85f1-423f-bbb3-127b419e5e4f", "create_time": 1774295034.65084, "update_time": 1788280100.5282538, "last_job_id": 0, "name": "file reputation - VirusTotal v3", "action": "9000", "description": "Queries VirusTotal for file reputation info", "type": "file reputation", "app_id": 323, "asset": 28, "parameters": [{"hash": ""}]}, {"id": "eda133de-bca5-4dfc-adb7-80c32b26a9af", "create_time": 1774295034.6509123, "update_time": 1788280100.5282822, "last_job_id": 0, "name": "ip reputation - VirusTotal v3", "action": "9002", "description": "Queries VirusTotal for IP info", "type": "ip reputation", "app_id": 323, "asset": 28, "parameters": [{"ip": ""}]}, {"id": "61ad9c71-2ac1-4ca6-93a8-2b6fac2bc23e", "create_time": 1774295034.650983, "update_time": 1788280100.5283108, "last_job_id": 0, "name": "url reputation - VirusTotal v3", "action": "9003", "description": "Queries VirusTotal for URL info (run this action after running detonate url)", "type": "url reputation", "app_id": 323, "asset": 28, "parameters": [{"url": ""}]}, {"id": "4d492999-a2cf-4f01-90c8-3c02ffc1074f", "create_time": 1774295034.6510537, "update_time": 1788280100.5283384, "last_job_id": 0, "name": "detonate file - VirusTotal v3", "action": "9005", "description": "Upload a file to Virus Total and retrieve the analysis results", "type": "detonate file", "app_id": 323, "asset": 28, "parameters": [{"vault_id": "", "wait_time": ""}]}, {"id": "b469d96c-f7d1-458e-b12a-b2e6024ef6ba", "create_time": 1774295034.6511242, "update_time": 1788280100.5283694, "last_job_id": 0, "name": "detonate url - VirusTotal v3", "action": "9004", "description": "Load a URL to Virus Total and retrieve analysis results", "type": "detonate url", "app_id": 323, "asset": 28, "parameters": [{"url": "", "wait_time": ""}]}, {"id": "dce78a62-bcde-499a-94dd-95f738db943a", "create_time": 1774295034.651194, "update_time": 1788280100.528398, "last_job_id": 0, "name": "url reputation - PhishTank", "action": "8902", "description": "Queries PhishTank for URL's phishing reputation", "type": "url reputation", "app_id": 225, "asset": 3, "parameters": [{"url": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a947eacc-04e3-485e-bac4-6566e85df173", "create_time": 1764758755.9060266, "update_time": 1788280100.5284767, "name": "Research%20Network%20and%20Traffic%20logs%20", "order": 2, "tag": "7586c74e-6844-45bb-9535-4924752ff0de", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0A%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BWeb%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/web_center)%0A2.%20%5BTraffic%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_center)%0A3.%20%5BTraffic%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_search)%0A4.%20%5BTraffic%20Size%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/traffic_size_analysis)%0A5.%20%5BPort%20and%20Protocol%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/port_protocol_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "bfa0b1ad-7bb1-484d-bcfa-16df7989518c", "create_time": 1764758755.906122, "update_time": 1788280100.528601, "name": "Research%20Authentication%20Behavior", "order": 3, "tag": "5f7e4c57-343a-4a5c-8c90-643bdb578dbb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BRisk%20Analysis%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/risk_analysis)%0A2.%20%5BAccess%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_center)%0A3.%20%5BAccount%20Management%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/account_management)%0A4.%20%5BAccess%20Tracker%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/access_tracker)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "0168209e-eb24-4a5a-b72a-7c074a96a19c", "create_time": 1764758755.906265, "update_time": 1788280100.5287104, "name": "Research%20OS%20%20and%20Endpoint%20Logs", "order": 4, "tag": "357d8065-7af2-4968-a52e-1daba8d36bcb", "description": "Not%20all%20Dashboards%20may%20come%20into%20play%20depending%20on%20detection/s%20%0AFind%20and%20document%20any%20evidence%20linked%20to%20detections.%0A%0ASuggested%20Dashboards%0A1.%20%5BEndpoint%20Changes%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/endpoint_changes)%0A2.%20%5BMalware%20Center%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_center)%0A3.%20%5BMalware%20Search%20Dashboard%5D(/app/SplunkEnterpriseSecuritySuite/malware_search)", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a16d098a-10a7-4b53-a798-fd83c467ddb6", "create_time": 1764758755.9069023, "update_time": 1788280100.528816, "name": "Determine%20full%20impact", "order": 5, "tag": "2419ca1b-fa9e-4443-8334-4642877218c4", "description": "Determine%20and%20Document%20Initial%20Infection%20vectors,%20attack%20targets,%20attacker%20sources,%20infected%20devices,%20compromised%20users.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "1cfc9549-b74f-4dfd-b1c5-956b1587e546", "create_time": 1788276680.0043044, "update_time": 1788280100.530551, "name": "Containment", "order": 3, "tasks": [{"id": "91691144-6812-44e7-ae84-769b7c91778f", "create_time": 1764758755.9071276, "update_time": 1788280100.5289705, "name": "Alert%20Appropriate%20Parties%20of%20evidence%20found%20and%20recommended%20next%20actions", "order": 1, "tag": "fa5fbdd4-4224-460f-80b1-081083c3a8e5", "description": "Send%20Email%20or%20Instant%20message%20to%20appropriate%20teams%20for%20awareness%20and%20assistance%0A%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "79483e20-2181-4940-8225-94c2d222e631", "create_time": 1788278442.8867176, "update_time": 1788280100.5290368, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "29954e34-f374-48b8-ac1d-ed2d53750ff5", "create_time": 1788278442.886742, "update_time": 1788280100.5290687, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "5acb959b-9bf7-4213-9ca4-0237a9191d61", "create_time": 1788278442.8867648, "update_time": 1788280100.5290997, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "f0239d21-9be0-4768-9971-cb03a109fb8c", "create_time": 1788278442.8867874, "update_time": 1788280100.5291348, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "2a6dc7f4-2326-4ca4-b9c3-e824c14e735e", "create_time": 1788278442.8868096, "update_time": 1788280100.529166, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "ac4ad54a-6826-4758-bd4b-7ea9366d1811", "create_time": 1788278442.8868325, "update_time": 1788280100.5291967, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "884da2c4-4fb8-494f-bd5a-2c0eacb81646", "create_time": 1764758755.9072351, "update_time": 1788280100.5292842, "name": "Block%20Malicious%20URL%20and%20%20IPs", "order": 2, "tag": "f735a650-8d7e-42ee-95fa-ca8122e29df4", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20URLs%20or%20IPs%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Cisco%20Firepower%20%0A2.%20Cisco%20Secure%20Firewall%20%0A3.%20Palo%20Alto%20%0A4.%20Zscaler%20%0A5.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "8e293ed1-ff03-4401-a9a3-39e7b7eb2d8a", "create_time": 1788278624.1030524, "update_time": 1788280100.5293477, "last_job_id": 0, "name": "block ip - Cisco Firepower", "action": "2989", "description": "Blocks an IP network", "type": "block ip", "app_id": 35, "asset": 38, "parameters": [{"ip": ""}]}, {"id": "0a955b4b-e637-429c-ac6f-b8baed5cc5c9", "create_time": 1788278624.1030767, "update_time": 1788280100.5293787, "last_job_id": 0, "name": "delete network object - Cisco Secure Firewall", "action": "2995", "description": "Deletes a network object in FMC", "type": "delete network object", "app_id": 37, "asset": 39, "parameters": [{"type": "", "object_id": "", "domain_name": ""}]}, {"id": "805b7d47-1625-4a45-abe3-d187d94fbdae", "create_time": 1788278624.1030996, "update_time": 1788280100.5294104, "last_job_id": 0, "name": "block ip - Panorama", "action": "2395", "description": "Block an IP", "type": "block ip", "app_id": 119, "asset": 10, "parameters": [{"ip": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "should_add_tag": false, "is_source_address": false, "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "984a01e3-f98b-4500-8e1e-1308536615c3", "create_time": 1788278624.1031215, "update_time": 1788280100.5294404, "last_job_id": 0, "name": "block url - Panorama", "action": "2391", "description": "Block an URL", "type": "block url", "app_id": 119, "asset": 10, "parameters": [{"url": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "939506af-4344-4903-8716-2c98620b1108", "create_time": 1788278624.1031427, "update_time": 1788280100.529471, "last_job_id": 0, "name": "block ip - Zscaler", "action": "2798", "description": "Block an IP", "type": "block ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "7d44cabe-dc7f-4282-9c65-982acc17af71", "create_time": 1788278624.1031644, "update_time": 1788280100.5295005, "last_job_id": 0, "name": "block url - Zscaler", "action": "2799", "description": "Block a URL", "type": "block url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}, {"id": "4972f488-4a2a-43b3-9380-67eaf963f2a3", "create_time": 1788278624.1031861, "update_time": 1788280100.5295336, "last_job_id": 0, "name": "unallow ip - Zscaler", "action": "2804", "description": "Remove an IP address from the allowlist", "type": "unallow ip", "app_id": 183, "asset": 24, "parameters": [{"ip": "", "url_category": ""}]}, {"id": "5a94c3aa-4d81-4803-9bb0-c04abf4a66fd", "create_time": 1788278624.1032078, "update_time": 1788280100.5295634, "last_job_id": 0, "name": "unallow url - Zscaler", "action": "2805", "description": "Remove a URL from the allowed list", "type": "unallow url", "app_id": 183, "asset": 24, "parameters": [{"url": "", "url_category": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5b6fd766-744a-4ada-9612-9934ff090668", "create_time": 1764758755.9073257, "update_time": 1788280100.5296493, "name": "Block%20Applications%20and%20Hashes", "order": 3, "tag": "de5b8d96-bc90-47e5-a707-4b4ce273b2f5", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20block%20any%20malicious%20or%20compromised%20applications%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Palo%20Alto/Panorama%0A2.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "4aeae82c-9dd1-40c2-a202-8c1681107ad0", "create_time": 1788278773.9890056, "update_time": 1788280100.5297146, "last_job_id": 0, "name": "block application - Panorama", "action": "2393", "description": "Block an application", "type": "block application", "app_id": 119, "asset": 10, "parameters": [{"application": "", "policy_name": "", "policy_type": "", "device_group": "", "audit_comment": "", "use_partial_commit": false, "should_commit_changes": false}]}, {"id": "aab34ec2-4c29-454f-a4c6-977593bb4223", "create_time": 1788278773.9890535, "update_time": 1788280100.5297453, "last_job_id": 0, "name": "block hash - Carbon Black Response", "action": "2075", "description": "Add a hash to the Carbon Black Response blacklist", "type": "block hash", "app_id": 28, "asset": 12, "parameters": [{"hash": "", "comment": ""}]}, {"id": "efce157a-05de-44a0-9068-8a89c805cabb", "create_time": 1788278773.9890966, "update_time": 1788280100.5297751, "last_job_id": 0, "name": "terminate process - Carbon Black Response", "action": "2067", "description": "Kill running processes on a machine", "type": "terminate process", "app_id": 28, "asset": 12, "parameters": [{"pid": "", "sensor_id": "", "ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "c21f1448-9c99-4d7b-818e-d803780529ad", "create_time": 1788279259.257031, "update_time": 1788280100.5298517, "name": "Quarantine%20compromised%20devices%20or%20endpoints", "order": 4, "tag": "de175899-36ac-48d6-9ca4-fa1f31c46019", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20quarantine%20any%20compromised%20devices.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A1.%20Crowdstrike%0A2.%20Microsoft%20Defender%20for%20Endpoint%0A3.%20VMware%20Carbon%20Black%20Cloud%20for%20Splunk%20SOAR", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "306acb45-61e8-4af7-8836-7f5b23e79f13", "create_time": 1788279409.7877266, "update_time": 1788280100.5299373, "last_job_id": 0, "name": "quarantine device - CrowdStrike OAuth API", "action": "2153", "description": "Block the device", "type": "quarantine device", "app_id": 48, "asset": 19, "parameters": [{"hostname": "", "device_id": ""}]}, {"id": "8e3459f3-a1d1-4230-8461-7ef56dc5a843", "create_time": 1788279409.7877512, "update_time": 1788280100.5299702, "last_job_id": 0, "name": "quarantine device - Windows Defender ATP", "action": "2698", "description": "Quarantine the device", "type": "quarantine device", "app_id": 101, "asset": 40, "parameters": [{"type": "", "comment": "", "timeout": "", "device_id": ""}]}, {"id": "889e7a1d-0df0-43d1-81b9-46ab7359ffba", "create_time": 1788279409.7877738, "update_time": 1788280100.5300007, "last_job_id": 0, "name": "quarantine file - Windows Defender ATP", "action": "2702", "description": "Quarantine a file", "type": "quarantine file", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": "", "file_hash": ""}]}, {"id": "7b3a2d28-4942-4598-bffc-7c1f4515ec72", "create_time": 1788279409.787797, "update_time": 1788280100.530035, "last_job_id": 0, "name": "restrict app execution - Windows Defender ATP", "action": "2715", "description": "Restrict execution of all applications on the device except a predefined set", "type": "restrict app execution", "app_id": 101, "asset": 40, "parameters": [{"comment": "", "timeout": "", "device_id": ""}]}, {"id": "5a8eb830-4b4a-411c-993c-fc5ac42da7ef", "create_time": 1788279409.7878232, "update_time": 1788280100.5300653, "last_job_id": 0, "name": "quarantine device - Carbon Black Response", "action": "2062", "description": "Quarantine the endpoint", "type": "quarantine device", "app_id": 28, "asset": 12, "parameters": [{"ip_hostname": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "e2eefabb-dd45-4647-a347-b8a66c3bd2ed", "create_time": 1788279702.6294243, "update_time": 1788280100.5301492, "name": "Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens", "order": 5, "tag": "8cd82a46-eb24-4bb7-8023-34d779e4c4d2", "description": "Using%20the%20information%20documented%20in%20evidence%20if%20applies%20Disable%20any%20compromised%20or%20malicious%20accounts%20or%20tokens.%0A%0ASuggested%20Integration%20(%20if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A1.%20MS%20Graph%20For%20Active%20Directory%20%0A2.%20AD%20LDAP%20%0A3.%20Okta%20%0A4.%20AWS%20IAM%20%0A5.%20Azure%20AD%20Graph", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "0b3091e6-c58b-495c-bf1e-92fda2468d00", "create_time": 1788279702.6294713, "update_time": 1788280100.5302153, "last_job_id": 0, "name": "disable account - AD LDAP", "action": "1930", "description": "Disables an Active Directory account", "type": "disable account", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "cb9c0ef7-748d-43ea-a0a0-1ba7dbe433cc", "create_time": 1788279702.629496, "update_time": 1788280100.5302463, "last_job_id": 0, "name": "reset password - AD LDAP", "action": "1932", "description": "Resets the password of a user, requiring the user to change password at next login", "type": "reset password", "app_id": 2, "asset": 28, "parameters": [{"user": "", "use_samaccountname": false}]}, {"id": "efcd23da-9a95-4a84-927c-5a80668bf16e", "create_time": 1788279702.629519, "update_time": 1788280100.5302763, "last_job_id": 0, "name": "disable user - Azure AD Graph", "action": "2019", "description": "Disable a user", "type": "disable user", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "73978225-62b4-49d4-b779-e38a85469279", "create_time": 1788279702.6295414, "update_time": 1788280100.5303059, "last_job_id": 0, "name": "reset password - Azure AD Graph", "action": "2016", "description": "Reset or set a user's password in an Azure AD environment", "type": "reset password", "app_id": 14, "asset": 21, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}, {"id": "89d063f3-11e3-49c7-957a-b07b8b9fb141", "create_time": 1788279702.629564, "update_time": 1788280100.5303347, "last_job_id": 0, "name": "disable tokens - Azure AD Graph", "action": "2017", "description": "Invalidate all active refresh tokens for a user in an Azure AD environment", "type": "disable tokens", "app_id": 14, "asset": 21, "parameters": [{"user_id": ""}]}, {"id": "0f2fe1cc-260d-4200-b13d-bcf6aa3ec877", "create_time": 1788279702.629587, "update_time": 1788280100.5303638, "last_job_id": 0, "name": "disable user - AWS IAM", "action": "3044", "description": "Disable login profile and access keys of a user", "type": "disable user", "app_id": 6, "asset": 42, "parameters": [{"username": "", "credentials": "", "disable_access_keys": false}]}, {"id": "e3f709da-f0a0-4140-b837-109df13fbb5e", "create_time": 1788279702.629611, "update_time": 1788280100.5303931, "last_job_id": 0, "name": "disable user - Okta", "action": "2367", "description": "Disables the specified user", "type": "disable user", "app_id": 118, "asset": 13, "parameters": [{"id": ""}]}, {"id": "fac660ff-6fa7-4952-8924-46e41746cfd8", "create_time": 1788279702.6296341, "update_time": 1788280100.5304255, "last_job_id": 0, "name": "disable user - MS Graph for Active Directory", "action": "3021", "description": "Disable a user", "type": "disable user", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "7fed8e92-ceb2-44fa-9711-5a23ed3342c2", "create_time": 1788279702.6296563, "update_time": 1788280100.5304606, "last_job_id": 0, "name": "disable tokens - MS Graph for Active Directory", "action": "3019", "description": "Invalidate all active refresh tokens for a user in a Microsoft AD environment", "type": "disable tokens", "app_id": 89, "asset": 41, "parameters": [{"user_id": ""}]}, {"id": "48c0cfa5-084a-447c-9f44-cd67be2c6ddd", "create_time": 1788279702.6296782, "update_time": 1788280100.53049, "last_job_id": 0, "name": "reset password - MS Graph for Active Directory", "action": "3018", "description": "Reset or set a user's password in a Microsoft AD environment", "type": "reset password", "app_id": 89, "asset": 41, "parameters": [{"user_id": "", "force_change": false, "temp_password": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}, {"id": "50452b43-98af-43ab-bfb0-1e9f7368b2c9", "create_time": 1788276680.0046902, "update_time": 1788280100.5313852, "name": "Recovery", "order": 4, "tasks": [{"id": "91a74317-f931-4ced-b4aa-6cdf54433221", "create_time": 1764758755.9079046, "update_time": 1788280100.5306091, "name": "Verify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20monitor%20for%20signs%20of%20recurrence", "order": 1, "tag": "c3c83a87-0d75-4d0a-b4e7-9fef0d60e5f4", "description": "Define%20who%20owns%20recovery%20execution,%20who%20approves%20restoration,%20and%20what%20systems/users/services%20are%20in%20scope.%20%0AVerify%20the%20integrity%20of%20restored%20assets,%20confirm%20normal%20operations%20with%20system%20owners,%20and%20monitor%20signs%20of%20recurrence.", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "91f6342d-a92b-4157-a124-5e87ab0c9827", "create_time": 1764758755.9080007, "update_time": 1788280100.5307238, "name": "Complete%20incident%20documentation%20and%20lessons%20learned%20before%20closure", "order": 2, "tag": "27d8d5a5-4c1b-470c-b995-c39275b61444", "description": "Root%20Cause%20Analysis.%20%20New%20Detections,%20Visualizations,%20responses%20or%20playbooks%20to%20help%20resolve%20in%20future.%20", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "5840a534-399b-4ac1-b0bc-80927edf8f8b", "create_time": 1764758755.9080942, "update_time": 1788280100.5308282, "name": "Report%20incident%20response%20status", "order": 3, "tag": "085d0c66-3bb9-48c8-9403-0fc21217d77c", "description": "Alert%20appropriate%20parties%20that%20incident%20response%20is%20complete.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Smtp%20%0A-%20MS%20Graph%20for%20Office%20365%20%0A-%20G%20Suite%20for%20Gmail%20%0A-%20Cisco%20Webex%20%0A-%20Slack%20%0A-%20Microsoft%20Teams", "owner": "", "is_note_required": false, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "2bcf6e5e-de9b-42bd-b24c-d4cdd423cb13", "create_time": 1788279986.6035137, "update_time": 1788280100.5308995, "last_job_id": 0, "name": "send email - SMTP", "action": "1903", "description": "Sends an email", "type": "send email", "app_id": 139, "asset": 6, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "393db9ae-69e9-4172-8b08-a7e59cf20aa9", "create_time": 1788279986.6035569, "update_time": 1788280100.5309548, "last_job_id": 0, "name": "send email - MS Graph for Office 365", "action": "2339", "description": "Sends an email with optional text rendering. Attachments are allowed a Content-ID tag for reference within the html", "type": "send email", "app_id": 97, "asset": 32, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "attachments": ""}]}, {"id": "d80a5892-bc25-4b3a-be22-af3620e30994", "create_time": 1788279986.6036005, "update_time": 1788280100.530988, "last_job_id": 0, "name": "send email - G Suite for GMail", "action": "2952", "description": "Send email via Gmail.\n\nConstructs MIME message with attachments, respecting 25MB size limit.\nOptionally creates send-as alias before sending.", "type": "send email", "app_id": 88, "asset": 35, "parameters": [{"cc": "", "to": "", "bcc": "", "body": "", "from": "", "headers": "", "subject": "", "reply_to": "", "alias_name": "", "alias_email": "", "attachments": ""}]}, {"id": "4d83b65b-55b8-4d55-81a0-1e7ee2e25ade", "create_time": 1788279986.6036437, "update_time": 1788280100.5310204, "last_job_id": 0, "name": "send message - Cisco Webex", "action": "2960", "description": "Send message to user or room", "type": "send message", "app_id": 42, "asset": 36, "parameters": [{"card": "", "message": "", "vault_id": "", "endpoint_id": "", "is_markdown": false, "destination_type": ""}]}, {"id": "db31bdad-1648-4426-bb85-2fed1912d79d", "create_time": 1788279986.6036847, "update_time": 1788280100.5310526, "last_job_id": 0, "name": "send message - Slack", "action": "2498", "description": "Send a message to Slack", "type": "send message", "app_id": 152, "asset": 17, "parameters": [{"blocks": "", "message": "", "link_names": false, "destination": "", "reply_broadcast": false, "parent_message_ts": ""}]}, {"id": "49790c40-0d53-4598-b162-25d69c9ce19b", "create_time": 1788279986.603725, "update_time": 1788280100.5310874, "last_job_id": 0, "name": "send chat message - Microsoft Teams", "action": "2979", "description": "Send a message to specific chat", "type": "send chat message", "app_id": 125, "asset": 37, "parameters": [{"chat_id": "", "message": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}, {"id": "a18d484f-0600-490d-9b4c-52851cd7b767", "create_time": 1788280100.5311828, "update_time": 1788280100.5311832, "name": "Update%20and%20close%20company-wide%20awareness%20tickets%20when%20appropriate.", "order": 4, "tag": "44b218d8-0a50-47f1-a5ed-20a5c73ff522", "description": "Update%20Incident%20to%20track%20notes%20from%20the%20investigaiton.%0A%0ASuggested%20Integration%20(if%20not%20already%20configured%20navigate%20%5BHERE%5D(/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_apps/apps)%20to%20locate%20and%20configure)%0A%0A-%20Service%20Now%20%0A-%20Salesforce%20%0A-%20Jira", "owner": "", "is_note_required": true, "status": "Pending", "notes": [], "files": [], "suggestions": {"playbooks": [], "actions": [{"id": "cc88b369-e5e6-4d63-9d88-97d985edd8f8", "create_time": 1788280100.5312567, "update_time": 1788280100.5312572, "last_job_id": 0, "name": "update ticket - ServiceNow", "action": "2473", "description": "Update ticket/record information", "type": "update ticket", "app_id": 147, "asset": 29, "parameters": [{"id": "", "table": "", "fields": "", "vault_id": "", "is_sys_id": false}]}, {"id": "99b0e0e2-2efd-4f9f-b4f4-6e68501acb3a", "create_time": 1788280100.5312977, "update_time": 1788280100.5312986, "last_job_id": 0, "name": "update ticket - Salesforce", "action": "2937", "description": "Update a Case", "type": "update ticket", "app_id": 144, "asset": 34, "parameters": [{"id": "", "status": "", "subject": "", "priority": "", "description": "", "field_values": "", "parent_case_id": ""}]}, {"id": "cc9e1aca-7be7-4b4c-a5ff-7c4929e8dd73", "create_time": 1788280100.531338, "update_time": 1788280100.5313385, "last_job_id": 0, "name": "update ticket - Jira", "action": "2287", "description": "Update ticket (issue)", "type": "update ticket", "app_id": 80, "asset": 31, "parameters": [{"id": "", "vault_id": "", "update_fields": ""}]}], "searches": []}, "start_time": 0, "end_time": 0, "total_time_taken": 0, "ai_summary": "", "ai_executed": false}]}], "origin": {"id": "67fc1f68-1928-4436-8525-2957aac3a534", "name": "Generic Incident Response", "version": 4}, "template_id": "69f3e851-6e19-4ecd-ae2b-7cd558d49133", "active": true, "used": false, "ai_generated": false, "source_attachment_id": null, "_user": "nobody", "_key": "bd873ed6-1463-4fbf-a184-8cc3ad7c446c"} diff --git a/scripts/check_archived_tas.py b/scripts/check_archived_tas.py new file mode 100644 index 00000000000..27269974ddf --- /dev/null +++ b/scripts/check_archived_tas.py @@ -0,0 +1,249 @@ +#!/usr/bin/env python3 +"""Create or refresh one GitHub issue for each archived TA in active use.""" + +from __future__ import annotations + +import json +import os +import re +import sys +import time +import urllib.error +import urllib.parse +import urllib.request +from pathlib import Path +from typing import Any + +import yaml + + +ROOT = Path(__file__).resolve().parents[1] +DATA_SOURCES_DIR = ROOT / "data_sources" +DETECTIONS_DIR = ROOT / "detections" +SPLUNKBASE_API = "https://splunkbase.splunk.com/api/v1/app" +APP_URL_PATTERN = re.compile( + r"https?://(?:www\.)?splunkbase\.splunk\.com/app/(\d+)(?:/|\b)", re.I +) +USER_AGENT = "splunk-threat-research-team/1.0" + + +def yaml_files(folder: Path): + yield from sorted(folder.rglob("*.yml")) + yield from sorted(folder.rglob("*.yaml")) + + +def load_yaml(path: Path) -> dict[str, Any] | None: + try: + value = yaml.safe_load(path.read_text(encoding="utf-8")) + except (OSError, yaml.YAMLError) as exc: + print(f"Warning: skipping {path.relative_to(ROOT)}: {exc}", file=sys.stderr) + return None + return value if isinstance(value, dict) else None + + +def discover_used_tas() -> dict[str, dict[str, Any]]: + """Return TAs grouped by app ID, including linked data sources/detections.""" + data_sources: dict[str, dict[str, Any]] = {} + for path in yaml_files(DATA_SOURCES_DIR): + obj = load_yaml(path) + if not obj or not isinstance(obj.get("name"), str): + continue + data_sources[obj["name"].strip().casefold()] = { + "name": obj["name"].strip(), + "path": path.relative_to(ROOT).as_posix(), + "supported_tas": obj.get("supported_TA") or [], + "detections": [], + } + + for path in yaml_files(DETECTIONS_DIR): + if (DETECTIONS_DIR / "deprecated") in path.parents: + continue + detection = load_yaml(path) + if not detection: + continue + if str(detection.get("status") or "").strip().casefold() == "deprecated": + continue + references = detection.get("data_source") or [] + if isinstance(references, str): + references = [references] + if not isinstance(references, list): + continue + detection_name = str(detection.get("name") or path.stem) + detection_path = path.relative_to(ROOT).as_posix() + for reference in references: + if not isinstance(reference, str): + continue + source = data_sources.get(reference.strip().casefold()) + if source: + source["detections"].append({"name": detection_name, "path": detection_path}) + + tas: dict[str, dict[str, Any]] = {} + for source in data_sources.values(): + if not source["detections"]: + continue + for ta in source["supported_tas"]: + if not isinstance(ta, dict): + continue + url = str(ta.get("url") or "").strip() + match = APP_URL_PATTERN.search(url) + if not match: + continue + app_id = match.group(1) + name = str(ta.get("name") or f"Splunkbase app {app_id}").strip() + record = tas.setdefault( + app_id, + { + "app_id": app_id, + "name": name, + "url": f"https://splunkbase.splunk.com/app/{app_id}/", + "data_sources": {}, + }, + ) + if record["name"].startswith("Splunkbase app ") and name: + record["name"] = name + record["data_sources"][source["path"]] = source + return tas + + +def get_json(url: str) -> Any: + request = urllib.request.Request( + url, headers={"User-Agent": USER_AGENT, "Accept": "application/json"} + ) + with urllib.request.urlopen(request, timeout=30) as response: + return json.loads(response.read().decode("utf-8")) + + +def truthy(value: Any) -> bool: + if isinstance(value, str): + return value.strip().casefold() in {"true", "1", "yes", "archived"} + return value is True or value == 1 + + +def splunkbase_archived(app_id: str) -> tuple[bool, str]: + url = f"{SPLUNKBASE_API}/{app_id}/" + payload = get_json(url) + if not isinstance(payload, dict): + raise ValueError("unexpected Splunkbase response") + archived = truthy(payload.get("is_archived")) or truthy(payload.get("archive_status")) + api_name = str(payload.get("title") or payload.get("name") or "").strip() + return archived, api_name + + +def github_request(method: str, url: str, token: str, body: dict[str, Any] | None = None) -> Any: + headers = { + "User-Agent": USER_AGENT, + "Accept": "application/vnd.github+json", + "Authorization": f"Bearer {token}", + "X-GitHub-Api-Version": "2022-11-28", + } + data = json.dumps(body).encode("utf-8") if body is not None else None + request = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(request, timeout=30) as response: + raw = response.read() + return json.loads(raw.decode("utf-8")) if raw else None + + +def list_repo_issues(repo: str, token: str) -> list[dict[str, Any]]: + """Read open and closed issues so an old issue can be reopened in place.""" + issues: list[dict[str, Any]] = [] + page = 1 + while True: + query = urllib.parse.urlencode({"state": "all", "per_page": 100, "page": page}) + payload = github_request("GET", f"https://api.github.com/repos/{repo}/issues?{query}", token) + if not isinstance(payload, list): + raise ValueError("unexpected GitHub issues response") + issues.extend(item for item in payload if isinstance(item, dict) and "pull_request" not in item) + if len(payload) < 100: + return issues + page += 1 + + +def issue_body(ta: dict[str, Any], repo: str, branch: str) -> str: + lines = [ + f"", + f"**Splunkbase TA:** [{ta['name']}]({ta['url']})", + "", + "This archived Splunkbase TA is referenced by data source objects used by detections.", + "", + "### Data source objects and detections", + ] + for source in sorted(ta["data_sources"].values(), key=lambda item: item["name"].casefold()): + source_url = f"https://github.com/{repo}/blob/{branch}/{source['path']}" + lines.append(f"- [{source['name']}]({source_url})") + detection_items = sorted(source["detections"], key=lambda item: item["name"].casefold()) + for detection in detection_items: + detection_url = f"https://github.com/{repo}/blob/{branch}/{detection['path']}" + lines.append(f" - Detection: [{detection['name']}]({detection_url})") + lines.extend(["", "_This issue is maintained automatically by the archived TA daily workflow._"]) + return "\n".join(lines) + + +def find_existing_issue(ta: dict[str, Any], issues: list[dict[str, Any]]) -> dict[str, Any] | None: + marker = f"" + marked = [issue for issue in issues if marker in str(issue.get("body") or "")] + if marked: + return next((issue for issue in marked if issue.get("state") == "open"), marked[0]) + + # Adopt a manually created issue only when its exact title and Splunkbase + # URL both match. This avoids conflating two apps that happen to share a name. + expected_title = f"{ta['name']} is archived on Splunkbase" + for issue in issues: + if issue.get("title") == expected_title and ta["url"] in str(issue.get("body") or ""): + return issue + return None + + +def main() -> int: + repo = os.environ.get("GITHUB_REPOSITORY", "").strip() + token = os.environ.get("GITHUB_TOKEN", "").strip() + branch = os.environ.get("GITHUB_REF_NAME", "develop").strip() + if not repo or not token: + print("GITHUB_REPOSITORY and GITHUB_TOKEN are required.", file=sys.stderr) + return 2 + + used_tas = discover_used_tas() + print(f"Found {len(used_tas)} distinct TAs referenced by data sources used in detections.") + issues = list_repo_issues(repo, token) + api_root = f"https://api.github.com/repos/{repo}/issues" + archived_count = 0 + + for app_id, ta in sorted(used_tas.items(), key=lambda item: item[1]["name"].casefold()): + try: + archived, api_name = splunkbase_archived(app_id) + except (urllib.error.URLError, urllib.error.HTTPError, TimeoutError, ValueError, json.JSONDecodeError) as exc: + print(f"Warning: could not check Splunkbase app {app_id}: {exc}", file=sys.stderr) + continue + if not archived: + continue + archived_count += 1 + if api_name: + ta["name"] = api_name + + title = f"{ta['name']} is archived on Splunkbase" + body = issue_body(ta, repo, branch) + existing = find_existing_issue(ta, issues) + try: + if existing: + issue_number = existing["number"] + result = github_request( + "PATCH", + f"{api_root}/{issue_number}", + token, + {"title": title, "body": body, "state": "open"}, + ) + action = "Updated/reopened" + else: + result = github_request("POST", api_root, token, {"title": title, "body": body}) + action = "Created" + issues.append(result) + print(f"{action} issue #{result['number']}: {title}") + except (urllib.error.URLError, urllib.error.HTTPError, TimeoutError, KeyError, TypeError) as exc: + print(f"Error: could not save issue for app {app_id}: {exc}", file=sys.stderr) + time.sleep(0.15) + + print(f"Archived TAs currently in use: {archived_count}") + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py b/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py new file mode 100644 index 00000000000..7cf35488c19 --- /dev/null +++ b/scripts/nist_dashboard/generate_nist_ai_rmf_detection_map.py @@ -0,0 +1,421 @@ +#!/usr/bin/env python3 +"""Generate the NIST AI RMF detection-to-subcategory lookup from ESCU detections.""" + +from __future__ import annotations + +import argparse +import csv +import io +import re +import sys +from collections import defaultdict +from dataclasses import dataclass +from datetime import date +from pathlib import Path +from typing import Any + +import yaml + + +DEFAULT_CONFIG = Path("scripts/nist_dashboard/nist_ai_rmf_data_sources.yml") +DEFAULT_DETECTIONS_DIR = Path("detections") +DEFAULT_RMF_LOOKUP = Path("lookups/csv/nist_ai_rmf_subcategories.csv") +DEFAULT_OUTPUT = Path("lookups/csv/detection_subcategory_map.csv") +DEFAULT_METADATA = Path("lookups/csv/detection_subcategory_map.yml") + +FIELDNAMES = [ + "ai_system", + "data_sources", + "detection_name", + "detection_status", + "detection_type", + "analytic_stories", + "rmf_function", + "subcategory_ids", + "mapping_confidence", + "mapping_source", + "mapping_reason", +] + +FUNCTION_ORDER = { + "GOVERN": 1, + "MAP": 2, + "MEASURE": 3, + "MANAGE": 4, +} + + +@dataclass(frozen=True) +class DataSourceSelector: + name: str + ai_system: str + analytic_stories: tuple[str, ...] = () + + +@dataclass(frozen=True) +class MappingRule: + pattern: re.Pattern[str] + subcategory_ids: tuple[str, ...] + reason: str + confidence: str = "high" + + +RULES: tuple[MappingRule, ...] = ( + MappingRule( + re.compile(r"\b(non[- ]?compliant|unauthorized|unmanaged).*(device|ai|llm)|\b(local llm framework execution|model file creation)\b", re.I), + ("Govern 1.6",), + "AI system or access inventory signal", + ), + MappingRule( + re.compile(r"\b(local llm|framework dns|model file creation|network connectivity|api endpoint scan|reconnaissance|cross[- ]?region)\b", re.I), + ("Map 4.1",), + "AI component, model, or service discovery signal", + ), + MappingRule( + re.compile(r"\bwindows local llm framework execution\b", re.I), + ("Map 4.2",), + "AI system operating context signal", + ), + MappingRule( + re.compile(r"\b(unusually large|excessive.*tokens?|excessive.*api requests?|memory exhaustion|application usage pattern|session origin|behavior anomaly|failed authentication)\b", re.I), + ("Measure 2.4",), + "Production behavior monitoring signal", + ), + MappingRule( + re.compile(r"\blong[- ]running inference requests?\b", re.I), + ("Measure 2.4",), + "Production AI functionality and behavior monitoring signal", + ), + MappingRule( + re.compile(r"\brepeated (?:ollama )?application errors?\b", re.I), + ("Measure 2.4", "Manage 4.3"), + "Production behavior monitoring and incident/error tracking signal", + ), + MappingRule( + re.compile(r"\b(prompt injection|jailbreak|ignore previous|system prompt override|hostile prompt|sentiment)\b", re.I), + ("Measure 2.6",), + "Prompt-behavior and harmful-content measurement signal", + ), + MappingRule( + re.compile(r"\b(prompt injection|jailbreak|agentic|impersonation|rce|remote code|model loading|suspicious extension write|github suspicious|postgres suspicious|tool invocation)\b", re.I), + ("Measure 2.7",), + "AI security and resilience evaluation signal", + ), + MappingRule( + re.compile(r"\b(sensitive data|credential|secret|api key|information extraction|system file|model exfiltration|data leakage|/etc/passwd|\.aws/credentials)\b", re.I), + ("Measure 2.10",), + "Sensitive information or data-protection signal", + ), + MappingRule( + re.compile(r"\b(failed authentication|service crash|availability|memory exhaustion|excessive.*api requests?|security alerts?|critical alerts?|high risk filesystem|exec tool|delete guardrail|delete knowledge base|delete model invocation logging)\b", re.I), + ("Manage 4.1",), + "Post-deployment monitoring and response signal", + ), + MappingRule( + re.compile(r"\b(high risk filesystem|exec tool|rce|remote code|incident|delete guardrail|delete knowledge base|delete model invocation logging)\b", re.I), + ("Manage 4.3",), + "Incident tracking or response signal", + ), +) + + +def parse_args() -> argparse.Namespace: + parser = argparse.ArgumentParser( + description=( + "Generate lookups/csv/detection_subcategory_map.csv from ESCU detection " + "metadata and a configured list of AI-related data sources." + ) + ) + parser.add_argument("--config", type=Path, default=DEFAULT_CONFIG, help=f"Data source config. Default: {DEFAULT_CONFIG}") + parser.add_argument( + "--data-source", + action="append", + default=[], + help="Additional data source name to include. The AI system defaults to the data source name.", + ) + parser.add_argument("--detections-dir", type=Path, default=DEFAULT_DETECTIONS_DIR, help=f"Detections directory. Default: {DEFAULT_DETECTIONS_DIR}") + parser.add_argument("--rmf-lookup", type=Path, default=DEFAULT_RMF_LOOKUP, help=f"NIST AI RMF subcategory lookup. Default: {DEFAULT_RMF_LOOKUP}") + parser.add_argument("--output", type=Path, default=DEFAULT_OUTPUT, help=f"CSV output path. Default: {DEFAULT_OUTPUT}") + parser.add_argument("--metadata", type=Path, default=DEFAULT_METADATA, help=f"Lookup metadata YAML to bump when --output changes. Default: {DEFAULT_METADATA}") + parser.add_argument("--modified-date", default=None, help="Metadata modification date in YYYY-MM-DD format. Default: today.") + parser.add_argument("--no-metadata-update", action="store_true", help="Do not bump lookup metadata when --output changes.") + parser.add_argument("--include-deprecated", action="store_true", help="Include detections under detections/deprecated and detections with deprecated status.") + parser.add_argument("--dry-run", action="store_true", help="Write generated CSV to stdout instead of --output.") + return parser.parse_args() + + +def as_list(value: Any) -> list[str]: + if value is None: + return [] + if isinstance(value, list): + return [str(item).strip() for item in value if str(item).strip()] + text = str(value).strip() + return [text] if text else [] + + +def norm(value: str) -> str: + return re.sub(r"\s+", " ", value.strip()).casefold() + + +def load_yaml(path: Path) -> dict[str, Any]: + with path.open(encoding="utf-8") as handle: + loaded = yaml.safe_load(handle) or {} + if not isinstance(loaded, dict): + raise ValueError(f"{path} must contain a YAML mapping") + return loaded + + +def load_selectors(config_path: Path, cli_data_sources: list[str]) -> list[DataSourceSelector]: + selectors: list[DataSourceSelector] = [] + + if config_path.exists(): + config = load_yaml(config_path) + configured_sources = config.get("data_sources", []) + if not isinstance(configured_sources, list): + raise ValueError(f"{config_path}: data_sources must be a list") + for item in configured_sources: + if isinstance(item, str): + selectors.append(DataSourceSelector(name=item, ai_system=item)) + continue + if not isinstance(item, dict): + raise ValueError(f"{config_path}: each data_sources entry must be a string or mapping") + name = str(item.get("name", "")).strip() + if not name: + raise ValueError(f"{config_path}: data source entry is missing name") + ai_system = str(item.get("ai_system") or name).strip() + stories = tuple(as_list(item.get("analytic_stories") or item.get("analytic_story"))) + selectors.append(DataSourceSelector(name=name, ai_system=ai_system, analytic_stories=stories)) + + for data_source in cli_data_sources: + data_source = data_source.strip() + if data_source: + selectors.append(DataSourceSelector(name=data_source, ai_system=data_source)) + + if not selectors: + raise ValueError("No data sources configured. Add --data-source or provide a config file.") + + deduped: dict[tuple[str, str, tuple[str, ...]], DataSourceSelector] = {} + for selector in selectors: + deduped[(norm(selector.name), norm(selector.ai_system), tuple(norm(s) for s in selector.analytic_stories))] = selector + return list(deduped.values()) + + +def load_valid_subcategories(path: Path) -> dict[str, str]: + valid: dict[str, str] = {} + with path.open(newline="", encoding="utf-8-sig") as handle: + reader = csv.DictReader(handle) + required = {"function", "subcategory_id"} + missing = required - set(reader.fieldnames or []) + if missing: + raise ValueError(f"{path} is missing required columns: {', '.join(sorted(missing))}") + for row in reader: + subcategory_id = (row.get("subcategory_id") or "").strip() + function = (row.get("function") or "").strip().upper() + if subcategory_id: + valid[subcategory_id] = function + if not valid: + raise ValueError(f"{path} did not contain any subcategory IDs") + return valid + + +def detection_files(root: Path, include_deprecated: bool) -> list[Path]: + files = sorted(root.rglob("*.yml")) + if include_deprecated: + return files + return [path for path in files if "deprecated" not in {part.casefold() for part in path.parts}] + + +def selector_matches(selector: DataSourceSelector, detection_data_sources: set[str], detection_stories: set[str]) -> bool: + if norm(selector.name) not in detection_data_sources: + return False + if selector.analytic_stories and not ({norm(story) for story in selector.analytic_stories} & detection_stories): + return False + return True + + +def confidence_rank(confidence: str) -> int: + return {"review": 1, "medium": 2, "high": 3}.get(confidence, 1) + + +def derive_mapping(detection: dict[str, Any], valid_subcategories: dict[str, str]) -> tuple[list[str], str, str, str]: + context_fields = [ + detection.get("name"), + detection.get("type"), + detection.get("status"), + " ".join(as_list(detection.get("data_source"))), + " ".join(as_list(detection.get("analytic_story"))), + ] + context = " ".join(str(field) for field in context_fields if field) + + subcategory_ids: list[str] = [] + reasons: list[str] = [] + confidence = "review" + for rule in RULES: + if rule.pattern.search(context): + for subcategory_id in rule.subcategory_ids: + if subcategory_id not in subcategory_ids: + subcategory_ids.append(subcategory_id) + if rule.reason not in reasons: + reasons.append(rule.reason) + if confidence_rank(rule.confidence) > confidence_rank(confidence): + confidence = rule.confidence + + if not subcategory_ids: + subcategory_ids = ["Measure 2.4"] + confidence = "review" + reasons = ["AI data source matched, but no specific RMF rule matched"] + + invalid = [subcategory_id for subcategory_id in subcategory_ids if subcategory_id not in valid_subcategories] + if invalid: + raise ValueError(f"{detection.get('name', '')} mapped to unknown RMF subcategories: {', '.join(invalid)}") + + functions = sorted( + {valid_subcategories[subcategory_id] for subcategory_id in subcategory_ids}, + key=lambda item: FUNCTION_ORDER.get(item, 99), + ) + mapping_source = "generated_rule" if confidence != "review" else "generated_review" + return subcategory_ids, "|".join(functions), confidence, "; ".join(reasons) + + +def rows_from_detections( + detections_dir: Path, + selectors: list[DataSourceSelector], + valid_subcategories: dict[str, str], + include_deprecated: bool, +) -> list[dict[str, str]]: + rows_by_key: dict[tuple[str, str], dict[str, str]] = {} + data_sources_by_key: dict[tuple[str, str], set[str]] = defaultdict(set) + + for path in detection_files(detections_dir, include_deprecated): + detection = load_yaml(path) + name = str(detection.get("name", "")).strip() + if not name: + continue + + status = str(detection.get("status", "")).strip() + if not include_deprecated and status.casefold() == "deprecated": + continue + + data_source_values = as_list(detection.get("data_source")) + story_values = as_list(detection.get("analytic_story")) + detection_data_sources = {norm(value) for value in data_source_values} + detection_stories = {norm(value) for value in story_values} + + matched_by_ai_system: dict[str, set[str]] = defaultdict(set) + for selector in selectors: + if selector_matches(selector, detection_data_sources, detection_stories): + matched_by_ai_system[selector.ai_system].add(selector.name) + + if not matched_by_ai_system: + continue + + subcategory_ids, rmf_function, confidence, reason = derive_mapping(detection, valid_subcategories) + for ai_system, matched_sources in matched_by_ai_system.items(): + key = (ai_system, name) + data_sources_by_key[key].update(matched_sources) + rows_by_key[key] = { + "ai_system": ai_system, + "data_sources": "", + "detection_name": name, + "detection_status": status, + "detection_type": str(detection.get("type", "")).strip(), + "analytic_stories": "|".join(story_values), + "rmf_function": rmf_function, + "subcategory_ids": "|".join(subcategory_ids), + "mapping_confidence": confidence, + "mapping_source": "generated_rule" if confidence != "review" else "generated_review", + "mapping_reason": reason, + } + + rows = list(rows_by_key.values()) + for row in rows: + key = (row["ai_system"], row["detection_name"]) + row["data_sources"] = "|".join(sorted(data_sources_by_key[key], key=str.casefold)) + rows.sort(key=lambda row: (row["ai_system"].casefold(), row["data_sources"].casefold(), row["detection_name"].casefold())) + return rows + + +def render_csv(rows: list[dict[str, str]]) -> str: + output = io.StringIO() + writer = csv.DictWriter(output, fieldnames=FIELDNAMES, lineterminator="\n") + writer.writeheader() + writer.writerows(rows) + return output.getvalue() + + +def write_csv_if_changed(content: str, output: Path | None) -> bool: + if output is None: + sys.stdout.write(content) + return True + + output.parent.mkdir(parents=True, exist_ok=True) + if output.exists() and output.read_text(encoding="utf-8") == content: + return False + + with output.open("w", newline="", encoding="utf-8") as handle: + handle.write(content) + return True + + +def validate_modified_date(value: str | None) -> str: + if value is None: + return date.today().isoformat() + if not re.fullmatch(r"\d{4}-\d{2}-\d{2}", value): + raise ValueError("--modified-date must use YYYY-MM-DD format") + return value + + +def bump_lookup_metadata(path: Path, modification_date: str) -> int: + metadata = load_yaml(path) + try: + version = int(metadata.get("version", 0)) + except (TypeError, ValueError) as exc: + raise ValueError(f"{path}: version must be an integer") from exc + + metadata["version"] = version + 1 + metadata["modification_date"] = modification_date + + with path.open("w", encoding="utf-8", newline="\n") as handle: + yaml.safe_dump(metadata, handle, sort_keys=False, width=120) + return metadata["version"] + + +def main() -> int: + args = parse_args() + selectors = load_selectors(args.config, args.data_source) + valid_subcategories = load_valid_subcategories(args.rmf_lookup) + rows = rows_from_detections(args.detections_dir, selectors, valid_subcategories, args.include_deprecated) + + if not rows: + raise ValueError("No detection mappings were generated. Check the configured data source names.") + + csv_content = render_csv(rows) + output_changed = write_csv_if_changed(csv_content, None if args.dry_run else args.output) + + message = f"Generated {len(rows)} detection mappings from {len(selectors)} data source selectors." + review_rows = [row for row in rows if row["mapping_source"] == "generated_review"] + if review_rows: + message += f" {len(review_rows)} mapping(s) need manual review:" + for row in review_rows: + message += f"\n - {row['ai_system']}: {row['detection_name']} — {row['mapping_reason']}" + else: + message += " No mappings need manual review." + if not args.dry_run: + if output_changed and not args.no_metadata_update: + new_version = bump_lookup_metadata(args.metadata, validate_modified_date(args.modified_date)) + message += f" {args.metadata} bumped to version {new_version}." + elif output_changed: + message += " Output changed; metadata update skipped." + else: + message += " Output unchanged." + + print(message, file=sys.stderr) + return 0 + + +if __name__ == "__main__": + try: + raise SystemExit(main()) + except Exception as exc: + print(f"error: {exc}", file=sys.stderr) + raise SystemExit(1) diff --git a/scripts/nist_dashboard/nist_ai_rmf_data_sources.yml b/scripts/nist_dashboard/nist_ai_rmf_data_sources.yml new file mode 100644 index 00000000000..d20b0d09ce4 --- /dev/null +++ b/scripts/nist_dashboard/nist_ai_rmf_data_sources.yml @@ -0,0 +1,43 @@ +data_sources: + - name: AWS Bedrock Claude + ai_system: AWS Bedrock Claude + + - name: M365 Exported eDiscovery Prompts + ai_system: M365 Copilot + + - name: M365 Copilot Graph API + ai_system: M365 Copilot + + - name: MCP Server + ai_system: MCP + + - name: Ollama Server + ai_system: Ollama + + - name: Cisco AI Defense Alerts + ai_system: Cisco AI Defense + + - name: Sysmon EventID 11 + ai_system: Local LLM Frameworks + analytic_stories: + - Suspicious Local LLM Frameworks + + - name: Sysmon EventID 22 + ai_system: Local LLM Frameworks + analytic_stories: + - Suspicious Local LLM Frameworks + + - name: Sysmon EventID 1 + ai_system: Local LLM Frameworks + analytic_stories: + - Suspicious Local LLM Frameworks + + - name: Windows Event Log Security 4688 + ai_system: Local LLM Frameworks + analytic_stories: + - Suspicious Local LLM Frameworks + + - name: CrowdStrike ProcessRollup2 + ai_system: Local LLM Frameworks + analytic_stories: + - Suspicious Local LLM Frameworks diff --git a/stories/abuse_of_genai_systems_and_applications.yml b/stories/abuse_of_genai_systems_and_applications.yml new file mode 100644 index 00000000000..872cc2f0b47 --- /dev/null +++ b/stories/abuse_of_genai_systems_and_applications.yml @@ -0,0 +1,23 @@ +name: Abuse of GenAI Systems and Applications +id: f79c6573-5550-4adc-b673-bb0d8c9e1df1 +version: 1 +creation_date: '2026-10-15' +modification_date: '2026-10-15' +author: Nasreddine Bencherchali, Splunk +status: production +description: |- + Detect and investigate threats targeting or abusing artificial intelligence systems, services and applications. + Coverage includes prompt injection, attempts to bypass model safeguards, repeated high-risk guardrail events, and possible sensitive data disclosure through model interactions. +narrative: |- + AI applications can expose sensitive information, invoke connected tools, or process untrusted prompts. Attackers and malicious insiders may try to override model instructions, extract restricted data, misuse AI-enabled tools, or repeatedly probe guardrails. + Use this story to investigate AI security events across model providers and application integrations. Review the affected application and connection, event action, prompt or response direction, policy, and guardrail categories. An allowed event can indicate exposure, while a blocked event records an attempt; neither alone confirms the full impact. Correlate high-risk events with identity, application, data access, and tool activity where those logs are available. +references: + - https://atlas.mitre.org/ + - https://owasp.org/www-project-top-10-for-large-language-model-applications/ +category: + - Adversary Tactics +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +usecase: Advanced Threat Detection