admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' into updates-june

Browse Source
This commit is contained in:
pyth0n1c
2025-06-17 11:54:36 -07:00
committed by GitHub
parent 437b5cf59c 669fedc667
commit 60656154e7
37 changed files with 840 additions and 403 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/cmd_carry_out_string_command_parameter.yml
+30 -29
View File
@@ -1,7 +1,7 @@
name: CMD Carry Out String Command Parameter
id: 54a6ed00-3256-11ec-b031-acde48001122
version: 11
date: '2025-05-06'
version: 12
date: '2025-05-26'
author: Teoderick Contreras, Bhavin Patel, Splunk
status: production
type: Hunting
@@ -17,14 +17,14 @@ data_source:
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_cmd` AND Processes.process IN ("*/c*", "*/k*")
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `cmd_carry_out_string_command_parameter_filter`'
as lastTime from datamodel=Endpoint.Processes where `process_cmd` AND Processes.process
IN ("*/c*", "*/k*") by Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmd_carry_out_string_command_parameter_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
@@ -41,27 +41,28 @@ references:
- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
tags:
analytic_story:
- Data Destruction
- DarkGate Malware
- Chaos Ransomware
- Hermetic Wiper
- Warzone RAT
- Winter Vivern
- ProxyNotShell
- IcedID
- Living Off The Land
- NjRAT
- Log4Shell CVE-2021-44228
- CISA AA23-347A
- AsyncRAT
- Rhysida Ransomware
- DarkCrystal RAT
- Crypto Stealer
- Azorult
- Qakbot
- RedLine Stealer
- PlugX
- Winter Vivern
- Rhysida Ransomware
- Malicious Inno Setup Loader
- DarkGate Malware
- ProxyNotShell
- Log4Shell CVE-2021-44228
- Azorult
- Living Off The Land
- Qakbot
- Chaos Ransomware
- IcedID
- Data Destruction
- Crypto Stealer
- WhisperGate
- NjRAT
- AsyncRAT
- CISA AA23-347A
- Hermetic Wiper
- RedLine Stealer
- DarkCrystal RAT
- Warzone RAT
asset_type: Endpoint
cve:
- CVE-2021-44228
detections/endpoint/cobalt_strike_named_pipes.yml
+28 -7
View File
@@ -1,7 +1,7 @@
name: Cobalt Strike Named Pipes
id: 5876d429-0240-4709-8b93-ea8330b411b5
version: 8
date: '2025-05-02'
version: 9
date: '2025-06-17'
author: Michael Haag, Splunk
status: production
type: TTP
@@ -16,12 +16,33 @@ description: The following analytic detects the use of default or publicly known
data_source:
- Sysmon EventID 17
- Sysmon EventID 18
search: '`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\DserNamePipe*,
\\srvsvc_*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*,
\\winsock*, \\UIA_PIPE*) | stats count min(_time) as firstTime max(_time) as lastTime
search: |
`sysmon` (EventID=17 OR EventID=18)
PipeName IN (
"\\DserNamePipe*",
"\\interprocess_*",
"\\lsarpc_*",
"\\mojo_*",
"\\msagent_*",
"\\MSSE-*",
"\\netlogon_*",
"\\ntsvcs*",
"\\postex_*",
"\\samr_*",
"\\spoolss_*",
"\\srvsvc_*",
"\\status_*",
"\\UIA_PIPE"*
"\\win_svc*",
"\\winsock*",
"\\wkssvc_*",
)
| stats count min(_time) as firstTime max(_time) as lastTime
by dest dvc pipe_name process_exec process_guid process_id process_name process_path
signature signature_id user_id vendor_product Image PipeName | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `cobalt_strike_named_pipes_filter`'
signature signature_id user_id vendor_product Image PipeName
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `cobalt_strike_named_pipes_filter`
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
detections/endpoint/detect_renamed_7_zip.yml
+3 -2
View File
@@ -1,7 +1,7 @@
name: Detect Renamed 7-Zip
id: 4057291a-b8cf-11eb-95fe-acde48001122
version: 9
date: '2025-05-02'
version: 10
date: '2025-06-02'
author: Michael Haag, Splunk
status: production
type: Hunting
@@ -43,6 +43,7 @@ references:
tags:
analytic_story:
- Collection and Staging
- Malicious Inno Setup Loader
asset_type: Endpoint
mitre_attack_id:
- T1560.001
detections/endpoint/detect_renamed_winrar.yml
+11 -9
View File
@@ -1,7 +1,7 @@
name: Detect Renamed WinRAR
id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122
version: 12
date: '2025-05-02'
version: 13
date: '2025-06-16'
author: Michael Haag, Splunk
status: production
type: Hunting
@@ -18,13 +18,15 @@ data_source:
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=WinRAR.exe
(Processes.process_name!=rar.exe OR Processes.process_name!=winrar.exe) by Processes.action
Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
(Processes.process_name!=rar.exe AND Processes.process_name!=winrar.exe)
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `detect_renamed_winrar_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
detections/endpoint/excessive_usage_of_cacls_app.yml
+43 -24
View File
@@ -1,37 +1,56 @@
name: Excessive Usage Of Cacls App
id: 0bdf6092-af17-11eb-939a-acde48001122
version: 8
date: '2025-05-02'
version: 9
date: '2025-06-17'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe`,
or `icacls.exe` to change file or folder permissions. It leverages data from Endpoint
Detection and Response (EDR) agents, focusing on process names and command-line
executions. This activity is significant as it may indicate an adversary attempting
to restrict access to malware components or artifacts on a compromised system. If
confirmed malicious, this behavior could prevent users from deleting or accessing
description: |
The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe`,
or `icacls.exe` to change file or folder permissions.
It looks for 10 or more execution of the aforementioned processes in the span of 1 minute.
It leverages data from Endpoint Detection and Response (EDR) agents,
focusing on process names and command-line executions.
This activity is significant as it may indicate an adversary attempting
to restrict access to malware components or artifacts on a compromised system.
If confirmed malicious, this behavior could prevent users from deleting or accessing
critical files, aiding in the persistence and concealment of malicious activities.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` values(Processes.dest) as dest
values(Processes.user) as user min(_time) as firstTime max(_time) as lastTime values(Processes.action)
as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process_exec)
as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid
values(Processes.parent_process_id) as parent_process_id values(Processes.parent_process_path)
as parent_process_path values(Processes.process) as process values(Processes.process_exec)
as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash)
as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level)
as process_integrity_level values(Processes.process_name) as process_name values(Processes.process_path)
as process_path values(Processes.user_id) as user_id values(Processes.vendor_product)
as vendor_product count from datamodel=Endpoint.Processes where Processes.process_name
= "cacls.exe" OR Processes.process_name = "icacls.exe" OR Processes.process_name
= "XCACLS.exe" by Processes.parent_process_name Processes.parent_process Processes.dest
Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_cacls_app_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
search: |
| tstats `security_content_summariesonly`
min(_time) as firstTime
max(_time) as lastTime
values(Processes.dest) as dest
values(Processes.user) as user
values(Processes.action) as action
values(Processes.original_file_name) as original_file_name
values(Processes.parent_process_exec) as parent_process_exec
values(Processes.parent_process_guid) as parent_process_guid
values(Processes.parent_process_id) as parent_process_id
values(Processes.parent_process_path) as parent_process_path
values(Processes.process) as process
values(Processes.process_exec) as process_exec
values(Processes.process_guid) as process_guid
values(Processes.process_hash) as process_hash
values(Processes.process_id) as process_id
values(Processes.process_integrity_level) as process_integrity_level
values(Processes.process_name) as process_name
values(Processes.process_path) as process_path
values(Processes.user_id) as user_id
values(Processes.vendor_product) as vendor_product count
from datamodel=Endpoint.Processes where
Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe")
by Processes.parent_process_name Processes.parent_process Processes.dest Processes.user _time span=1m
| where count >=10
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `excessive_usage_of_cacls_app_filter`
how_to_implement: |
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml
+4 -3
View File
@@ -1,7 +1,7 @@
name: Hiding Files And Directories With Attrib exe
id: 6e5a3ae4-90a3-462d-9aa6-0119f638c0f1
version: 12
date: '2025-05-02'
version: 13
date: '2025-05-26'
author: Bhavin Patel, Splunk
status: production
type: TTP
@@ -64,8 +64,9 @@ rba:
threat_objects: []
tags:
analytic_story:
- Azorult
- Windows Persistence Techniques
- Malicious Inno Setup Loader
- Azorult
- Compromised Windows Host
- Windows Defense Evasion Tactics
- Crypto Stealer
detections/endpoint/icacls_deny_command.yml
+21 -15
View File
@@ -1,11 +1,12 @@
name: Icacls Deny Command
id: cf8d753e-a8fe-11eb-8f58-acde48001122
version: 8
date: '2025-05-02'
version: 9
date: '2025-06-17'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects instances where an adversary modifies
type: Anomaly
description: |
The following analytic detects instances where an adversary modifies
security permissions of a file or directory using commands like "icacls.exe", "cacls.exe",
or "xcacls.exe" with deny options. It leverages data from Endpoint Detection and
Response (EDR) agents, focusing on process names and command-line executions. This
@@ -17,17 +18,22 @@ data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe",
"cacls.exe", "xcacls.exe") AND Processes.process IN ("*/deny*", "*/D*") by Processes.action
Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `icacls_deny_command_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
search: |
| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where
Processes.process_name IN ( "icacls.exe", "cacls.exe", "xcacls.exe") AND
Processes.process IN ("*/deny*", "*/d:*", "*/d ")
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `icacls_deny_command_filter`
how_to_implement: |
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
detections/endpoint/icacls_grant_command.yml
+20 -14
View File
@@ -1,11 +1,12 @@
name: ICACLS Grant Command
id: b1b1e316-accc-11eb-a9b4-acde48001122
version: 7
date: '2025-05-02'
version: 8
date: '2025-06-17'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of the ICACLS command to grant
description: |
The following analytic detects the use of the ICACLS command to grant
additional access permissions to files or directories. It leverages data from Endpoint
Detection and Response (EDR) agents, focusing on specific process names and command-line
arguments. This activity is significant because it is commonly used by Advanced
@@ -17,17 +18,22 @@ data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe",
"cacls.exe", "xcacls.exe") AND Processes.process IN ("*/grant*", "*/G*") by Processes.action
Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `icacls_grant_command_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
search: |
| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where
Processes.process_name IN ( "icacls.exe", "cacls.exe", "xcacls.exe") AND
Processes.process IN ("*/grant*", "*/g:*", "*/g *")
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `icacls_grant_command_filter`
how_to_implement: |
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
detections/endpoint/lolbas_with_network_traffic.yml
+42 -46
View File
@@ -1,12 +1,11 @@
name: LOLBAS With Network Traffic
id: 2820f032-19eb-497e-8642-25b04a880359
version: 10
date: '2025-05-19'
version: 11
date: '2025-05-26'
author: Steven Dick
status: production
type: TTP
description:
The following analytic identifies the use of Living Off the Land Binaries
description: The following analytic identifies the use of Living Off the Land Binaries
and Scripts (LOLBAS) with network traffic. It leverages data from the Network Traffic
data model to detect when native Windows binaries, often abused by adversaries,
initiate network connections. This activity is significant as LOLBAS are frequently
@@ -15,9 +14,8 @@ description:
to execute arbitrary code, escalate privileges, or maintain persistence within the
environment, posing a severe threat to organizational security.
data_source:
- Sysmon EventID 3
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
- Sysmon EventID 3
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Network_Traffic.All_Traffic where (All_Traffic.app IN
("*Regsvcs.exe", "*\\Ftp.exe", "*OfflineScannerShell.exe", "*Rasautou.exe", "*Schtasks.exe",
"*Xwizard.exe", "*Pnputil.exe", "*Atbroker.exe", "*Pcwrun.exe", "*Ttdinject.exe",
@@ -36,61 +34,59 @@ search:
All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product
| `drop_dm_object_name(All_Traffic)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| rex field=app ".*\\\(?<process_name>.*)$" | `lolbas_with_network_traffic_filter`'
how_to_implement:
To successfully implement this detection you must ingest events
how_to_implement: To successfully implement this detection you must ingest events
into the Network traffic data model that contain the source, destination, and communicating
process in the app field. Relevant processes must also be ingested in the Endpoint
data model with matching process_id field. Sysmon EID1 and EID3 are good examples
of this type this data type.
known_false_positives:
Legitimate usage of internal automation or scripting, especially
known_false_positives: Legitimate usage of internal automation or scripting, especially
powershell.exe or pwsh.exe, internal to internal or logon scripts. It may be necessary
to omit internal IP ranges if extremely noisy. ie NOT dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","170.98.0.0/16","0:0:0:0:0:0:0:1")
references:
- https://lolbas-project.github.io/#
- https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/
- https://lolbas-project.github.io/#
- https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/
drilldown_searches:
- name: View the detection results for - "$src$"
search: '%original_detection_search% | search src = "$src$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$src$"
search:
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View the detection results for - "$src$"
search: '%original_detection_search% | search src = "$src$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$src$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: The LOLBAS $process_name$ on device $src$ was seen communicating with $dest$.
risk_objects:
- field: src
type: system
score: 25
- field: src
type: system
score: 25
threat_objects:
- field: dest_ip
type: ip_address
- field: dest_ip
type: ip_address
tags:
analytic_story:
- Living Off The Land
- Water Gamayun
- Fake CAPTCHA Campaigns
- Fake CAPTCHA Campaigns
- Living Off The Land
- Malicious Inno Setup Loader
- Water Gamayun
asset_type: Endpoint
mitre_attack_id:
- T1105
- T1567
- T1218
- T1105
- T1567
- T1218
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: network
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/modify_acl_permission_to_files_or_folder.yml
+23 -16
View File
@@ -1,7 +1,7 @@
name: Modify ACL permission To Files Or Folder
id: 7e8458cc-acca-11eb-9e3f-acde48001122
version: 8
date: '2025-05-02'
version: 9
date: '2025-06-17'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -17,20 +17,27 @@ data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "cacls.exe"
OR Processes.process_name = "icacls.exe" OR Processes.process_name = "xcacls.exe")
AND Processes.process = "*/G*" AND (Processes.process = "* everyone:*" OR Processes.process
= "* SYSTEM:*" OR Processes.process = "* S-1-1-0:*") by Processes.action Processes.dest
Processes.original_file_name Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `modify_acl_permission_to_files_or_folder_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
search: |
| tstats `security_content_summariesonly` count
min(_time) as firstTime
max(_time) as lastTime
values(Processes.process) as process
values(Processes.process_id) as process_id
from datamodel=Endpoint.Processes where
Processes.process_name IN ("icacls.exe", "cacls.exe", "xcacls.exe")
Processes.process IN ("*/grant*", "*/g:*", "*/g *")
Processes.process IN ("* Everyone:*", "* SYSTEM:*", "* S-1-1-0:*")
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `modify_acl_permission_to_files_or_folder_filter`
how_to_implement: |
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
you must ingest logs that contain the process GUID, process name, and parent process.
detections/endpoint/network_traffic_to_active_directory_web_services_protocol.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Network Traffic to Active Directory Web Services Protocol
id: 68a0056c-34cb-455f-b03d-df935ea62c4f
version: 8
date: '2025-05-02'
version: 9
date: '2025-06-17'
author: Michael Haag, Splunk
status: production
type: Hunting
@@ -30,7 +30,7 @@ how_to_implement: The detection is based on data that originates from network tr
known_false_positives: False positives should be limited as the destination port is
specific to Active Directory Web Services Protocol, however we recommend utilizing
this analytic to hunt for non-standard processes querying the ADWS port. Filter
by App or dest_ip to AD servers and remove known proceses querying ADWS.
by App or dest_ip to AD servers and remove known processes querying ADWS.
references:
- https://github.com/FalconForceTeam/SOAPHound
tags:
detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
+8 -6
View File
@@ -1,7 +1,7 @@
name: Non Chrome Process Accessing Chrome Default Dir
id: 81263de4-160a-11ec-944f-acde48001122
version: 10
date: '2025-05-02'
version: 11
date: '2025-05-25'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -15,10 +15,11 @@ description: The following analytic detects a non-Chrome process accessing files
and further compromise of the affected system.
data_source:
- Windows Event Log Security 4663
search: '`wineventlog_security` EventCode=4663 NOT (ProcessName IN ("*\\chrome.exe",
"*\\explorer.exe", "*sql*")) ObjectName="*\\Google\\Chrome\\User Data\\Default*"
| stats count min(_time) as firstTime max(_time) as lastTime by ObjectName ObjectType
ProcessName AccessMask EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
search: '`wineventlog_security` EventCode=4663
NOT (ProcessName IN ("*\\chrome.exe", "*\\explorer.exe", "*sql*", "*\\dllhost.exe")) ObjectName="*\\Google\\Chrome\\User Data\\Default*"
| stats count min(_time) as firstTime max(_time) as lastTime by ObjectName ObjectType ProcessName AccessMask EventCode dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `non_chrome_process_accessing_chrome_default_dir_filter`'
how_to_implement: To successfully implement this search, you must ingest Windows Security
Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
@@ -63,6 +64,7 @@ tags:
- 3CX Supply Chain Attack
- DarkGate Malware
- NjRAT
- Malicious Inno Setup Loader
asset_type: Endpoint
mitre_attack_id:
- T1555.003
detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
+17 -16
View File
@@ -1,7 +1,7 @@
name: Non Firefox Process Access Firefox Profile Dir
id: e6fc13b0-1609-11ec-b533-acde48001122
version: 9
date: '2025-05-02'
version: '10'
date: '2025-05-26'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -48,21 +48,22 @@ rba:
threat_objects: []
tags:
analytic_story:
- AgentTesla
- Snake Keylogger
- CISA AA23-347A
- China-Nexus Threat Activity
- Remcos
- FIN7
- Phemedrone Stealer
- SnappyBee
- Azorult
- RedLine Stealer
- Warzone RAT
- Salt Typhoon
- 3CX Supply Chain Attack
- DarkGate Malware
- NjRAT
- Snake Keylogger
- AgentTesla
- DarkGate Malware
- China-Nexus Threat Activity
- 3CX Supply Chain Attack
- Malicious Inno Setup Loader
- CISA AA23-347A
- Phemedrone Stealer
- Azorult
- Remcos
- RedLine Stealer
- Salt Typhoon
- Warzone RAT
- SnappyBee
- FIN7
asset_type: Endpoint
mitre_attack_id:
- T1555.003
detections/endpoint/recon_using_wmi_class.yml
+6 -5
View File
@@ -1,7 +1,7 @@
name: Recon Using WMI Class
id: 018c1972-ca07-11eb-9473-acde48001122
version: 7
date: '2025-05-02'
version: '8'
date: '2025-05-26'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -65,12 +65,13 @@ rba:
tags:
analytic_story:
- AsyncRAT
- Qakbot
- Industroyer2
- Hermetic Wiper
- LockBit Ransomware
- Malicious PowerShell
- Malicious Inno Setup Loader
- Hermetic Wiper
- Data Destruction
- Qakbot
- Industroyer2
- MoonPeak
asset_type: Endpoint
mitre_attack_id:
detections/endpoint/suspicious_copy_on_system32.yml
+41 -24
View File
@@ -1,38 +1,55 @@
name: Suspicious Copy on System32
id: ce633e56-25b2-11ec-9e76-acde48001122
version: 10
date: '2025-05-02'
author: Teoderick Contreras, Splunk
version: 11
date: '2025-06-17'
author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
status: production
type: TTP
description:
The following analytic detects suspicious file copy operations from the
System32 or SysWow64 directories, often indicative of malicious activity. It leverages
data from Endpoint Detection and Response (EDR) agents, focusing on processes initiated
by command-line tools like cmd.exe or PowerShell. This behavior is significant as
it may indicate an attempt to execute malicious code using legitimate system tools
(LOLBIN). If confirmed malicious, this activity could allow an attacker to execute
arbitrary code, potentially leading to system compromise or further lateral movement
type: Anomaly
description: |
The following analytic detects potentially suspicious file copy operations targeting the
System32 or SysWow64 directories as source, often indicative of malicious activity.
It leverages data from Endpoint Detection and Response (EDR) agents,
focusing on activity initiated by command-line tools like cmd.exe or PowerShell.
This behavior is significant as it may indicate an attempt to evade defenses by copying
an existing binary from the system directory and renaming it.
If confirmed malicious, this activity could allow an attacker to execute
code undetected and potentially leading to system compromise or further lateral movement
within the network.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search:
'| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe")
AND `process_copy` AND Processes.process IN("*\\Windows\\System32\\*", "*\\Windows\\SysWow64\\*")
AND Processes.process = "*copy*" by Processes.action Processes.dest Processes.original_file_name
search: |
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where
Processes.parent_process_name IN (
"cmd.exe",
"powershell_ise.exe",
"powershell.exe",
"pwsh.exe",
"sqlps.exe",
"sqltoolsps.exe"
)
`process_copy`
Processes.process IN (
"* \"C:\\Windows\\System32\\*",
"* \'C:\\Windows\\System32\\*",
"* C:\\Windows\\System32\\*",
"* \"C:\\Windows\\SysWow64\\*",
"* \'C:\\Windows\\SysWow64\\*",
"* C:\\Windows\\SysWow64\\*"
)
by Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
| eval splitted_commandline=split(process," ") | eval first_cmdline=lower(mvindex(splitted_commandline,0))
| where NOT LIKE(first_cmdline,"%\\windows\\system32\\%") AND NOT LIKE(first_cmdline,"%\\windows\\syswow64\\%")
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |`suspicious_copy_on_system32_filter`'
how_to_implement:
Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `suspicious_copy_on_system32_filter`
how_to_implement: |
The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
@@ -42,7 +59,7 @@ how_to_implement:
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
data model. Use the Splunk Common Information Model (CIM) to normalize the field
names and speed up the data modeling process.
known_false_positives: every user may do this event but very un-ussual.
known_false_positives: Copying files from System directories can happen for multiple admin reasons, allbeit rare without approval. Apply additional filters where needed.
references:
- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
+15 -14
View File
@@ -1,7 +1,7 @@
name: Suspicious Scheduled Task from Public Directory
id: 7feb7972-7ac3-11eb-bac8-acde48001122
version: '12'
date: '2025-05-06'
version: '13'
date: '2025-05-26'
author: Michael Haag, Splunk
status: production
type: Anomaly
@@ -69,21 +69,22 @@ rba:
threat_objects: []
tags:
analytic_story:
- CISA AA24-241A
- CISA AA23-347A
- Medusa Ransomware
- China-Nexus Threat Activity
- Scheduled Tasks
- Windows Persistence Techniques
- Living Off The Land
- Ryuk Ransomware
- Salt Typhoon
- Ransomware
- DarkCrystal RAT
- China-Nexus Threat Activity
- Windows Persistence Techniques
- Ryuk Ransomware
- Medusa Ransomware
- Malicious Inno Setup Loader
- CISA AA23-347A
- Azorult
- MoonPeak
- XWorm
- Living Off The Land
- Crypto Stealer
- Salt Typhoon
- XWorm
- CISA AA24-241A
- Scheduled Tasks
- Ransomware
- MoonPeak
asset_type: Endpoint
mitre_attack_id:
- T1053.005
detections/endpoint/windows_chromium_browser_no_security_sandbox_process.yml
+77
View File
@@ -0,0 +1,77 @@
name: Windows Chromium Browser No Security Sandbox Process
id: 314cb263-7eeb-4d45-b693-bb21699c73d2
version: 1
date: '2025-05-26'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: |
The following analytic detects instances where a Chrome or Chromium-based browser is launched with the --no-sandbox flag, a known indicator of potentially malicious or suspicious behavior. While this flag is occasionally used during software development or testing, it is rarely seen in normal user activity. Threat actors often abuse this setting to disable Chrome's built-in security sandbox, making it easier to execute malicious code or escape browser isolation. This behavior is commonly observed in malware droppers or loaders that embed Chromium components for command and control, credential theft, or UI spoofing. Analysts should investigate such events, especially if they originate from unusual parent processes (e.g., powershell.exe, cmd.exe, or unknown binaries), or if accompanied by other indicators such as file drops, process injection, or outbound network activity. Filtering by command-line arguments and process ancestry can help reduce false positives and surface high-fidelity detections.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: |
| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where
Processes.process_name IN ("Chrome.exe","Brave.exe", "Opera.exe", "Vivaldi.exe", "msedge.exe")
Processes.process = "*--no-sandbox*"
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_chromium_browser_no_security_sandbox_process_filter`
how_to_implement: |
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Administrators may enable or disable this feature that may
cause some false positive.
references:
- https://unix.stackexchange.com/questions/68832/what-does-the-chromium-option-no-sandbox-mean
drilldown_searches:
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A chromium process with the --no-sandbox flag was launched on $dest$ by user $user$.
risk_objects:
- field: dest
type: system
score: 60
threat_objects:
- field: parent_process_name
type: parent_process_name
tags:
analytic_story:
- Malicious Inno Setup Loader
asset_type: Endpoint
mitre_attack_id:
- T1497
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1497/chrom_no_sandbox/chrome-no_sandbox.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_chromium_browser_with_custom_user_data_directory.yml
+78
View File
@@ -0,0 +1,78 @@
name: Windows Chromium Browser with Custom User Data Directory
id: 4f546cf4-15aa-4368-80f7-940e92bc551e
version: 1
date: '2025-05-26'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
The following analytic detects instances where the Chromium-based browser (e.g., Google Chrome, Microsoft Edge) is launched with the --user-data-dir command-line argument. While this flag is legitimate and used for multi-profile support or automation, it is frequently leveraged by malware and adversaries to run Chrome in an isolated environment for stealth operations, credential harvesting, phishing delivery, or evasion of user session artifacts.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: |
| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where
Processes.process_name IN ("Chrome.exe","Brave.exe", "Opera.exe", "Vivaldi.exe", "msedge.exe")
Processes.process = "*--user-data-dir*"
Processes.process IN ("*--disable-gpu*", "*--disable-3d-apis*")
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_chromium_browser_with_custom_user_data_directory_filter`
how_to_implement: |
To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Administrators may enable or disable this feature that may
cause some false positive.
references:
- https://chromium.googlesource.com/chromium/src/+/main/docs/user_data_dir.md
drilldown_searches:
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: A chromium process with the --user-data-dir flag was launched on $dest$ by user $user$.
risk_objects:
- field: dest
type: system
score: 40
threat_objects:
- field: parent_process_name
type: parent_process_name
tags:
analytic_story:
- Malicious Inno Setup Loader
asset_type: Endpoint
mitre_attack_id:
- T1497
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1497/chrom_no_sandbox/chrome-no_sandbox.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_credential_access_from_browser_password_store.yml
+7 -6
View File
@@ -1,7 +1,7 @@
name: Windows Credential Access From Browser Password Store
id: 72013a8e-5cea-408a-9d51-5585386b4d69
version: 11
date: '2025-05-02'
version: 12
date: '2025-05-26'
author: Teoderick Contreras, Bhavin Patel Splunk
data_source:
- Windows Event Log Security 4663
@@ -60,15 +60,16 @@ rba:
threat_objects: []
tags:
analytic_story:
- Meduza Stealer
- Snake Keylogger
- China-Nexus Threat Activity
- SnappyBee
- Meduza Stealer
- Malicious Inno Setup Loader
- Earth Alux
- PXA Stealer
- Salt Typhoon
- MoonPeak
- Braodo Stealer
- Earth Alux
- SnappyBee
- MoonPeak
asset_type: Endpoint
mitre_attack_id:
- T1012
detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml
+9 -9
View File
@@ -1,7 +1,7 @@
name: Windows Credentials from Password Stores Chrome Extension Access
id: 2e65afe0-9a75-4487-bd87-ada9a9f1b9af
version: 6
date: '2025-05-02'
version: 7
date: '2025-05-26'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -53,13 +53,14 @@ rba:
tags:
analytic_story:
- DarkGate Malware
- CISA AA23-347A
- Amadey
- RedLine Stealer
- Phemedrone Stealer
- MoonPeak
- Braodo Stealer
- Meduza Stealer
- Malicious Inno Setup Loader
- Phemedrone Stealer
- CISA AA23-347A
- RedLine Stealer
- Braodo Stealer
- MoonPeak
asset_type: Endpoint
mitre_attack_id:
- T1012
@@ -71,7 +72,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/browser_ext_access/security-ext-raw.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/browser_ext_access/security-ext-raw.log
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml
+16 -15
View File
@@ -1,7 +1,7 @@
name: Windows Credentials from Password Stores Chrome LocalState Access
id: 3b1d09a8-a26f-473e-a510-6c6613573657
version: 11
date: '2025-05-02'
version: 12
date: '2025-05-26'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -51,21 +51,22 @@ rba:
threat_objects: []
tags:
analytic_story:
- Meduza Stealer
- Snake Keylogger
- China-Nexus Threat Activity
- Phemedrone Stealer
- SnappyBee
- PXA Stealer
- RedLine Stealer
- Warzone RAT
- Salt Typhoon
- DarkGate Malware
- MoonPeak
- Braodo Stealer
- Amadey
- NjRAT
- Snake Keylogger
- DarkGate Malware
- China-Nexus Threat Activity
- Meduza Stealer
- Amadey
- Malicious Inno Setup Loader
- Phemedrone Stealer
- Earth Alux
- RedLine Stealer
- PXA Stealer
- Salt Typhoon
- Braodo Stealer
- Warzone RAT
- SnappyBee
- MoonPeak
asset_type: Endpoint
mitre_attack_id:
- T1012
detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml
+16 -15
View File
@@ -1,7 +1,7 @@
name: Windows Credentials from Password Stores Chrome Login Data Access
id: 0d32ba37-80fc-4429-809c-0ba15801aeaf
version: 11
date: '2025-05-02'
version: 12
date: '2025-05-26'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -52,21 +52,22 @@ rba:
threat_objects: []
tags:
analytic_story:
- Meduza Stealer
- Snake Keylogger
- China-Nexus Threat Activity
- Phemedrone Stealer
- SnappyBee
- PXA Stealer
- RedLine Stealer
- Warzone RAT
- Salt Typhoon
- DarkGate Malware
- MoonPeak
- Braodo Stealer
- Amadey
- NjRAT
- Snake Keylogger
- DarkGate Malware
- China-Nexus Threat Activity
- Meduza Stealer
- Amadey
- Malicious Inno Setup Loader
- Phemedrone Stealer
- Earth Alux
- RedLine Stealer
- PXA Stealer
- Salt Typhoon
- Braodo Stealer
- Warzone RAT
- SnappyBee
- MoonPeak
asset_type: Endpoint
mitre_attack_id:
- T1012
detections/endpoint/windows_disable_internet_explorer_addons.yml
+77
View File
@@ -0,0 +1,77 @@
name: Windows Disable Internet Explorer Addons
id: 65224d8b-b95d-44ec-bb44-408d830c1258
version: 1
date: '2025-05-26'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
The following analytic detects the execution of iexplore.exe (Internet Explorer) with the -extoff command-line flag, which disables all browser extensions. This flag is commonly abused by adversaries to launch a clean browser session that bypasses security controls such as antivirus browser extensions, toolbars, or group policy-enforced add-ons.
Malicious documents or scripts may leverage iexplore.exe -extoff to open phishing pages, command-and-control interfaces, or download additional payloads in an environment free from security monitoring plugins. While this flag may be used legitimately by IT administrators for troubleshooting purposes, its use in modern enterprise environments is rare and should be considered suspicious—particularly when launched by Office applications, scripting engines (e.g., PowerShell, WScript), or scheduled tasks.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: |
| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where
(Processes.process_name = "iexplore.exe" OR Processes.original_file_name="IEXPLORE.EXE")
Processes.process = "*-extoff*"
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_disable_internet_explorer_addons_filter`
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Administrators may enable or disable this feature that may
cause some false positive.
references:
- https://www.hybrid-analysis.com/sample/e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875/588175f1aac2edf92bbed32f
drilldown_searches:
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: An iexplore.exe process with the -extoff flag was launched on $dest$ by user $user$.
risk_objects:
- field: dest
type: system
score: 40
threat_objects:
- field: parent_process_name
type: parent_process_name
tags:
analytic_story:
- Malicious Inno Setup Loader
asset_type: Endpoint
mitre_attack_id:
- T1176.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1176.001/disable_extension/iexplore-extoff.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml
+5 -4
View File
@@ -1,7 +1,7 @@
name: Windows DLL Search Order Hijacking Hunt with Sysmon
id: 79c7d1fc-64c7-91be-a616-ccda752efe81
version: 10
date: '2025-05-02'
version: 11
date: '2025-05-26'
author: Michael Haag, Splunk
status: production
type: Hunting
@@ -32,9 +32,10 @@ references:
- https://hijacklibs.net
tags:
analytic_story:
- Living Off The Land
- Windows Defense Evasion Tactics
- Qakbot
- Windows Defense Evasion Tactics
- Living Off The Land
- Malicious Inno Setup Loader
asset_type: Endpoint
mitre_attack_id:
- T1574.001
detections/endpoint/windows_dns_query_request_to_tinyurl.yml
+80
View File
@@ -0,0 +1,80 @@
name: Windows DNS Query Request To TinyUrl
id: b1ea79da-719c-437c-acaf-5c93f838f425
version: 1
date: '2025-06-02'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |
The following analytic detects a process located in a potentially suspicious location making DNS queries to known URL shortening services, specifically tinyurl.
URL shorteners are frequently used by threat actors to obfuscate malicious destinations, including phishing pages, malware distribution sites, or command-and-control (C2) endpoints.
While tinyurl.com is a legitimate service, its use in enterprise environments—particularly by non-browser processes or scripts—should be considered suspicious, especially if correlated with subsequent outbound connections, file downloads, process file path or credential prompts. Analysts should investigate the source process, execution context, and destination domain to determine intent and risk.
data_source:
- Sysmon EventID 22
search: |
`sysmon`
EventCode=22
QueryName = "tinyurl.com"
Image IN (
"*\\AppData\\*",
"*\\Perflogs\\*",
"*\\ProgramData\\*",
"*\\Temp\\*",
"*\\Users\\Public\\*",
"*\\Windows\\Tasks\\*"
)
| stats count min(_time) as firstTime max(_time) as lastTime
by answer answer_count dvc process_exec process_guid process_name query query_count
reply_code_id signature signature_id src user_id vendor_product QueryName QueryResults QueryStatus
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_dns_query_request_to_tinyurl_filter`
how_to_implement: |
This detection relies on sysmon logs with the Event ID 22, DNS Query.
We suggest you run this detection at least once a day over the last 14 days.
known_false_positives: |
Noise and false positive can be seen if the following instant
messaging is allowed to use within corporate network. In this case, a filter is needed.
references:
- https://x.com/Unit42_Intel/status/1919418143476199869
drilldown_searches:
- name: View the detection results for - "$dest$"
search: '%original_detection_search% | search dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
rba:
message: Suspicious process $process_name$ made a DNS query for $QueryName$ on $dvc$
risk_objects:
- field: dvc
type: system
score: 40
threat_objects:
- field: process_name
type: process_name
tags:
analytic_story:
- Malicious Inno Setup Loader
asset_type: Endpoint
mitre_attack_id:
- T1105
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/tinyurl_dns_query/tinyurl.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: XmlWinEventLog
detections/endpoint/windows_file_and_directory_permissions_enable_inheritance.yml
+3 -3
View File
@@ -3,9 +3,6 @@ id: 0247f90a-aca4-47b2-a94d-e30f445d7b41
version: 3
date: '2025-05-02'
author: Teoderick Contreras, Splunk
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
type: Hunting
status: production
description: The following analytic detects the enabling of permission inheritance
@@ -16,6 +13,9 @@ description: The following analytic detects the enabling of permission inheritan
can indicate legitimate administrative actions but may also signal attempts to override
restrictive custom permissions, potentially exposing sensitive files to unauthorized
access.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe",
"cacls.exe", "xcacls.exe") AND Processes.process = "*/inheritance:e*" by Processes.action
detections/endpoint/windows_files_and_dirs_access_rights_modification_via_icacls.yml
+21 -16
View File
@@ -1,15 +1,12 @@
name: Windows Files and Dirs Access Rights Modification Via Icacls
id: c76b796c-27e1-4520-91c4-4a58695c749e
version: 8
version: 9
date: '2025-05-02'
author: Teoderick Contreras, Splunk
status: production
type: TTP
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
description: The following analytic identifies the modification of security permissions
description: |
The following analytic identifies the modification of security permissions
on files or directories using tools like icacls.exe, cacls.exe, or xcacls.exe. It
leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific
command-line executions. This activity is significant as it is commonly used by
@@ -17,16 +14,24 @@ description: The following analytic identifies the modification of security perm
maintain control over compromised systems. If confirmed malicious, this behavior
could allow attackers to hinder investigation, impede remediation efforts, and maintain
persistent access to the compromised environment.
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe",
"cacls.exe","xcacls.exe") AND Processes.process IN ("*:R*", "*:W*", "*:F*", "*:C*",,
"*:N*","*/P*", "*/E*") by Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_files_and_dirs_access_rights_modification_via_icacls_filter`'
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: |
| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where
Processes.process_name IN ("icacls.exe", "cacls.exe","xcacls.exe") AND
Processes.process IN ("*:R*", "*:W*", "*:F*", "*:C*", "*:N*", "*/P*", "*/E*")
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_files_and_dirs_access_rights_modification_via_icacls_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection
and Response (EDR) agents. These agents are designed to provide security-related
telemetry from the endpoints where the agent is installed. To implement this search,
detections/endpoint/windows_hidden_schedule_task_settings.yml
+19 -14
View File
@@ -1,7 +1,7 @@
name: Windows Hidden Schedule Task Settings
id: 0b730470-5fe8-4b13-93a7-fe0ad014d0cc
version: 7
date: '2025-05-02'
version: 8
date: '2025-05-26'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -15,10 +15,15 @@ description: The following analytic detects the creation of hidden scheduled tas
malicious payloads.
data_source:
- Windows Event Log Security 4698
search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Hidden = true
| stats count min(_time) as firstTime max(_time) as lastTime by Task_Name, Command,
Author, Hidden, dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_hidden_schedule_task_settings_filter`'
search: |
`wineventlog_security`
EventCode=4698
TaskContent = "*&lt;Hidden&gt;true&lt;/Hidden&gt;*"
| stats count min(_time) as firstTime max(_time) as lastTime
by TaskName TaskContent action signature status dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_hidden_schedule_task_settings_filter`
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and
filter known instances of Task schedule used in your environment.
@@ -50,12 +55,13 @@ rba:
tags:
analytic_story:
- CISA AA22-257A
- Industroyer2
- Data Destruction
- Scheduled Tasks
- Compromised Windows Host
- Active Directory Discovery
- Malicious Inno Setup Loader
- Compromised Windows Host
- Data Destruction
- Industroyer2
- Cactus Ransomware
- Scheduled Tasks
asset_type: Endpoint
mitre_attack_id:
- T1053
@@ -67,7 +73,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053/hidden_schedule_task/security.log
source: WinEventLog:Security
sourcetype: WinEventLog
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053/hidden_schedule_task/inno_schtask.log
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml
+3 -2
View File
@@ -1,7 +1,7 @@
name: Windows Hijack Execution Flow Version Dll Side Load
id: 8351340b-ac0e-41ec-8b07-dd01bf32d6ea
version: '8'
date: '2025-05-06'
version: 9
date: '2025-05-26'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
@@ -53,6 +53,7 @@ tags:
analytic_story:
- Brute Ratel C4
- XWorm
- Malicious Inno Setup Loader
asset_type: Endpoint
mitre_attack_id:
- T1574.001
detections/endpoint/windows_scheduled_task_created_via_xml.yml
+3 -2
View File
@@ -1,7 +1,7 @@
name: Windows Scheduled Task Created Via XML
id: 7e03b682-3965-4598-8e91-a60a40a3f7e4
version: 8
date: '2025-05-02'
version: 9
date: '2025-05-26'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -69,6 +69,7 @@ rba:
tags:
analytic_story:
- Winter Vivern
- Malicious Inno Setup Loader
- CISA AA23-347A
- Scheduled Tasks
- MoonPeak
detections/endpoint/windows_suspicious_process_file_path.yml
+39 -38
View File
@@ -1,7 +1,7 @@
name: Windows Suspicious Process File Path
id: ecddae4e-3d4b-41e2-b3df-e46a88b38521
version: '12'
date: '2025-05-06'
version: 13
date: '2025-05-26'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -74,47 +74,48 @@ rba:
type: process_name
tags:
analytic_story:
- Meduza Stealer
- Phemedrone Stealer
- CISA AA23-347A
- China-Nexus Threat Activity
- Data Destruction
- Chaos Ransomware
- Handala Wiper
- Hermetic Wiper
- IcedID
- Swift Slicer
- PlugX
- BlackByte Ransomware
- Warzone RAT
- MoonPeak
- DarkGate Malware
- Prestige Ransomware
- AsyncRAT
- Double Zero Destructor
- RedLine Stealer
- Salt Typhoon
- Amadey
- AgentTesla
- Graceful Wipe Out Attack
- Water Gamayun
- ValleyRAT
- Earth Alux
- XWorm
- SnappyBee
- WhisperGate
- DarkCrystal RAT
- Azorult
- Brute Ratel C4
- Industroyer2
- Volt Typhoon
- Rhysida Ransomware
- LockBit Ransomware
- ValleyRAT
- Malicious Inno Setup Loader
- Double Zero Destructor
- Remcos
- XMRig
- SystemBC
- Qakbot
- Handala Wiper
- Trickbot
- DarkGate Malware
- China-Nexus Threat Activity
- Prestige Ransomware
- Amadey
- Phemedrone Stealer
- Earth Alux
- Azorult
- XMRig
- Qakbot
- XWorm
- Chaos Ransomware
- IcedID
- Graceful Wipe Out Attack
- Meduza Stealer
- LockBit Ransomware
- Volt Typhoon
- Data Destruction
- Salt Typhoon
- Brute Ratel C4
- WhisperGate
- Water Gamayun
- AgentTesla
- Swift Slicer
- SystemBC
- AsyncRAT
- CISA AA23-347A
- Hermetic Wiper
- RedLine Stealer
- DarkCrystal RAT
- Warzone RAT
- SnappyBee
- Industroyer2
- MoonPeak
asset_type: Endpoint
mitre_attack_id:
- T1543
detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml
+7 -6
View File
@@ -1,10 +1,8 @@
name: Windows Unsigned DLL Side-Loading In Same Process Path
id: 3cf85c02-f9d6-4186-bf3c-e70ee99fbc7f
version: '12'
date: '2025-05-06'
version: 13
date: '2025-05-26'
author: Teoderick Contreras, Splunk
data_source:
- Sysmon EventID 7
type: TTP
status: production
description: This detection identifies unsigned DLLs loaded through DLL side-loading
@@ -15,6 +13,8 @@ description: This detection identifies unsigned DLLs loaded through DLL side-loa
potential security breaches. Regular security assessments, thorough monitoring,
and implementing security best practices are essential in safeguarding systems from
such threats.
data_source:
- Sysmon EventID 7
search: '`sysmon` EventCode=7 Signed=false SignatureStatus != Valid NOT (Image IN
("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program Files*"))
NOT (ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*", "c:\\Program
@@ -55,12 +55,13 @@ rba:
threat_objects: []
tags:
analytic_story:
- PlugX
- DarkGate Malware
- China-Nexus Threat Activity
- Derusbi
- China-Nexus Threat Activity
- Malicious Inno Setup Loader
- Salt Typhoon
- XWorm
- PlugX
- SnappyBee
asset_type: Endpoint
mitre_attack_id:
detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
+18 -17
View File
@@ -1,7 +1,7 @@
name: WinEvent Scheduled Task Created Within Public Path
id: 5d9c6eee-988c-11eb-8253-acde48001122
version: '15'
date: '2025-05-06'
version: 16
date: '2025-05-26'
author: Michael Haag, Splunk
status: production
type: TTP
@@ -54,25 +54,26 @@ rba:
threat_objects: []
tags:
analytic_story:
- Compromised Windows Host
- CISA AA23-347A
- China-Nexus Threat Activity
- Data Destruction
- IcedID
- Medusa Ransomware
- Prestige Ransomware
- AsyncRAT
- Salt Typhoon
- Windows Persistence Techniques
- Winter Vivern
- Ransomware
- XWorm
- Industroyer2
- Active Directory Lateral Movement
- CISA AA22-257A
- Scheduled Tasks
- Ryuk Ransomware
- Medusa Ransomware
- Malicious Inno Setup Loader
- Compromised Windows Host
- China-Nexus Threat Activity
- Prestige Ransomware
- XWorm
- Ransomware
- Active Directory Lateral Movement
- IcedID
- Data Destruction
- Salt Typhoon
- Industroyer2
- CISA AA22-257A
- SystemBC
- AsyncRAT
- CISA AA23-347A
- Scheduled Tasks
asset_type: Endpoint
mitre_attack_id:
- T1053.005
detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
+14 -14
View File
@@ -1,7 +1,7 @@
name: WinEvent Windows Task Scheduler Event Action Started
id: b3632472-310b-11ec-9aab-acde48001122
version: 9
date: '2025-05-19'
version: 10
date: '2025-05-26'
author: Michael Haag, Splunk
status: production
type: Hunting
@@ -30,23 +30,24 @@ references:
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
tags:
analytic_story:
- Qakbot
- IcedID
- BlackSuit Ransomware
- Windows Persistence Techniques
- Prestige Ransomware
- DarkCrystal RAT
- AsyncRAT
- Winter Vivern
- IcedID
- CISA AA22-257A
- Industroyer2
- Sandworm Tools
- Data Destruction
- Amadey
- Scheduled Tasks
- CISA AA24-241A
- BlackSuit Ransomware
- AsyncRAT
- ValleyRAT
- SystemBC
- Malicious Inno Setup Loader
- Scheduled Tasks
- Data Destruction
- CISA AA24-241A
- DarkCrystal RAT
- Qakbot
- Sandworm Tools
- Industroyer2
asset_type: Endpoint
mitre_attack_id:
- T1053.005
@@ -58,7 +59,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data:
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_windows_task_scheduler_event_action_started/windows-xml.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_windows_task_scheduler_event_action_started/windows-xml.log
source: XmlWinEventLog:Microsoft-Windows-TaskScheduler/Operational
sourcetype: XmlWinEventLog
detections/network/suspicious_process_dns_query_known_abuse_web_services.yml
+8 -7
View File
@@ -1,7 +1,7 @@
name: Suspicious Process DNS Query Known Abuse Web Services
id: 3cf0dc36-484d-11ec-a6bc-acde48001122
version: 12
date: '2025-05-02'
version: 13
date: '2025-05-26'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -55,13 +55,14 @@ rba:
type: process_name
tags:
analytic_story:
- Data Destruction
- WhisperGate
- Remcos
- Phemedrone Stealer
- Snake Keylogger
- PXA Stealer
- Meduza Stealer
- Malicious Inno Setup Loader
- Phemedrone Stealer
- Remcos
- Data Destruction
- PXA Stealer
- WhisperGate
- Cactus Ransomware
asset_type: Endpoint
mitre_attack_id:
detections/network/windows_abused_web_services.yml
+3 -2
View File
@@ -1,7 +1,7 @@
name: Windows Abused Web Services
id: 01f0aef4-8591-4daa-a53d-0ed49823b681
version: 6
date: '2025-05-02'
version: 7
date: '2025-05-26'
author: Teoderick Contreras, Splunk
status: production
type: TTP
@@ -54,6 +54,7 @@ tags:
analytic_story:
- NjRAT
- CISA AA24-241A
- Malicious Inno Setup Loader
asset_type: Endpoint
mitre_attack_id:
- T1102
stories/malicious_inno_setup_loader.yml
+22
View File
@@ -0,0 +1,22 @@
name: Malicious Inno Setup Loader
id: ef8b2f11-fb0b-4acd-828c-83345e171b61
version: 1
date: '2025-05-25'
author: Teoderick Contreras, Splunk
status: production
description: |
Leverage searches that allow you to detect and investigate unusual activities that might relate to malicious Inno Setup-based loaders include monitoring unexpected process trees, script execution, and memory injection patterns originating from installer executables. Inno Setup is a widely used legitimate packaging tool, but its popularity and flexibility make it an attractive vehicle for malware delivery. Malicious actors abuse this framework to create installers that appear benign while hiding and executing embedded payloads. These loaders typically drop encrypted or obfuscated binaries to disk or inject them directly into memory without user consent. These components are typically executed via scripting (e.g., embedded PowerShell, VBScript) or injected directly into memory using process injection techniques like Process Hollowing, Thread Hijacking, or DLL Side-Loading. Some loaders include anti-analysis features such as sandbox evasion, VM detection, or delaying execution to avoid early sandbox detection. Their payloads can range from commodity malware (infostealers, keyloggers, remote access trojans) to custom backdoors.
narrative: |
Detecting malicious Inno Setup-based loaders involves identifying deviations from typical installer behavior. While legitimate Inno Setup binaries follow predictable installation patterns, malicious variants exhibit suspicious child process activity—such as launching cmd.exe, powershell.exe, or performing in-memory execution without dropping a visible payload. Analysts may observe payloads being written to temporary directories like %APPDATA%, %TEMP%, or %ProgramData%, followed by obfuscated execution mechanisms. Static analysis of the installer may reveal high-entropy sections, encrypted blobs, or anomalous script content embedded in the setup script. Behavioral analysis through EDR or sandboxing can further expose delayed execution, anti-VM logic, or environment fingerprinting techniques. Threat intelligence correlations—such as hashes, command-and-control domains, or loader-specific strings—can assist in clustering related loader campaigns. Detecting these loaders early is crucial, as they often serve as the initial access vector in multi-stage infection chains, enabling more severe intrusions or ransomware deployment.
references:
- https://x.com/Unit42_Intel/status/1919418143476199869
- https://www.esentire.com/blog/d3f-ck-loader-the-new-maas-loader
- https://tria.ge/241129-lgghqaxqgz
tags:
category:
- Malware
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
usecase: Advanced Threat Detection