Skip to content

Commit 281f8d2

Browse files
patel-bhavinpatel-bhavin
authored
Merge branch 'develop' into eventlog-stuff
2 parents 88d9ef4 + 5af5894 commit 281f8d2

23 files changed

Lines changed: 449 additions & 141 deletions

detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml renamed to detections/deprecated/certutil_download_with_urlcache_and_split_arguments.yml

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
name: CertUtil Download With URLCache and Split Arguments
22
id: 415b4306-8bfb-11eb-85c4-acde48001122
3-
version: 12
4-
date: '2025-04-16'
3+
version: 13
4+
date: '2025-04-24'
55
author: Michael Haag, Splunk
6-
status: production
6+
status: deprecated
77
type: TTP
8-
description: The following analytic detects the use of certutil.exe to download files
8+
description: This analytic has been deprecated in favor of "Windows CertUtil Download".
9+
The following analytic detects the use of certutil.exe to download files
910
using the `-urlcache` and `-f` arguments. It leverages Endpoint Detection and Response
1011
(EDR) data, focusing on command-line executions that include these specific arguments.
1112
This activity is significant because certutil.exe is typically used for certificate

detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml renamed to detections/deprecated/certutil_download_with_verifyctl_and_split_arguments.yml

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
name: CertUtil Download With VerifyCtl and Split Arguments
22
id: 801ad9e4-8bfb-11eb-8b31-acde48001122
3-
version: 12
4-
date: '2025-04-16'
3+
version: 13
4+
date: '2025-04-24'
55
author: Michael Haag, Splunk
6-
status: production
6+
status: deprecated
77
type: TTP
8-
description: The following analytic detects the use of `certutil.exe` to download
8+
description: This analytic has been deprecated in favor of "Windows CertUtil Download".
9+
The following analytic detects the use of `certutil.exe` to download
910
files using the `-VerifyCtl` and `-f` arguments. This behavior is identified by
1011
monitoring command-line executions for these specific arguments via Endpoint Detection
1112
and Response (EDR) telemetry. This activity is significant because `certutil.exe`

detections/endpoint/windows_certutil_download_with_url_argument.yml renamed to detections/deprecated/windows_certutil_download_with_url_argument.yml

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
name: Windows CertUtil Download With URL Argument
22
id: 4fc5ca00-4c7c-46b3-8772-c98a4b8bd944
3-
version: 5
4-
date: '2025-04-16'
3+
version: 6
4+
date: '2025-04-24'
55
author: Nasreddine Bencherchali, Splunk
6-
status: production
6+
status: deprecated
77
type: TTP
8-
description: The following analytic detects the use of `certutil.exe` to download
8+
description: This analytic has been deprecated in favor of "Windows CertUtil Download".
9+
The following analytic detects the use of `certutil.exe` to download
910
files using the `-URL` arguments. This behavior is identified by monitoring command-line
1011
executions for these specific arguments via Endpoint Detection and Response (EDR)
1112
telemetry. This activity is significant because `certutil.exe` is a legitimate tool

detections/endpoint/windows_remote_access_software_hunt.yml renamed to detections/deprecated/windows_remote_access_software_hunt.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
name: Windows Remote Access Software Hunt
22
id: 8bd22c9f-05a2-4db1-b131-29271f28cb0a
3-
version: 7
4-
date: '2025-04-18'
3+
version: 8
4+
date: '2025-04-30'
55
author: Michael Haag, Splunk
6-
status: production
6+
status: deprecated
77
type: Hunting
8-
description: The following analytic identifies the use of remote access software within
8+
description: This search is deprecated in favor of the new detection - Detect Remote Access Software Usage Process. The following analytic identifies the use of remote access software within
99
the environment. It leverages data from Endpoint Detection and Response (EDR) agents,
1010
focusing on process execution logs. This detection is significant as unauthorized
1111
remote access tools can be used by adversaries to maintain persistent access to

‎detections/endpoint/chcp_command_execution.yml‎

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
11
name: CHCP Command Execution
22
id: 21d236ec-eec1-11eb-b23e-acde48001122
3-
version: 6
4-
date: '2025-02-19'
3+
version: 7
4+
date: '2025-04-24'
55
author: Teoderick Contreras, Splunk
66
status: production
7-
type: TTP
8-
description: The following analytic detects the execution of the chcp.exe application,
7+
type: Anomaly
8+
description: The following analytic detects the execution of the chcp.com utility,
99
which is used to change the active code page of the console. This detection leverages
1010
data from Endpoint Detection and Response (EDR) agents, focusing on process creation
11-
events where chcp.exe is executed by cmd.exe with specific command-line arguments.
12-
This activity is significant because it can indicate the presence of malware, such
11+
events. This activity is significant because it can indicate the presence of malware, such
1312
as IcedID, which uses this technique to determine the locale region, language, or
1413
country of the compromised host. If confirmed malicious, this could lead to further
1514
system compromise and data exfiltration.
@@ -18,7 +17,6 @@ data_source:
1817
- CrowdStrike ProcessRollup2
1918
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
2019
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=chcp.com
21-
Processes.parent_process_name = cmd.exe (Processes.parent_process=*/c* OR Processes.parent_process=*/k*)
2220
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
2321
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
2422
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
@@ -35,8 +33,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D
3533
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
3634
data model. Use the Splunk Common Information Model (CIM) to normalize the field
3735
names and speed up the data modeling process.
38-
known_false_positives: other tools or script may used this to change code page to
39-
UTF-* or others
36+
known_false_positives: other tools or script may used this to change code page to UTF-* or others
4037
references:
4138
- https://ss64.com/nt/chcp.html
4239
- https://twitter.com/tccontre18/status/1419941156633329665?s=20

‎detections/endpoint/check_elevated_cmd_using_whoami.yml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,15 @@
11
name: Check Elevated CMD using whoami
22
id: a9079b18-1633-11ec-859c-acde48001122
3-
version: 6
4-
date: '2024-11-13'
3+
version: 7
4+
date: '2025-04-24'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: TTP
8-
description: The following analytic identifies the execution of the 'whoami' command
9-
with specific parameters to check for elevated privileges. It leverages data from
8+
description: The following analytic identifies the execution of the "whoami" command
9+
with the "/group" flag, where the results are passed to the "find" command in order
10+
to look for a the string "12288". This string represents the SID of the group
11+
"Mandatory Label\High Mandatory Level" effectively checking if the current process
12+
is running as a "High" integrity process or with Administrator privileges. It leverages data from
1013
Endpoint Detection and Response (EDR) agents, focusing on process and command-line
1114
telemetry. This activity is significant because it is commonly used by attackers,
1215
such as FIN7, to perform reconnaissance on a compromised host. If confirmed malicious,
@@ -35,7 +38,7 @@ how_to_implement: The detection is based on data that originates from Endpoint D
3538
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
3639
data model. Use the Splunk Common Information Model (CIM) to normalize the field
3740
names and speed up the data modeling process.
38-
known_false_positives: unknown
41+
known_false_positives: The combination of these commands is unlikely to occur in a production environment. Any matches should be investigated.
3942
references: []
4043
drilldown_searches:
4144
- name: View the detection results for - "$dest$" and "$user$"

‎detections/endpoint/detect_remote_access_software_usage_process.yml‎

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,38 @@
11
name: Detect Remote Access Software Usage Process
22
id: ffd5e001-2e34-48f4-97a2-26dc4bb08178
3-
version: 8
4-
date: '2025-04-18'
5-
author: Steven Dick
3+
version: 9
4+
date: '2025-04-30'
5+
author: Steven Dick, Sebastian Wurl, Splunk Community
66
status: production
77
type: Anomaly
88
description: The following analytic detects the execution of known remote access software
99
within the environment. It leverages data from Endpoint Detection and Response (EDR)
1010
agents, focusing on process names and parent processes mapped to the Endpoint data
11-
model. This activity is significant as adversaries often use remote access tools
12-
like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access.
11+
model. We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access.
1312
If confirmed malicious, this could allow attackers to control systems remotely,
1413
exfiltrate data, or deploy additional malware, posing a severe threat to the organization's
1514
security.
1615
data_source:
1716
- Sysmon EventID 1
1817
- Windows Event Log Security 4688
1918
- CrowdStrike ProcessRollup2
20-
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
21-
as lastTime values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes
22-
where Processes.dest!=unknown Processes.process!=unknown by Processes.action Processes.dest
23-
Processes.original_file_name Processes.parent_process Processes.parent_process_exec
24-
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
25-
Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
26-
Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
27-
Processes.process_path Processes.user Processes.user_id Processes.vendor_product
28-
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)`
29-
| lookup remote_access_software remote_utility AS process_name OUTPUT isutility,
30-
description as signature, comment_reference as desc, category | search isutility
31-
= True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_process_filter`'
19+
search: |
20+
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.parent_process) as parent_process
21+
from datamodel=Endpoint.Processes
22+
where
23+
[| inputlookup remote_access_software where isutility=TRUE
24+
| rename remote_utility AS Processes.process_name
25+
| fields Processes.process_name]
26+
AND Processes.dest!="unknown"
27+
AND Processes.user!="unknown"
28+
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
29+
| `security_content_ctime(firstTime)`
30+
| `security_content_ctime(lastTime)`
31+
| `drop_dm_object_name(Processes)`
32+
| lookup remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category
33+
| search isutility = TRUE
34+
| `remote_access_software_usage_exceptions`
35+
| `detect_remote_access_software_usage_process_filter`
3236
how_to_implement: The detection is based on data that originates from Endpoint Detection
3337
and Response (EDR) agents. These agents are designed to provide security-related
3438
telemetry from the endpoints where the agent is installed. To implement this search,
@@ -107,3 +111,6 @@ tests:
107111
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/screenconnect/screenconnect_sysmon.log
108112
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
109113
sourcetype: XmlWinEventLog
114+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/atomic_red_team/windows-sysmon.log
115+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
116+
sourcetype: XmlWinEventLog

‎detections/endpoint/detection_of_tools_built_by_nirsoft.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
name: Detection of tools built by NirSoft
22
id: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0
3-
version: 7
4-
date: '2024-11-13'
3+
version: 8
4+
date: '2025-04-24'
55
author: Bhavin Patel, Splunk
66
status: experimental
7-
type: TTP
7+
type: Anomaly
88
description: The following analytic identifies the execution of tools built by NirSoft
99
by detecting specific command-line arguments such as "/stext" and "/scomma". It
1010
leverages data from Endpoint Detection and Response (EDR) agents, focusing on process
@@ -37,10 +37,10 @@ how_to_implement: The detection is based on data that originates from Endpoint D
3737
data model. Use the Splunk Common Information Model (CIM) to normalize the field
3838
names and speed up the data modeling process.
3939
known_false_positives: While legitimate, these NirSoft tools are prone to abuse. You
40-
should verfiy that the tool was used for a legitimate purpose.
40+
should verify that the tool was used for a legitimate purpose.
4141
references: []
4242
rba:
43-
message: NirSoft tools detected on $dest$
43+
message: NirSoft tool detected on $dest$
4444
risk_objects:
4545
- field: user
4646
type: user

‎detections/endpoint/excessive_number_of_taskhost_processes.yml‎

Lines changed: 45 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
name: Excessive number of taskhost processes
22
id: f443dac2-c7cf-11eb-ab51-acde48001122
3-
version: 7
4-
date: '2024-11-13'
3+
version: 8
4+
date: '2025-04-25'
55
author: Michael Hart
66
status: production
77
type: Anomaly
8-
description: The following analytic identifies an excessive number of taskhost.exe
8+
description:
9+
The following analytic identifies an excessive number of taskhost.exe
910
and taskhostex.exe processes running within a short time frame. It leverages data
1011
from Endpoint Detection and Response (EDR) agents, focusing on process names and
1112
their counts. This behavior is significant as it is commonly associated with post-exploitation
@@ -14,10 +15,11 @@ description: The following analytic identifies an excessive number of taskhost.e
1415
activity could indicate an ongoing attack, allowing attackers to execute code, escalate
1516
privileges, or move laterally within the network.
1617
data_source:
17-
- Sysmon EventID 1
18-
- Windows Event Log Security 4688
19-
- CrowdStrike ProcessRollup2
20-
search: '| tstats `security_content_summariesonly` values(Processes.action) as action
18+
- Sysmon EventID 1
19+
- Windows Event Log Security 4688
20+
- CrowdStrike ProcessRollup2
21+
search:
22+
'| tstats `security_content_summariesonly` values(Processes.action) as action
2123
values(Processes.original_file_name) as original_file_name values(Processes.parent_process)
2224
as parent_process values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid)
2325
as parent_process_guid values(Processes.parent_process_id) as parent_process_id
@@ -41,9 +43,11 @@ search: '| tstats `security_content_summariesonly` values(Processes.action) as a
4143
values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level)
4244
as process_integrity_level values(user) as user values(process_path) as process_path
4345
values(user_id) as user_id values(vendor_product) as vendor_product values(process_name)
44-
as process_name by _time, dest, firstTime, lastTime | `security_content_ctime(firstTime)`
46+
as process_name by _time, dest, firstTime, lastTime | where taskhost_count >
47+
10 or taskhostex_count > 10 | `security_content_ctime(firstTime)`
4548
| `security_content_ctime(lastTime)` | `excessive_number_of_taskhost_processes_filter`'
46-
how_to_implement: The detection is based on data that originates from Endpoint Detection
49+
how_to_implement:
50+
The detection is based on data that originates from Endpoint Detection
4751
and Response (EDR) agents. These agents are designed to provide security-related
4852
telemetry from the endpoints where the agent is installed. To implement this search,
4953
you must ingest logs that contain the process GUID, process name, and parent process.
@@ -52,46 +56,49 @@ how_to_implement: The detection is based on data that originates from Endpoint D
5256
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
5357
data model. Use the Splunk Common Information Model (CIM) to normalize the field
5458
names and speed up the data modeling process.
55-
known_false_positives: Administrators, administrative actions or certain applications
59+
known_false_positives:
60+
Administrators, administrative actions or certain applications
5661
may run many instances of taskhost and taskhostex concurrently. Filter as needed.
5762
references:
58-
- https://attack.mitre.org/software/S0250/
63+
- https://attack.mitre.org/software/S0250/
5964
drilldown_searches:
60-
- name: View the detection results for - "$dest$"
61-
search: '%original_detection_search% | search dest = "$dest$"'
62-
earliest_offset: $info_min_time$
63-
latest_offset: $info_max_time$
64-
- name: View risk events for the last 7 days for - "$dest$"
65-
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
66-
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
67-
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
68-
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
69-
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
70-
| `security_content_ctime(lastTime)`'
71-
earliest_offset: $info_min_time$
72-
latest_offset: $info_max_time$
65+
- name: View the detection results for - "$dest$"
66+
search: '%original_detection_search% | search dest = "$dest$"'
67+
earliest_offset: $info_min_time$
68+
latest_offset: $info_max_time$
69+
- name: View risk events for the last 7 days for - "$dest$"
70+
search:
71+
'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
72+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
73+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
74+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
75+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
76+
| `security_content_ctime(lastTime)`'
77+
earliest_offset: $info_min_time$
78+
latest_offset: $info_max_time$
7379
rba:
74-
message: An excessive amount of taskhost.exe and taskhostex.exe was executed on
80+
message:
81+
An excessive amount of taskhost.exe and taskhostex.exe was executed on
7582
$dest$ indicative of suspicious behavior.
7683
risk_objects:
77-
- field: dest
78-
type: system
79-
score: 56
84+
- field: dest
85+
type: system
86+
score: 56
8087
threat_objects: []
8188
tags:
8289
analytic_story:
83-
- Meterpreter
90+
- Meterpreter
8491
asset_type: Endpoint
8592
mitre_attack_id:
86-
- T1059
93+
- T1059
8794
product:
88-
- Splunk Enterprise
89-
- Splunk Enterprise Security
90-
- Splunk Cloud
95+
- Splunk Enterprise
96+
- Splunk Enterprise Security
97+
- Splunk Cloud
9198
security_domain: endpoint
9299
tests:
93-
- name: True Positive Test
94-
attack_data:
95-
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/windows-xml.log
96-
source: XmlWinEventLog:Security
97-
sourcetype: XmlWinEventLog
100+
- name: True Positive Test
101+
attack_data:
102+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/windows-xml.log
103+
source: XmlWinEventLog:Security
104+
sourcetype: XmlWinEventLog

‎detections/endpoint/java_writing_jsp_file.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Java Writing JSP File
22
id: eb65619c-4f8d-4383-a975-d352765d344b
3-
version: 8
4-
date: '2025-04-22'
3+
version: 9
4+
date: '2025-04-28'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -72,6 +72,7 @@ tags:
7272
- Spring4Shell CVE-2022-22965
7373
- Atlassian Confluence Server and Data Center CVE-2022-26134
7474
- SysAid On-Prem Software CVE-2023-47246 Vulnerability
75+
- SAP NetWeaver Exploitation
7576
asset_type: Endpoint
7677
cve:
7778
- CVE-2022-22965

0 commit comments

Comments
 (0)