Skip to content

Commit fad1a59

Browse files
RavenTaitnasbenchpatel-bhavin
authored
Add New BlueHammer / RedSun Analytics (#4037)
--------- Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com> Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
1 parent e9400d9 commit fad1a59

14 files changed

Lines changed: 978 additions & 0 deletions

‎data_sources/windows_event_log_security_4723.yml‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
name: Windows Event Log Security 4723
2+
id: df19b271-57c8-4f31-817a-6c5566985484
3+
version: 1
4+
creation_date: '2026-06-15'
5+
modification_date: '2026-06-15'
6+
author: Raven Tait, Splunk
7+
description: Logs an event when an attempt is made to change an account's password, whether successful or not.
8+
mitre_components:
9+
- User Account Modification
10+
source: XmlWinEventLog:Security
11+
sourcetype: XmlWinEventLog
12+
separator: EventCode
13+
separator_value: '4723'
14+
supported_TA:
15+
- name: Splunk Add-on for Microsoft Windows
16+
url: https://splunkbase.splunk.com/app/742
17+
version: 10.0.1
18+
fields:
19+
- _time
20+
- Caller_Domain
21+
- Caller_User_Name
22+
- CategoryString
23+
- Channel
24+
- Computer
25+
- Error_Code
26+
- EventCode
27+
- EventData_Xml
28+
- EventID
29+
- EventRecordID
30+
- Guid
31+
- Keywords
32+
- Level
33+
- Logon_ID
34+
- Name
35+
- Opcode
36+
- ProcessID
37+
- RecordNumber
38+
- SubjectDomainName
39+
- SubjectLogonId
40+
- SubjectUserName
41+
- SubjectUserSid
42+
- SystemTime
43+
- System_Props_Xml
44+
- TargetDomainName
45+
- TargetSid
46+
- TargetUserName
47+
- Target_Domain
48+
- Target_User_Name
49+
- Task
50+
- ThreadID
51+
- Version
52+
- action
53+
- app
54+
- change_type
55+
- date_hour
56+
- date_mday
57+
- date_minute
58+
- date_month
59+
- date_second
60+
- date_wday
61+
- date_year
62+
- date_zone
63+
- dest
64+
- dest_nt_domain
65+
- dvc
66+
- dvc_nt_host
67+
- event_id
68+
- eventtype
69+
- host
70+
- id
71+
- index
72+
- linecount
73+
- name
74+
- object
75+
- object_attrs
76+
- object_category
77+
- object_id
78+
- product
79+
- punct
80+
- result
81+
- session_id
82+
- signature
83+
- signature_id
84+
- source
85+
- sourcetype
86+
- splunk_server
87+
- src_nt_domain
88+
- src_user
89+
- src_user_name
90+
- status
91+
- subject
92+
- ta_windows_action
93+
- ta_windows_security_CategoryString
94+
- tag
95+
- tag::eventtype
96+
- timeendpos
97+
- timestartpos
98+
- user
99+
- user_group
100+
- user_name
101+
- vendor
102+
- vendor_product
103+
output_fields:
104+
- dest
105+
example_log: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider
106+
Name="Microsoft-Windows-Security-Auditing" Guid="54849625-5478-4994-A5BA-3E3B0328C30D"></Provider>
107+
<EventID>4723</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode>
108+
<Keywords>0x8010000000000000</Keywords><TimeCreated SystemTime="2026-04-21T17:43:18.298641Z">
109+
</TimeCreated><EventRecordID>781490</EventRecordID><Correlation ActivityID="9F3364FE-E417-0002-2065-339F17E4DA01">
110+
</Correlation><Execution ProcessID="724" ThreadID="12596"></Execution><Channel>Security</Channel>
111+
<Computer>WIN10-21H1.strt.labs</Computer><Security></Security></System><EventData>
112+
<Data Name="TargetUserName">Administrator</Data><Data Name="TargetDomainName">WIN10-21H1</Data>
113+
<Data Name="TargetSid">S-1-5-21-1538153195-943065003-848949206-500</Data><Data Name="SubjectUserSid">
114+
S-1-5-21-1538153195-943065003-848949206-1003</Data><Data Name="SubjectUserName">bob</Data>
115+
<Data Name="SubjectDomainName">WIN10-21H1</Data><Data Name="SubjectLogonId">0x61a292</Data>
116+
<Data Name="PrivilegeList">-</Data></EventData></Event>

‎detections/endpoint/windows_admin_password_changed_by_non_admin.yml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
name: Windows Admin Password Changed by Non-Admin
2+
id: 6d4c4d88-cd60-43a1-8c70-c74a9614f724
3+
version: 1
4+
creation_date: '2026-04-27'
5+
modification_date: '2026-04-27'
6+
author: Raven Tait, Splunk
7+
status: production
8+
type: TTP
9+
description: |-
10+
The following analytic detects when a unprivileged user changes an Admin accounts password. This is a common artifact of successful exploitation of the BlueHammer Windows Defender privilege escalation. The attacker's process momentarily changes the passwords of high-value local accounts including the built-in Administrator to spawn an authenticated shell session, then immediately reverts the passwords to avoid detection. This uses EventID 4723 to log this activity.
11+
data_source:
12+
- Windows Event Log Security 4723
13+
search: |-
14+
`wineventlog_security`
15+
EventCode=4723
16+
| rex field=object_id "-(?<target_rid>\d+)$"
17+
| rex field=SubjectUserSid "-(?<subject_rid>\d+)$"
18+
| where target_rid="500" OR tonumber(target_rid) IN (512,513,518,519,520)
19+
| where tonumber(subject_rid) >= 1000
20+
| where SubjectUserSid != object_id
21+
| stats count min(_time) as firstTime
22+
max(_time) as lastTime
23+
by dest user object_id EventCode src_user
24+
SubjectUserSid SubjectLogonId PrivilegeList
25+
| `security_content_ctime(firstTime)`
26+
| `security_content_ctime(lastTime)`
27+
| `windows_admin_password_changed_by_non_admin_filter`
28+
how_to_implement: |-
29+
The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
30+
known_false_positives: |-
31+
Some IT support tools or automated scripts may change administrator passwords during maintenance. Verify changes against authorized administrative activities to reduce false alerts.
32+
references:
33+
- https://github.com/Nightmare-Eclipse/BlueHammer
34+
drilldown_searches:
35+
- earliest_offset: $info_min_time$
36+
latest_offset: $info_max_time$
37+
name: View the detection results for - "$dest$"
38+
search: '%original_detection_search% | search dest = "$dest$"'
39+
- earliest_offset: $info_min_time$
40+
latest_offset: $info_max_time$
41+
name: View risk events for the last 7 days for - "$dest$"
42+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
43+
finding:
44+
title: Non-Administrator account $src_user$ changed password of Admin account $user$ on $dest$.
45+
entity:
46+
field: dest
47+
type: system
48+
score: 50
49+
analytic_story:
50+
- Windows Privilege Escalation
51+
- BlueHammer
52+
asset_type: Endpoint
53+
mitre_attack_id:
54+
- T1068
55+
- T1543.003
56+
product:
57+
- Splunk Enterprise
58+
- Splunk Enterprise Security
59+
- Splunk Cloud
60+
category: endpoint
61+
security_domain: endpoint
62+
cve:
63+
- CVE-2026-33825
64+
tests:
65+
- name: True Positive Test
66+
attack_data:
67+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/bluehammer/windows-security.log
68+
source: XmlWinEventLog:Security
69+
sourcetype: XmlWinEventLog
70+
test_type: unit

‎detections/endpoint/windows_cloud_files_filter_loaded_by_uncommon_process.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: Windows Cloud Files Filter Loaded by Uncommon Process
2+
id: 77b85062-274e-43a5-9dab-c25862b85291
3+
version: 1
4+
creation_date: '2026-05-18'
5+
modification_date: '2026-05-18'
6+
author: Raven Tait, Splunk
7+
status: production
8+
type: Anomaly
9+
description: |-
10+
The following analytic detects cldapi.dll being loaded by a process not associated with legitimate cloud sync activity.
11+
The Windows Cloud Files API (cldapi.dll) is abused by several local privilege escalation exploits.
12+
data_source:
13+
- Sysmon EventID 7
14+
search: |-
15+
`sysmon`
16+
EventID=7
17+
ImageLoaded="*\\cldapi.dll"
18+
NOT Image IN (
19+
"*\\box.exe",
20+
"*\\dropbox.exe",
21+
"*\\googledrivefs.exe",
22+
"*\\icloud.exe",
23+
"*\\onedrive*.exe",
24+
"*\\Windows\\explorer.exe"
25+
"*\\Windows\\System32\\*",
26+
"*\\Windows\\Syswow64\\*",
27+
"*\\Windows\\WinSxS\\*"
28+
)
29+
| stats count min(_time) as firstTime
30+
max(_time) as lastTime
31+
by Computer ImageLoaded EventID dest loaded_file loaded_file_path process_exec
32+
process_guid process_hash process_id process_name process_path
33+
service_dll_signature_exists service_dll_signature_verified signature_id user_id
34+
vendor_product
35+
| `security_content_ctime(firstTime)`
36+
| `security_content_ctime(lastTime)`
37+
| `windows_cloud_files_filter_loaded_by_uncommon_process_filter`
38+
how_to_implement: |-
39+
To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
40+
known_false_positives: |-
41+
False positives may include other third-party cloud-based file storage software.
42+
Filter as necessary for your environment.
43+
references:
44+
- https://www.huntress.com/blog/nightmare-eclipse-intrusion
45+
- https://www.threatlocker.com/blog/miniplasma-windows-privilege-escalation-zero-day-affects-fully-patched-systems
46+
drilldown_searches:
47+
- name: View the detection results for - "$dest$"
48+
search: '%original_detection_search% | search dest = "$dest$"'
49+
earliest_offset: $info_min_time$
50+
latest_offset: $info_max_time$
51+
- name: View risk events for the last 7 days for - "$dest$"
52+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
53+
earliest_offset: 7d
54+
latest_offset: "0"
55+
intermediate_findings:
56+
entities:
57+
- field: dest
58+
type: system
59+
score: 20
60+
message: Cloud Files Filter ($ImageLoaded$) loaded by suspicious process $Image$ on $dest$
61+
analytic_story:
62+
- RedSun
63+
- BlueHammer
64+
asset_type: Endpoint
65+
mitre_attack_id:
66+
- T1543.003
67+
product:
68+
- Splunk Enterprise
69+
- Splunk Enterprise Security
70+
- Splunk Cloud
71+
category: endpoint
72+
security_domain: endpoint
73+
tests:
74+
- name: True Positive Test
75+
attack_data:
76+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/redsun/windows-sysmon.log
77+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
78+
sourcetype: XmlWinEventLog
79+
test_type: unit

‎detections/endpoint/windows_cloud_files_filter_log_created_by_non_system_process.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: Windows Cloud Files Filter Log Created by Non-System Process
2+
id: 2e0042b9-8a75-49ca-b3a2-948f04b752bf
3+
version: 1
4+
creation_date: '2026-05-01'
5+
modification_date: '2026-05-01'
6+
author: Raven Tait, Splunk
7+
status: production
8+
type: TTP
9+
description: |-
10+
Detects a non-system process causing creation of CldFlt0.etl under C:\Windows\System32\LogFiles\CloudFiles\.
11+
This path is initialised by the CldFlt driver when a process calls CfRegisterSyncRoot() or CfConnectSyncRoot().
12+
In the RedSun exploit this is a side-effect of the DoCloudStuff() function that registers a fake sync provider to create the cloud-tagged bait file.
13+
Legitimate cloud providers (OneDrive etc.) register sync roots from SYSTEM-level service processes, not from user-context executables.
14+
data_source:
15+
- Sysmon EventID 11
16+
search: |-
17+
`sysmon`
18+
EventCode=11
19+
TargetFilename = "*\\Windows\\System32\\LogFiles\\CloudFiles\\*"
20+
NOT Image IN (
21+
"*:\\Windows\\System32*",
22+
"*:\\Windows\\SysWOW64*",
23+
"*:\\Program Files\\WindowsApps\\*"
24+
)
25+
| stats count min(_time) as firstTime
26+
max(_time) as lastTime
27+
by action dest file_name file_path Image process_guid
28+
process_id user_id vendor_product
29+
| `security_content_ctime(firstTime)`
30+
| `security_content_ctime(lastTime)`
31+
| `windows_cloud_files_filter_log_created_by_non_system_process_filter`
32+
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
33+
known_false_positives: No false positives have been identified at this time.
34+
references:
35+
- https://github.com/Nightmare-Eclipse/RedSun
36+
- https://www.huntress.com/blog/nightmare-eclipse-intrusion
37+
drilldown_searches:
38+
- name: View the detection results for - "$dest$"
39+
search: '%original_detection_search% | search dest = "$dest$"'
40+
earliest_offset: $info_min_time$
41+
latest_offset: $info_max_time$
42+
- name: View risk events for the last 7 days for - "$dest$"
43+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
44+
earliest_offset: 7d
45+
latest_offset: "0"
46+
finding:
47+
title: Non-System process $Image$ created a cloud files filter $file_name$ on host $dest$
48+
entity:
49+
field: dest
50+
type: system
51+
score: 50
52+
analytic_story:
53+
- RedSun
54+
- Windows Privilege Escalation
55+
asset_type: Endpoint
56+
mitre_attack_id:
57+
- T1068
58+
product:
59+
- Splunk Enterprise
60+
- Splunk Enterprise Security
61+
- Splunk Cloud
62+
category: endpoint
63+
security_domain: endpoint
64+
cve:
65+
- CVE-2026-33825
66+
tests:
67+
- name: True Positive Test
68+
attack_data:
69+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/redsun/windows-sysmon.log
70+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
71+
sourcetype: XmlWinEventLog
72+
test_type: unit

0 commit comments

Comments
 (0)