Splunk Security
@SplunkSecurity35 followers31,483 downloads1,595 copies11 likes89,306 views
2,505 detections
Filters
Last updated
All Time
Detection languages
2,505
Categories
834
530
264
239
208
Platforms
1,611
260
203
142
100
Products / Services
1,231
900
795
217
212
MITRE Techniques
932
663
511
497
306
CVEs
18
13
12
10
9
This analytic detects the use of the PowerShell Cmdlet `export-certificate` by leveraging Script Block Logging. This activity is significant as it may indicate an adversary attempting to exfiltrate certificates from the local Certificate Store on a Windows endpoint. Monitoring this behavior is crucial because stolen certificates can be used to impersonate users, decrypt sensitive data, or facilitate further attacks. If confirmed malicious, this activity could lead to unauthorized access to encrypted communications and sensitive information, posing a severe security risk.
This analytic detects the use of `get-WebConfigurationProperty` and `Set-ItemProperty` commands in PowerShell to disable HTTP logging on Windows systems. This detection leverages PowerShell Script Block Logging, specifically looking for script blocks that reference HTTP logging properties and attempt to set them to "false" or "dontLog". Disabling HTTP logging is significant as it can be used by adversaries to cover their tracks and delete logs, hindering forensic investigations. If confirmed malicious, this activity could allow attackers to evade detection and persist in the environment undetected.
The following analytic detects the creation of a new Group Policy Object (GPO) using Splunk's Admon data. It identifies events where a new GPO is created, excluding default "New Group Policy Object" entries. Monitoring GPO creation is crucial as adversaries can exploit GPOs to escalate privileges or deploy malware across an Active Directory network. If confirmed malicious, this activity could allow attackers to control system configurations, deploy ransomware, or propagate malware, significantly compromising the network's security.
This analytic detects new UDP communication between a source and destination workload pair within a Kubernetes cluster. It uses Network Performance Monitoring (NPM) metrics from an OTEL collector via Splunk Observability Cloud. The detection compares network activity over the last hour with the past 30 days to identify new inter-workload communication. Such changes in network behavior can indicate potential security threats or anomalies, including unauthorized connections that may lead to data breaches, privilege escalation, lateral movement, or disruption of critical services.
This analytic detects the execution of the `Get-DomainGroupMember` cmdlet from PowerView, identified through PowerShell Script Block Logging (EventCode=4104). This cmdlet is used to enumerate members of elevated domain groups such as Domain Admins and Enterprise Admins. Monitoring this activity is crucial as it indicates potential reconnaissance efforts by adversaries to identify high-privileged users within the domain. If confirmed malicious, this activity could lead to targeted attacks on privileged accounts, facilitating further compromise and lateral movement within the network.
This analytic detects the execution of the `Get-ForestTrust` command, often associated with the PowerSploit framework, via PowerShell Script Block Logging (EventCode=4104). This activity is significant because `Get-ForestTrust` is used to enumerate trust relationships within an Active Directory forest. Adversaries commonly perform this discovery technique as a precursor to lateral movement or privilege escalation, aiming to map out the environment for further exploitation and access to sensitive resources. Detecting this command provides visibility into potential reconnaissance efforts by attackers.
Detection rule generated by AI system
This analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell scripts to query Active Directory for domain computers. It specifically looks for PowerShell Script Block Logging (EventCode=4104) events containing `adsisearcher`, `objectcategory=computer`, and methods like `findAll()` or `findOne()`. This activity is indicative of Active Directory discovery, which adversaries or Red Teams perform to gain situational awareness and identify potential targets for lateral movement.
This analytic identifies newly observed TCP communication between source and destination workloads within a Kubernetes cluster. It leverages Network Performance Monitoring metrics to compare recent network activity with historical data (past 30 days) to detect new inter-workload communications. Such new connections can indicate changes in application behavior or potential security threats, including unauthorized access, lateral movement, privilege escalation, data exfiltration, or disruption of critical services.
The analytic detects the use of the PowerShell cmdlet `export-pfxcertificate` by leveraging Script Block Logging. This activity is significant as it may indicate an adversary attempting to exfiltrate certificates from the Windows Certificate Store. Monitoring this behavior is crucial for identifying potential certificate theft, which can lead to unauthorized access and impersonation attacks. If confirmed malicious, this activity could allow attackers to compromise secure communications, authenticate as legitimate users, and escalate their privileges within the network.
Page 107 of 251