Splunk Security
@SplunkSecurity35 followers31,483 downloads1,584 copies11 likes89,239 views
2,497 detections
Filters
Last updated
All Time
Detection languages
2,497
Categories
829
523
264
239
208
Platforms
1,607
256
203
142
100
Products / Services
1,226
896
791
217
212
MITRE Techniques
932
661
510
495
306
CVEs
18
12
11
10
9
The analytic detects outbound network connections from Java processes to default ports used by LDAP and RMI protocols, which may indicate exploitation of the CVE-2021-44228 Log4j vulnerability. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and network traffic logs. Monitoring this activity is crucial as it can signify an attacker’s attempt to perform JNDI lookups and retrieve malicious payloads. If confirmed malicious, this activity could lead to remote code execution and further compromise of the affected server.
The analytic detects a suspicious computer account name change in Active Directory. It leverages Event ID 4781, which logs account name changes, to identify instances where a computer account name is changed to one that does not end with a '$'. This behavior is significant as it may indicate an attempt to exploit CVE-2021-42278 and CVE-2021-42287, which can lead to domain controller impersonation and privilege escalation. If confirmed malicious, this activity could allow an attacker to gain elevated privileges and potentially control the domain.
This analytic identifies a Living Off The Land Binaries and Scripts (LOLBAS) process being executed where its process name does not match its original file name attribute. Processes that have been renamed and executed may indicate an adversary attempting to evade defenses or execute malicious code. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. The detection logic specifically looks for process creation events where the `original_file_name` field (which stores the original name of the executable) does not match the `process_name` (the name of the process as it's currently running). It also filters out common system paths and uses a lookup table (`lolbas_file_path`) to identify known LOLBAS binaries.
This analytic detects the execution of the `Get-DomainSPNTicket` commandlet, which is part of the PowerView tool, by monitoring PowerShell Script Block Logging (EventCode=4104). This commandlet is used to request Kerberos service tickets for specified Service Principal Names (SPNs). Detecting this activity is critical because it can indicate attempts to perform Kerberoasting, a technique where attackers extract SPN account passwords for offline cracking. If this activity is confirmed to be malicious, it could lead to unauthorized access to sensitive accounts, potentially resulting in privilege escalation and further compromise of the network.
This analytic detects an unusual number of NTLM authentications targeting a single destination using a null domain. This activity is indicative of an attacker attempting to brute force or password spray a domain-joined Windows device from a non-domain device. Such activity may also generate a high volume of EventID 4776 events, though these events might not specify the attacker or target device.
The following analytic identifies the presence of unauthorized DHCP servers on the network. It leverages logs from Cisco network devices with DHCP Snooping enabled, specifically looking for events where DHCP leases are issued from untrusted ports. This activity is significant because rogue DHCP servers can facilitate Man-in-the-Middle attacks, leading to potential data interception and network disruption. If confirmed malicious, this could allow attackers to redirect network traffic, capture sensitive information, and compromise the integrity of the network.
The analytic identifies access to a specific Ivanti Connect Secure endpoint, `/api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark`, which is known to be vulnerable to CVE-2023-46805 and CVE-2024-21887. It specifically looks for GET requests that result in a 403 Forbidden HTTP status code with an empty response body. This behavior is indicative of potential exploitation attempts against Ivanti Connect Secure systems. Successful exploitation could lead to unauthorized access or control, potentially resulting in data breaches or system compromise.
The analytic identifies potential adware activity blocked by Zscaler. It leverages web proxy logs to detect blocked actions associated with adware threats. Key data points such as device owner, user, URL category, destination URL, and IP are analyzed. This activity is significant as adware can degrade system performance, lead to unwanted advertisements, and potentially expose users to further malicious content. If confirmed malicious, it could indicate an attempt to compromise user systems, necessitating further investigation and remediation to prevent potential data breaches or system exploitation.
The following analytic detects the registration of a new Multi-Factor Authentication (MFA) method for a PingID (PingOne) account. It leverages JSON logs from PingID, specifically looking for successful device pairing events. This activity is significant as adversaries who gain unauthorized access to a user account may register a new MFA method to maintain persistence. If confirmed malicious, this could allow attackers to bypass existing security measures, maintain long-term access, and potentially escalate their privileges within the compromised environment.
The following analytic detects when AWS S3 bucket versioning is suspended by a user. It leverages AWS CloudTrail logs to identify `PutBucketVersioning` events with the `VersioningConfiguration.Status` set to `Suspended`. This activity is significant because disabling versioning can prevent recovery of deleted or modified data, which is a common tactic in ransomware attacks. If confirmed malicious, this action could lead to data loss and hinder recovery efforts, severely impacting data integrity and availability.
Page 162 of 250