Splunk Security
@SplunkSecurity35 followers31,482 downloads1,576 copies11 likes89,203 views
2,496 detections
Filters
Last updated
All Time
Detection languages
2,496
Categories
828
522
264
239
208
Platforms
1,607
255
203
142
100
Products / Services
1,226
896
791
217
212
MITRE Techniques
932
661
510
495
306
CVEs
18
12
11
10
9
The analytic identifies instances of `control.exe` loading a `.cpl` or `.inf` file from a world-writable directory (e.g., `appdata`, `windows\temp`, `programdata`). This activity is often associated with attempts to exploit vulnerabilities like CVE-2021-40444, which could lead to unauthorized code execution and system compromise. The detection leverages process names and command-line executions from EDR agents.
This analytic identifies suspicious process names using a pre-trained Deep Learning model. It analyzes Endpoint Detection and Response (EDR) telemetry to classify process names as benign or suspicious based on a threshold score. This detection is significant for identifying malware, such as TrickBot, which often uses randomly generated filenames to evade detection. If confirmed malicious, this activity could indicate the presence of malware capable of propagating across the network and executing harmful actions.
The following analytic detects the execution of a command to disable an existing scheduled task using 'schtasks.exe' with the '/change' and '/disable' parameters. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. Disabling scheduled tasks is significant as it is a common tactic used by adversaries, including malware like IcedID, to disable security applications and evade detection. If confirmed malicious, this activity could allow attackers to persist undetected, disable critical security defenses, and further compromise the targeted host.
This analytic detects modifications to the Windows registry that disable the display of hidden files. It specifically monitors changes to registry paths associated with hidden file settings. This activity is significant because malware often uses hidden files to evade detection. If confirmed malicious, this behavior could allow an attacker to conceal malicious files on the system, making it harder for security tools and analysts to identify and remove the threat.
The analytic identifies modifications to the Windows registry that disable Task Manager. It specifically looks for changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" with a value of "0x00000001". This activity is commonly associated with malware such as RATs, Trojans, and worms, which disable Task Manager to prevent users from terminating malicious processes, thereby maintaining persistence and control over the infected system.
The following analytic detects the use of procdump.exe to dump the LSASS process, specifically looking for the -mm and -ma command-line arguments. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, command-line executions, and parent processes. This activity is significant because dumping LSASS can expose sensitive credentials, posing a severe security risk. If confirmed malicious, an attacker could obtain credentials, escalate privileges, and move laterally within the network, leading to potential data breaches and further compromise of the environment.
The analytic detects the first occurrence of a Windows service running in the environment by leveraging Windows system event logs (EventCode 7036) to identify services entering the "running" state. The appearance of a new or previously unseen service could indicate the installation of unauthorized or malicious software, potentially allowing an attacker to execute arbitrary code, maintain persistence, or escalate privileges. Monitoring for new services aids in early detection of potential threats.
The analytic detects the execution of fodhelper.exe, which is known to exploit a User Account Control (UAC) bypass by leveraging specific registry keys. The detection method uses Endpoint Detection and Response (EDR) telemetry to identify when fodhelper.exe spawns a child process and accesses the registry keys. This activity is significant because it indicates a potential privilege escalation attempt by an attacker. If confirmed malicious, the attacker could execute commands with elevated privileges, leading to unauthorized system changes and potential full system compromise.
The analytic detects the execution of the `Get-ADUserResultantPasswordPolicy` PowerShell cmdlet, which is used to obtain the password policy in a Windows domain. This activity is identified by leveraging PowerShell Script Block Logging (EventCode=4104). Monitoring this behavior is significant as it may indicate an attempt to enumerate domain policies, a common tactic used by adversaries for situational awareness and Active Directory discovery. If confirmed malicious, this activity could allow attackers to understand password policies, aiding in further attacks such as password guessing or policy exploitation.
The analytic detects the execution of `powershell.exe` with command-line arguments used to enumerate domain users via the `Get-DomainUser` command. This activity indicates potential reconnaissance efforts by adversaries or Red Teams using PowerView for Active Directory discovery. If confirmed malicious, this could allow attackers to gain situational awareness and identify valuable targets within the domain, potentially leading to further exploitation.
Page 191 of 250