Splunk Security
@SplunkSecurity35 followers31,482 downloads1,576 copies11 likes89,177 views
2,496 detections
Filters
Last updated
All Time
Detection languages
2,496
Categories
828
522
264
239
208
Platforms
1,607
255
203
142
100
Products / Services
1,226
896
791
217
212
MITRE Techniques
932
661
510
495
306
CVEs
18
12
11
10
9
This analytic identifies instances where the `reg.exe` utility is launched from a command prompt (`cmd.exe`) that was not initiated by a user, specifically when the parent process is not `explorer.exe`. This activity is significant because `reg.exe` is commonly used for registry manipulation, which can be indicative of malicious behavior such as establishing persistence mechanisms or altering system configurations. If confirmed malicious, this could allow an attacker to modify critical system settings, potentially leading to privilege escalation or persistent access.
The following analytic detects when a process other than explorer.exe writes to the Windows Recycle Bin. It leverages the Endpoint.Filesystem and Endpoint.Processes data models in Splunk to identify any process writing to the "*$Recycle.Bin*" file path, excluding explorer.exe. This activity is significant because it may indicate an attacker attempting to hide their actions, potentially leading to data theft, ransomware, or other malicious outcomes. If confirmed malicious, this behavior could allow an attacker to persist in the environment and evade detection by security tools.
This analytic detects the uninstallation of applications using msiexec.exe with specific command-line arguments. It focuses on process execution logs that include command-line details such as '/qn' (quiet mode), '/X' (uninstall), and 'REBOOT=' (reboot control). This activity is uncommon in enterprise environments and has been associated with malicious behavior, such as disabling security software to facilitate further compromise and persistence.
The analytic identifies an unusual number of Kerberos service ticket requests (Event ID 4769) originating from a single client address and account. It uses statistical analysis, specifically standard deviation and the 3-sigma rule, to detect anomalies. This activity is significant as it may indicate malicious behavior such as lateral movement, malware staging, or reconnaissance, potentially leading to unauthorized access to multiple endpoints and further compromise.
The analytic detects the execution of `powershell.exe` with command-line arguments that use PowerShell environment variables to identify the current logged user. This activity is significant as adversaries may use it for situational awareness and Active Directory discovery on compromised endpoints. If confirmed malicious, this behavior could allow attackers to gather critical user information, aiding in further exploitation and lateral movement within the network.
The analytic detects the execution of `query.exe` with command-line arguments aimed at discovering data on remote devices. This activity is significant as adversaries may use `query.exe` to gain situational awareness and perform Active Directory discovery on compromised endpoints. If confirmed malicious, this behavior could allow attackers to identify various details about a system, aiding in further lateral movement and privilege escalation within the network.
The following analytic detects the execution of `whoami.exe` with the `/priv` parameter, which displays the privileges assigned to the current user account. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it may indicate an adversary attempting to enumerate user privileges, a common step in the reconnaissance phase of an attack. If confirmed malicious, this could lead to privilege escalation or further exploitation within the environment.
The analytic detects when a process spawns an executable known for User Account Control (UAC) bypass exploitation and subsequently monitors for any child processes with a higher integrity level than the original process. This detection leverages Sysmon EventID 1 data, focusing on process integrity levels and known UAC bypass executables. This activity is significant as it may indicate an attacker has successfully used a UAC bypass exploit to escalate privileges. If confirmed malicious, the attacker could gain elevated privileges, potentially leading to further system compromise and persistent access.
This analytic identifies a source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. It leverages Windows EventCode 4768, which is generated when the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT) and detects failure code `0x12` (credentials revoked). This behavior is significant as it may indicate a Password Spraying attack targeting disabled accounts, potentially leading to initial access or privilege escalation. If confirmed malicious, attackers could gain unauthorized access or elevate privileges within the Active Directory environment.
This analytic identifies the creation of WMI permanent event subscriptions, which can be used to establish persistence or perform privilege escalation. It leverages Sysmon data, specifically EventCode 21, to detect the creation of WMI EventFilters, EventConsumers, and FilterToConsumerBindings. This activity is significant as it may indicate an attacker setting up mechanisms to execute code with elevated SYSTEM privileges when specific events occur. If confirmed malicious, this could allow the attacker to maintain persistence, escalate privileges, and execute arbitrary code, posing a severe threat to the environment.
Page 245 of 250