Splunk Security

@SplunkSecurity
35 followers31,483 downloads1,586 copies11 likes89,260 views

2,502 detections

Wermgr Process Create Executable File

SPL
The analytic detects the `wermgr.exe` process creating an executable file. This behavior is unusual because `wermgr.exe` is typically associated with error reporting, not file creation. Such activity is significant as it may indicate TrickBot malware, which injects code into `wermgr.exe` to execute malicious actions like downloading additional payloads. If confirmed malicious, this could lead to further malware infections, data exfiltration, or system compromise.
Splunk Security@SplunkSecurity
avatar
Splunk Security Content
2 years ago
0026

Windows User Deletion Via Net Command

SPL
The following analytic detects the use of net.exe or net1.exe command-line to delete a user account on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line execution logs. This activity is significant as it may indicate an attempt to impair user accounts or cover tracks during lateral movement. If confirmed malicious, this could lead to unauthorized access removal, disruption of legitimate user activities, or concealment of adversarial actions, complicating incident response and forensic investigations.
Splunk Security@SplunkSecurity
avatar
Splunk Security Content
2 years ago
0026
Page 251 of 251