diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index b52db6e54f..2626558819 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -16,7 +16,8 @@ search: |- EventCode=4104 ScriptBlockText IN ( - "*-dumpcr%*", "*::decompress*", "*Add-Exfiltration*", "*Add-Persistence*", "*Add-RegBackdoor*", + "*-dumpcr%*", "* -version *", "*::decompress*", + "*Add-Exfiltration*", "*Add-Persistence*", "*Add-RegBackdoor*", "*Add-ScrnSaveBackdoor*", "*AmsiBypass*", "*assemblybuilderaccess*", "*backdoor*", "*backupprivilege*", "*beacon*", "*bitstransfer*", "*Brute-Force*", "*BruteForce*", "*CachedRDPConnection*", "*Check-VM*", "*cnvert*", "*compress-archive*", "*ComputerProperty*", @@ -24,8 +25,8 @@ search: |- "*Do-Exfiltration*", "*downloadfile*", "*downloadstring*", "*Enabled-DuplicateToken*", "*EXEonRemote*", "*exfiltration*", "*expand-archive*", "*Exploit-*", "*exploit*", "*Find-*", "*Frombase64_keyword*", "*Get-ApplicationHost*", "*Get-ChromeDump*", - "*Get-ClipboardContents*", "*Get-FoxDump*", "*Get-GPPPassword*", "*Get-IndexedItem*", - "*Get-Keystrokes*", "*Get-PassHash*", "*Get-RegAlwaysInstallElevated*", "*Get-RegAutoLogon*", + "*Get-ClipboardContents*", "*Get-*Credent*", "*Get-FoxDump*", "*Get-GPPPassword*", "*Get-IndexedItem*", + "*Get-Keystrokes*", "*Get-PassHash*", "*Get-*Password*", "*Get-RegAlwaysInstallElevated*", "*Get-RegAutoLogon*", "*Get-RickAstley*", "*Get-Screenshot*", "*Get-SecurityPackages*", "*Get-ServiceFilePermission*", "*Get-ServicePermission*", "*Get-ServiceUnquoted*", "*Get-SiteListPassword*", "*Get-System*", "*Get-TimedScreenshot*", "*Get-UnattendedInstallFile*", @@ -67,7 +68,7 @@ search: |- | eval invoke_wmi_keyword=if(like(script_lower,"%wmiobject%") OR like(script_lower,"%wmimethod%") OR like(script_lower,"%remotewmi%") OR like(script_lower,"%powershellwmi%") OR like(script_lower,"%wmicommand%"),5,0) - | eval downgrade_version=if(match(script_lower, "([-]ve*r*s*i*o*n*\s+2)") OR like(script_lower,"%powershell -version%"),3,0) + | eval downgrade_version=if(like(script_lower, "% -version 2%"),3,0) | eval compression_keyword=if(match(script_lower, "gzipstream|::decompress|io.compression|write-zip|(expand|compress)-archive"),5,0) diff --git a/detections/endpoint/windows_builtin_account_name_was_changed.yml b/detections/endpoint/windows_builtin_account_name_was_changed.yml new file mode 100644 index 0000000000..5981a964fb --- /dev/null +++ b/detections/endpoint/windows_builtin_account_name_was_changed.yml @@ -0,0 +1,79 @@ +name: Windows Builtin Account Name Was Changed +id: 65e6e8b9-c68c-460f-beb8-48cfe91b4d21 +version: 1 +creation_date: '2026-08-24' +modification_date: '2026-08-24' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects renaming of Windows built-in accounts via Event ID 4781. + It identifies renames targeting accounts with well-known reserved RIDs (500-504): Administrator, Guest, krbtgt, DefaultAccount, and WDAGUtilityAccount, by matching the TargetSid field against the S-1-5-21-*-50[0-4] pattern. + Attackers commonly rename the built-in Administrator account to evade detections that alert on the literal account name, while retaining the full privileges of the RID-500 account. + Renaming Guest, krbtgt, or other reserved accounts is highly unusual in any legitimate environment. +data_source: + - Windows Event Log Security 4781 +search: |- + `wineventlog_security` + EventCode=4781 + TargetSid="S-1-5-21-*" + + | where match(TargetSid, "S-1-5-21-.*-50[0-4]$") + + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest OldTargetUserName NewTargetUserName + TargetSid SubjectLogonId + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_builtin_account_name_was_changed_filter` +how_to_implement: |- + To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. +known_false_positives: |- + Renaming built-in accounts is uncommon in most environments but may occur during initial system hardening or CIS benchmark compliance efforts. + Validate the source user, logon ID, and timing against expected change control windows before tuning. +references: + - https://attack.mitre.org/techniques/T1078/003/ + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4781 + - https://nvd.nist.gov/vuln/detail/cve-2026-47301 + - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca + - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations +drilldown_searches: + - name: View the detection results for - "$dest$" and "$OldTargetUserName$" + search: '%original_detection_search% | search dest = "$dest$" OldTargetUserName = "$OldTargetUserName$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Built-in account [$OldTargetUserName$] (SID [$TargetSid$]) was renamed to [$NewTargetUserName$] on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: NewTargetUserName + type: user +analytic_story: + - Windows Defense Evasion Tactics + - Compromised Windows Host +asset_type: Endpoint +mitre_attack_id: + - T1078.003 + - T1036.010 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.003/builtin_account_rename/windows_security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_cab_file_on_disk.yml b/detections/endpoint/windows_cab_file_on_disk.yml index 5d9220feba..878f72ce35 100644 --- a/detections/endpoint/windows_cab_file_on_disk.yml +++ b/detections/endpoint/windows_cab_file_on_disk.yml @@ -1,30 +1,66 @@ name: Windows CAB File on Disk id: 622f08d0-69ef-42c2-8139-66088bc25acd -version: 11 +version: 12 creation_date: '2023-11-16' -modification_date: '2026-05-13' -author: Michael Haag, Splunk +modification_date: '2026-08-24' +author: Michael Haag, Nasreddine Bencherchali, Splunk status: production type: Anomaly -description: The following analytic detects .cab files being written to disk. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on events where the file name is '*.cab' and the action is 'write'. This activity is significant as .cab files can be used to deliver malicious payloads, including embedded .url files that execute harmful code. If confirmed malicious, this behavior could lead to unauthorized code execution and potential system compromise. Analysts should review the file path and associated artifacts for further investigation. +description: |- + The following analytic detects .cab files being written to disk. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on events where the file name is '*.cab' and the action is 'write'. + This activity can be significant as .cab files can be used to deliver malicious payloads, including embedded .url files that execute harmful code. + If confirmed malicious, this behavior could lead to unauthorized code execution and potential system compromise. + Analysts should review the file path and associated artifacts for further investigation. data_source: - Sysmon EventID 11 search: |- - | tstats `security_content_summariesonly` count values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - WHERE ( - Filesystem.file_name=*.cab - ) - BY Filesystem.action Filesystem.dest Filesystem.file_access_time - Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time - Filesystem.file_name Filesystem.file_path Filesystem.file_acl - Filesystem.file_size Filesystem.process_guid Filesystem.process_id - Filesystem.user Filesystem.vendor_product + | tstats `security_content_summariesonly` + count values(Filesystem.file_path) as file_path + min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Filesystem WHERE + + Filesystem.action IN ("created", "modified") + Filesystem.file_name="*.cab" + NOT Filesystem.file_path IN ( + "*\\AppData\\Local\\Microsoft\\*", + "*\\Windows Kits\\10\\ADK\\Installers\\*", + "C:\\Program Files (x86)\\*", + "C:\\Program Files\\*", + "C:\\ProgramData\\Microsoft\\*", + "C:\\ProgramData\\Package Cache\\*", + "C:\\Windows\\appcompat\\*", + "C:\\Windows\\Logs\\CBS\\*", + "C:\\Windows\\servicing\\*", + "C:\\Windows\\SoftwareDistribution\\*", + "C:\\Windows\\System32\\*", + "C:\\Windows\\SystemApps\\*", + "C:\\Windows\\SysWOW64\\*", + "C:\\Windows\\WinSxS\\*", + ) + + BY Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl + Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name("Filesystem")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cab_file_on_disk_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: False positives will only be present if a process legitimately writes a .cab file to disk. Modify the analytic as needed by file path. Filter as needed. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. + These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. + To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. + These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. + The logs must also be mapped to the `Processes` node of the `Endpoint` data model. + Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Some false positives are expected from user controlled folders. references: - https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2023-10-25-IOCs-from-DarkGate-activity.txt drilldown_searches: @@ -41,11 +77,16 @@ intermediate_findings: - field: dest type: system score: 20 - message: A .cab file was written to disk on endpoint $dest$. + message: The file [$file_path$] with a .cab extension was written to disk on endpoint $dest$. +threat_objects: + - field: file_path + type: file_path analytic_story: - DarkGate Malware - APT37 Rustonotto and FadeStealer asset_type: Endpoint +cve: + - CVE-2026-47301 mitre_attack_id: - T1566.001 product: diff --git a/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml b/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml new file mode 100644 index 0000000000..dff7ccf275 --- /dev/null +++ b/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml @@ -0,0 +1,88 @@ +name: Windows SCCM Adsource DLL Was Planted In SMS Provider Directory +id: 4f55b07b-7aeb-47f4-a234-b222a902276b +version: 1 +creation_date: '2026-08-20' +modification_date: '2026-08-20' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects the creation or modification of adsource.dll or other staging files with the name adsource_*.dll within the SCCM SMS Provider bin directory, consistent with exploitation of CVE-2026-47301. + This abuses a DLL side-loading vulnerability in the Microsoft Configuration Manager SMS Provider component. + An attacker can plant a malicious adsource.dll in the SCCMProvider bin\X64 path, causing the SMS Provider service to load the attacker-controlled library in a privileged context. + The presence of renamed dlls alongside adsource.dll is a strong indicator of the classic DLL hijacking pattern where the legitimate library has been renamed so the malicious replacement can proxy calls to it. + If confirmed malicious, this activity represents a privilege escalation vector that can result in SYSTEM-level code execution on any host running the SCCM SMS Provider role. +data_source: + - Sysmon EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Filesystem where + + Filesystem.action IN ("created", "modified") + Filesystem.file_name IN ( + "adsource.dll", + "adsource_*.dll" + ) + Filesystem.file_path="*Microsoft Configuration Manager\\bin\\X64\\*" + + BY Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl + Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product + + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_sccm_adsource_dll_was_planted_in_sms_provider_directory_filter` +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. If you are using Sysmon, you must have EventID 11 (FileCreate) enabled, and the FileCreate section of the configuration must include TargetFilename paths ending in .dll or "Microsoft Configuration Manager\bin\X64\" folder. +known_false_positives: |- + Legitimate SCCM upgrades or hotfix installations may create or replace adsource.dll in the bin\X64 directory. + Validate the file hash and digital signature of any detected adsource.dll against the expected version for the installed SCCM build before tuning. +references: + - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca + - https://nvd.nist.gov/vuln/detail/cve-2026-47301 + - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Suspicious SCCM adsource DLL [$file_name$] detected at [$file_path$] on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: file_name + type: file_name + - field: file_path + type: file_path +analytic_story: + - Windows Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2026-47301 +mitre_attack_id: + - T1574.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/sccm_adsource_dll/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml b/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml new file mode 100644 index 0000000000..e93cc7f693 --- /dev/null +++ b/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml @@ -0,0 +1,110 @@ +name: Windows SCCM Smsexec Spawned a Suspicious Child Process +id: 72091a05-3008-4330-b43e-f5e070134ec1 +version: 1 +creation_date: '2026-08-24' +modification_date: '2026-08-24' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: |- + The following analytic detects shells, scripting engines, and common post-exploitation utilities spawned as child processes of smsexec.exe. + smsexec.exe is the core SCCM SMS Executive service process and has no legitimate reason to launch interactive shells or scripting interpreters. + An attacker who plants a malicious adsource.dll in the SCCMProvider bin\X64 directory will obtain code execution in the SCCM service context, typically resulting in a SYSTEM-level child process being spawned under smsexec.exe. + If confirmed malicious, this activity represents successful exploitation of the SCCM SMS Executive service and should be treated as a full host compromise. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.parent_process_name="smsexec.exe" + Processes.process_name IN ( + "bitsadmin.exe", + "certutil.exe", + "cmd.exe", + "conhost.exe", + "cscript.exe", + "curl.exe", + "mshta.exe", + "net.exe", + "net1.exe", + "powershell.exe", + "pwsh.exe", + "reg.exe", + "regsvr32.exe", + "rundll32.exe", + "wmic.exe", + "wscript.exe" + ) + + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_sccm_smsexec_spawned_a_suspicious_child_process_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + smsexec.exe is not expected to spawn interactive shells or scripting engines under normal operating conditions. + False positives are unlikely. Validate the full command line and file hash of any match before tuning. +references: + - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca + - https://attack.mitre.org/techniques/T1574/001/ + - https://attack.mitre.org/techniques/T1068/ + - https://nvd.nist.gov/vuln/detail/cve-2026-47301 + - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +intermediate_findings: + entities: + - field: dest + type: system + score: 50 + message: Suspicious child process [$process_name$] with Command Line [$process$] spawned by [$parent_process_path$] on [$dest$] +threat_objects: + - field: process_name + type: process_name + - field: process + type: process +analytic_story: + - Windows Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2026-47301 +mitre_attack_id: + - T1574.001 + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/sccm_adsource_dll/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit