CVE-2026-47301

detections/endpoint/powershell_4104_hunting.yml

@@ -16,16 +16,17 @@ search: |-
     EventCode=4104
 
     ScriptBlockText IN (
-        "*-dumpcr%*", "*::decompress*", "*Add-Exfiltration*", "*Add-Persistence*", "*Add-RegBackdoor*",
+        "*-dumpcr%*", "* -version *", "*::decompress*",
+        "*Add-Exfiltration*", "*Add-Persistence*", "*Add-RegBackdoor*",
         "*Add-ScrnSaveBackdoor*", "*AmsiBypass*", "*assemblybuilderaccess*", "*backdoor*",
         "*backupprivilege*", "*beacon*", "*bitstransfer*", "*Brute-Force*", "*BruteForce*",
         "*CachedRDPConnection*", "*Check-VM*", "*cnvert*", "*compress-archive*", "*ComputerProperty*",
         "*comsvcs*", "*copy-vss*", "*CreateShortcut*", "*disablerealtimemonitoring*",
         "*Do-Exfiltration*", "*downloadfile*", "*downloadstring*", "*Enabled-DuplicateToken*",
         "*EXEonRemote*", "*exfiltration*", "*expand-archive*", "*Exploit-*", "*exploit*",
         "*Find-*", "*Frombase64_keyword*", "*Get-ApplicationHost*", "*Get-ChromeDump*",
-        "*Get-ClipboardContents*", "*Get-FoxDump*", "*Get-GPPPassword*", "*Get-IndexedItem*",
-        "*Get-Keystrokes*", "*Get-PassHash*", "*Get-RegAlwaysInstallElevated*", "*Get-RegAutoLogon*",
+        "*Get-ClipboardContents*", "*Get-*Credent*", "*Get-FoxDump*", "*Get-GPPPassword*", "*Get-IndexedItem*",
+        "*Get-Keystrokes*", "*Get-PassHash*", "*Get-*Password*", "*Get-RegAlwaysInstallElevated*", "*Get-RegAutoLogon*",
         "*Get-RickAstley*", "*Get-Screenshot*", "*Get-SecurityPackages*", "*Get-ServiceFilePermission*",
         "*Get-ServicePermission*", "*Get-ServiceUnquoted*", "*Get-SiteListPassword*",
         "*Get-System*", "*Get-TimedScreenshot*", "*Get-UnattendedInstallFile*",
@@ -67,7 +68,7 @@ search: |-
 
     | eval invoke_wmi_keyword=if(like(script_lower,"%wmiobject%") OR like(script_lower,"%wmimethod%") OR like(script_lower,"%remotewmi%") OR like(script_lower,"%powershellwmi%") OR like(script_lower,"%wmicommand%"),5,0)
 
-    | eval downgrade_version=if(match(script_lower, "([-]ve*r*s*i*o*n*\s+2)") OR like(script_lower,"%powershell -version%"),3,0)
+    | eval downgrade_version=if(like(script_lower, "% -version 2%"),3,0)
 
     | eval compression_keyword=if(match(script_lower, "gzipstream|::decompress|io.compression|write-zip|(expand|compress)-archive"),5,0)
 

detections/endpoint/windows_builtin_account_name_was_changed.yml

@@ -0,0 +1,79 @@
+name: Windows Builtin Account Name Was Changed
+id: 65e6e8b9-c68c-460f-beb8-48cfe91b4d21
+version: 1
+creation_date: '2026-08-24'
+modification_date: '2026-08-24'
+author: Raven Tait, Splunk
+status: production
+type: TTP
+description: |-
+    The following analytic detects renaming of Windows built-in accounts via Event ID 4781.
+    It identifies renames targeting accounts with well-known reserved RIDs (500-504): Administrator, Guest, krbtgt, DefaultAccount, and WDAGUtilityAccount, by matching the TargetSid field against the S-1-5-21-*-50[0-4] pattern.
+    Attackers commonly rename the built-in Administrator account to evade detections that alert on the literal account name, while retaining the full privileges of the RID-500 account.
+    Renaming Guest, krbtgt, or other reserved accounts is highly unusual in any legitimate environment.
+data_source:
+    - Windows Event Log Security 4781
+search: |-
+    `wineventlog_security`
+    EventCode=4781
+    TargetSid="S-1-5-21-*"
+
+    | where match(TargetSid, "S-1-5-21-.*-50[0-4]$")
+
+    | stats count min(_time) as firstTime
+                  max(_time) as lastTime
+      by dest OldTargetUserName NewTargetUserName
+         TargetSid SubjectLogonId
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `windows_builtin_account_name_was_changed_filter`
+how_to_implement: |-
+    To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
+known_false_positives: |-
+    Renaming built-in accounts is uncommon in most environments but may occur during initial system hardening or CIS benchmark compliance efforts.
+    Validate the source user, logon ID, and timing against expected change control windows before tuning.
+references:
+    - https://attack.mitre.org/techniques/T1078/003/
+    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4781
+    - https://nvd.nist.gov/vuln/detail/cve-2026-47301
+    - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca
+    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations
+drilldown_searches:
+    - name: View the detection results for - "$dest$" and "$OldTargetUserName$"
+      search: '%original_detection_search% | search  dest = "$dest$" OldTargetUserName = "$OldTargetUserName$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+finding:
+    title: Built-in account [$OldTargetUserName$] (SID [$TargetSid$]) was renamed to [$NewTargetUserName$] on [$dest$]
+    entity:
+        field: dest
+        type: system
+        score: 50
+threat_objects:
+    - field: NewTargetUserName
+      type: user
+analytic_story:
+    - Windows Defense Evasion Tactics
+    - Compromised Windows Host
+asset_type: Endpoint
+mitre_attack_id:
+    - T1078.003
+    - T1036.010
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.003/builtin_account_rename/windows_security.log
+          source: XmlWinEventLog:Security
+          sourcetype: XmlWinEventLog
+      test_type: unit

detections/endpoint/windows_cab_file_on_disk.yml

@@ -1,30 +1,66 @@
 name: Windows CAB File on Disk
 id: 622f08d0-69ef-42c2-8139-66088bc25acd
-version: 11
+version: 12
 creation_date: '2023-11-16'
-modification_date: '2026-05-13'
-author: Michael Haag, Splunk
+modification_date: '2026-08-24'
+author: Michael Haag, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: The following analytic detects .cab files being written to disk. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on events where the file name is '*.cab' and the action is 'write'. This activity is significant as .cab files can be used to deliver malicious payloads, including embedded .url files that execute harmful code. If confirmed malicious, this behavior could lead to unauthorized code execution and potential system compromise. Analysts should review the file path and associated artifacts for further investigation.
+description: |-
+    The following analytic detects .cab files being written to disk.
+    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on events where the file name is '*.cab' and the action is 'write'.
+    This activity can be significant as .cab files can be used to deliver malicious payloads, including embedded .url files that execute harmful code.
+    If confirmed malicious, this behavior could lead to unauthorized code execution and potential system compromise.
+    Analysts should review the file path and associated artifacts for further investigation.
 data_source:
     - Sysmon EventID 11
 search: |-
-    | tstats `security_content_summariesonly` count values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-      WHERE (
-            Filesystem.file_name=*.cab
-        )
-      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
-         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
-         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
-         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
-         Filesystem.user Filesystem.vendor_product
+    | tstats `security_content_summariesonly`
+      count values(Filesystem.file_path) as file_path
+            min(_time) as firstTime
+            max(_time) as lastTime
+
+    FROM datamodel=Endpoint.Filesystem WHERE
+
+    Filesystem.action IN ("created", "modified")
+    Filesystem.file_name="*.cab"
+    NOT Filesystem.file_path IN (
+        "*\\AppData\\Local\\Microsoft\\*",
+        "*\\Windows Kits\\10\\ADK\\Installers\\*",
+        "C:\\Program Files (x86)\\*",
+        "C:\\Program Files\\*",
+        "C:\\ProgramData\\Microsoft\\*",
+        "C:\\ProgramData\\Package Cache\\*",
+        "C:\\Windows\\appcompat\\*",
+        "C:\\Windows\\Logs\\CBS\\*",
+        "C:\\Windows\\servicing\\*",
+        "C:\\Windows\\SoftwareDistribution\\*",
+        "C:\\Windows\\System32\\*",
+        "C:\\Windows\\SystemApps\\*",
+        "C:\\Windows\\SysWOW64\\*",
+        "C:\\Windows\\WinSxS\\*",
+    )
+
+    BY Filesystem.action Filesystem.dest Filesystem.file_access_time
+       Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
+       Filesystem.file_name Filesystem.file_path Filesystem.file_acl
+       Filesystem.file_size Filesystem.process_guid Filesystem.process_id
+       Filesystem.user Filesystem.vendor_product
+
     | `drop_dm_object_name("Filesystem")`
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_cab_file_on_disk_filter`
-how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: False positives will only be present if a process legitimately writes a .cab file to disk. Modify the analytic as needed by file path. Filter as needed.
+how_to_implement: |-
+    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents.
+    These agents are designed to provide security-related telemetry from the endpoints where the agent is installed.
+    To implement this search, you must ingest logs that contain the process GUID, process name, and parent process.
+    Additionally, you must ingest complete command-line executions.
+    These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product.
+    The logs must also be mapped to the `Processes` node of the `Endpoint` data model.
+    Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: |-
+    Some false positives are expected from user controlled folders.
 references:
     - https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2023-10-25-IOCs-from-DarkGate-activity.txt
 drilldown_searches:
@@ -41,11 +77,16 @@ intermediate_findings:
         - field: dest
           type: system
           score: 20
-          message: A .cab file was written to disk on endpoint $dest$.
+          message: The file [$file_path$] with a .cab extension was written to disk on endpoint $dest$.
+threat_objects:
+    - field: file_path
+      type: file_path
 analytic_story:
     - DarkGate Malware
     - APT37 Rustonotto and FadeStealer
 asset_type: Endpoint
+cve:
+    - CVE-2026-47301
 mitre_attack_id:
     - T1566.001
 product:

detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml

@@ -0,0 +1,88 @@
+name: Windows SCCM Adsource DLL Was Planted In SMS Provider Directory
+id: 4f55b07b-7aeb-47f4-a234-b222a902276b
+version: 1
+creation_date: '2026-08-20'
+modification_date: '2026-08-20'
+author: Raven Tait, Splunk
+status: production
+type: TTP
+description: |-
+    The following analytic detects the creation or modification of adsource.dll or other staging files with the name adsource_*.dll within the SCCM SMS Provider bin directory, consistent with exploitation of CVE-2026-47301.
+    This abuses a DLL side-loading vulnerability in the Microsoft Configuration Manager SMS Provider component.
+    An attacker can plant a malicious adsource.dll in the SCCMProvider bin\X64 path, causing the SMS Provider service to load the attacker-controlled library in a privileged context.
+    The presence of renamed dlls alongside adsource.dll is a strong indicator of the classic DLL hijacking pattern where the legitimate library has been renamed so the malicious replacement can proxy calls to it.
+    If confirmed malicious, this activity represents a privilege escalation vector that can result in SYSTEM-level code execution on any host running the SCCM SMS Provider role.
+data_source:
+    - Sysmon EventID 11
+search: |-
+    | tstats `security_content_summariesonly`
+      count min(_time) as firstTime
+            max(_time) as lastTime
+
+    from datamodel=Endpoint.Filesystem where
+
+    Filesystem.action IN ("created", "modified")
+    Filesystem.file_name IN (
+        "adsource.dll",
+        "adsource_*.dll"
+    )
+    Filesystem.file_path="*Microsoft Configuration Manager\\bin\\X64\\*"
+
+    BY Filesystem.action Filesystem.dest Filesystem.file_access_time
+        Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
+        Filesystem.file_name Filesystem.file_path Filesystem.file_acl
+        Filesystem.file_size Filesystem.process_guid Filesystem.process_id
+        Filesystem.user Filesystem.vendor_product
+
+    | `drop_dm_object_name(Filesystem)`
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `windows_sccm_adsource_dll_was_planted_in_sms_provider_directory_filter`
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. If you are using Sysmon, you must have EventID 11 (FileCreate) enabled, and the FileCreate section of the configuration must include TargetFilename paths ending in .dll or "Microsoft Configuration Manager\bin\X64\" folder.
+known_false_positives: |-
+    Legitimate SCCM upgrades or hotfix installations may create or replace adsource.dll in the bin\X64 directory.
+    Validate the file hash and digital signature of any detected adsource.dll against the expected version for the installed SCCM build before tuning.
+references:
+    - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca
+    - https://nvd.nist.gov/vuln/detail/cve-2026-47301
+    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations
+drilldown_searches:
+    - name: View the detection results for - "$dest$"
+      search: '%original_detection_search% | search  dest = "$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+finding:
+    title: Suspicious SCCM adsource DLL [$file_name$] detected at [$file_path$] on [$dest$]
+    entity:
+        field: dest
+        type: system
+        score: 50
+threat_objects:
+    - field: file_name
+      type: file_name
+    - field: file_path
+      type: file_path
+analytic_story:
+    - Windows Privilege Escalation
+asset_type: Endpoint
+cve:
+    - CVE-2026-47301
+mitre_attack_id:
+    - T1574.002
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/sccm_adsource_dll/sysmon.log
+          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
+      test_type: unit