From e8c603fc3ffe17171e11ec8af3fc42c5345f3305 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Tue, 8 Sep 2026 12:20:25 +0200 Subject: [PATCH 1/2] add some missing TOs --- .../xmrig_driver_loaded.yml | 12 ++++-- ...outlook_credentials_access_in_registry.yml | 37 ++++++++++++++++--- ..._file_creation_in_confluence_directory.yml | 10 +++-- .../windows_vulnerable_driver_installed.yml | 7 +++- ...rmgr_alternate_data_stream_in_temp_dir.yml | 9 +++-- detections/network/dns_kerberos_coercion.yml | 7 +++- ...ernal_horizontal_port_scan_nmap_top_20.yml | 7 +++- ...ftp_authentication_bypass_exploitation.yml | 7 +++- ...rushftp_max_simultaneous_users_from_ip.yml | 7 +++- ...g4shell_jndi_payload_injection_attempt.yml | 9 ++++- ...oad_injection_with_outbound_connection.yml | 12 ++++-- ...se_screenconnect_authentication_bypass.yml | 9 ++++- .../web/plain_http_post_exfiltrated_data.yml | 7 +++- .../unusually_long_content_type_length.yml | 9 ++++- 14 files changed, 114 insertions(+), 35 deletions(-) rename detections/{endpoint => deprecated}/xmrig_driver_loaded.yml (89%) diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/deprecated/xmrig_driver_loaded.yml similarity index 89% rename from detections/endpoint/xmrig_driver_loaded.yml rename to detections/deprecated/xmrig_driver_loaded.yml index a6e725500e..efd2ac89a2 100644 --- a/detections/endpoint/xmrig_driver_loaded.yml +++ b/detections/deprecated/xmrig_driver_loaded.yml @@ -1,10 +1,10 @@ name: XMRIG Driver Loaded id: 90080fa6-a8df-11eb-91e4-acde48001122 -version: 10 +version: 11 creation_date: '2021-05-07' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP description: The following analytic detects the installation of the XMRIG coinminer driver on a system. It identifies the loading of the `WinRing0x64.sys` driver, commonly associated with XMRIG, by analyzing Sysmon EventCode 6 logs for specific signatures and image loads. This activity is significant because XMRIG is an open-source CPU miner frequently exploited by adversaries to mine cryptocurrency illicitly. If confirmed malicious, this activity could lead to unauthorized resource consumption, degraded system performance, and potential financial loss due to unauthorized cryptocurrency mining. data_source: @@ -49,3 +49,9 @@ tests: source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog test_type: unit +deprecation_info: + reason: Detection deprecated as it is inacurate. WinRing0x64.sys is not related to XMRIG. It is a driver that is used to access the hardware ring0. + removed_in_version: 6.10.0 + replacement_content: + - Windows Vulnerable Driver Installed + - Windows Vulnerable Driver Loaded diff --git a/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml b/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml index ccdf81a36d..31d8f46e31 100644 --- a/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml +++ b/detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml @@ -1,15 +1,39 @@ name: Windows Unsecured Outlook Credentials Access In Registry id: 36334123-077d-47a2-b70c-6c7b3cc85049 -version: 14 +version: 15 creation_date: '2024-02-22' -modification_date: '2026-06-25' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects unauthorized access to Outlook credentials stored in the Windows registry. It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles. This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts. If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk. +description: |- + The following analytic detects unauthorized access to Outlook credentials stored in the Windows registry. + It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles. + This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts. + If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk. data_source: - Windows Event Log Security 4663 -search: '`wineventlog_security` EventCode=4663 object_file_path IN ("*\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676*", "*\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676*") AND process_name != *\\outlook.exe | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unsecured_outlook_credentials_access_in_registry_filter`' +search: |- + `wineventlog_security` + EventCode=4663 + object_file_path IN ( + "*\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676*", + "*\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676*" + ) + NOT process_name IN ( + "*\\HxOutlook.exe", + "*\\Outlook.exe" + ) + + | stats count min(_time) as firstTime + max(_time) as lastTime + + by EventCode object_file_name object_file_path + process_name process_path process_id dest + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_unsecured_outlook_credentials_access_in_registry_filter` how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." known_false_positives: third party software may access this outlook registry. references: @@ -29,7 +53,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: A suspicious process $process_name$ accessing outlook credentials registry on $dest$ + message: A suspicious process [$process_name$] accessing outlook credentials registry [$object_file_path$] on [$dest$]. +threat_objects: + - field: process_name + type: process_name analytic_story: - StealC Stealer - Snake Keylogger diff --git a/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml b/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml index 8d84834fed..f463cfdccf 100644 --- a/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml +++ b/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml @@ -1,8 +1,8 @@ name: Windows Unusual File Creation in Confluence Directory id: aa9d80d9-ed47-44da-aceb-2909ca4dc19e -version: 2 +version: 3 creation_date: '2021-09-02' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Raven Tait, Splunk status: production type: Anomaly @@ -42,6 +42,10 @@ search: |- | `windows_unusual_file_creation_in_confluence_directory_filter` how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Some legitimate administrative or development activities may create executable files in the Confluence directory. Review and filter based on approved maintenance processes. +references: + - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-289a + - https://confluence.atlassian.com/security/cve-2023-22515-broken-access-control-vulnerability-in-confluence-data-center-and-server-1295682276.html + - https://www.rapid7.com/blog/post/2023/10/04/etr-cve-2023-22515-zero-day-privilege-escalation-in-confluence-server-and-data-center/ drilldown_searches: - earliest_offset: $info_min_time$ latest_offset: $info_max_time$ @@ -56,7 +60,7 @@ intermediate_findings: - field: dest type: system score: 20 - message: Executable file created under a Confluence path at $file_path$ on $dest$. + message: The process [$process_name$] created an executable file under a Confluence path at [$file_path$] on [$dest$]. threat_objects: - field: file_path type: file_path diff --git a/detections/endpoint/windows_vulnerable_driver_installed.yml b/detections/endpoint/windows_vulnerable_driver_installed.yml index e2832a332f..4884e5dd26 100644 --- a/detections/endpoint/windows_vulnerable_driver_installed.yml +++ b/detections/endpoint/windows_vulnerable_driver_installed.yml @@ -1,8 +1,8 @@ name: Windows Vulnerable Driver Installed id: 1dda7586-57be-4a1b-8de1-a9ad802b9a7f -version: 10 +version: 11 creation_date: '2020-01-19' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Dean Luxton status: production type: TTP @@ -38,6 +38,9 @@ finding: field: dest type: system score: 50 +threat_objects: + - field: ImagePath + type: file_path analytic_story: - Windows Drivers - Void Manticore diff --git a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml index b3ff2e6f63..54fd1c50a9 100644 --- a/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml +++ b/detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml @@ -1,8 +1,8 @@ name: Windows Wermgr Alternate Data Stream in Temp Dir id: 65222e9b-9d0b-4bfe-8da1-199b98e1d44a -version: 1 +version: 2 creation_date: '2026-06-11' -modification_date: '2026-06-11' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -47,7 +47,10 @@ intermediate_findings: - field: dest type: system score: 20 - message: A [$process_name$] created a wermgr.exe alternate stream in the temp directory on $dest$ by $user$ + message: The process [$process_name$] owned by [$user$] created a Wermgr.exe alternate data stream in [$file_path$] on [$dest$] +threat_objects: + - field: file_path + type: file_path analytic_story: - RoguePlanet asset_type: Endpoint diff --git a/detections/network/dns_kerberos_coercion.yml b/detections/network/dns_kerberos_coercion.yml index c5ec0f6c16..3b6869045a 100644 --- a/detections/network/dns_kerberos_coercion.yml +++ b/detections/network/dns_kerberos_coercion.yml @@ -1,8 +1,8 @@ name: DNS Kerberos Coercion id: 8551252d-b5b6-4b6e-8a82-51460aeb29a3 -version: 5 +version: 6 creation_date: '2025-11-18' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Raven Tait, Splunk status: production type: TTP @@ -42,6 +42,9 @@ finding: field: src type: system score: 50 +threat_objects: + - field: query + type: dns_query analytic_story: - Compromised Windows Host - Suspicious DNS Traffic diff --git a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml index 3e03807d67..800abe5718 100644 --- a/detections/network/internal_horizontal_port_scan_nmap_top_20.yml +++ b/detections/network/internal_horizontal_port_scan_nmap_top_20.yml @@ -1,8 +1,8 @@ name: Internal Horizontal Port Scan NMAP Top 20 id: 3141a041-4f57-4277-9faa-9305ca1f8e5b -version: 12 +version: 13 creation_date: '2024-07-01' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Dean Luxton status: production type: TTP @@ -77,6 +77,9 @@ finding: field: src_ip type: system score: 50 +threat_objects: + - field: src_ip + type: ip_address analytic_story: - Network Discovery - Cisco Secure Firewall Threat Defense Analytics diff --git a/detections/web/crushftp_authentication_bypass_exploitation.yml b/detections/web/crushftp_authentication_bypass_exploitation.yml index f86f476bc0..58545166f2 100644 --- a/detections/web/crushftp_authentication_bypass_exploitation.yml +++ b/detections/web/crushftp_authentication_bypass_exploitation.yml @@ -1,8 +1,8 @@ name: CrushFTP Authentication Bypass Exploitation id: 82eb7f64-d219-4e21-acfe-956de84c1a35 -version: 6 +version: 7 creation_date: '2025-04-14' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Michael Haag, Splunk status: production type: TTP @@ -37,6 +37,9 @@ intermediate_findings: type: system score: 50 message: Potential CrushFTP authentication bypass exploitation from IP $src_ip$ as user $user$ +threat_objects: + - field: process + type: process analytic_story: - CrushFTP Vulnerabilities - Hellcat Ransomware diff --git a/detections/web/crushftp_max_simultaneous_users_from_ip.yml b/detections/web/crushftp_max_simultaneous_users_from_ip.yml index 2417444f99..58f97fc476 100644 --- a/detections/web/crushftp_max_simultaneous_users_from_ip.yml +++ b/detections/web/crushftp_max_simultaneous_users_from_ip.yml @@ -1,8 +1,8 @@ name: CrushFTP Max Simultaneous Users From IP id: 75dfd9f4-ca64-45d0-9422-4bde6d26a59e -version: 5 +version: 6 creation_date: '2025-04-14' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Michael Haag, Splunk status: production type: Anomaly @@ -31,6 +31,9 @@ intermediate_findings: type: system score: 20 message: Potential brute force or automated attack against CrushFTP detected from IP $src_ip$ +threat_objects: + - field: src_ip + type: ip_address analytic_story: - CrushFTP Vulnerabilities asset_type: Web Server diff --git a/detections/web/log4shell_jndi_payload_injection_attempt.yml b/detections/web/log4shell_jndi_payload_injection_attempt.yml index a1ea25c3f5..e6c6582a0f 100644 --- a/detections/web/log4shell_jndi_payload_injection_attempt.yml +++ b/detections/web/log4shell_jndi_payload_injection_attempt.yml @@ -1,8 +1,8 @@ name: Log4Shell JNDI Payload Injection Attempt id: c184f12e-5c90-11ec-bf1f-497c9a704a72 -version: 9 +version: 10 creation_date: '2021-12-13' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Jose Hernandez status: production type: Anomaly @@ -38,6 +38,11 @@ intermediate_findings: type: system score: 20 message: CVE-2021-44228 Log4Shell triggered for host $dest$ +threat_objects: + - field: http_user_agent + type: http_user_agent + - field: url + type: url analytic_story: - Log4Shell CVE-2021-44228 - CISA AA22-257A diff --git a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml index bfe6480c26..7f04588142 100644 --- a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml +++ b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml @@ -1,13 +1,14 @@ name: Log4Shell JNDI Payload Injection with Outbound Connection id: 69afee44-5c91-11ec-bf1f-497c9a704a72 -version: 9 +version: 10 creation_date: '2021-12-13' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Jose Hernandez status: production type: Anomaly description: The following analytic detects Log4Shell JNDI payload injections via outbound connections. It identifies suspicious LDAP lookup functions in web logs, such as `${jndi:ldap://PAYLOAD_INJECTED}`, and correlates them with network traffic to known malicious IP addresses. This detection leverages the Web and Network_Traffic data models in Splunk. Monitoring this activity is crucial as it targets vulnerabilities in Java web applications using log4j, potentially leading to remote code execution. If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, and compromise sensitive data within the affected environment. -data_source: [] +data_source: + - Splunk Stream IP search: |- | from datamodel Web.Web | rex field=_raw max_match=0 "[jJnNdDiI]{4}(\:|\%3A|\/|\%2F)(?\w+)(\:\/\/|\%3A\%2F\%2F)(\$\{.*?\}(\.)?)?(?[a-zA-Z0-9\.\-\_\$]+)" | join affected_host type=inner [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic by All_Traffic.dest | `drop_dm_object_name(All_Traffic)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename dest AS affected_host] @@ -37,6 +38,11 @@ intermediate_findings: type: system score: 20 message: CVE-2021-44228 Log4Shell triggered for host $dest$ +threat_objects: + - field: http_user_agent + type: http_user_agent + - field: url + type: url analytic_story: - Log4Shell CVE-2021-44228 - CISA AA22-320A diff --git a/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml b/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml index 154858839f..bae64a63da 100644 --- a/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml +++ b/detections/web/nginx_connectwise_screenconnect_authentication_bypass.yml @@ -1,8 +1,8 @@ name: Nginx ConnectWise ScreenConnect Authentication Bypass id: b3f7a803-e802-448b-8eb2-e796b223bccc -version: 11 +version: 12 creation_date: '2024-02-22' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Michael Haag, Splunk status: production type: TTP @@ -41,6 +41,11 @@ finding: field: dest type: system score: 50 +threat_objects: + - field: http_user_agent + type: http_user_agent + - field: url + type: url analytic_story: - ConnectWise ScreenConnect Vulnerabilities - Seashell Blizzard diff --git a/detections/web/plain_http_post_exfiltrated_data.yml b/detections/web/plain_http_post_exfiltrated_data.yml index e6432c5fff..4a01f10787 100644 --- a/detections/web/plain_http_post_exfiltrated_data.yml +++ b/detections/web/plain_http_post_exfiltrated_data.yml @@ -1,8 +1,8 @@ name: Plain HTTP POST Exfiltrated Data id: e2b36208-a364-11eb-8909-acde48001122 -version: 13 +version: 14 creation_date: '2021-04-22' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Teoderick Contreras, Splunk status: production type: TTP @@ -37,6 +37,9 @@ finding: field: src_ip type: system score: 50 +threat_objects: + - field: dest_ip + type: ip_address analytic_story: - Data Exfiltration - Command And Control diff --git a/detections/web/unusually_long_content_type_length.yml b/detections/web/unusually_long_content_type_length.yml index f5b0a3f1ed..d7975e1a33 100644 --- a/detections/web/unusually_long_content_type_length.yml +++ b/detections/web/unusually_long_content_type_length.yml @@ -1,8 +1,8 @@ name: Unusually Long Content-Type Length id: 57a0a2bf-353f-40c1-84dc-29293f3c35b7 -version: 7 +version: 8 creation_date: '2020-04-29' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Bhavin Patel, Splunk status: experimental type: Anomaly @@ -29,6 +29,11 @@ intermediate_findings: type: system score: 20 message: Unusually Long Content-Type Length ($http_content_type_length$ characters) In Web Request from $src$ +threat_objects: + - field: http_user_agent + type: http_user_agent + - field: url + type: url analytic_story: - Apache Struts Vulnerability asset_type: Web Server From 90fecbba9488fa9e32cc2a2761e1abfde266b9af Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Tue, 8 Sep 2026 13:19:32 +0200 Subject: [PATCH 2/2] additional updates --- ...os_xe_webui_programmatic_configuration.yml | 9 ++-- ...itten_outside_of_the_outlook_directory.yml | 7 ++- .../application/esxi_audit_tampering.yml | 36 +++++++++++--- .../application/esxi_bulk_vm_termination.yml | 47 ++++++++++++++++--- ..._file_creation_in_confluence_directory.yml | 11 +++-- 5 files changed, 86 insertions(+), 24 deletions(-) diff --git a/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml b/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml index 8a22647372..8beac37a15 100644 --- a/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml +++ b/detections/application/cisco_ios_xe_webui_programmatic_configuration.yml @@ -1,13 +1,13 @@ name: Cisco IOS XE WebUI Programmatic Configuration id: f9686576-a23d-4c4d-bfad-a45499dc448a -version: 1 +version: 2 creation_date: '2026-05-19' -modification_date: '2026-05-19' +modification_date: '2026-09-08' author: Nasreddine Bencherchali status: production type: Anomaly description: | - This analytic detects Cisco IOS-XE configuration changes performed by the WebUI WSMA process. + The following analytic detects Cisco IOS-XE configuration changes performed by the WebUI WSMA process. data_source: - Cisco IOS Logs search: |- @@ -47,7 +47,8 @@ intermediate_findings: - field: user type: user score: 20 - message: User $user$ performed Cisco IOS-XE WebUI programmatic configuration on $dest$. + message: User [$user$] performed Cisco IOS-XE WebUI programmatic configuration on [$dest$] via [$process$] on [$vty$]. +threat_objects: [] analytic_story: - Salt Typhoon asset_type: Network diff --git a/detections/application/email_files_written_outside_of_the_outlook_directory.yml b/detections/application/email_files_written_outside_of_the_outlook_directory.yml index 229731bdff..211609724d 100644 --- a/detections/application/email_files_written_outside_of_the_outlook_directory.yml +++ b/detections/application/email_files_written_outside_of_the_outlook_directory.yml @@ -1,8 +1,8 @@ name: Email files written outside of the Outlook directory id: 8d52cf03-ba25-4101-aa78-07994aed4f74 -version: 13 +version: 14 creation_date: '2020-04-29' -modification_date: '2026-07-02' +modification_date: '2026-09-08' author: Bhavin Patel, Splunk status: production type: Anomaly @@ -55,6 +55,9 @@ intermediate_findings: type: system score: 20 message: A new email file [$file_name$] was written to [$file_path$] on endpoint $dest$ by user $user$. +threat_objects: + - field: file_path + type: file_path analytic_story: - Collection and Staging asset_type: Endpoint diff --git a/detections/application/esxi_audit_tampering.yml b/detections/application/esxi_audit_tampering.yml index d0936d95ff..269ff72aeb 100644 --- a/detections/application/esxi_audit_tampering.yml +++ b/detections/application/esxi_audit_tampering.yml @@ -1,17 +1,36 @@ name: ESXi Audit Tampering id: c48a155b-2861-417a-813c-220f5272cf01 -version: 5 +version: 6 creation_date: '2025-07-11' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Raven Tait, Splunk status: production type: TTP -description: This detection identifies the use of the esxcli system auditrecords commands, which can be used to tamper with logging on an ESXi host. This action may indicate an attempt to evade detection or hinder forensic analysis by preventing the recording of system-level audit events. +description: |- + The following analytic identifies the use of the esxcli system auditrecords commands, which can be used to tamper with logging on an ESXi host. + This action may indicate an attempt to evade detection or hinder forensic analysis by preventing the recording of system-level audit events. data_source: - VMWare ESXi Syslog -search: '`esxi_syslog` Message="*esxcli system auditrecords*" Message IN ("*remote*","*local*") NOT Message = "*[shell*" | rex field=_raw "Z (?[\w\.]+)\s" | rex field=_raw "[\w+]\]: (?.*)" | rex field=full_command "\[(?.*)]:\s(?.*)" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_audit_tampering_filter`' -how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. -known_false_positives: Limited false positives in most environments, however tune as needed. +search: |- + `esxi_syslog` + Message="*esxcli system auditrecords*" + Message IN ("*remote*","*local*") + NOT Message = "*[shell*" + + | rex field=_raw "Z (?[\w\.]+)\s" + | rex field=_raw "[\w+]\]: (?.*)" + | rex field=full_command "\[(?.*)]:\s(?.*)" + + | stats count min(_time) as firstTime + max(_time) as lastTime + by dest user command + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `esxi_audit_tampering_filter` +how_to_implement: |- + This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. +known_false_positives: No false positives have been identified at this time. references: - https://detect.fyi/detecting-and-responding-to-esxi-compromise-with-splunk-f33998ce7823 drilldown_searches: @@ -24,11 +43,14 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Audit tampering activity on ESXi host $dest$. + title: Audit tampering activity via [$command$] on ESXi host [$dest$]. entity: field: dest type: system score: 50 +threat_objects: + - field: command + type: command analytic_story: - ESXi Post Compromise - Black Basta Ransomware diff --git a/detections/application/esxi_bulk_vm_termination.yml b/detections/application/esxi_bulk_vm_termination.yml index ba4f702548..4f8cd6c99d 100644 --- a/detections/application/esxi_bulk_vm_termination.yml +++ b/detections/application/esxi_bulk_vm_termination.yml @@ -1,17 +1,49 @@ name: ESXi Bulk VM Termination id: cfe094b4-0737-4a33-9d63-e0562ce2b883 -version: 4 +version: 5 creation_date: '2025-07-11' -modification_date: '2026-05-13' +modification_date: '2026-09-08' author: Raven Tait, Splunk status: production type: TTP -description: This detection identifies when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads. +description: |- + The following analytic detects when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads. data_source: - VMWare ESXi Syslog -search: '`esxi_syslog` | rex field=_raw "\s\[(?[^\]]+)\]:\s(?.+)$" | rex field=_raw "Z (?[\w\.]+)\s.*:\s(?esxcli\s.+)" | eval command=mvappend(esxicli_Command, shell_Command) | where isnotnull(command) | search (command="pkill -9 vmx-*") OR ( command="*esxcli*" AND command="*--format-param*" AND command="*vm process list*" AND command="*awk*" AND command="*esxcli vm process kill*") | stats min(_time) as firstTime max(_time) as lastTime values(_time) as timeStamp values(command) as commands values(user) as user by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_bulk_vm_termination_filter`' -how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. -known_false_positives: Limited false positives in most environments, however tune as needed. +search: |- + `esxi_syslog` + Message IN ( + "*pkill -9 *" + "*process kill*" + ) + | rex field=_raw "\s\[(?[^\]]+)\]:\s(?.+)$" + | rex field=_raw "Z (?[\w\.]+)\s.*:\s(?esxcli\s.+)" + | eval command=mvappend(esxicli_Command, shell_Command) + | where isnotnull(command) + | search (command="pkill -9 vmx-*") + OR + ( + command="*esxcli*" + command="*--format-param*" + command="*vm process list*" + command="*awk*" + command="*esxcli vm process kill*" + ) + | stats min(_time) as firstTime + max(_time) as lastTime + values(_time) as timeStamp + values(command) as commands + + by dest user + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `esxi_bulk_vm_termination_filter` +how_to_implement: |- + This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. +known_false_positives: No false positives have been identified at this time. +references: + - https://www.securityweek.com/microsoft-says-ransomware-gangs-exploiting-just-patched-vmware-esxi-flaw/ drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -22,11 +54,12 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Bulk VM termination activity on ESXi host $dest$. + title: Bulk VM termination activity on ESXi host [$dest$]. entity: field: dest type: system score: 50 +threat_objects: [] analytic_story: - ESXi Post Compromise - Black Basta Ransomware diff --git a/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml b/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml index f463cfdccf..bd0469d430 100644 --- a/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml +++ b/detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml @@ -7,7 +7,7 @@ author: Raven Tait, Splunk status: production type: Anomaly description: |- - Detects executable file formats being created within the Confluence main directory. + The following analytic detects executable file formats being created within the Confluence main directory. This can be indicative of exploitation of the Confluence web services to stage malware. This won't catch adversaries who modify the output location outside the Confluence directory when exploiting. data_source: @@ -32,7 +32,7 @@ search: |- "*.vbs" ) - by Filesystem.dest Filesystem.file_create_time Filesystem.process_path + by Filesystem.dest Filesystem.file_create_time Filesystem.process_path Filesystem.process_name Filesystem.process_guid Filesystem.process_id Filesystem.file_path Filesystem.action Filesystem.file_name Filesystem.user Filesystem.vendor_product @@ -40,8 +40,11 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unusual_file_creation_in_confluence_directory_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Some legitimate administrative or development activities may create executable files in the Confluence directory. Review and filter based on approved maintenance processes. +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + Some legitimate administrative or development activities may create executable files in the Confluence directory. + Review and filter based on approved maintenance processes. references: - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-289a - https://confluence.atlassian.com/security/cve-2023-22515-broken-access-control-vulnerability-in-confluence-data-center-and-server-1295682276.html