Skip to content

Commit 9fc8942

Browse files
nasbenchnasbench
authored
New Rules & Updates - Oct 25 (#3726)
* new rules and updates * fix issues with ci * rename for accurate macro * update description and logic * new wbadmin rule and fix pwsh dataset * more updates for the weekend * update network rules filters * downgrade versions * Update windows_file_transfer_protocol_in_non_common_process_path.yml * add missing DS for some rules * update nirsoft lookup and add new rules * update more nirsoft stuff * update snort message * Update cisco_secure_firewall_filetype_lookup.yml * new analytic and updates / incl. fix #3730 * Update detect_new_local_admin_account.yml * add lnx dataset and fix wildcards
1 parent 0227a4f commit 9fc8942

File tree

42 files changed

+1597
-371
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+1597
-371
lines changed

‎detections/cloud/o365_elevated_mailbox_permission_assigned.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
name: O365 Elevated Mailbox Permission Assigned
22
id: 2246c142-a678-45f8-8546-aaed7e0efd30
3-
version: 8
4-
date: '2025-05-02'
3+
version: 9
4+
date: '2025-10-21'
55
author: Patrick Bareiss, Mauricio Velazco, Splunk
6-
data_source: []
6+
data_source:
7+
- O365 Add-MailboxPermission
78
type: TTP
89
status: production
910
description: The following analytic identifies the assignment of elevated mailbox

‎detections/cloud/o365_mailbox_folder_read_permission_assigned.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
name: O365 Mailbox Folder Read Permission Assigned
22
id: 1435475e-2128-4417-a34f-59770733b0d5
3-
version: 7
4-
date: '2025-05-02'
3+
version: 8
4+
date: '2025-10-21'
55
author: Mauricio Velazco, Splunk
6-
data_source: []
6+
data_source:
7+
- O365 ModifyFolderPermissions
78
type: TTP
89
status: production
910
description: The following analytic identifies instances where read permissions are

‎detections/cloud/o365_mailbox_folder_read_permission_granted.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
name: O365 Mailbox Folder Read Permission Granted
22
id: cd15c0a8-470e-4b12-9517-046e4927db30
3-
version: 8
4-
date: '2025-05-02'
3+
version: 9
4+
date: '2025-10-21'
55
author: Mauricio Velazco, Splunk
6-
data_source: []
6+
data_source:
7+
- O365 ModifyFolderPermissions
78
type: TTP
89
status: production
910
description: The following analytic identifies instances where read permissions are

detections/endpoint/curl_download_and_bash_execution.yml renamed to detections/deprecated/curl_download_and_bash_execution.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
name: Curl Download and Bash Execution
22
id: 900bc324-59f3-11ec-9fb4-acde48001122
3-
version: 9
4-
date: '2025-05-02'
3+
version: 10
4+
date: '2025-10-16'
55
author: Michael Haag, Splunk, DipsyTipsy
6-
status: production
6+
status: deprecated
77
type: TTP
88
description: The following analytic detects the use of curl on Linux or MacOS systems
99
to download a file from a remote source and pipe it directly to bash for execution.

detections/endpoint/w3wp_spawning_shell.yml renamed to detections/deprecated/w3wp_spawning_shell.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
name: W3WP Spawning Shell
22
id: 0f03423c-7c6a-11eb-bc47-acde48001122
3-
version: 10
4-
date: '2025-09-16'
3+
version: 11
4+
date: '2025-10-16'
55
author: Michael Haag, Splunk
6-
status: production
6+
status: deprecated
77
type: TTP
88
description: The following analytic identifies instances where a shell (PowerShell.exe
99
or Cmd.exe) is spawned from W3WP.exe, the IIS worker process. This detection leverages

detections/endpoint/wget_download_and_bash_execution.yml renamed to detections/deprecated/wget_download_and_bash_execution.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
name: Wget Download and Bash Execution
22
id: 35682718-5a85-11ec-b8f7-acde48001122
3-
version: 9
4-
date: '2025-05-02'
3+
version: 10
4+
date: '2025-10-16'
55
author: Michael Haag, Splunk, DipsyTipsy
6-
status: production
6+
status: deprecated
77
type: TTP
88
description: The following analytic detects the use of wget on Windows, Linux or MacOS
99
to download a file from a remote source and pipe it to bash. This detection leverages

‎detections/endpoint/advanced_ip_or_port_scanner_execution.yml‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
name: Advanced IP or Port Scanner Execution
2+
id: 9a4e50c7-5b62-4d52-93b4-f2b61332e9a5
3+
version: 1
4+
date: '2025-10-13'
5+
author: Nasreddine Bencherchali, Splunk
6+
status: production
7+
type: Anomaly
8+
description: |
9+
The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner.
10+
These legitimate administrative tools are often leveraged by threat actors and ransomware operators during the discovery phase to enumerate active hosts and open ports within a target environment.
11+
Detection is based on process creation telemetry referencing known executable names, original file names, or specific command-line parameters such as "/portable" and "/lng" that are characteristic of these tools.
12+
If confirmed malicious, this activity may indicate internal reconnaissance aimed at identifying reachable systems or services prior to lateral movement or further post-compromise actions.
13+
data_source:
14+
- Sysmon EventID 1
15+
- Windows Event Log Security 4688
16+
- CrowdStrike ProcessRollup2
17+
search: |
18+
| tstats `security_content_summariesonly`
19+
count min(_time) as firstTime
20+
max(_time) as lastTime
21+
22+
from datamodel=Endpoint.Processes where
23+
Processes.process_name IN ("advanced_ip_scanner.exe", "advanced_ip_scanner_console.exe", "advanced_port_scanner.exe", "advanced_port_scanner_console.exe")
24+
OR
25+
Processes.original_file_name IN ("advanced_ip_scanner.exe", "advanced_ip_scanner_console.exe", "advanced_port_scanner.exe", "advanced_port_scanner_console.exe")
26+
OR (
27+
Processes.process = "* /portable *"
28+
Processes.process = "* /lng *"
29+
)
30+
31+
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
32+
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
33+
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
34+
Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
35+
Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
36+
37+
| `drop_dm_object_name(Processes)`
38+
| `security_content_ctime(firstTime)`
39+
| `security_content_ctime(lastTime)`
40+
| `advanced_ip_or_port_scanner_execution_filter`
41+
how_to_implement: |
42+
The detection is based on data that originates from Endpoint Detection
43+
and Response (EDR) agents. These agents are designed to provide security-related
44+
telemetry from the endpoints where the agent is installed. To implement this search,
45+
you must ingest logs that contain the process GUID, process name, and parent process.
46+
Additionally, you must ingest complete command-line executions. These logs must
47+
be processed using the appropriate Splunk Technology Add-ons that are specific to
48+
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
49+
data model. Use the Splunk Common Information Model (CIM) to normalize the field
50+
names and speed up the data modeling process.
51+
known_false_positives: |
52+
Legitimate administrators or IT staff may use Advanced IP or Port Scanner for authorized
53+
network management or inventory purposes. Validate the context of execution and apply any filters as necessary.
54+
references:
55+
- https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/
56+
- https://cloud.google.com/blog/topics/threat-intelligence/tactics-techniques-procedures-associated-with-maze-ransomware-incidents/
57+
- https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf
58+
- https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer
59+
- https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20IP%20Scanner
60+
drilldown_searches:
61+
- name: View the detection results for - "$dest$" and "$user$"
62+
search: '%original_detection_search% | search dest = "$dest$" user = "$user$"'
63+
earliest_offset: $info_min_time$
64+
latest_offset: $info_max_time$
65+
- name: View risk events for the last 7 days for - "$dest$" and "$user$"
66+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
67+
"$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
68+
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
69+
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
70+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
71+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
72+
earliest_offset: $info_min_time$
73+
latest_offset: $info_max_time$
74+
rba:
75+
message: Execution of Advanced IP or Port Scanner detected via $process$ on $dest$
76+
risk_objects:
77+
- field: user
78+
type: user
79+
score: 64
80+
- field: dest
81+
type: system
82+
score: 64
83+
threat_objects: []
84+
tags:
85+
analytic_story:
86+
- Windows Defense Evasion Tactics
87+
asset_type: Endpoint
88+
mitre_attack_id:
89+
- T1046
90+
- T1135
91+
product:
92+
- Splunk Enterprise
93+
- Splunk Enterprise Security
94+
- Splunk Cloud
95+
security_domain: endpoint
96+
tests:
97+
- name: True Positive Test
98+
attack_data:
99+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/advanced_ip_port_scanner/advanced_ip_port_scanner.log
100+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
101+
sourcetype: XmlWinEventLog

‎detections/endpoint/detect_new_local_admin_account.yml‎

Lines changed: 25 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect New Local Admin account
22
id: b25f6f62-0712-43c1-b203-083231ffd97d
33
version: 9
4-
date: '2025-10-14'
4+
date: '2025-10-23'
55
author: David Dorsey, Splunk
66
status: production
77
type: TTP
@@ -16,11 +16,30 @@ description: The following analytic detects the creation of new accounts elevate
1616
data_source:
1717
- Windows Event Log Security 4732
1818
- Windows Event Log Security 4720
19-
search: '`wineventlog_security` EventCode=4720 OR (EventCode=4732 Group_Name=Administrators)
20-
| transaction user dest connected=false maxspan=180m | stats count min(_time) as
21-
firstTime max(_time) as lastTime dc(EventCode) as distinct_eventcodes by src_user
22-
user dest | where distinct_eventcodes>1 | `security_content_ctime(firstTime)` |
23-
`security_content_ctime(lastTime)` | `detect_new_local_admin_account_filter`'
19+
search: |
20+
`wineventlog_security`
21+
(
22+
EventCode=4720
23+
OR
24+
(
25+
EventCode=4732
26+
AND
27+
(
28+
Group_Name=Administrators
29+
OR
30+
TargetUserName=Administrators
31+
)
32+
)
33+
)
34+
| transaction user dest connected=false maxspan=180m
35+
| stats count min(_time) as firstTime
36+
max(_time) as lastTime
37+
dc(EventCode) as distinct_eventcodes
38+
by src_user user dest
39+
| where distinct_eventcodes > 1
40+
| `security_content_ctime(firstTime)`
41+
| `security_content_ctime(lastTime)`
42+
| `detect_new_local_admin_account_filter`
2443
how_to_implement: You must be ingesting Windows event logs using the Splunk Windows
2544
TA and collecting event code 4720 and 4732
2645
known_false_positives: The activity may be legitimate. For this reason, it's best

‎detections/endpoint/detect_regasm_with_network_connection.yml‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Regasm with Network Connection
22
id: 07921114-6db4-4e2e-ae58-3ea8a52ae93f
33
version: 11
4-
date: '2025-10-14'
4+
date: '2025-10-20'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -14,12 +14,24 @@ description: The following analytic detects the execution of regasm.exe establis
1414
leading to privilege escalation and further malicious actions within the environment.
1515
data_source:
1616
- Sysmon EventID 3
17-
search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/8 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16
18-
process_name=regasm.exe | stats count min(_time) as firstTime max(_time) as lastTime
19-
by action app dest dest_ip dest_port direction dvc protocol protocol_version src
20-
src_ip src_port transport user vendor_product process_name process_exec process_guid
21-
process_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
22-
| `detect_regasm_with_network_connection_filter`'
17+
search: |
18+
`sysmon`
19+
EventID=3
20+
process_name=regasm.exe
21+
NOT dest_ip IN (
22+
"10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
23+
"127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
24+
"192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
25+
"192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
26+
"198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4"
27+
)
28+
| stats count min(_time) as firstTime max(_time) as lastTime
29+
by action app dest dest_ip dest_port direction dvc protocol protocol_version src
30+
src_ip src_port transport user vendor_product process_name process_exec process_guid
31+
process_id
32+
| `security_content_ctime(firstTime)`
33+
| `security_content_ctime(lastTime)`
34+
| `detect_regasm_with_network_connection_filter`
2335
how_to_implement: To successfully implement this search, you need to be ingesting
2436
logs with the process name, parent process, and command-line executions from your
2537
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

‎detections/endpoint/detect_regsvcs_with_network_connection.yml‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Regsvcs with Network Connection
22
id: e3e7a1c0-f2b9-445c-8493-f30a63522d1a
33
version: 12
4-
date: '2025-10-14'
4+
date: '2025-10-20'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -15,12 +15,24 @@ description: The following analytic identifies instances of Regsvcs.exe establis
1515
data. Immediate investigation and remediation are recommended.
1616
data_source:
1717
- Sysmon EventID 3
18-
search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/8 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16
19-
process_name=regsvcs.exe | stats count min(_time) as firstTime max(_time) as lastTime
20-
by action app dest dest_ip dest_port direction dvc protocol protocol_version src
21-
src_ip src_port transport user vendor_product process_name process_exec process_guid
22-
process_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
23-
| `detect_regsvcs_with_network_connection_filter`'
18+
search: |
19+
`sysmon`
20+
EventID=3
21+
NOT dest_ip IN (
22+
"10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "100.64.0.0/10",
23+
"127.0.0.0/8", "169.254.0.0/16", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
24+
"192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
25+
"192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4", "192.175.48.0/24",
26+
"198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4"
27+
)
28+
process_name=regsvcs.exe
29+
| stats count min(_time) as firstTime max(_time) as lastTime
30+
by action app dest dest_ip dest_port direction dvc protocol protocol_version src
31+
src_ip src_port transport user vendor_product process_name process_exec process_guid
32+
process_id
33+
| `security_content_ctime(firstTime)`
34+
| `security_content_ctime(lastTime)`
35+
| `detect_regsvcs_with_network_connection_filter`
2436
how_to_implement: To successfully implement this search, you need to be ingesting
2537
logs with the process name, parent process, and command-line executions from your
2638
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

0 commit comments

Comments
 (0)