Skip to content

Commit fa45863

Browse files
P4T12ICKP4T12ICK
authored
Merge pull request #3971 from splunk/detections_improvement
Improved detections based on telemetry.
2 parents 697a77c + 30e0c54 commit fa45863

32 files changed

+126
-300
lines changed

detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml renamed to detections/deprecated/attempt_to_add_certificate_to_untrusted_store.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
name: Attempt To Add Certificate To Untrusted Store
22
id: 6bc5243e-ef36-45dc-9b12-f4a6be131159
3-
version: 18
4-
date: '2026-03-10'
3+
version: 19
4+
date: '2026-03-26'
55
author: Patrick Bareiss, Rico Valdez, Splunk
6-
status: production
6+
status: deprecated
77
type: Anomaly
88
description: |
99
The following analytic detects attempts to add a certificate to the untrusted

detections/endpoint/chcp_command_execution.yml renamed to detections/deprecated/chcp_command_execution.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
name: CHCP Command Execution
22
id: 21d236ec-eec1-11eb-b23e-acde48001122
3-
version: 11
4-
date: '2026-03-10'
3+
version: 12
4+
date: '2026-03-23'
55
author: Teoderick Contreras, Splunk
6-
status: production
6+
status: deprecated
77
type: Anomaly
88
description: The following analytic detects the execution of the chcp.com utility, which is used to change the active code page of the console. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events. This activity is significant because it can indicate the presence of malware, such as IcedID, which uses this technique to determine the locale region, language, or country of the compromised host. If confirmed malicious, this could lead to further system compromise and data exfiltration.
99
data_source:

detections/endpoint/processes_launching_netsh.yml renamed to detections/deprecated/processes_launching_netsh.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
name: Processes launching netsh
22
id: b89919ed-fe5f-492c-b139-95dbb162040e
3-
version: 13
4-
date: '2026-03-10'
3+
version: 14
4+
date: '2026-03-26'
55
author: Michael Haag, Josef Kuepker, Splunk
6-
status: production
6+
status: deprecated
77
type: Anomaly
88
description: The following analytic identifies processes launching netsh.exe, a command-line utility used to modify network configurations. It detects this activity by analyzing data from Endpoint Detection and Response (EDR) agents, focusing on process GUIDs, names, parent processes, and command-line executions. This behavior is significant because netsh.exe can be exploited to execute malicious helper DLLs, serving as a persistence mechanism. If confirmed malicious, an attacker could gain persistent access, modify network settings, and potentially escalate privileges, posing a severe threat to the network's integrity and security.
99
data_source:

detections/endpoint/sc_exe_manipulating_windows_services.yml renamed to detections/deprecated/sc_exe_manipulating_windows_services.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
name: Sc exe Manipulating Windows Services
22
id: f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d
3-
version: 14
4-
date: '2026-03-10'
3+
version: 15
4+
date: '2026-03-26'
55
author: Rico Valdez, Splunk
6-
status: production
6+
status: deprecated
77
type: TTP
88
description: The following analytic detects the creation or modification of Windows services using the sc.exe command. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because manipulating Windows services can be a method for attackers to establish persistence, escalate privileges, or execute arbitrary code. If confirmed malicious, this behavior could allow an attacker to maintain long-term access, disrupt services, or gain control over critical system functions, posing a severe threat to the environment.
99
data_source:

‎detections/endpoint/anomalous_usage_of_7zip.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Anomalous usage of 7zip
22
id: 9364ee8e-a39a-11eb-8f1d-acde48001122
3-
version: 12
4-
date: '2026-03-10'
3+
version: 13
4+
date: '2026-03-26'
55
author: Michael Haag, Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
@@ -12,7 +12,7 @@ data_source:
1212
- CrowdStrike ProcessRollup2
1313
search: |-
1414
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
15-
WHERE Processes.parent_process_name IN ("rundll32.exe", "dllhost.exe") Processes.process_name=*7z*
15+
WHERE (Processes.parent_process_name IN ("rundll32.exe", "dllhost.exe") Processes.process_name=*7z*) AND NOT Processes.process_path = "C:\\Program Files\\VMware\\VMware Tools\\7za.exe"
1616
BY Processes.action Processes.dest Processes.original_file_name
1717
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
1818
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path

‎detections/endpoint/conti_common_exec_parameter.yml‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Conti Common Exec parameter
22
id: 624919bc-c382-11eb-adcc-acde48001122
3-
version: 12
4-
date: '2026-03-10'
3+
version: 13
4+
date: '2026-03-26'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: TTP
@@ -12,13 +12,7 @@ data_source:
1212
- CrowdStrike ProcessRollup2
1313
search: |-
1414
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
15-
WHERE Processes.process = "*-m local*"
16-
OR
17-
Processes.process = "*-m net*"
18-
OR
19-
Processes.process = "*-m all*"
20-
OR
21-
Processes.process = "*-nomutex*"
15+
WHERE Processes.process IN ("*-m local", "*-m local *", "*-m net", "*-m net *", "*-m all","*-m all *", "*-nomutex", "*-nomutex *")
2216
BY Processes.action Processes.dest Processes.original_file_name
2317
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
2418
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path

‎detections/endpoint/detect_rundll32_inline_hta_execution.yml‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Rundll32 Inline HTA Execution
22
id: 91c79f14-5b41-11eb-ae93-0242ac130002
3-
version: 11
4-
date: '2026-03-10'
3+
version: 12
4+
date: '2026-03-26'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -14,9 +14,7 @@ search: |-
1414
| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
1515
WHERE `process_rundll32` (Processes.process=*vbscript*
1616
OR
17-
Processes.process=*javascript*
18-
OR
19-
Processes.process=*about*)
17+
Processes.process=*javascript*)
2018
BY Processes.action Processes.dest Processes.original_file_name
2119
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
2220
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path

‎detections/endpoint/disable_schedule_task.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
name: Disable Schedule Task
22
id: db596056-3019-11ec-a9ff-acde48001122
3-
version: 9
4-
date: '2026-03-10'
3+
version: 10
4+
date: '2026-03-26'
55
author: Teoderick Contreras, Splunk
66
status: production
7-
type: TTP
7+
type: Anomaly
88
description: The following analytic detects the execution of a command to disable an existing scheduled task using 'schtasks.exe' with the '/change' and '/disable' parameters. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. Disabling scheduled tasks is significant as it is a common tactic used by adversaries, including malware like IcedID, to disable security applications and evade detection. If confirmed malicious, this activity could allow attackers to persist undetected, disable critical security defenses, and further compromise the targeted host.
99
data_source:
1010
- Sysmon EventID 1

‎detections/endpoint/modify_acl_permission_to_files_or_folder.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Modify ACL permission To Files Or Folder
22
id: 7e8458cc-acca-11eb-9e3f-acde48001122
3-
version: 11
4-
date: '2026-03-10'
3+
version: 12
4+
date: '2026-03-24'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
@@ -19,7 +19,7 @@ search: |
1919
from datamodel=Endpoint.Processes where
2020
Processes.process_name IN ("icacls.exe", "cacls.exe", "xcacls.exe")
2121
Processes.process IN ("*/grant*", "*/g:*", "*/g *")
22-
Processes.process IN ("* Everyone:*", "* SYSTEM:*", "* S-1-1-0:*")
22+
Processes.process IN ("* SYSTEM:*", "* S-1-1-0:*")
2323
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
2424
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
2525
Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec

‎detections/endpoint/possible_lateral_movement_powershell_spawn.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Possible Lateral Movement PowerShell Spawn
22
id: cb909b3e-512b-11ec-aa31-3e22fbd008af
3-
version: 13
4-
date: '2026-03-10'
3+
version: 14
4+
date: '2026-03-26'
55
author: Mauricio Velazco, Michael Haag, Splunk
66
status: production
77
type: TTP

0 commit comments

Comments
 (0)