In March, the Splunk Threat Research Team had 2 releases of security content via the Enterprise Security Content Update (ESCU) app (v5.1.1 and v5.2.0), which are now available in Splunk Enterprise Security via the ESCU application update process.   Content highlights include: The new SQL Server Abuse analytic story includes detections covering malicious SQLCMD execution, abuse of xp_cmdshell, unauthorized configuration changes, and more. To learn more about SQL Server exploitation tactics and the detections included in this analytic story, check out the team’s blog Sinister SQL Queries and How to Catch Them. The new GitHub Malicious Activity analytic story includes detections to help identify potential security risks and policy violations in GitHub Enterprise and GitHub Organizations. Several existing detections have been mapped to analytic stories for specific malware families, including Black Basta Ransomware and SystemBC.   New Analytics Executables Or Script Creation In Temp Path GitHub Enterprise Delete Branch Ruleset GitHub Enterprise Disable 2FA Requirement GitHub Enterprise Disable Audit Log Event Stream GitHub Enterprise Disable Classic Branch Protection Rule GitHub Enterprise Disable Dependabot GitHub Enterprise Disable IP Allow List GitHub Enterprise Modify Audit Log Event Stream GitHub Enterprise Pause Audit Log Event Stream GitHub Enterprise Register Self Hosted Runner GitHub Enterprise Remove Organization GitHub Enterprise Repository Archived GitHub Enterprise Repository Deleted GitHub Organizations Delete Branch Ruleset GitHub Organizations Disable 2FA Requirement GitHub Organizations Disable Classic Branch Protection Rule GitHub Organizations Disable Dependabot GitHub Organizations Repository Archived GitHub Organizations Repository Deleted O365 BEC Email Hiding Rule Created (External Contributor: @0xC0FFEEEE) O365 Email Hard Delete Excessive Volume (External Contributor: @nterl0k) O365 Email New Inbox Rule Created (External Contributor: @nterl0k) O365 Email Password and Payroll Compromise Behavior O365 Email Receive and Hard Delete Takeover Behavior O365 Email Send Attachments Excessive Volume O365 Email Send and Hard Delete Exfiltration Behavior O365 Email Send and Hard Delete Suspicious Behavior O365 Email Suspicious Search Behavior Windows Anonymous Pipe Activity Windows PowerShell Invoke-Sqlcmd Execution Windows Process Execution From ProgramData Windows SQL Server Configuration Option Hunt Windows SQL Server Critical Procedures Enabled Windows SQL Server Extended Procedure DLL Loading Hunt Windows SQL Server Startup Procedure Windows SQL Server xp_cmdshell Config Change Windows SQLCMD Execution Windows Scheduled Task with Suspicious Command Windows Scheduled Task with Suspicious Name Windows SnappyBee Create Test Registry Windows Sqlservr Spawning Shell Windows Svchost.exe Parent Process Anomaly Windows Unusual SysWOW64 Process Run System32 Executable   New Analytic Stories Black Basta Ransomware GitHub Malicious Activity SQL Server Abuse SystemBC   For all our tools and security content, please visit research.splunk.com.   — The Splunk Threat Research Team   ... View more

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content Update (ESCU) app (v5.0). With this release, there are 52 new analytics and 9 new analytic stories now available in Splunk Enterprise Security via the ESCU application update process — plus several new exciting enhancements. Highlights include: The team released new analytic stories designed to help identify activity related to various types of malware (i.e., Backdoor Pingpong, Crypto Stealer, Derusbi, WinDealer RAT, and XorDDos), specific threat actors (i.e., Earth Estries, Nexus), and other threats. ESCU 5.0 introduces several enhancements designed to help further security operations. These include: A revamped user interface and home page A new Analytic Story Onboarding Assistant to help accelerate the enablement of detections A new dashboard to help identify detections that are marked as Deprecated by the Splunk Threat Research Team that are currently enabled in your environment And more! Check out the blog “Now Available: Splunk Enterprise Security Content Update App 5.0” for more details. New Analytics (52) ASL AWS Create Access Key ASL AWS Create Policy Version to allow all resources ASL AWS Credential Access GetPasswordData ASL AWS Credential Access RDS Password reset ASL AWS Defense Evasion PutBucketLifecycle ASL AWS Detect Users creating keys with encrypt policy without MFA ASL AWS Disable Bucket Versioning ASL AWS EC2 Snapshot Shared Externally ASL AWS IAM AccessDenied Discovery Events ASL AWS IAM Assume Role Policy Brute Force ASL AWS Network Access Control List Created with All Open Ports ASL AWS Network Access Control List Deleted ASL AWS SAML Update identity provider ASL AWS UpdateLoginProfile Azure AD AzureHound UserAgent Detected Azure AD Service Principal Enumeration Azure AD Service Principal Privilege Escalation Detect Remote Access Software Usage Registry Microsoft Intune Device Health Scripts Microsoft Intune DeviceManagementConfigurationPolicies Microsoft Intune Manual Device Management O365 Service Principal Privilege Escalation Windows Account Access Removal via Logoff Exec Windows CertUtil Download With URL Argument Windows DNS Query Request by Telegram Bot API Windows Detect Network Scanner Behavior Windows File and Directory Enable ReadOnly Permissions Windows File and Directory Permissions Enable Inheritance Windows File and Directory Permissions Remove Inheritance Windows Impair Defenses Disable Auto Logger Session Windows New Custom Security Descriptor Set On EventLog Channel Windows New Deny Permission Set On Service SD Via Sc.EXE Windows New EventLog ChannelAccess Registry Value Set Windows New Service Security Descriptor Set Via Sc.EXE Windows Obfuscated Files or Information via RAR SFX Windows Office Product Dropped Cab or Inf File Windows Office Product Dropped Uncommon File Windows Office Product Spawned Control Windows Office Product Spawned MSDT Windows Office Product Spawned Rundll32 With No DLL Windows Office Product Spawned Uncommon Process Windows Powershell Logoff User via Quser Windows Process With NetExec Command Line Parameters Windows Registry Dotnet ETW Disabled Via ENV Variable Windows Remote Management Execute Shell Windows ScManager Security Descriptor Tampering Via Sc.EXE Windows Service Execution RemCom Windows Service Stop Attempt Windows Set Account Password Policy To Unlimited Via Net Windows SubInAcl Execution Windows Suspicious Child Process Spawned From WebServer Windows User Discovery Via Net New Analytic Stories (9) Backdoor Pingpong Cleo File Transfer Software Crypto Stealer Defense Evasion or Unauthorized Access Via SDDL Tampering Derusbi Earth Estries Nexus APT Threat Activity WinDealer RAT XorDDos For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team ... View more

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk Enterprise Security, Splunk SOAR, and Splunk Attack Analyzer. We know just how eager the community has been to see these integrations come to fruition, so we’re thrilled to share that all of the integrations are live! Now, Splunk Security (cloud) customers can directly leverage Cisco Talos’ invaluable threat intelligence through Cisco Talos Intelligence for Enterprise Security, the Cisco Talos Intelligence connector for Splunk SOAR, and as a globally enabled feature in Splunk Attack Analyzer — at no additional cost. To learn more, read our blog “Harness the Power of Cisco Talos Threat Intelligence Across Splunk Security Products” and then check out the following: Cisco Talos Intelligence for Enterprise Security: Current Splunk Enterprise Security (cloud) customers can download the Cisco Talos Intelligence for Enterprise Security app from Splunkbase here and find additional guidance on leveraging the app’s capabilities here. Cisco Talos Intelligence connector for Splunk SOAR: The Cisco Talos Intelligence connector for Splunk SOAR is now pre-installed for all current Splunk SOAR (cloud) customers. Additional guidance on leveraging the connector’s capabilities is available here. Cisco Talos Intelligence in Splunk Attack Analyzer: These capabilities are globally enabled for all Splunk Attack Analyzer customers and don’t require any extra apps, connectors, or configuration. Check out this blog for additional details. ... View more

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security Content Update (ESCU) app (v4.44.0). With this release, there are 8 new analytics, 3 new analytic stories, and 261 updated analytics now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: The new Lumma Stealer analytics story includes detections related to this information-stealing malware, which leverages several obfuscation techniques like base64 encoding and clipboard manipulation to evade detection. The new Meduza Stealer analytics story includes detections designed to help identify activity related to this stealer, a relatively new threat that was first identified in 2023 and targets sensitive information like login credentials and financial details. The new PAX Stealer analytics story features detections to help identify this data-stealing malware, which is especially stealthy as it’s able to evade antivirus software. New Analytics (8) Microsoft Defender ATP Alerts Microsoft Defender Incident Alerts Windows BitLockerToGo Process Execution Windows BitLockerToGo with Network Activity Windows Credentials Access via VaultCli Module Windows RDP File Execution Windows RDPClient Connection Sequence Events Windows RunMRU Command Execution New Analytic Stories (3) Lumma Stealer Meduza Stealer PXA Stealer Updated Analytics (261) A number of analytics have been updated to address minor typos in the description field, make use of macros, or capture equivalent variants of commands. 7zip CommandLine To SMB Share Path Active Setup Registry Autostart Add DefaultUser And Password In Registry Add or Set Windows Defender Exclusion Allow Inbound Traffic By Firewall Rule Registry Allow Operation with Consent Admin Any Powershell DownloadFile Attacker Tools On Endpoint Attempted Credential Dump From Registry via Reg exe Auto Admin Logon Registry Entry BCDEdit Failure Recovery Modification Batch File Write to System32 CMD Echo Pipe - Escalation CertUtil Download With URLCache and Split Arguments CertUtil Download With VerifyCtl and Split Arguments Certutil exe certificate extraction Clear Unallocated Sector Using Cipher App Clop Common Exec Parameter Clop Ransomware Known Service Name ConnectWise ScreenConnect Path Traversal Windows SACL Conti Common Exec parameter Control Loading from World Writable Directory Create Remote Thread In Shell Application Create local admin accounts using net exe Creation of Shadow Copy with wmic and powershell Creation of Shadow Copy Credential Dumping via Copy Command from Shadow Copy Credential Dumping via Symlink to Shadow Copy Curl Download and Bash Execution DNS Exfiltration Using Nslookup App DSQuery Domain Discovery Deleting Shadow Copies Detect AzureHound Command-Line Arguments Detect Certify Command Line Arguments Detect Distributed Password Spray Attempts Detect Exchange Web Shell Detect HTML Help Spawn Child Process Detect HTML Help URL in Command Line Detect HTML Help Using InfoTech Storage Handlers Detect MSHTA Url in Command Line Detect Password Spray Attempts Detect Regasm Spawning a Process Detect Regsvcs Spawning a Process Detect Regsvr32 Application Control Bypass Detect Rundll32 Application Control Bypass - advpack Detect Rundll32 Application Control Bypass - setupapi Detect Rundll32 Application Control Bypass - syssetup Detect Webshell Exploit Behavior Detect mshta inline hta execution Disable AMSI Through Registry Disable Defender AntiVirus Registry Disable Defender BlockAtFirstSeen Feature Disable Defender Enhanced Notification Disable Defender MpEngine Registry Disable Defender Spynet Reporting Disable Defender Submit Samples Consent Feature Disable ETW Through Registry Disable Logs Using WevtUtil Disable Registry Tool Disable Security Logs Using MiniNt Registry Disable Show Hidden Files Disable UAC Remote Restriction Disable Windows App Hotkeys Disable Windows Behavior Monitoring Disable Windows SmartScreen Protection Disabling CMD Application Disabling ControlPanel Disabling Defender Services Disabling FolderOptions Windows Feature Disabling NoRun Windows App Disabling SystemRestore In Registry Disabling Task Manager Domain Controller Discovery with Nltest Domain Group Discovery With Net Domain Group Discovery With Wmic Dump LSASS via comsvcs DLL Dump LSASS via procdump ETW Registry Disabled Elevated Group Discovery With Net Enable RDP In Other Port Number Enable WDigest UseLogonCredential Registry Enumerate Users Local Group Using Telegram Excel Spawning PowerShell Excel Spawning Windows Script Host Executable File Written in Administrative SMB Share Executables Or Script Creation In Suspicious Path FodHelper UAC Bypass GPUpdate with no Command Line Arguments with Network Hide User Account From Sign-In Screen Hiding Files And Directories With Attrib exe Icacls Deny Command Impacket Lateral Movement Commandline Parameters Impacket Lateral Movement WMIExec Commandline Parameters Impacket Lateral Movement smbexec CommandLine Parameters Kerberoasting spn request with RC4 encryption Known Services Killed by Ransomware Linux Auditd File Permission Modification Via Chmod Malicious PowerShell Process - Encoded Command Malicious Powershell Executed As A Service Monitor Registry Keys for Print Monitors Net Localgroup Discovery Network Connection Discovery With Net Office Application Drop Executable Office Application Spawn Regsvr32 process Office Application Spawn rundll32 process Office Product Spawning BITSAdmin Office Product Spawning CertUtil Office Product Spawning MSHTA Office Product Spawning Rundll32 with no DLL Office Product Spawning Windows Script Host Office Product Spawning Wmic Office Product Writing cab or inf Office Spawning Control Okta Mismatch Between Source and Response for Verify Push Request Password Policy Discovery with Net Ping Sleep Batch Command PowerShell 4104 Hunting Powershell Disable Security Monitoring Powershell Processing Stream Of Data Registry Keys Used For Privilege Escalation Registry Keys for Creating SHIM Databases Remote Process Instantiation via DCOM and PowerShell Remote Process Instantiation via WMI and PowerShell Remote System Discovery with Net Resize ShadowStorage volume Rundll32 Control RunDLL World Writable Directory Rundll32 Shimcache Flush Rundll32 with no Command Line Arguments with Network Ryuk Wake on LAN Command SLUI RunAs Elevated SLUI Spawning a Process Schedule Task with HTTP Command Arguments Schedule Task with Rundll32 Command Trigger Schtasks scheduling job on remote system SearchProtocolHost with no Command Line with Network SecretDumps Offline NTDS Dumping Tool ServicePrincipalNames Discovery with SetSPN Services Escalate Exe Shim Database Installation With Suspicious Parameters Short Lived Scheduled Task Short Lived Windows Accounts Single Letter Process On Endpoint Splunk Unauthenticated Log Injection Web Service Log Spoolsv Spawning Rundll32 Spoolsv Writing a DLL Suspicious Computer Account Name Change Suspicious Copy on System32 Suspicious Process DNS Query Known Abuse Web Services Suspicious Process File Path Suspicious Process With Discord DNS Query Suspicious mshta child process Time Provider Persistence Registry WBAdmin Delete System Backups WMIC XSL Execution via URL Wget Download and Bash Execution WinEvent Scheduled Task Created Within Public Path WinEvent Scheduled Task Created to Spawn Shell WinRAR Spawning Shell Application Windows AD Cross Domain SID History Addition Windows AD Domain Controller Promotion Windows AD Domain Replication ACL Addition Windows AD Privileged Account SID History Addition Windows AD Replication Request Initiated by User Account Windows AD Replication Request Initiated from Unsanctioned Location Windows AD Same Domain SID History Addition Windows AD Short Lived Domain Controller SPN Attribute Windows AD Short Lived Server Object Windows Access Token Manipulation SeDebugPrivilege Windows Alternate DataStream - Process Execution Windows COM Hijacking InprocServer32 Modification Windows Change Default File Association For No File Ext Windows Command Shell DCRat ForkBomb Payload Windows Command and Scripting Interpreter Path Traversal Exec Windows Computer Account With SPN Windows ConHost with Headless Argument Windows Credential Access From Browser Password Store Windows Credential Dumping LSASS Memory Createdump Windows Credentials from Password Stores Chrome Extension Access Windows Credentials from Password Stores Chrome LocalState Access Windows Credentials from Password Stores Chrome Login Data Access Windows Credentials from Password Stores Creation Windows Credentials from Password Stores Deletion Windows Curl Download to Suspicious Path Windows Curl Upload to Remote Destination Windows DISM Remove Defender Windows DLL Search Order Hijacking with iscsicpl Windows Defender Exclusion Registry Entry Windows Disable Change Password Through Registry Windows Disable Lock Workstation Feature Through Registry Windows Disable LogOff Button Through Registry Windows Disable Notification Center Windows Disable Shutdown Button Through Registry Windows Disable Windows Event Logging Disable HTTP Logging Windows Disable or Modify Tools Via Taskkill Windows Domain Admin Impersonation Indicator Windows ESX Admins Group Creation via Net Windows Event Log Cleared Windows Excessive Disabled Services Event Windows Execute Arbitrary Commands with MSDT Windows Gather Victim Network Info Through Ip Check Web Services Windows Hidden Schedule Task Settings Windows Hide Notification Features Through Registry Windows Impair Defense Configure App Install Control Windows Impair Defense Disable Web Evaluation Windows Impair Defense Override SmartScreen Prompt Windows InstallUtil Remote Network Connection Windows InstallUtil URL in Command Line Windows InstallUtil Uninstall Option with Network Windows InstallUtil Uninstall Option Windows Kerberos Local Successful Logon Windows KrbRelayUp Service Creation Windows LSA Secrets NoLMhash Registry Windows MOF Event Triggered Execution via WMI Windows MSIExec Spawn Discovery Command Windows MSIExec Spawn WinDBG Windows Masquerading Explorer As Child Process Windows Masquerading Msdtc Process Windows Mimikatz Binary Execution Windows Modify Registry Disable Restricted Admin Windows Modify Registry EnableLinkedConnections Windows Modify Registry LongPathsEnabled Windows Modify Registry NoChangingWallPaper Windows Modify Registry to Add or Modify Firewall Rule Windows Modify Show Compress Color And Info Tip Registry Windows Modify System Firewall with Notable Process Path Windows Network Share Interaction With Net Windows Non Discord App Access Discord LevelDB Windows Office Product Spawning MSDT Windows PaperCut NG Spawn Shell Windows Parent PID Spoofing with Explorer Windows Privilege Escalation User Process Spawn System Process Windows Query Registry UnInstall Program List Windows Raccine Scheduled Task Deletion Windows Rasautou DLL Execution Windows Registry BootExecute Modification Windows Registry Certificate Added Windows Registry Delete Task SD Windows Registry Modification for Safe Mode Persistence Windows Regsvr32 Renamed Binary Windows Remote Assistance Spawning Process Windows Remote Service Rdpwinst Tool Execution Windows SOAPHound Binary Execution Windows Scheduled Task with Highest Privileges Windows Security Account Manager Stopped Windows Service Create SliverC2 Windows Service Create with Tscon Windows Service Creation Using Registry Entry Windows Snake Malware Service Create Windows Spearphishing Attachment Onenote Spawn Mshta Windows Special Privileged Logon On Multiple Hosts Windows Steal Authentication Certificates - ESC1 Authentication Windows System Binary Proxy Execution Compiled HTML File Decompile Windows UAC Bypass Suspicious Escalation Behavior Windows Unsecured Outlook Credentials Access In Registry Windows Valid Account With Never Expires Password Windows WinDBG Spawning AutoIt3 Winhlp32 Spawning a Process Winword Spawning Cmd Winword Spawning PowerShell Winword Spawning Windows Script Host Wscript Or Cscript Suspicious Child Process For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team ... View more

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise Security Content Update (ESCU) app (v4.43.0). With this release, there are 2 new analytic stories and 9 new analytics now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: Braodo Stealer analytics story: This includes detections to help identify the Braodo Stealer malware, which is designed to steal sensitive information like credentials, cookies, and system data. To learn more about Braodo Stealer and the detections included in this analytics story, check out the team’s blog ”Cracking Braodo Stealer: Analyzing Python Malware and Its Obfuscated Loader.” Enhanced drilldowns: In addition, all TTP or Anomaly and Correlation type detections have had two drilldowns added to their yaml files. The drilldowns let users view detection results for specific risk objects and access risk events from the past 7 days. New Analytic Stories (2) Braodo Stealer Critical Alerts New Analytics (9) Detect Critical Alerts from Security Tools High Volume of Bytes Out to Url Internal Horizontal Port Scan NMAP Top 20 Plain HTTP POST Exfiltrated Data Windows Archived Collected Data In TEMP Folder Windows Credentials from Password Stores Chrome Copied in TEMP Dir Windows Credentials from Web Browsers Saved in TEMP Folder Windows Disable or Stop Browser Process Windows Screen Capture in TEMP folder The team also published the following 4 blogs: Cracking Braodo Stealer: Analyzing Python Malware and Its Obfuscated Loader CosmicSting: A Critical XXE Vulnerability in Adobe Commerce and Magento (CVE-2024-34102) Bypassing the Bypass: Detecting Okta Classic Application Sign-On Policy Evasion Splunk Security Content for Threat Detection & Response: Q3 Roundup For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team ... View more

In October, the Splunk Threat Research Team had one release of new security content via the Enterprise Security Content Update (ESCU) app (v4.42.0). With this release, there are 10 new analytics, 15 updated analytics, and 1 updated analytic story now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: The CISA AA24-241A analytic story was updated with detections tailored to identify malicious usage of PowerShell Web Access in Windows environments. The new detections focus on monitoring PowerShell Web Access activity through the IIS application pool and web access logs, providing enhanced visibility into suspicious or unauthorized access. The Splunk Threat Research Team also updated the security content repository on research.splunk.com to better help security teams find the most relevant content for their organizations, understand how individual detections operate, and stay up-to-date on the latest releases. For more details, check out this blog: Fueling the SOC of the Future with Built-in Threat Research and Detections in Splunk Enterprise Security. New Analytics (10) Splunk Disable KVStore via CSRF Enabling Maintenance Mode Splunk Image File Disclosure via PDF Export in Classic Dashboard Splunk Low-Priv Search as nobody SplunkDeploymentServerConfig App Splunk Persistent XSS via Props Conf Splunk Persistent XSS via Scheduled Views Splunk RCE Through Arbitrary File Write to Windows System Root Splunk SG Information Disclosure for Low Privs User Splunk Sensitive Information Disclosure in DEBUG Logging Channels Windows IIS Server PSWA Console Access Windows Identify PowerShell Web Access IIS Pool Updated Analytics (15) Create Remote Thread into LSASS Detect Regsvcs with Network Connection Linux Auditd Change File Owner To Root Possible Lateral Movement PowerShell Spawn Suspicious Process DNS Query Known Abuse Web Services Windows AdFind Exe Windows DISM Install PowerShell Web Access Windows Enable PowerShell Web Access Windows Impair Defenses Disable AV AutoStart via Registry Windows Modify Registry Utilize ProgIDs Windows Modify Registry ValleyRAT C2 Config Windows Modify Registry ValleyRat PWN Reg Entry Windows Privileged Group Modification Windows Scheduled Task DLL Module Loaded Windows Scheduled Tasks for CompMgmtLauncher or Eventvwr Updated Analytic Stories (1) CISA AA24-241A The team also published the following 4 blogs: ValleyRAT Insights: Tactics, Techniques, and Detection Methods Introducing Splunk Attack Range v3.1 PowerShell Web Access: Your Network's Backdoor in Plain Sight My CUPS Runneth Over (with CVEs) For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team ... View more

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.40.0 and v4.41.0). With these releases, there are 58 new analytics, 4 new analytic stories, and 81 updated analytics now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: The new analytic story “Compromised Linux Host” introduces a robust set of 50 detections for compromised Linux hosts, covering a wide range of activities such as unauthorized account creation, file ownership changes, kernel module modifications, privilege escalation, data destruction, and suspicious service stoppages, enhancing visibility into potential malicious actions and system tampering. We have tagged existing analytics related to Black Suit ransomware TTPs into a new “BlackSuit Ransomware” analytic story, providing organizations with targeted threat detection capabilities to identify and mitigate ransomware attacks before they can cause significant damage. The ValleyRAT analytic story includes new detections tailored to the ValleyRAT malware, providing enhanced monitoring and threat-hunting capabilities for adversarial activity on Windows systems. These detections improve visibility into malicious registry changes, task scheduling anomalies, and suspicious executable behavior. New Analytics (58) Linux Auditd Add User Account Type Linux Auditd Add User Account Linux Auditd At Application Execution Linux Auditd Auditd Service Stop Linux Auditd Base64 Decode Files Linux Auditd Change File Owner To Root Linux Auditd Clipboard Data Copy Linux Auditd Data Destruction Command Linux Auditd Data Transfer Size Limits Via Split Syscall Linux Auditd Data Transfer Size Limits Via Split Linux Auditd Database File And Directory Discovery Linux Auditd Dd File Overwrite Linux Auditd Disable Or Modify System Firewall Linux Auditd Doas Conf File Creation Linux Auditd Doas Tool Execution Linux Auditd Edit Cron Table Parameter Linux Auditd File And Directory Discovery Linux Auditd File Permission Modification Via Chmod Linux Auditd File Permissions Modification Via Chattr Linux Auditd Find Credentials From Password Managers Linux Auditd Find Credentials From Password Stores Linux Auditd Find Private Keys Linux Auditd Find Ssh Private Keys Linux Auditd Hardware Addition Swapoff Linux Auditd Hidden Files And Directories Creation Linux Auditd Insert Kernel Module Using Insmod Utility Auditd Install Kernel Module Using Modprobe Utility Linux Auditd Kernel Module Enumeration Linux Auditd Kernel Module Using Rmmod Utility Linux Auditd Nopasswd Entry In Sudoers File Linux Auditd Osquery Service Stop Linux Auditd Possible Access Or Modification Of Sshd Config File Linux Auditd Possible Access To Credential Files Linux Auditd Possible Access To Sudoers File Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File Linux Auditd Preload Hijack Library Calls Linux Auditd Preload Hijack Via Preload File Linux Auditd Service Restarted Linux Auditd Service Started Linux Auditd Setuid Using Chmod Utility Linux Auditd Setuid Using Setcap Utility Linux Auditd Shred Overwrite Command Linux Auditd Stop Services Linux Auditd Sudo Or Su Execution Linux Auditd Sysmon Service Stop Linux Auditd System Network Configuration Discovery Linux Auditd Unix Shell Configuration Modification Linux Auditd Unload Module Via Modprobe Linux Auditd Virtual Disk File And Directory Discovery Linux Auditd Whoami User Discovery Windows DISM Install PowerShell Web Access Windows Enable PowerShell Web Access Windows Impair Defenses Disable AV AutoStart via Registry Windows Modify Registry Utilize ProgIDs Windows Modify Registry ValleyRAT C2 Config Windows Modify Registry ValleyRat PWN Reg Entry Windows Schedule Task DLL Module Loaded Windows Schedule Tasks for CompMgmtLauncher or Eventvwr New Analytic Stories (4) BlackSuit Ransomware CISA AA24-241A Compromised Linux Host ValleyRAT Updated Analytics (81) ASL AWS Concurrent Sessions From Different Ips Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint Anomalous usage of 7zip Citrix ADC Exploitation CVE-2023-3519 Create Remote Thread into LSASS Create local admin accounts using net exe Detect Credential Dumping through LSASS access Detect New Local Admin account Detect Remote Access Software Usage DNS Detect Remote Access Software Usage File Detect Remote Access Software Usage Process Detect Remote Access Software Usage URL Detect SharpHound Command-Line Arguments Detect SharpHound File Modifications Disable Defender AntiVirus Registry Disabled Kerberos Pre-Authentication Discovery With Get-ADUser Domain Controller Discovery with Nltest Elevated Group Discovery With Net Excessive Usage Of Taskkill Executable File Written in Administrative SMB Share F5 BIG-IP iControl REST Vulnerability CVE-2022-1388 Ivanti Connect Secure Command Injection Attempts Ivanti Connect Secure System Information Access via Auth Bypass Kerberos Pre-Authentication Flag Disabled in UserAccountControl Kubernetes Abuse of Secret by Unusual Location Kubernetes Abuse of Secret by Unusual User Agent Kubernetes Abuse of Secret by Unusual User Group Kubernetes Abuse of Secret by Unusual User Name Kubernetes Access Scanning Kubernetes Create or Update Privileged Pod Kubernetes Cron Job Creation Kubernetes DaemonSet Deployed Kubernetes Falco Shell Spawned Kubernetes Node Port Creation Kubernetes Pod Created in Default Namespace Kubernetes Pod With Host Network Attachment Kubernetes Scanning by Unauthenticated IP Address Kubernetes Suspicious Image Pulling Kubernetes Unauthorized Access Ngrok Reverse Proxy on Network PowerShell 4104 Hunting Powershell Disable Security Monitoring Registry Keys Used For Persistence Rubeus Command Line Parameters Rubeus Kerberos Ticket Exports Through Winlogon Access Rundll32 with no Command Line Arguments with Network Scheduled Task Deleted Or Created via CMD Suspicious Scheduled Task from Public Directory System Information Discovery Detection Unknown Process Using The Kerberos Protocol WinEvent Windows Task Scheduler Event Action Started Windows AD Abnormal Object Access Activity Windows AD Privileged Object Access Activity Windows Abused Web Services Windows AdFind Exe Windows Alternate DataStream - Base64 Content Windows Alternate DataStream - Executable Content Windows Alternate DataStream - Process Execution Windows Create Local Account Windows Disable or Modify Tools Via Taskkill Windows Driver Load Non-Standard Path Windows Modify Registry Delete Firewall Rules Windows Modify Registry to Add or Modify Firewall Rule Windows Ngrok Reverse Proxy Usage Windows Privilege Escalation Suspicious Process Elevation Windows Privilege Escalation System Process Without System Parent Windows Privilege Escalation User Process Spawn System Process Windows Remote Create Service Windows Remote Services Rdp Enable Windows UAC Bypass Suspicious Child Process Windows UAC Bypass Suspicious Escalation Behavior Wsmprovhost LOLBAS Execution Process Spawn Add or Set Windows Defender Exclusion CMLUA Or CMSTPLUA UAC Bypass Eventvwr UAC Bypass Executables Or Script Creation In Suspicious Path FodHelper UAC Bypass Suspicious Process File Path WinEvent Windows Task Scheduler Event Action Started Windows Access Token Manipulation SeDebugPrivilege Windows Defender Exclusion Registry Entry The team also published the following 4 blogs: Splunk Security Content for Threat Detection & Response: Q2 Roundup The Final Shell: Introducing ShellSweepX ShrinkLocker Malware: Abusing BitLocker to Lock Your Data Handala’s Wiper: Threat Analysis and Detections For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team ... View more

In August, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.38.0, v4.39.0 and v4.39.1). With these releases, there are 49 new analytics, 4 new analytic stories, 15 updated analytics, and 1 updated analytic story now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: Detections aimed at addressing vulnerabilities in Ivanti Virtual Traffic Manager (CVE-2024-7593), with a particular focus on detecting SQL injection remote code execution and unauthorized account creation activities. A comprehensive set of new detections for Windows Active Directory, targeting potential threats related to privilege escalation, dangerous ACL modifications, GPO changes, and suspicious attribute modifications. New analytic stories to help detect Compromised Windows Hosts or activities linked to the Handala Wiper Malware. New Analytics (49) Detect Password Spray Attack Behavior From Source (External Contributor: @nterl0k) Detect Password Spray Attack Behavior On User (External Contributor: @nterl0k) Ivanti EPM SQL Injection Remote Code Execution Ivanti VTM New Account Creation O365 DLP Rule Triggered (External Contributor: @nterl0k) O365 Email Access By Security Administrator (External Contributor: @nterl0k) O365 Email Reported By Admin Found Malicious (External Contributor: @nterl0k) Email Reported By User Found Malicious (External Contributor: @nterl0k) O365 Email Security Feature Changed (External Contributor: @nterl0k) O365 Email Suspicious Behavior Alert (External Contributor: @nterl0k) O365 Safe Links Detection (External Contributor: @nterl0k) O365 SharePoint Allowed Domains Policy Changed (External Contributor: @nterl0k) O365 SharePoint Malware Detection (External Contributor: @nterl0k) O365 Threat Intelligence Suspicious Email Delivered (External Contributor: @nterl0k) O365 Threat Intelligence Suspicious File Detected (External Contributor: @nterl0k) O365 ZAP Activity Detection (External Contributor: @nterl0k) Windows AD DCShadow Privileges ACL Addition (External Contributor: @dluxtron) Windows AD Dangerous Deny ACL Modification (External Contributor: @dluxtron) Windows AD Dangerous Group ACL Modification (External Contributor: @dluxtron) Windows AD Dangerous User ACL Modification (External Contributor: @dluxtron) Windows AD Domain Root ACL Deletion (External Contributor: @dluxtron) Windows AD Domain Root ACL Modification (External Contributor: @dluxtron) Windows AD GPO Deleted (External Contributor: @dluxtron) Windows AD GPO Disabled (External Contributor: @dluxtron) Windows AD GPO New CSE Addition(External Contributor: @dluxtron) Windows AD Hidden OU Creation (External Contributor: @dluxtron) Windows AD Object Owner Updated (External Contributor: @dluxtron) Windows AD Self DACL Assignment (External Contributor: @dluxtron) Windows AD Suspicious Attribute Modification (External Contributor: @dluxtron) Crowdstrike Admin Weak Password Policy Crowdstrike Admin With Duplicate Password Crowdstrike High Identity Risk Severity Crowdstrike Medium Identity Risk Severity Crowdstrike Medium Severity Alert Crowdstrike Multiple Low Severity Alerts Crowdstrike Privilege Escalation For Non-Admin User Crowdstrike User Weak Password Policy Crowdstrike User with Duplicate Password O365 Application Available To Other Tenants O365 Cross-Tenant Access Change O365 External Guest User Invited O365 External Identity Policy Changed O365 Privileged Role Assigned To Service Principal O365 Privileged Role Assigned Windows Multiple NTLM Null Domain Authentications Windows Unusual NTLM Authentication Destinations By Source Windows Unusual NTLM Authentication Destinations By User Windows Unusual NTLM Authentication Users By Destination Windows Unusual NTLM Authentication Users By Source New Analytic Stories (4) Ivanti Virtual Traffic Manager CVE-2024-7593 MoonPeak Compromised Windows Host Handala Wiper Updated Analytics (15) Azure AD Concurrent Sessions From Different IPs Azure AD High Number Of Failed Authentications From IP Detect Regasm Spawning a Process Detect Regasm with Network Connection Detect Regasm with no Command Line Arguments Executables Or Script Creation In Suspicious Path Internal Horizontal Port Scan Linux c99 Privilege Escalation Powershell Windows Defender Exclusion Commands Suspicious Process File Path Windows AutoIt3 Execution Windows Data Destruction Recursive Exec Files Deletion Windows Gather Victim Network Info Through Ip Check Web Services Windows High File Deletion Frequency Windows Vulnerable Driver Installed Updated Analytic Stories (1) CISA AA23-347A For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team ... View more

In July, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.35.0, v4.36.0 and v.37.0). With these releases, there are 36 new analytics, 6 new analytic stories, 6 updated analytics, and 20 updated analytic stories now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: The new AcidPour analytic story includes content to help detect and investigate activity that might relate to AcidPour Wiper malware. To learn more about this malware and the content in the related analytic story, check out this blog. The new Gozi Malware analytic story covers the detection and analysis of Gozi malware (also known as Ursnif or ISFB), one of the oldest and most persistent banking trojans. The new ShrinkLocker analytic story includes detections related to ShrinkLocker, a new ransomware that uses Windows BitLocker to encrypt files by creating new boot partitions. New Analytics (36) Splunk DoS via POST Request Datamodel Endpoint Splunk Information Disclosure on Account Login Splunk RCE PDFgen Render Splunk RCE via External Lookup Copybuckets Splunk Stored XSS conf-web Settings on Premises Splunk Stored XSS via Specially Crafted Bulletin Message Splunk Unauthenticated DoS via Null Pointer References Splunk Unauthenticated Path Traversal Modules Messaging Splunk Unauthorized Experimental Items Creation Splunk XSS Privilege Escalation via Custom Urls in Dashboard Splunk XSS Via External Urls in Dashboards SSRF Detect Distributed Password Spray Attempts Detect Password Spray Attempts Internal Horizontal Port Scan Internal Vertical Port Scan Windows AD add Self to Group Windows Increase in Group or Object Modification Activity Windows Increase in User Modification Activity Windows Network Share Interaction With Net Windows Vulnerable Driver Installed Ivanti EPM SQL Injection Remote Code Execution MOVEit Certificate Store Access Failure MOVEit Empty Key Fingerprint Authentication Attempt Windows ESX Admins Group Creation Security Event Windows ESX Admins Group Creation via Net Windows ESX Admins Group Creation via PowerShell Windows Known Abused DLL Loaded Suspiciously (External Contributor: @nterl0k) Windows LOLBAS Executed As Renamed File (External Contributor: @nterl0k) Windows LOLBAS Executed Outside Expected Path (External Contributor: @nterl0k) Windows Modify Registry Configure BitLocker Windows Modify Registry Delete Firewall Rules Windows Modify Registry Disable RDP Windows Modify Registry on Smart Card Group Policy Windows Modify Registry to Add or Modify Firewall Rule Windows Outlook WebView Registry Modification Windows Privileged Group Modification (External Contributor: @TheLawsOfChaos) New Analytic Stories (6) AcidPour Gozi Malware Ivanti EPM Vulnerabilities MOVEit Transfer Authentication Bypass ShrinkLocker VMware ESXi AD Integration Authentication Bypass CVE-2024-37085 Updated Analytics (6) Splunk CSRF in the SSG kvstore Client Endpoint Splunk Enterprise Windows Deserialization File Partition Splunk Stored XSS via Data Model objectName Field Splunk XSS in Highlighted JSON Events Splunk XSS in Save table dialog header in search page Splunk risky Command Abuse disclosed february 2023 Updated Analytic Stories (20) Detect Remote Access Software Usage DNS (External Contributor: @nterl0k) Detect Remote Access Software Usage FileInfo (External Contributor: @nterl0k) Detect Remote Access Software Usage File (External Contributor: @nterl0k) Detect Remote Access Software Usage Process (External Contributor: @nterl0k) Detect Remote Access Software Usage Traffic (External Contributor: @nterl0k) Detect Remote Access Software Usage URL (External Contributor: @nterl0k) Possible Lateral Movement PowerShell Spawn Linux Obfuscated Files or Information Base64 Decode Linux Decode Base64 to Shell Windows Protocol Tunneling with Plink Malicious PowerShell Process - Encoded Command Windows Event Log Cleared Azure AD Admin Consent Bypassed by Service Principal (External Contributor: @dluxtron) Azure AD Global Administrator Role Assigned (External Contributor: @dluxtron) Azure AD Privileged Role Assigned (External Contributor: @dluxtron) Azure AD Service Principal New Client Credentials (External Contributor: @dluxtron) Detect New Local Admin account (External Contributor: @dluxtron) Kerberos Pre-Authentication Flag Disabled in UserAccountControl (External Contributor: @dluxtron) Detect Renamed PSExec (External Contributor: Alex Oberkircher, Github) Scheduled Task Initiation on Remote Endpoint (External Contributor: @badoodish, Github) The team also published the following blogs: Introducing ShellSweepPlus: Open-Source Web Shell Detection Breaking Down Linux.Gomir: Understanding this Backdoor’s TTPs Splunk Security Content for Impact Assessment of CrowdStrike Windows Outage AcidPour Wiper Malware: Threat Analysis and Detections For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team ... View more

In June, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.33.0 and v4.34.0). With these releases, there are 3 new analytics, 2 new analytic stories, and 10 updated analytics now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: The new CrushFTP Vulnerabilities analytic story includes content to help identify indicators of CVE-2024-4040 exploitation. To learn more about this vulnerability and how to use Splunk to identify and investigate CVE-2024-4040, check out this blog. The new Gomir analytic story includes detections that help security analysts identify and investigate unusual activities associated with the Gomir backdoor malware. The team also updated over 1,200 analytics descriptions for stylistic changes and improved readability. New Analytics (3) CrushFTP Server Side Template Injection Windows Debugger Tool Execution Windows Unsigned DLL Side-Loading In Same Process Path New Analytic Stories (2) CrushFTP Vulnerabilities Gomir Updated Analytics (10) Azure AD Privileged Role Assigned Azure AD Privileged Role Assigned to Service Principal Kubernetes Nginx Ingress LFI Windows AppLocker Block Events Windows Credential Access From Browser Password Store Windows Defender ASR Audit Events Windows Defender ASR Block Events Windows Defender ASR Registry Modification Windows Defender ASR Rule Disabled Windows Defender ASR Rules Stacking The team also published the following 4 blogs: Security Insights: Detecting CVE-2024-4040 Exploitation in CrushFTP Deploy, Test, Monitor: Mastering Microsoft AppLocker, Part 1 Deploy, Test, Monitor: Mastering Microsoft AppLocker, Part 2 LNK or Swim: Analysis & Simulation of Recent LNK Phishing For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team ... View more

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.31.0, v4.31.1 and v4.32.0). With these releases, there are 7 new analytics and 23 updated analytics, now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: The new analytic Windows Process Writing File to World Writable Path detects a process writing a file, specifically a .txt, to a world-writable path. This technique has been used by APT29-related campaign adversaries. We added 6 new analytics and updated 6 existing analytics focused on AWS, detecting critical security events such as attempts to disable or modify CloudTrail logging, unauthorized container uploads to Amazon Elastic Container Service (ECR), and suspicious Identity & Access Management (IAM) group deletions. New Analytics (7) Windows Process Writing File to World Writable Path ASL AWS Defense Evasion Stop Logging Cloudtrail ASL AWS Defense Evasion Update Cloudtrail ASL AWS ECR Container Upload Outside Business Hours ASL AWS ECR Container Upload Unknown User ASL AWS IAM Failure Group Deletion ASL AWS IAM Successful Group Deletion Updated Analytics (23) Create Policy Version to allow all resources Detect Rare Executables Prohibited Network Traffic Allowed Remote Desktop Network Traffic Windows Masquerading Explorer As Child Process Recon AVProduct Through Pwh or WMI Detect Outbound SMB Traffic MSHTML Module Load in Office Product Office Document Creating Schedule Task Office Document Executing Macro Code Windows InstallUtil Credential Theft ASL AWS Concurrent Sessions From Different Ips ASL AWS Defense Evasion Delete CloudWatch Log Group ASL AWS Defense Evasion Delete Cloudtrail ASL AWS Defense Evasion Impair Security Services ASL AWS IAM Delete Policy ASL AWS Multi-Factor Authentication Disabled Detect Regasm Spawning a Process Possible Lateral Movement PowerShell Spawn Process Creating LNK file in Suspicious Location Process Execution via WMI Windows InstallUtil Uninstall Option Windows MOF Event Triggered Execution via WMI The team also published the following 3 blogs: Hunting M365 Invaders: Dissecting Email Collection Techniques Splunk Tools & Analytics To Empower Threat Hunters Splunk Security Content for Threat Detection & Response: Q1 Roundup For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team ... View more

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.29.0 and v4.30.0). With these releases, there are 41 new analytics, 5 new analytic stories, 32 updated analytics, and 3 updated analytic stories now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: The new Okta Account Takeover analytic story features detections covering suspicious activities within an Okta tenant, including failed multi-factor authentication attempts and unauthorized Identity Provider modifications. The new Windows AppLocker analytic story features detections covering WindowsAppLocker event logs to help detect attempts to bypass application restrictions. The new Zscaler Browser Proxy Threats analytic story features detections covering threats blocked by Zscaler, including malware, crypto-miners, virus downloads, and more. New Analytics (41) Windows InProcServer32 New Outlook Form Windows MSHTA Writing to World Writable Path Windows New InProcServer32 Added Windows Phishing Outlook Drop Dll In FORM Dir Windows SqlWriter SQLDumper DLL Sideload Okta Authentication Failed During MFA Challenge Okta IDP Lifecycle Modifications Okta Multi-Factor Authentication Disabled Okta Multiple Accounts Locked Out Okta Multiple Failed MFA Requests For User Okta Multiple Users Failing To Authenticate From Ip Okta Successful Single Factor Authentication Okta Unauthorized Access to Application O365 Compliance Content Search Exported O365 Compliance Content Search Started O365 Elevated Mailbox Permission Assigned O365 Mailbox Email Forwarding Enabled O365 Mailbox Folder Read Permission Assigned O365 Mailbox Folder Read Permission Granted O365 New Email Forwarding Rule Created O365 New Email Forwarding Rule Enabled O365 New Forwarding Mailflow Rule Created O365 Security And Compliance Alert Triggered Okta User Logins From Multiple Cities Windows AppLocker Block Events Windows AppLocker Execution from Uncommon Locations Windows AppLocker Privilege Escalation via Unauthorized Bypass Windows AppLocker Rare Application Launch Detection Windows Unsigned MS DLL Side-Loading Zscaler Adware Activities Threat Blocked Zscaler Behavior Analysis Threat Blocked Zscaler CryptoMiner Downloaded Threat Blocked Zscaler Employment Search Web Activity Zscaler Exploit Threat Blocked Zscaler Legal Liability Threat Blocked Zscaler Malware Activity Threat Blocked Zscaler Phishing Activity Threat Blocked Zscaler Potentially Abused File Download Zscaler Privacy Risk Destinations Threat Blocked Zscaler Scam Destinations Threat Blocked Zscaler Virus Download threat blocked New Analytic Stories (5) APT29 Diplomatic Deceptions with WINELOADER Outlook RCE CVE-2024-21378 Okta Account Takeover Windows AppLocker Zscaler Browser Proxy Threats Updated Analytics (32) CertUtil With Decode Argument Email Attachments With Lots Of Spaces Okta MFA Exhaustion Hunt Okta Mismatch Between Source and Response for Verify Push Request Okta Multiple Failed Requests to Access Applications Okta New API Token Created Okta New Device Enrolled on Account Okta Phishing Detection with FastPass Origin Check Okta Risk Threshold Exceeded Okta Suspicious Activity Reported Okta Suspicious Use of a Session Cookie Okta ThreatInsight Threat Detected Suspicious Email Attachment Extensions O365 Admin Consent Bypassed by Service Principal O365 Application Impersonation Role Assigned O365 Mailbox Inbox Folder Shared with All Users O365 PST export alert Detect Use of cmd exe to Launch Script Interpreters Detection of tools built by NirSoft Excessive File Deletion In WinDefender Folder Linux Account Manipulation Of SSH Config and Keys Linux Deletion of SSL Certificate Malicious Powershell Executed As A Service Registry Keys Used For Persistence SchCache Change By App Connect And Create ADSI Object Suspicious Regsvr32 Register Suspicious Path Windows Data Destruction Recursive Exec Files Deletion Windows High File Deletion Frequency Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos SMB Traffic Spike SMB Traffic Spike - MLTK Web Remote ShellServlet Access Updated Analytic Stories (3) Azure Active Directory Account Takeover Compromised User Account GCP Account Takeover The team also published the blog From Water to Wine: An Analysis of WINELOADER. For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team ... View more

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.26.0, v4.27.0, and v4.28.0). With these releases, there are 18 new analytics, 1 new analytic story, 31 updated analytics, and 2 updated analytic stories now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: A new analytic story and detections for CVE-2024-27198 and CVE-2024-27199. This security content addresses critical authentication bypass vulnerabilities in JetBrains TeamCity. To learn more about these vulnerabilities and security content, check out our blog. Six new detections for remote monitoring management (RMM) software abuse contributed by @nterl0k. Thank you! New Analytics (18) Cloud Security Groups Modifications by User Detect Remote Access Software Usage File (External Contributor : @nterl0k) Detect Remote Access Software Usage FileInfo (External Contributor : @nterl0k) Detect Remote Access Software Usage Process (External Contributor : @nterl0k) Windows Multiple Account Passwords Changed Windows Multiple Accounts Deleted Windows Multiple Accounts Disabled Detect Remote Access Software Usage DNS (External Contributor : @nterl0k) Detect Remote Access Software Usage Traffic (External Contributor : @nterl0k) High Volume of Bytes Out to Url Detect Remote Access Software Usage URL (External Contributor : @nterl0k) JetBrains TeamCity Authentication Bypass CVE-2024-27198 JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198 JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199 Nginx ConnectWise ScreenConnect Authentication Bypass Windows Credential Access From Browser Password Store Windows Known Abused DLL Created (External Contributor : @nterl0k) Splunk Authentication Token Exposure in Debug Log New Analytic Stories (1) JetBrains TeamCity Vulnerabilities Updated Analytics (31) AWS IAM Delete Policy O365 Multiple Users Failing To Authenticate From Ip ConnectWise ScreenConnect Authentication Bypass JetBrains TeamCity RCE Attempt Okta User Logins From Multiple Cities Path traversal SPL injection Splunk User Enumeration Attempt AWS Concurrent Sessions From Different Ips AWS Credential Access RDS Password reset Kubernetes Nginx Ingress LFI Kubernetes Nginx Ingress RFI Kubernetes Previously Unseen Process Detect AzureHound Command-Line Arguments Detect AzureHound File Modifications Detect SharpHound Command-Line Arguments Detect SharpHound File Modifications Detect SharpHound Usage Disabling Windows Local Security Authority Defences via Registry Linux Iptables Firewall Modification Linux Kworker Process In Writable Process Path Linux Stdout Redirection To Dev Null File Network Traffic to Active Directory Web Services Protocol System Information Discovery Detection Windows SOAPHound Binary Execution Splunk Command and Scripting Interpreter Risky Commands ASL AWS Concurrent Sessions From Different Ips Gsuite Outbound Email With Attachment To External Domain Detect Excessive Account Lockouts From Endpoint Detect Excessive User Account Lockouts Short Lived Windows Accounts Windows Create Local Account Updated Analytic Stories (2) Cyclops Blink Sneaky Active Directory Persistence Tricks The team also published the following 3 blogs: Security Insights: JetBrains TeamCity CVE-2024-27198 and CVE-2024-27199 Under the Hood of SnakeKeylogger: Analyzing its Loader and its Tactics, Techniques, and Procedures Splunk Security Content for Threat Detection & Response: Q4 Roundup For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team ... View more

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with pre-built frameworks and content aligned to PCI DSS requirements and common threats to cardholder data environments.  To help customers further simplify day-to-day compliance operations, remediate compliance-related issues and threats, and demonstrate adherence to PCI DSS requirements, we’re happy to share the release of version 5.3.1. Check out the documentation to learn more, and download the Splunk App for PCI Compliance on Splunkbase. ... View more

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, Splunk Enterprise, and Splunk Enterprise Security deployment and help strengthen an organization’s security program — no matter their current level of maturity. To help you mature your program even faster, we released version 3.8.0, which includes: An updated security data maturity journey that includes four levels instead of six stages Faster content searches and loading in security content  A new MITRE ATT&CK benchmarking dashboard to check how your detections stack up against the top 20 techniques To learn more about each of these updates, check out the full blog and release notes. Download Splunk Security Essentials on Splunkbase. ... View more

Last month, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.24.0 and v4.25.0). With these releases, there are 27 new analytics, 5 new analytic stories, 110 updated analytics, and 1 updated analytic story now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: New content to help detect Midnight Blizzard (also known as Nobelium and APT29) attack techniques, improving detection coverage against sophisticated threats targeting Microsoft 365 environments. To learn more about Midnight Blizzard and the security content created by the Splunk Threat Research Team, check out the blog “Hunting M365 Invaders: Navigating the Shadows of Midnight Blizzard.” A new analytic story with content that can be used to help detect Phemedrone Stealer activities. To learn more about Phemedrone Stealer and the security content created by the Splunk Threat Research Team, check out the blog “Unveiling Phemedrone Stealer: Threat Analysis and Detections.” New content to help detect the critical ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows an attacker to bypass authentication using an alternate path or channel. New Analytics (27) Azure AD Admin Consent Bypassed by Service Principal Azure AD FullAccessAsApp Permission Assigned Azure AD Multiple Service Principals Created by SP Azure AD Multiple Service Principals Created by User Azure AD Privileged Graph API Permission Assigned Azure AD Service Principal Authentication O365 Admin Consent Bypassed by Service Principal O365 FullAccessAsApp Permission Assigned O365 Multiple Mailboxes Accessed via API O365 Multiple Service Principals Created by SP O365 Multiple Service Principals Created by User O365 OAuth App Mailbox Access via EWS O365 OAuth App Mailbox Access via Graph API O365 Privileged Graph API Permission Assigned Network Traffic to Active Directory Web Services Protocol Windows Privilege Escalation Suspicious Process Elevation Windows Privilege Escalation System Process Without System Parent Windows Privilege Escalation User Process Spawn System Process Windows SOAPHound Binary Execution Ivanti Connect Secure SSRF in SAML Component ConnectWise ScreenConnect Path Traversal ConnectWise ScreenConnect Path Traversal Windows SACL Windows Non Discord App Access Discord LevelDB Windows Time Based Evasion via Choice Exec Windows Unsecured Outlook Credentials Access In Registry ConnectWise ScreenConnect Authentication Bypass WordPress Bricks Builder plugin RCE New Analytic Stories (5) Office 365 Collection Techniques Phemedrone Stealer ConnectWise ScreenConnect Vulnerabilities Snake Keylogger WordPress Vulnerabilities Updated Analytics (110) Splunk unnecessary file extensions allowed by lookup table uploads Azure AD High Number Of Failed Authentications From Ip Azure AD Multi-Source Failed Authentications Spike Azure AD Privileged Role Assigned Azure AD Privileged Role Assigned to Service Principal Azure AD Service Principal Created Azure AD Service Principal New Client Credentials Azure AD Service Principal Owner Added Azure AD Tenant Wide Admin Consent Granted O365 Added Service Principal O365 Application Registration Owner Added O365 ApplicationImpersonation Role Assigned O365 Mailbox Inbox Folder Shared with All Users O365 Mailbox Read Access Granted to Application O365 Multi-Source Failed Authentications Spike O365 Multiple Users Failing To Authenticate From Ip O365 Service Principal New Client Credentials O365 Suspicious Admin Email Forwarding O365 Suspicious Rights Delegation O365 Suspicious User Email Forwarding O365 Tenant Wide Admin Consent Granted Correlation by Repository and Risk Correlation by User and Risk Any Powershell DownloadFile Any Powershell DownloadString Attacker Tools On Endpoint Create local admin accounts using net exe Create Remote Thread In Shell Application Creation of Shadow Copy Detect Certify Command Line Arguments Detect Certify With PowerShell Script Block Logging Detect Excessive Account Lockouts From Endpoint Detect New Local Admin account Detect Regasm with Network Connection Detect Regsvcs with Network Connection Detect Use of cmd exe to Launch Script Interpreters Disable Show Hidden Files Disable Windows SmartScreen Protection Disabling ControlPanel Disabling SystemRestore In Registry Download Files Using Telegram Elevated Group Discovery with PowerView Executable File Written in Administrative SMB Share Executables Or Script Creation In Suspicious Path Execute Javascript With Jscript COM CLSID Execution of File with Multiple Extensions Extraction of Registry Hives Hiding Files And Directories With Attrib exe Linux Account Manipulation Of SSH Config and Keys Linux Deletion Of Cron Jobs Linux Deletion Of Init Daemon Script Linux Deletion Of Services Linux Deletion of SSL Certificate Linux High Frequency Of File Deletion In Boot Folder Linux High Frequency Of File Deletion In Etc Folder MacOS LOLbin MacOS plutil Network Discovery Using Route Windows App Non Chrome Process Accessing Chrome Default Dir Non Firefox Process Access Firefox Profile Dir Overwriting Accessibility Binaries PowerShell - Connect To Internet With Hidden Window Rundll32 Process Creating Exe Dll Files Scheduled Task Deleted Or Created via CMD Schtasks scheduling job on remote system Spoolsv Spawning Rundll32 Spoolsv Writing a DLL Spoolsv Writing a DLL - Sysmon Suspicious Driver Loaded Path Suspicious mshta child process Suspicious Process DNS Query Known Abuse Web Services Suspicious Process File Path System Processes Run From Unexpected Locations Trickbot Named Pipe Windows Account Discovery for None Disable User Account Windows AD Replication Request Initiated by User Account Windows AD Replication Request Initiated from Unsanctioned Location Windows Admin Permission Discovery Windows Alternate DataStream - Base64 Content Windows Alternate DataStream - Executable Content Windows Credentials from Password Stores Chrome Extension Access Windows Credentials from Password Stores Chrome LocalState Access Windows Credentials from Password Stores Chrome Login Data Access Windows Gather Victim Network Info Through Ip Check Web Services Windows Process Injection Remote Thread Windows Registry Payload Injection Windows Replication Through Removable Media Windows Rundll32 WebDav With Network Connection Windows Scheduled Task Created Via XML Windows Scheduled Task Service Spawned Shell Windows Security Account Manager Stopped Windows Suspect Process With Authentication Traffic Windows UAC Bypass Suspicious Child Process Windows UAC Bypass Suspicious Escalation Behavior Windows WinLogon with Public Network Connection WinEvent Scheduled Task Created Within Public Path Detect DGA domains using pretrained model in DSDL Multiple Archive Files Http Post Traffic Plain HTTP POST Exfiltrated Data DNS Query Length With High Standard Deviation Detect Regasm Spawning a Process High Process Termination Frequency Linux Edit Cron Table Parameter Processes launching netsh Registry Keys Used For Persistence Suspicious Process Executed From Container File Windows File Transfer Protocol In Non-Common Process Path Windows Phishing PDF File Executes URL Link Windows System Network Connections Discovery Netsh Windows User Execution Malicious URL Shortcut File Updated Analytic Stories (1) NOBELIUM Group The team also published the following 3 blogs: Unveiling Phemedrone Stealer: Threat Analysis and Detections Hunting M365 Invaders: Navigating the Shadows of Midnight Blizzard Another Year of RATs and Trojan Stealer: Detection Commonalities and Summary Plus, Principal Threat Researcher Michael Haag hosted the Tech Talk "Using the Splunk Threat Research Team’s Latest Security Content.” During this Tech Talk, Michael provided: Best practices for accessing and using the team’s content in the ESCU app An overview of the team’s content updates between November and January Deeper dives into new content for detecting DarkGate malware, Office 365 account takeover, and Windows Attack Surface Reduction events You can watch the Tech Talk on-demand here. For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team ... View more

Last month, the Splunk Threat Research Team had 5 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.19.0., v4.20.0, v4.21.0, v4.22.0, and v.4.23.0). With these releases, there are 74 new analytics, 5 new analytic stories, 14 updated analytics, and 3 updated analytic stories now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: The new "Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring" analytic story includes a range of detections that identify abnormal or unexpected container behavior in Kubernetes environments, using metrics from Splunk Observability Cloud. The new “CISA AA23-347A” analytic story includes a variety of detections that allow you to detect and investigate unusual activities that might be related to SVR cyber activity. The new “Ivanti Connect Secure VPN Vulnerabilities'' analytic story addresses critical vulnerabilities CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure and Ivanti Policy Secure Gateways. The team also published a blog with additional information about these vulnerabilities and how to use this new threat detection content. New Analytics (74) Kubernetes Anomalous Inbound Outbound Network IO Kubernetes Anomalous Inbound to Outbound Network IO Ratio Kubernetes Previously Unseen Container Image Name Kubernetes Previously Unseen Process Kubernetes Process Running From New Path Kubernetes Process with Anomalous Resource Utilisation Kubernetes Process with Resource Ratio Anomalies Kubernetes Shell Running on Worker Node with CPU Activity Kubernetes Shell Running on Worker Node Windows Account Discovery For None Disable User Account Windows Lsa Secrets Nolmhash Registry Windows Modify Registry Disable Restricted Admin Windows Account Discovery For Sam Account Name Windows Account Discovery With Netuser PreauthNotRequire Windows Archive Collected Data Via Powershell Windows Domain Account Discovery Via Get Netcomputer Windows Known Graphicalproton Loaded Modules Windows Process Commandline Discovery Windows System User Privilege Discovery Windows Modify Registry Nochangingwallpaper Windows Rundll32 Apply User Settings Changes Windows UAC Bypass Suspicious Child Process (External Contributor : @nterl0k) Windows UAC Bypass Suspicious Escalation Behavior (External Contributor : @nterl0k) Windows Alternate DataStream - Base64 Content (External Contributor : @nterl0k) Windows Alternate DataStream - Process Execution (External Contributor : @nterl0k) Windows Alternate DataStream - Executable Content (External Contributor : @nterl0k) O365 Concurrent Sessions From Different Ips Splunk ES DoS Investigations Manager via Investigation Creation Splunk ES DoS Through Investigation Attachments Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint Ivanti Connect Secure Command Injection Attempts Ivanti Connect Secure System Information Access via Auth Bypass Splunk Enterprise KV Store Incorrect Authorization Splunk Enterprise Windows Deserialization File Partition Confluence Pre-Auth RCE via OGNL Injection CVE-2023-22527 Splunk Information Disclosure in Splunk Add-on Builder Kubernetes Anomalous Inbound Network Activity from Process Kubernetes Anomalous Outbound Network Activity from Process Kubernetes Anomalous Traffic on Network Edge Kubernetes Create or Update Privileged Pod Kubernetes Cron Job Creation Kubernetes DaemonSet Deployed Kubernetes Falco Shell Spawned Kubernetes newly seen TCP edge Kubernetes newly seen UDP edge Kubernetes Node Port Creation Kubernetes Pod Created in Default Namespace Kubernetes Pod With Host Network Attachment Kubernetes Scanning by Unauthenticated IP Address Windows Impair Defense Change Win Defender Health Check Intervals Windows Impair Defense Change Win Defender Quick Scan Interval Windows Impair Defense Change Win Defender Throttle Rate Windows Impair Defense Change Win Defender Tracing Level Windows Impair Defense Configure App Install Control Windows Impair Defense Define Win Defender Threat Action Windows Impair Defense Disable Controlled Folder Access Windows Impair Defense Disable Defender Firewall And Network Windows Impair Defense Disable Defender Protocol Recognition Windows Impair Defense Disable PUA Protection Windows Impair Defense Disable Realtime Signature Delivery Windows Impair Defense Disable Web Evaluation Windows Impair Defense Disable Win Defender App Guard Windows Impair Defense Disable Win Defender Compute File Hashes Windows Impair Defense Disable Win Defender Gen reports Windows Impair Defense Disable Win Defender Network Protection Windows Impair Defense Disable Win Defender Report Infection Windows Impair Defense Disable Win Defender Scan On Update Windows Impair Defense Disable Win Defender Signature Retirement Windows Impair Defense Overide Win Defender Phishing Filter Windows Impair Defense Override SmartScreen Prompt Windows Impair Defense Set Win Defender Smart Screen Level To Warn Windows MsiExec HideWindow Rundll32 Execution Windows Process Injection In Non-Service SearchIndexer Jenkins Arbitrary File Read CVE-2024-23897 New Analytic Stories (5) CISA AA23-347A Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring Ivanti Connect Secure VPN Vulnerabilities Confluence Data Center and Confluence Server Vulnerabilities Jenkins Server Vulnerabilities Updated Analytics (14) GCP Authentication Failed During MFA Challenge GCP Multi-Factor Authentication Disabled GCP Successful Single-Factor Authentication Windows Steal Authentication Certificates - ESC1 Abuse Allow Network Discovery In Firewall Msmpeng Application DLL Side Loading Confluence Data Center and Server Privilege Escalation Confluence Unauthenticated Remote Code Execution CVE-2022-26134 Kubernetes Access Scanning Kubernetes AWS detect suspicious kubectl calls Disable Windows SmartScreen Protection Linux Service Started Or Enabled Unknown Process Using The Kerberos Protocol Windows Excessive Disabled Services Event Updated Analytic Stories (3) Office 365 Account Takeover Office 365 Persistence Mechanisms Splunk Vulnerabilities The team also published the following 6 blogs: Security Insights: Jenkins CVE-2024-23897 RCE Security Insights: Tracking Confluence CVE-2023-22527 Security Insights: Investigating Ivanti Connect Secure Auth Bypass and RCE Enter the Gates: An Analysis of the DarkGate AutoIt Loader Hunting M365 Invaders: Blue Team's Guide to Initial Access Vectors Ghost in the Web Shell: Introducing ShellSweep For all our tools and security content, please visit research.splunk.com.  — The Splunk Threat Research Team ... View more

In the last month, the Splunk Threat Research Team has had 2 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.17.0 and v4.18.0). With these releases, there are 51 new analytics, 5 new analytic stories, 18 updated analytics, and 4 updated analytic stories now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: The "Office 365 Persistence Mechanisms" analytic story includes a group of detections that delve into attackers' tactics and techniques to maintain prolonged unauthorized access within the O365 environment. Persistence in this context refers to adversaries' methods to keep their foothold after an initial compromise. The "Windows Attack Surface Reduction" analytic story includes a group of detections for Attack Surface Reduction (ASR) events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. When an action is blocked by an ASR rule, an event is generated. The "Kubernetes Security" analytic story encompasses a range of detections that highlight the escalating challenges when securing containerized environments. Key detections include Kubernetes Abuse of Secret by Unusual Location, User Agent, User Group, and Username, which pinpoints attempts to exploit secrets via anomalous parameters. Four new analytics delve into the intricacies of MFA security in the PingID environment. These detections, contributed by @nterl0k, cover scenarios like Mismatch Auth Source and Verification Response, Multiple Failed MFA Requests, New MFA Method Post-Credential Reset, and Registration of New MFA Methods, highlighting the evolving landscape of digital authentication security. New Analytics (51) O365 Service Principal New Client Credentials O365 Mailbox Read Access Granted to Application O365 Tenant Wide Admin Consent Granted O365 Application Registration Owner Added O365 Mailbox Inbox Folder Shared with All Users O365 Advanced Audit Disabled O365 High Number Of Failed Authentications for User O365 Multiple Users Failing To Authenticate From Ip O365 User Consent Blocked for Risky Application O365 User Consent Denied for OAuth Application O365 Mail Permissioned Application Consent Granted by User O365 ApplicationImpersonation Role Assigned O365 File Permissioned Application Consent Granted by User O365 Multiple Failed MFA Requests For User O365 High Privilege Role Granted O365 New MFA Method Registered O365 Multiple AppIDs and UserAgents Authentication Spike O365 Block User Consent For Risky Apps Disabled O365 Multi-Source Failed Authentications Spike Powershell Remote Services Add TrustedHost Windows Modify Registry AuthenticationLevelOverride Windows Modify Registry DisableRemoteDesktopAntiAlias Windows Modify Registry DisableSecuritySettings Windows Modify Registry DontShowUI Windows Modify Registry ProxyEnable Windows Modify Registry ProxyServer Windows Archive Collected Data via Rar Windows Indicator Removal Via Rmdir Windows Credentials from Password Stores Creation Windows Credentials from Password Stores Deletion Windows Defender ASR Rules Stacking Windows Defender ASR Rule Disabled Windows Defender ASR Registry Modification Windows Defender ASR Block Events Windows Defender ASR Audit Events Windows Masquerading Msdtc Process Windows Parent PID Spoofing with Explorer Web Remote ShellServlet Access Splunk RCE via User XSLT PingID Mismatch Auth Source and Verification Response (External Contributor: @nterl0k) PingID Multiple Failed MFA Requests For User  (External Contributor: @nterl0k) PingID New MFA Method After Credential Reset (External Contributor: @nterl0k) PingID New MFA Method Registered For User (External Contributor: @nterl0k) Kubernetes Abuse of Secret by Unusual Location Kubernetes Abuse of Secret by Unusual User Agent Kubernetes Abuse of Secret by Unusual User Group Kubernetes Abuse of Secret by Unusual User Name Kubernetes Access Scanning Kubernetes Suspicious Image Pulling Kubernetes Unauthorized Access Windows Modify System Firewall with Notable Process Path New Analytic Stories (5) Office 365 Account Takeover Office 365 Persistence Mechanisms Windows Attack Surface Reduction Rhysida Ransomware Kubernetes Security Updated Analytics (18) High Number of Login Failures from a single source O365 Add App Role Assignment Grant User O365 Added Service Principal O365 Bypass MFA via Trusted IP O365 Disable MFA O365 Excessive Authentication Failures Alert O365 Excessive SSO logon errors O365 New Federated Domain Added O365 PST export alert O365 Suspicious Admin Email Forwarding O365 Suspicious Rights Delegation O365 Suspicious User Email Forwarding Splunk App for Lookup File Editing RCE via User XSLT Allow File And Printing Sharing In Firewall Azure AD PIM Role Assigned CMD Carry Out String Command Parameter Detect Use of cmd exe to Launch Script Interpreters Modification Of Wallpaper Updated Analytic Stories (4) DarkGate Malware NjRAT RedLine Stealer Amadey The team has also published the following blogs: Deploy, Test, Monitor: Mastering Microsoft Defender ASR with Atomic Techniques in Splunk Unmasking the Enigma: A Historical Dive into the World of PlugX Malware Splunk Security Content for Threat Detection & Response: Q3 Roundup Previous Security Content Roundups from the Splunk Threat Research Team For all our tools and security content, please visit research.splunk.com.  — The Splunk Threat Research Team ... View more