Splunk Security
@SplunkSecurity35 followers31,507 downloads1,688 copies11 likes90,245 views
2,515 detections
Filters
Last updated
All Time
Detection languages
2,515
Categories
839
535
265
240
208
Platforms
1,613
264
203
142
100
Products / Services
1,234
902
796
217
212
MITRE Techniques
935
667
517
499
307
CVEs
18
13
12
12
9
The following analytic detects instances where Java, or Tomcat processes spawn a Linux shell, which may indicate exploitation attempts, such as those related to CVE-2021-44228 (Log4Shell).
This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships.
This activity is significant as it can signify a compromised Java application, potentially leading to unauthorized shell access.
If confirmed malicious, attackers could execute arbitrary commands, escalate privileges, or maintain persistent access, posing a severe threat to the environment.
This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships.
This activity is significant as it can signify a compromised Java application, potentially leading to unauthorized shell access.
If confirmed malicious, attackers could execute arbitrary commands, escalate privileges, or maintain persistent access, posing a severe threat to the environment.
This analytic detects HTTP POST requests with a body of at least one megabyte that receive an HTTP 500 response.
Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
This analytic correlates Apache and Nginx access and error logs when "multipart/form-data" requests and PHP memory-limit exhaustion errors occur for the same PID, host, and client.
It extracts web request details and "PHP" error messages to support investigation of possible PHP2Shell exploitation attempts.
It extracts web request details and "PHP" error messages to support investigation of possible PHP2Shell exploitation attempts.
The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with
CLI code-execution options such as -r / --run and -B / -R / -E / -F, or PHP runtime INI overrides that can load code.
It also detects code supplied to PHPDBG through the -s option and FrankenPHP php-cli execution. It covers common Linux
CLI executable names, including php, versioned PHP binaries, phpdbg, and FrankenPHP. PHP-CGI and PHP-FPM are excluded
from the CLI option branch because they do not support the PHP CLI inline -r option. This behavior can be used legitimately
for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an
installed interpreter to run commands without dropping a script file.
CLI code-execution options such as -r / --run and -B / -R / -E / -F, or PHP runtime INI overrides that can load code.
It also detects code supplied to PHPDBG through the -s option and FrankenPHP php-cli execution. It covers common Linux
CLI executable names, including php, versioned PHP binaries, phpdbg, and FrankenPHP. PHP-CGI and PHP-FPM are excluded
from the CLI option branch because they do not support the PHP CLI inline -r option. This behavior can be used legitimately
for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an
installed interpreter to run commands without dropping a script file.
This analytic detects a successful Linux execve event where a PID changes executable image under the same parent after the prior image has been active for at least one second and no more than 60 seconds.
A delayed image change in an existing process can indicate execution following exploitation and should be investigated with related endpoint and network activity.
A delayed image change in an existing process can indicate execution following exploitation and should be investigated with related endpoint and network activity.
The following analytic detects suspicious Azure Active Directory device registrations by monitoring "Register device" audit events for device names matching specific DESKTOP patterns or the user agent "Dsreg/10.0 (Windows 10.0.19041.928)".
This user agent may indicate device registration activity through ROADtools, an offensive security framework targeting EntraID deployments.
Device registration can support persistence or provide a device identity that can be used to access internal resources.
If confirmed malicious, an attacker could use the registered device to maintain access or facilitate further compromise of the environment.
This user agent may indicate device registration activity through ROADtools, an offensive security framework targeting EntraID deployments.
Device registration can support persistence or provide a device identity that can be used to access internal resources.
If confirmed malicious, an attacker could use the registered device to maintain access or facilitate further compromise of the environment.
The following analytic detects PHP command-line interpreters executing code supplied directly on the command line with the CLI -r / --run options, or code supplied to PHPDBG through standard input.
It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand.
PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option.
This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.
It covers common CLI executable names on Linux and Windows, including php.exe, php-win.exe, the legacy php-cli.exe name, versioned Linux php binaries, phpdbg, and FrankenPHP's php-cli subcommand.
PHP-CGI and PHP-FPM are excluded because they do not support the PHP CLI inline -r option.
This behavior can be used legitimately for administration and automation, but unexpected or obfuscated inline PHP execution may indicate an attacker using an installed interpreter to run commands without dropping a script file.
This analytic detects multipart POST traffic with a serialized PHP structure in an uploaded filename, which may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.
Suricata EVE's standard HTTP events do not expose multipart form field names, so this Suricata variant cannot confirm the PHP_SESSION_UPLOAD_PROGRESS field without additional request-body inspection.
Suricata EVE's standard HTTP events do not expose multipart form field names, so this Suricata variant cannot confirm the PHP_SESSION_UPLOAD_PROGRESS field without additional request-body inspection.
This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of c2 frameworks. This activity can signify malicious actors attempting to interact with hosts on the network using known default configurations of command and control tools.
This analytic detects multipart POST requests containing a PHPSESSID form field and an uploaded filename with a PHP opening tag.
When observed with "PHP_SESSION_UPLOAD_PROGRESS" behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
When observed with "PHP_SESSION_UPLOAD_PROGRESS" behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
Page 1 of 252