Splunk Security
@SplunkSecurity35 followers31,507 downloads1,688 copies11 likes90,245 views
2,515 detections
Filters
Last updated
All Time
Detection languages
2,515
Categories
839
535
265
240
208
Platforms
1,613
264
203
142
100
Products / Services
1,234
902
796
217
212
MITRE Techniques
935
667
517
499
307
CVEs
18
13
12
12
9
The following analytic detects the use of Ngrok on a Linux operating system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments associated with Ngrok. This activity is significant because Ngrok can be used by adversaries to establish reverse proxies, potentially bypassing network defenses. If confirmed malicious, this could allow attackers to create persistent, unauthorized access channels, facilitating data exfiltration or further exploitation of the compromised system.
This analytic detects selected processes spawned directly by Windows Remote Management Host processes winrshost.exe and wsmprovhost.exe.
The selected children include shells, scripting hosts, and administrative, discovery, and file-transfer utilities. This target-side process relationship can indicate remote execution, but it can also result from authorized WinRM administration.
Investigate the account, target host, available command line, and surrounding remote-logon activity to determine context.
The selected children include shells, scripting hosts, and administrative, discovery, and file-transfer utilities. This target-side process relationship can indicate remote execution, but it can also result from authorized WinRM administration.
Investigate the account, target host, available command line, and surrounding remote-logon activity to determine context.
The following analytic detects instances where Java, web server, or application server processes attempts to spawn
a Linux shell, which may indicate exploitation attempts. This detection leverages Endpoint Detection and Response
(EDR) telemetry, focusing on process names and parent-child process relationships. This activity may indicate a
compromised service leading to unauthorized shell access. If confirmed malicious, attackers could execute commands,
escalate privileges, or maintain persistent access.
a Linux shell, which may indicate exploitation attempts. This detection leverages Endpoint Detection and Response
(EDR) telemetry, focusing on process names and parent-child process relationships. This activity may indicate a
compromised service leading to unauthorized shell access. If confirmed malicious, attackers could execute commands,
escalate privileges, or maintain persistent access.
The following analytic detects the creation of a Temporary Access Pass (TAP) for an Azure AD user.
It leverages Azure Active Directory AuditLogs to identify the "Create Temporary Access Pass method for user" operation.
TAPs are time-limited passcodes that bypass all authentication requirements including MFA and FIDO2 - an attacker who
creates a TAP for a compromised account can sign in from any location without any additional factor.
If confirmed malicious, this activity provides an attacker with an unchallenged authentication path into the affected account.
It leverages Azure Active Directory AuditLogs to identify the "Create Temporary Access Pass method for user" operation.
TAPs are time-limited passcodes that bypass all authentication requirements including MFA and FIDO2 - an attacker who
creates a TAP for a compromised account can sign in from any location without any additional factor.
If confirmed malicious, this activity provides an attacker with an unchallenged authentication path into the affected account.
The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, `net1.exe`, or similar tools are executed by a non-standard shell parent process, excluding CMD, PowerShell, Explorer, or `net.exe`.
This detection leverages Endpoint Detection and Response (EDR) telemetry to monitor process creation events. Such behavior is significant as it may indicate adversaries using injected processes to perform system discovery, a tactic observed in FIN7's JSSLoader.
If confirmed malicious, this activity could allow attackers to gather critical host information, aiding in further exploitation or lateral movement within the network.
This detection leverages Endpoint Detection and Response (EDR) telemetry to monitor process creation events. Such behavior is significant as it may indicate adversaries using injected processes to perform system discovery, a tactic observed in FIN7's JSSLoader.
If confirmed malicious, this activity could allow attackers to gather critical host information, aiding in further exploitation or lateral movement within the network.
The following analytic detects cmd.exe being used to write a Windows Scheduled Task XML definition to disk through the echo command.
This analytic focuses on command lines that combine echo with the Task Scheduler XML namespace. This is a significant activity because legitimate
software rarely assembles a task definition on the fly from the console. Browser hijackers and adware droppers do this to create a scheduled task,
through schtasks.exe and the generated XML file, that periodically relaunches a copy of themselves, and then delete the XML file to hinder forensic analysis.
If confirmed malicious, this could allow an attacker to establish persistence, repeatedly execute a payload and maintain control over the victim's browser.
This analytic focuses on command lines that combine echo with the Task Scheduler XML namespace. This is a significant activity because legitimate
software rarely assembles a task definition on the fly from the console. Browser hijackers and adware droppers do this to create a scheduled task,
through schtasks.exe and the generated XML file, that periodically relaunches a copy of themselves, and then delete the XML file to hinder forensic analysis.
If confirmed malicious, this could allow an attacker to establish persistence, repeatedly execute a payload and maintain control over the victim's browser.
This analytic detects suspicious PHP web application requests using Cisco Secure Firewall Threat Defense Intrusion Events.
The matching network signature identifies a serialized input pattern associated with attempts to exploit PHP request handling.
Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.
The matching network signature identifies a serialized input pattern associated with attempts to exploit PHP request handling.
Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.
This analytic detects suspicious PHP web application upload activity using Cisco Secure Firewall Threat Defense Intrusion Events.
The matching network signature identifies a request pattern associated with attempts to exhaust server resources through PHP session handling.
Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.
The matching network signature identifies a request pattern associated with attempts to exhaust server resources through PHP session handling.
Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.
This analytic detects HTTP POST requests with a declared body size of at least one megabyte that receive an HTTP 500 response or have no response status recorded.
Large failed or unanswered uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Large failed or unanswered uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
The following analytic detects a C/C++ compiler compiling a C source file with the output binary written to /tmp, executed as a non-root user.
This is a compile-after-delivery privilege escalation pattern. Kernel exploit PoCs and local privilege escalation tools commonly drop a C source file
use compilers at runtime to produce a platform-specific binary in /tmp. This avoids architecture mismatches and allows the exploit to adapt to the running
kernel's symbol offsets.
This is a compile-after-delivery privilege escalation pattern. Kernel exploit PoCs and local privilege escalation tools commonly drop a C source file
use compilers at runtime to produce a platform-specific binary in /tmp. This avoids architecture mismatches and allows the exploit to adapt to the running
kernel's symbol offsets.
Page 3 of 252