Browse Rules

Base64 encoded Windows process command-lines

'Identifies instances of a base64-encoded PE file header seen in the process command line parameter.'

NRT Base64 Encoded Windows Process Command-lines

'This detection identifies instances of a base64 encoded PE file header seen in the process command line parameter.'

Suspicious Splwow64 Without Params

Detects suspicious Splwow64.exe process without any command line parameters

Suspicious Splwow64 Without Params

Detects suspicious Splwow64.exe process without any command line parameters

Suspicious SYSTEM User Process Creation

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Suspicious SYSTEM User Process Creation

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Suspicious PowerShell Parameter Substring [splunk-winevent]

Threat actors may use obfuscated and truncated PowerShell execution arguments to evade detection, leveraging PowerShell's parameter binding functionality that allows partial matching of command-line arguments. This use case detects process executions containing substrings for commonly abused PowerShell parameters.

Suspicious Splwow64 Without Params

Detects suspicious Splwow64.exe process without any command line parameters

Suspicious SYSTEM User Process Creation

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

WhoAmI as Parameter

Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)

WhoAmI as Parameter

Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)

WhoAmI as Parameter

Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)

Suspicious Use of _dev_tcp [splunk-unix]

Detects suspicious command with /dev/tcp

Suspicious PowerShell Parameter Substring [snowflake-crowdstrikefdr_process]

Threat actors may use obfuscated and truncated PowerShell execution arguments to evade detection, leveraging PowerShell's parameter binding functionality that allows partial matching of command-line arguments. This use case detects process executions containing substrings for commonly abused PowerShell parameters.

Uncommon Svchost Command Line Parameter

Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns. This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.

Uncommon Svchost Command Line Parameter

Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns. This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.

Uncommon Svchost Command Line Parameter

Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns. This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.

Base64 encoded Windows process command-lines (Normalized Process Events)

'Identifies instances of a base64 encoded PE file header seen in the process command line parameter. To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'

Suspicious process Spawned by Java [splunk-edr]

Detect Java Spawning suspicious processes. This could indicate successful execution of vulnerabilities such as log4j CVE-2021-44228. - Threat Actor Association: Evilnum, Volt Typhoon

Potential SSH Authorized Key Overwrite [splunk-unix]

Potential overwrites of authorized_keys file for ssh. -- Threat Actor Association: TeamTNT

MultiDump.exe Execution [splunk-sysmon]

MultiDump is a post-exploitation tool written in C with a Python handler designed to discreetly dump and extract LSASS memory without triggering Defender alerts. This use case detects rundll32 executions with specific command line parameters unique to MultiDump.

Formbook Process Creation

Detects Formbook like process executions that inject code into a set of files in the System32 folder, which executes a special command command line to delete the dropper from the AppData Temp folder. We avoid false positives by excluding all parent process with command line parameters.

Formbook Process Creation

Detects Formbook like process executions that inject code into a set of files in the System32 folder, which executes a special command command line to delete the dropper from the AppData Temp folder. We avoid false positives by excluding all parent process with command line parameters.

MultiDump.exe Execution [splunk-winevent]

MultiDump is a post-exploitation tool written in C with a Python handler designed to discreetly dump and extract LSASS memory without triggering Defender alerts. This use case detects rundll32 executions with specific command line parameters unique to MultiDump.

Logon Script Registry Key added [splunk-edr]

Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence.