Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.26.0, v4.27.0, and v4.28.0). With these releases, there are 18 new analytics, 1 new analytic story, 31 updated analytics, and 2 updated analytic stories now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: A new analytic story and detections for CVE-2024-27198 and CVE-2024-27199. This security content addresses critical authentication bypass vulnerabilities in JetBrains TeamCity. To learn more about these vulnerabilities and security content, check out our blog. Six new detections for remote monitoring management (RMM) software abuse contributed by @nterl0k. Thank you! New Analytics (18) Cloud Security Groups Modifications by User Detect Remote Access Software Usage File (External Contributor : @nterl0k) Detect Remote Access Software Usage FileInfo (External Contributor : @nterl0k) Detect Remote Access Software Usage Process (External Contributor : @nterl0k) Windows Multiple Account Passwords Changed Windows Multiple Accounts Deleted Windows Multiple Accounts Disabled Detect Remote Access Software Usage DNS (External Contributor : @nterl0k) Detect Remote Access Software Usage Traffic (External Contributor : @nterl0k) High Volume of Bytes Out to Url Detect Remote Access Software Usage URL (External Contributor : @nterl0k) JetBrains TeamCity Authentication Bypass CVE-2024-27198 JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198 JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199 Nginx ConnectWise ScreenConnect Authentication Bypass Windows Credential Access From Browser Password Store Windows Known Abused DLL Created (External Contributor : @nterl0k) Splunk Authentication Token Exposure in Debug Log New Analytic Stories (1) JetBrains TeamCity Vulnerabilities Updated Analytics (31) AWS IAM Delete Policy O365 Multiple Users Failing To Authenticate From Ip ConnectWise ScreenConnect Authentication Bypass JetBrains TeamCity RCE Attempt Okta User Logins From Multiple Cities Path traversal SPL injection Splunk User Enumeration Attempt AWS Concurrent Sessions From Different Ips AWS Credential Access RDS Password reset Kubernetes Nginx Ingress LFI Kubernetes Nginx Ingress RFI Kubernetes Previously Unseen Process Detect AzureHound Command-Line Arguments Detect AzureHound File Modifications Detect SharpHound Command-Line Arguments Detect SharpHound File Modifications Detect SharpHound Usage Disabling Windows Local Security Authority Defences via Registry Linux Iptables Firewall Modification Linux Kworker Process In Writable Process Path Linux Stdout Redirection To Dev Null File Network Traffic to Active Directory Web Services Protocol System Information Discovery Detection Windows SOAPHound Binary Execution Splunk Command and Scripting Interpreter Risky Commands ASL AWS Concurrent Sessions From Different Ips Gsuite Outbound Email With Attachment To External Domain Detect Excessive Account Lockouts From Endpoint Detect Excessive User Account Lockouts Short Lived Windows Accounts Windows Create Local Account Updated Analytic Stories (2) Cyclops Blink Sneaky Active Directory Persistence Tricks The team also published the following 3 blogs: Security Insights: JetBrains TeamCity CVE-2024-27198 and CVE-2024-27199 Under the Hood of SnakeKeylogger: Analyzing its Loader and its Tactics, Techniques, and Procedures Splunk Security Content for Threat Detection & Response: Q4 Roundup For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team ... View more

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with pre-built frameworks and content aligned to PCI DSS requirements and common threats to cardholder data environments.  To help customers further simplify day-to-day compliance operations, remediate compliance-related issues and threats, and demonstrate adherence to PCI DSS requirements, we’re happy to share the release of version 5.3.1. Check out the documentation to learn more, and download the Splunk App for PCI Compliance on Splunkbase. ... View more

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, Splunk Enterprise, and Splunk Enterprise Security deployment and help strengthen an organization’s security program — no matter their current level of maturity. To help you mature your program even faster, we released version 3.8.0, which includes: An updated security data maturity journey that includes four levels instead of six stages Faster content searches and loading in security content  A new MITRE ATT&CK benchmarking dashboard to check how your detections stack up against the top 20 techniques To learn more about each of these updates, check out the full blog and release notes. Download Splunk Security Essentials on Splunkbase. ... View more

Last month, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.24.0 and v4.25.0). With these releases, there are 27 new analytics, 5 new analytic stories, 110 updated analytics, and 1 updated analytic story now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: New content to help detect Midnight Blizzard (also known as Nobelium and APT29) attack techniques, improving detection coverage against sophisticated threats targeting Microsoft 365 environments. To learn more about Midnight Blizzard and the security content created by the Splunk Threat Research Team, check out the blog “Hunting M365 Invaders: Navigating the Shadows of Midnight Blizzard.” A new analytic story with content that can be used to help detect Phemedrone Stealer activities. To learn more about Phemedrone Stealer and the security content created by the Splunk Threat Research Team, check out the blog “Unveiling Phemedrone Stealer: Threat Analysis and Detections.” New content to help detect the critical ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows an attacker to bypass authentication using an alternate path or channel. New Analytics (27) Azure AD Admin Consent Bypassed by Service Principal Azure AD FullAccessAsApp Permission Assigned Azure AD Multiple Service Principals Created by SP Azure AD Multiple Service Principals Created by User Azure AD Privileged Graph API Permission Assigned Azure AD Service Principal Authentication O365 Admin Consent Bypassed by Service Principal O365 FullAccessAsApp Permission Assigned O365 Multiple Mailboxes Accessed via API O365 Multiple Service Principals Created by SP O365 Multiple Service Principals Created by User O365 OAuth App Mailbox Access via EWS O365 OAuth App Mailbox Access via Graph API O365 Privileged Graph API Permission Assigned Network Traffic to Active Directory Web Services Protocol Windows Privilege Escalation Suspicious Process Elevation Windows Privilege Escalation System Process Without System Parent Windows Privilege Escalation User Process Spawn System Process Windows SOAPHound Binary Execution Ivanti Connect Secure SSRF in SAML Component ConnectWise ScreenConnect Path Traversal ConnectWise ScreenConnect Path Traversal Windows SACL Windows Non Discord App Access Discord LevelDB Windows Time Based Evasion via Choice Exec Windows Unsecured Outlook Credentials Access In Registry ConnectWise ScreenConnect Authentication Bypass WordPress Bricks Builder plugin RCE New Analytic Stories (5) Office 365 Collection Techniques Phemedrone Stealer ConnectWise ScreenConnect Vulnerabilities Snake Keylogger WordPress Vulnerabilities Updated Analytics (110) Splunk unnecessary file extensions allowed by lookup table uploads Azure AD High Number Of Failed Authentications From Ip Azure AD Multi-Source Failed Authentications Spike Azure AD Privileged Role Assigned Azure AD Privileged Role Assigned to Service Principal Azure AD Service Principal Created Azure AD Service Principal New Client Credentials Azure AD Service Principal Owner Added Azure AD Tenant Wide Admin Consent Granted O365 Added Service Principal O365 Application Registration Owner Added O365 ApplicationImpersonation Role Assigned O365 Mailbox Inbox Folder Shared with All Users O365 Mailbox Read Access Granted to Application O365 Multi-Source Failed Authentications Spike O365 Multiple Users Failing To Authenticate From Ip O365 Service Principal New Client Credentials O365 Suspicious Admin Email Forwarding O365 Suspicious Rights Delegation O365 Suspicious User Email Forwarding O365 Tenant Wide Admin Consent Granted Correlation by Repository and Risk Correlation by User and Risk Any Powershell DownloadFile Any Powershell DownloadString Attacker Tools On Endpoint Create local admin accounts using net exe Create Remote Thread In Shell Application Creation of Shadow Copy Detect Certify Command Line Arguments Detect Certify With PowerShell Script Block Logging Detect Excessive Account Lockouts From Endpoint Detect New Local Admin account Detect Regasm with Network Connection Detect Regsvcs with Network Connection Detect Use of cmd exe to Launch Script Interpreters Disable Show Hidden Files Disable Windows SmartScreen Protection Disabling ControlPanel Disabling SystemRestore In Registry Download Files Using Telegram Elevated Group Discovery with PowerView Executable File Written in Administrative SMB Share Executables Or Script Creation In Suspicious Path Execute Javascript With Jscript COM CLSID Execution of File with Multiple Extensions Extraction of Registry Hives Hiding Files And Directories With Attrib exe Linux Account Manipulation Of SSH Config and Keys Linux Deletion Of Cron Jobs Linux Deletion Of Init Daemon Script Linux Deletion Of Services Linux Deletion of SSL Certificate Linux High Frequency Of File Deletion In Boot Folder Linux High Frequency Of File Deletion In Etc Folder MacOS LOLbin MacOS plutil Network Discovery Using Route Windows App Non Chrome Process Accessing Chrome Default Dir Non Firefox Process Access Firefox Profile Dir Overwriting Accessibility Binaries PowerShell - Connect To Internet With Hidden Window Rundll32 Process Creating Exe Dll Files Scheduled Task Deleted Or Created via CMD Schtasks scheduling job on remote system Spoolsv Spawning Rundll32 Spoolsv Writing a DLL Spoolsv Writing a DLL - Sysmon Suspicious Driver Loaded Path Suspicious mshta child process Suspicious Process DNS Query Known Abuse Web Services Suspicious Process File Path System Processes Run From Unexpected Locations Trickbot Named Pipe Windows Account Discovery for None Disable User Account Windows AD Replication Request Initiated by User Account Windows AD Replication Request Initiated from Unsanctioned Location Windows Admin Permission Discovery Windows Alternate DataStream - Base64 Content Windows Alternate DataStream - Executable Content Windows Credentials from Password Stores Chrome Extension Access Windows Credentials from Password Stores Chrome LocalState Access Windows Credentials from Password Stores Chrome Login Data Access Windows Gather Victim Network Info Through Ip Check Web Services Windows Process Injection Remote Thread Windows Registry Payload Injection Windows Replication Through Removable Media Windows Rundll32 WebDav With Network Connection Windows Scheduled Task Created Via XML Windows Scheduled Task Service Spawned Shell Windows Security Account Manager Stopped Windows Suspect Process With Authentication Traffic Windows UAC Bypass Suspicious Child Process Windows UAC Bypass Suspicious Escalation Behavior Windows WinLogon with Public Network Connection WinEvent Scheduled Task Created Within Public Path Detect DGA domains using pretrained model in DSDL Multiple Archive Files Http Post Traffic Plain HTTP POST Exfiltrated Data DNS Query Length With High Standard Deviation Detect Regasm Spawning a Process High Process Termination Frequency Linux Edit Cron Table Parameter Processes launching netsh Registry Keys Used For Persistence Suspicious Process Executed From Container File Windows File Transfer Protocol In Non-Common Process Path Windows Phishing PDF File Executes URL Link Windows System Network Connections Discovery Netsh Windows User Execution Malicious URL Shortcut File Updated Analytic Stories (1) NOBELIUM Group The team also published the following 3 blogs: Unveiling Phemedrone Stealer: Threat Analysis and Detections Hunting M365 Invaders: Navigating the Shadows of Midnight Blizzard Another Year of RATs and Trojan Stealer: Detection Commonalities and Summary Plus, Principal Threat Researcher Michael Haag hosted the Tech Talk "Using the Splunk Threat Research Team’s Latest Security Content.” During this Tech Talk, Michael provided: Best practices for accessing and using the team’s content in the ESCU app An overview of the team’s content updates between November and January Deeper dives into new content for detecting DarkGate malware, Office 365 account takeover, and Windows Attack Surface Reduction events You can watch the Tech Talk on-demand here. For all our tools and security content, please visit research.splunk.com. — The Splunk Threat Research Team ... View more

Last month, the Splunk Threat Research Team had 5 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.19.0., v4.20.0, v4.21.0, v4.22.0, and v.4.23.0). With these releases, there are 74 new analytics, 5 new analytic stories, 14 updated analytics, and 3 updated analytic stories now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: The new "Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring" analytic story includes a range of detections that identify abnormal or unexpected container behavior in Kubernetes environments, using metrics from Splunk Observability Cloud. The new “CISA AA23-347A” analytic story includes a variety of detections that allow you to detect and investigate unusual activities that might be related to SVR cyber activity. The new “Ivanti Connect Secure VPN Vulnerabilities'' analytic story addresses critical vulnerabilities CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure and Ivanti Policy Secure Gateways. The team also published a blog with additional information about these vulnerabilities and how to use this new threat detection content. New Analytics (74) Kubernetes Anomalous Inbound Outbound Network IO Kubernetes Anomalous Inbound to Outbound Network IO Ratio Kubernetes Previously Unseen Container Image Name Kubernetes Previously Unseen Process Kubernetes Process Running From New Path Kubernetes Process with Anomalous Resource Utilisation Kubernetes Process with Resource Ratio Anomalies Kubernetes Shell Running on Worker Node with CPU Activity Kubernetes Shell Running on Worker Node Windows Account Discovery For None Disable User Account Windows Lsa Secrets Nolmhash Registry Windows Modify Registry Disable Restricted Admin Windows Account Discovery For Sam Account Name Windows Account Discovery With Netuser PreauthNotRequire Windows Archive Collected Data Via Powershell Windows Domain Account Discovery Via Get Netcomputer Windows Known Graphicalproton Loaded Modules Windows Process Commandline Discovery Windows System User Privilege Discovery Windows Modify Registry Nochangingwallpaper Windows Rundll32 Apply User Settings Changes Windows UAC Bypass Suspicious Child Process (External Contributor : @nterl0k) Windows UAC Bypass Suspicious Escalation Behavior (External Contributor : @nterl0k) Windows Alternate DataStream - Base64 Content (External Contributor : @nterl0k) Windows Alternate DataStream - Process Execution (External Contributor : @nterl0k) Windows Alternate DataStream - Executable Content (External Contributor : @nterl0k) O365 Concurrent Sessions From Different Ips Splunk ES DoS Investigations Manager via Investigation Creation Splunk ES DoS Through Investigation Attachments Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint Ivanti Connect Secure Command Injection Attempts Ivanti Connect Secure System Information Access via Auth Bypass Splunk Enterprise KV Store Incorrect Authorization Splunk Enterprise Windows Deserialization File Partition Confluence Pre-Auth RCE via OGNL Injection CVE-2023-22527 Splunk Information Disclosure in Splunk Add-on Builder Kubernetes Anomalous Inbound Network Activity from Process Kubernetes Anomalous Outbound Network Activity from Process Kubernetes Anomalous Traffic on Network Edge Kubernetes Create or Update Privileged Pod Kubernetes Cron Job Creation Kubernetes DaemonSet Deployed Kubernetes Falco Shell Spawned Kubernetes newly seen TCP edge Kubernetes newly seen UDP edge Kubernetes Node Port Creation Kubernetes Pod Created in Default Namespace Kubernetes Pod With Host Network Attachment Kubernetes Scanning by Unauthenticated IP Address Windows Impair Defense Change Win Defender Health Check Intervals Windows Impair Defense Change Win Defender Quick Scan Interval Windows Impair Defense Change Win Defender Throttle Rate Windows Impair Defense Change Win Defender Tracing Level Windows Impair Defense Configure App Install Control Windows Impair Defense Define Win Defender Threat Action Windows Impair Defense Disable Controlled Folder Access Windows Impair Defense Disable Defender Firewall And Network Windows Impair Defense Disable Defender Protocol Recognition Windows Impair Defense Disable PUA Protection Windows Impair Defense Disable Realtime Signature Delivery Windows Impair Defense Disable Web Evaluation Windows Impair Defense Disable Win Defender App Guard Windows Impair Defense Disable Win Defender Compute File Hashes Windows Impair Defense Disable Win Defender Gen reports Windows Impair Defense Disable Win Defender Network Protection Windows Impair Defense Disable Win Defender Report Infection Windows Impair Defense Disable Win Defender Scan On Update Windows Impair Defense Disable Win Defender Signature Retirement Windows Impair Defense Overide Win Defender Phishing Filter Windows Impair Defense Override SmartScreen Prompt Windows Impair Defense Set Win Defender Smart Screen Level To Warn Windows MsiExec HideWindow Rundll32 Execution Windows Process Injection In Non-Service SearchIndexer Jenkins Arbitrary File Read CVE-2024-23897 New Analytic Stories (5) CISA AA23-347A Abnormal Kubernetes Behavior using Splunk Infrastructure Monitoring Ivanti Connect Secure VPN Vulnerabilities Confluence Data Center and Confluence Server Vulnerabilities Jenkins Server Vulnerabilities Updated Analytics (14) GCP Authentication Failed During MFA Challenge GCP Multi-Factor Authentication Disabled GCP Successful Single-Factor Authentication Windows Steal Authentication Certificates - ESC1 Abuse Allow Network Discovery In Firewall Msmpeng Application DLL Side Loading Confluence Data Center and Server Privilege Escalation Confluence Unauthenticated Remote Code Execution CVE-2022-26134 Kubernetes Access Scanning Kubernetes AWS detect suspicious kubectl calls Disable Windows SmartScreen Protection Linux Service Started Or Enabled Unknown Process Using The Kerberos Protocol Windows Excessive Disabled Services Event Updated Analytic Stories (3) Office 365 Account Takeover Office 365 Persistence Mechanisms Splunk Vulnerabilities The team also published the following 6 blogs: Security Insights: Jenkins CVE-2024-23897 RCE Security Insights: Tracking Confluence CVE-2023-22527 Security Insights: Investigating Ivanti Connect Secure Auth Bypass and RCE Enter the Gates: An Analysis of the DarkGate AutoIt Loader Hunting M365 Invaders: Blue Team's Guide to Initial Access Vectors Ghost in the Web Shell: Introducing ShellSweep For all our tools and security content, please visit research.splunk.com.  — The Splunk Threat Research Team ... View more

In the last month, the Splunk Threat Research Team has had 2 releases of new security content via the Enterprise Security Content Update (ESCU) app (v4.17.0 and v4.18.0). With these releases, there are 51 new analytics, 5 new analytic stories, 18 updated analytics, and 4 updated analytic stories now available in Splunk Enterprise Security via the ESCU application update process. Content highlights include: The "Office 365 Persistence Mechanisms" analytic story includes a group of detections that delve into attackers' tactics and techniques to maintain prolonged unauthorized access within the O365 environment. Persistence in this context refers to adversaries' methods to keep their foothold after an initial compromise. The "Windows Attack Surface Reduction" analytic story includes a group of detections for Attack Surface Reduction (ASR) events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. When an action is blocked by an ASR rule, an event is generated. The "Kubernetes Security" analytic story encompasses a range of detections that highlight the escalating challenges when securing containerized environments. Key detections include Kubernetes Abuse of Secret by Unusual Location, User Agent, User Group, and Username, which pinpoints attempts to exploit secrets via anomalous parameters. Four new analytics delve into the intricacies of MFA security in the PingID environment. These detections, contributed by @nterl0k, cover scenarios like Mismatch Auth Source and Verification Response, Multiple Failed MFA Requests, New MFA Method Post-Credential Reset, and Registration of New MFA Methods, highlighting the evolving landscape of digital authentication security. New Analytics (51) O365 Service Principal New Client Credentials O365 Mailbox Read Access Granted to Application O365 Tenant Wide Admin Consent Granted O365 Application Registration Owner Added O365 Mailbox Inbox Folder Shared with All Users O365 Advanced Audit Disabled O365 High Number Of Failed Authentications for User O365 Multiple Users Failing To Authenticate From Ip O365 User Consent Blocked for Risky Application O365 User Consent Denied for OAuth Application O365 Mail Permissioned Application Consent Granted by User O365 ApplicationImpersonation Role Assigned O365 File Permissioned Application Consent Granted by User O365 Multiple Failed MFA Requests For User O365 High Privilege Role Granted O365 New MFA Method Registered O365 Multiple AppIDs and UserAgents Authentication Spike O365 Block User Consent For Risky Apps Disabled O365 Multi-Source Failed Authentications Spike Powershell Remote Services Add TrustedHost Windows Modify Registry AuthenticationLevelOverride Windows Modify Registry DisableRemoteDesktopAntiAlias Windows Modify Registry DisableSecuritySettings Windows Modify Registry DontShowUI Windows Modify Registry ProxyEnable Windows Modify Registry ProxyServer Windows Archive Collected Data via Rar Windows Indicator Removal Via Rmdir Windows Credentials from Password Stores Creation Windows Credentials from Password Stores Deletion Windows Defender ASR Rules Stacking Windows Defender ASR Rule Disabled Windows Defender ASR Registry Modification Windows Defender ASR Block Events Windows Defender ASR Audit Events Windows Masquerading Msdtc Process Windows Parent PID Spoofing with Explorer Web Remote ShellServlet Access Splunk RCE via User XSLT PingID Mismatch Auth Source and Verification Response (External Contributor: @nterl0k) PingID Multiple Failed MFA Requests For User  (External Contributor: @nterl0k) PingID New MFA Method After Credential Reset (External Contributor: @nterl0k) PingID New MFA Method Registered For User (External Contributor: @nterl0k) Kubernetes Abuse of Secret by Unusual Location Kubernetes Abuse of Secret by Unusual User Agent Kubernetes Abuse of Secret by Unusual User Group Kubernetes Abuse of Secret by Unusual User Name Kubernetes Access Scanning Kubernetes Suspicious Image Pulling Kubernetes Unauthorized Access Windows Modify System Firewall with Notable Process Path New Analytic Stories (5) Office 365 Account Takeover Office 365 Persistence Mechanisms Windows Attack Surface Reduction Rhysida Ransomware Kubernetes Security Updated Analytics (18) High Number of Login Failures from a single source O365 Add App Role Assignment Grant User O365 Added Service Principal O365 Bypass MFA via Trusted IP O365 Disable MFA O365 Excessive Authentication Failures Alert O365 Excessive SSO logon errors O365 New Federated Domain Added O365 PST export alert O365 Suspicious Admin Email Forwarding O365 Suspicious Rights Delegation O365 Suspicious User Email Forwarding Splunk App for Lookup File Editing RCE via User XSLT Allow File And Printing Sharing In Firewall Azure AD PIM Role Assigned CMD Carry Out String Command Parameter Detect Use of cmd exe to Launch Script Interpreters Modification Of Wallpaper Updated Analytic Stories (4) DarkGate Malware NjRAT RedLine Stealer Amadey The team has also published the following blogs: Deploy, Test, Monitor: Mastering Microsoft Defender ASR with Atomic Techniques in Splunk Unmasking the Enigma: A Historical Dive into the World of PlugX Malware Splunk Security Content for Threat Detection & Response: Q3 Roundup Previous Security Content Roundups from the Splunk Threat Research Team For all our tools and security content, please visit research.splunk.com.  — The Splunk Threat Research Team ... View more