Detection rules

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

11,394
detections

Search detections

Filters

Showing 30 of 11,394

This Splunk query analyzes web access logs to identify and categorize non-browser user agents, detecting various types of security tools, scripting languages, automation frameworks, and suspicious patterns. This activity can signify malicious actors attempting to interact with web endpoints in non-standard ways.

T1071.001

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 6, 2026

InformationalSplunk security content

Detect Remote Access Software Usage URL

The following analytic detects the execution of known remote access software within the environment. It leverages network logs mapped to the Web data model, identifying specific URLs and user agents associated with remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these utilities to maintain unauthorized remote access.

T1219

Written by: Steven DickAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 6, 2026

InformationalSplunk security content

Prohibited Network Traffic Allowed

The following analytic detects instances where network traffic, identified by port and transport layer protocol as prohibited in the "lookup_interesting_ports" table, is allowed. It uses the Network_Traffic data model to cross-reference traffic data against predefined security policies. This activity is significant for a SOC as it highlights potential misconfigurations or policy violations that could lead to unauthorized access or data exfiltration.

T1048

Written by: Rico ValdezAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 6, 2026

InformationalSplunk security content

HTTP RMM User Agent

This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of Remote Monitoring and Mangement applications. This activity can signify possible compromised hosts on the network.

T1071.001T1219

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 6, 2026

InformationalSplunk security content

HTTP PUA User Agent

This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of unwanted applications. This activity can signify possible compromised hosts on the network.

T1071.001

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 6, 2026

MediumSplunk security content

HTTP Malware User Agent

This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of malware. This activity can signify possible compromised hosts on the network.

T1071.001

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 6, 2026

MediumSplunk security content

HTTP C2 Framework User Agent

This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of c2 frameworks. This activity can signify malicious actors attempting to interact with hosts on the network using known default configurations of command and control tools.

T1071.001

Written by: Ravent TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 6, 2026

InformationalSplunk security content

Detect Remote Access Software Usage Traffic

The following analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. It leverages Palo Alto traffic logs mapped to the Network_Traffic data model in Splunk. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments.

T1219

Written by: Steven DickAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 6, 2026

InformationalSplunk security content

Detect Remote Access Software Usage DNS

The following analytic detects DNS queries to domains associated with known remote access software such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This detection is crucial as adversaries often use these tools to maintain access and control over compromised environments. Identifying such behavior is vital for a Security Operations Center (SOC) because unauthorized remote access can lead to data breaches, ransomware attacks, and other severe impacts if these threats are not mitigated

T1219

Written by: Steven DickAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 6, 2026

MediumSplunk security content

Detect hosts connecting to dynamic domain providers

The following analytic identifies DNS queries from internal hosts to dynamic domain providers. It leverages DNS query logs from the `Network_Resolution` data model and cross-references them with a lookup file containing known dynamic DNS providers. This activity is significant because attackers often use dynamic DNS services to host malicious payloads or command-and-control servers, making it crucial for security teams to monitor.

T1189

Written by: Bhavin PatelAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 6, 2026

InformationalSplunk security content

Cisco Secure Firewall - Repeated Malware Downloads

The following analytic detects repeated malware file downloads initiated by the same internal host (src) within a short time window. It leverages Cisco Secure Firewall Threat Defense logs and identifies `FileEvent` events with a `SHA_Disposition` of "Malware" and `FileDirection` set to "Download". If ten or more such events occur from the same host within five minutes, this analytic will trigger.

T1027T1105

Written by: Nasreddine BencherchaliAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 6, 2026

InformationalSplunk security content

Cisco Secure Firewall - Remote Access Software Usage Traffic

The following analytic detects network traffic associated with known remote access software applications that are covered by Cisco Secure Firewall Application Detectors, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. It leverages Cisco Secure Firewall Threat Defense Connection Event. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments.

T1219

Written by: Nasreddine BencherchaliAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 6, 2026

InformationalSplunk security content

Cisco Secure Firewall - Malware File Downloaded

The following analytic detects file downloads that were classified as malware by Cisco Secure Firewall Threat Defense. It relies on the `SHA_Disposition` field with a value of "Malware" and includes metadata such as file name, file_hash hash, and threat classification. This analytic is critical for surfacing file-based threats that are identified via Cisco's AMP or Threat Grid integrations. If confirmed malicious, this could indicate delivery of malware.

T1105T1203

Written by: Nasreddine BencherchaliAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 6, 2026

InformationalSplunk security content

Cisco Secure Firewall - Intrusion Events by Threat Activity

This analytic detects intrusion events from known threat activity using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where one or multiple Snort signatures associated with a known threat or threat actor activity have been triggered within a one-hour time window. The detection uses a lookup table (cisco_snort_ids_to_threat_mapping) to map Snort signature IDs to known threat actors and their techniques.

T1041T1573.002

Written by: Bhavin PatelAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 6, 2026

InformationalSplunk security content

Cisco Secure Firewall - File Download Over Uncommon Port

The following analytic detects file transfers flagged as malware that occurred over non-standard ports (other than 80 and 443). Adversaries may attempt to bypass protocol-based detection or use alternate ports to blend in with other traffic. This analytic identifies these non-conventional flows and surfaces potential evasion techniques. If confirmed malicious this indicate potential malware delivery or other nefarious activity.

T1105T1571

Written by: Nasreddine BencherchaliAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 6, 2026

MediumSplunk security content

Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint

The following analytic detects the use of known suspicious SSL certificates in any observed event where the SSL_CertFingerprint field is present. It leverages Cisco Secure Firewall logs and compares the SSL certificate SHA1 fingerprint against a blacklist of certificates associated with malware distribution, command and control (C2) infrastructure, or phishing campaigns.

T1071.001T1573.002T1587.002T1588.004

Written by: Nasreddine BencherchaliAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 6, 2026

InformationalSplunk security content

Cisco Secure Firewall - Binary File Type Download

The following analytic detects file downloads involving executable, archive, or scripting-related file types that are commonly used in malware delivery. These file types include formats like PE executables, shell scripts, autorun files, installers, and known testing samples such as EICAR. This detection leverages Cisco Secure Firewall Threat Defense logs and enriches the results using a filetype lookup to provide context.

T1059T1203

Written by: Nasreddine BencherchaliAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 6, 2026

MediumSplunk security content

3CX Supply Chain Attack Network Indicators

The following analytic identifies DNS queries to domains associated with the 3CX supply chain attack. It leverages the Network_Resolution datamodel to detect these suspicious domain indicators. This activity is significant because it can indicate a potential compromise stemming from the 3CX supply chain attack, which is known for distributing malicious software through trusted updates.

T1195.002

Written by: Michael HaagAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 6, 2026

MediumSplunk security content

WMI Permanent Event Subscription - Sysmon

Detects the creation, modification or deletion of a WMI permanent event subscription using Sysmon EventID 21.

T1546.003

Written by: Rico ValdezAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 6, 2026

InformationalSplunk security content

WMI Permanent Event Subscription

Detects permanent WMI event subscriptions that are containing `CommandLineEventConsumer` or `ActiveScriptEventConsumer`. Due to their command execution capabilties, given WMI consumers are often leveraged by adversaries for both execution and persistence purposes.

T1546.003

Written by: Rico ValdezAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 6, 2026

MediumSplunk security content

Windows Vulnerable Driver Loaded

The following analytic detects the loading of known vulnerable Windows drivers, which may indicate potential persistence or privilege escalation attempts. It leverages Sysmon EventCode 6 to identify driver loading events and cross-references them with a list of vulnerable drivers. This activity is significant as attackers often exploit vulnerable drivers to gain elevated privileges or maintain persistence on a system.

T1543.003

Written by: Michael HaagAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 6, 2026

MediumSplunk security content

Windows Vulnerable Driver Installed

The following analytic detects the loading of known vulnerable Windows drivers, which may indicate potential persistence or privilege escalation attempts. It leverages Windows System service install EventCode 7045 to identify driver loading events and cross-references them with a list of vulnerable drivers. This activity is significant as attackers often exploit vulnerable drivers to gain elevated privileges or maintain persistence on a system.

T1543.003

Written by: Dean LuxtonAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 6, 2026

MediumSplunk security content

Windows Suspicious Named Pipe

The following analytic detects the creation or connection to known suspicious named pipes. It leverages Sysmon EventCodes 17 and 18 to identify known default pipe names used by malicious or suspicious tools. If confirmed malicious, this could allow an attacker to abuse these to potentially gain privilege escalation, persistence, c2 communications, or further system compromise.

T1021.002T1055T1559

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 6, 2026

MediumSplunk security content

Windows Suspicious C2 Named Pipe

The following analytic detects the creation or connection to known suspicious C2 named pipes. It leverages Sysmon EventCodes 17 and 18 to identify known default pipe names used by C2 tools. If confirmed malicious, this could allow an attacker to abuse these to potentially gain persistence, command and control, or further system compromise.

T1021.002T1055T1559

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 6, 2026

InformationalSplunk security content

Windows Service Created with Suspicious Service Name

The following analytic detects the creation of a Windows Service with a known suspicious or malicious name using Windows Event ID 7045. It leverages logs from the `wineventlog_system` to identify these services installations. This activity is significant as adversaries, including those deploying Clop ransomware, often create malicious services for lateral movement, remote code execution, persistence, and execution.

T1569.002

Written by: Steven DickAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 6, 2026

MediumSplunk security content

Windows Scheduled Task with Suspicious Name

The following analytic detects the creation, modification, or enabling of scheduled tasks with known suspicious or malicious task names. It leverages Windows Security EventCode 4698, 4700, and 4702 to identify when such tasks are registered, modified, or enabled. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system.

T1053.005

Written by: Steven DickAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 6, 2026

MediumSplunk security content

Windows Scheduled Task with Suspicious Command

The following analytic detects the creation of scheduled tasks designed to execute commands using native Windows shells like PowerShell, Cmd, Wscript, or Cscript or from public folders such as Users, Temp, or ProgramData. It leverages Windows Security EventCode 4698, 4700, and 4702 to identify when such tasks are registered, enabled, or modified. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system.

T1053.005

Written by: Steven DickAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 6, 2026

InformationalSplunk security content

Windows RMM Named Pipe

The following analytic detects the creation or connection to known suspicious named pipes, which is a technique often used by offensive tools. It leverages Sysmon EventCodes 17 and 18 to identify known default pipe names used by RMM tools. If confirmed malicious, this could allow an attacker to abuse these to potentially gain persistence, command and control, or further system compromise.

T1021.002T1055T1559

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 6, 2026

InformationalSplunk security content

Windows Renamed Python Binary was Executed

The following analytic identifies a Python process being executed where it's process name does not match it's original file name attribute. Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.

T1036.003T1059.006

Written by: Onur Mustafa ErdoganAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 6, 2026

InformationalSplunk security content

Windows Renamed Popular 3rd Party Software was Executed

The following analytic identifies a popular 3rd party software process being executed where it's process name does not match it's original file name attribute. Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.

T1036.003

Written by: Onur Mustafa ErdoganAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 6, 2026

Load more detections

Loading detection rules

Back to results

InformationalSplunk security content Steven Dick +2

Windows Renamed LOLBAS Binary was Executed

Description

The following analytic identifies a LOLBAS process being executed where it's process name does not match it's original file name attribute. Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code.

Detection logic

Detection requirements

Platform: Linux macOS Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source category: crowdstrike_processrollup2 sysmon_eventid_1

Known benign triggers

3rd party software binaries sharing the same name as LOLBAS utilities may trigger false positives.

MITRE ATT&CK mappings

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.

Stealth

T1036Masquerading
- T1036.003Rename Legitimate Utilities 53 detections cover this technique

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
attack.mitre.org/techniques/T1036/	Taxonomy	7
attack.mitre.org/techniques/T1036/003/	Taxonomy	8
redcanary.com/threat-detection-report/techniques/rename-system-utilities/	Security research	2

From the source

At source: Open at source
Upstream identifier: 10c3850e-810d-41b4-a197-2f14d7883579
Tagged by the source as: Living Off The LandMasquerading - Rename System UtilitiesWater GamayunWindows Defense Evasion TacticsEndpointendpointSplunk CloudSplunk EnterpriseSplunk Enterprise Securityendpoint

Licence

Published under: Apache License 2.0Read the licence
Attribution: Required
Obtained under: Apache-2.0Read the origin licence

Authorship

Written by: Steven Dick
Onur Mustafa Erdogan
Splunk
Published: Oct 6, 2026
Version: 1