Another snapattack windows batch

Author: RavenTait

detections/endpoint/windows_dir_piped_to_findstr_activity.yml

@@ -0,0 +1,58 @@
+name: Windows Dir Piped to Findstr Activity
+id: 43cd7a59-3d52-4969-a01a-d677630b1426
+version: 1
+creation_date: '2026-07-30'
+modification_date: '2026-07-30'
+author: Raven Tait, Splunk
+status: production
+type: Anomaly
+description: The following analytic detects the execution of the `dir` command piped to `findstr` on Windows systems. This technique is commonly used by attackers during the reconnaissance phase to enumerate files, directories, or sensitive data by filtering directory listings for specific strings or patterns. While this command combination can have legitimate administrative uses, adversaries frequently leverage it to locate credentials, configuration files, or other high-value targets on a compromised system. If confirmed malicious, this activity could indicate an attacker is actively mapping the file system in preparation for data exfiltration, lateral movement, or further exploitation.
+data_source:
+    - Sysmon EventID 1
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*dir*|*findstr*" by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash Processes.parent_process_name Processes.parent_process_exec Processes.action Processes.dest Processes.process_current_directory Processes.process_path Processes.process_integrity_level Processes.original_file_name Processes.parent_process Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id Processes.process_guid Processes.process_id Processes.user Processes.process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `windows_dir_piped_to_findstr_activity_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate administrative tasks and scripts may use `dir` piped to `findstr` for routine file searches. Filter based on known user behavior and approved administrative activity.
+drilldown_searches:
+    - earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+      name: View the detection results for - "$user$" and "$dest$"
+      search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+    - name: View risk events for the last 7 days for - "$user$" and "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: '0'
+intermediate_findings:
+    entities:
+        - field: dest
+          type: system
+          score: 20
+          message: Suspicious findstr Activity by $user$ on $dest$ via $process_name$.
+        - field: user
+          type: user
+          score: 20
+          message: Suspicious findstr Activity by $user$ on $dest$ via $process_name$.
+threat_objects:
+    - field: parent_process_name
+      type: parent_process_name
+    - field: process_name
+      type: process_name
+analytic_story:
+    - Suspicious Command-Line Executions
+    - Windows Discovery Techniques
+    - Active Directory Discovery
+asset_type: Endpoint
+mitre_attack_id:
+    - T1119
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      test_type: unit
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1119/windows_dir_piped_to_findstr_activity/snapattack_windows.log
+          source: XmlWinEventLog:Security
+          sourcetype: XmlWinEventLog

detections/endpoint/windows_network_sniffing_tools.yml

@@ -0,0 +1,58 @@
+name: Windows Network Sniffing Tools
+id: 0c594353-e12d-4867-92f6-2a1b8a1faf5f
+version: 1
+creation_date: '2026-07-30'
+modification_date: '2026-07-30'
+author: Raven Tait, Splunk
+status: production
+type: Anomaly
+description: The following analytic detects the execution of common network sniffing tools on Windows systems, including Wireshark, WinPcap, tcpdump, and similar utilities. This activity is significant because attackers use packet capture tools to intercept and analyze network traffic, enabling credential theft, sensitive data harvesting, and reconnaissance of internal network communications. While these tools have legitimate administrative uses, their presence in unexpected environments may indicate an adversary conducting man-in-the-middle attacks or exfiltrating sensitive information traversing the network. If confirmed malicious, this could lead to the exposure of credentials, session tokens, and confidential data, facilitating lateral movement and further compromise of the environment.
+data_source:
+    - Sysmon EventID 1
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("wireshark.exe", "winpcap.exe", "tcpdump", "windump.exe", "netmon.exe", "netcap.exe", "dumpcap.exe", "tshark") by Processes.process Processes.vendor_product Processes.user_id Processes.process_hash Processes.parent_process_name Processes.parent_process_exec Processes.action Processes.dest Processes.process_current_directory Processes.process_path Processes.process_integrity_level Processes.original_file_name Processes.parent_process Processes.parent_process_path Processes.parent_process_guid Processes.parent_process_id Processes.process_guid Processes.process_id Processes.user Processes.process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `windows_network_sniffing_tools_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate network administrators and security teams may use these tools for authorized network monitoring and troubleshooting. Filter based on approved software inventory and known administrative activity.
+references:
+    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1040/T1040.md
+drilldown_searches:
+    - earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+      name: View the detection results for - "$user$" and "$dest$"
+      search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+    - name: View risk events for the last 7 days for - "$user$" and "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: '0'
+intermediate_findings:
+    entities:
+        - field: dest
+          type: system
+          score: 20
+          message: Potential Network Sniffing by $user$ on $dest$ via $process_name$.
+threat_objects:
+    - field: parent_process_name
+      type: parent_process_name
+    - field: process_name
+      type: process_name
+analytic_story:
+    - Credential Dumping
+    - Data Exfiltration
+    - Suspicious Command-Line Executions
+    - Windows Discovery Techniques
+    - Network Discovery
+asset_type: Endpoint
+mitre_attack_id:
+    - T1040
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      test_type: unit
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1040/windows_network_sniffing_tools/snapattack_windows.log
+          source: XmlWinEventLog:Security
+          sourcetype: ''

detections/endpoint/windows_powershell_commands_from_dns_txt.yml

@@ -0,0 +1,77 @@
+name: Windows Powershell Commands from DNS TXT
+id: b61353cd-5b09-4699-8b86-6517a9038043
+version: 1
+creation_date: '2026-07-30'
+modification_date: '2026-07-30'
+author: Raven Tait, Splunk
+status: production
+type: Anomaly
+description: >-
+    The following analytic detects execution of powershell commands retrieved from
+    a remote DNS TXT query response. The use of the DNS TXT record for C2 is an uncommon
+    method for malware that is resilient due to the need for DNS in normal networking
+    activities. This can ensure that their c2 is not blocked by any firewalls. False
+    positives are highly unlikely due to the very uncommon chaining of powershell
+    and DNS TXT queries.
+data_source:
+    - Powershell Script Block Logging 4104
+search: |-
+    `powershell` EventCode=4104
+      (
+        (ScriptBlockText="*resolve-dnsname*" AND ScriptBlockText="*-Type TXT*")
+        OR (ScriptBlockText="*nslookup*" AND ScriptBlockText="*type=txt*")
+        OR (ScriptBlockText="*dig*" AND ScriptBlockText="* TXT*")
+      )
+      (ScriptBlockText="*. (*" OR ScriptBlockText="*IEX*")
+      | fillnull
+      | stats count min(_time) as firstTime max(_time) as lastTime
+        by dest signature signature_id
+           user_id vendor_product EventID
+           Guid Opcode Name
+           Path ProcessID ScriptBlockId
+           ScriptBlockText
+      | `security_content_ctime(firstTime)`
+      | `security_content_ctime(lastTime)`
+      | `windows_powershell_commands_from_dns_txt_filter`
+how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions are available at https://docs.splunk.com/Documentation/ES/latest/Admin/Configurepowershelllogging.
+known_false_positives: False positives are highly unlikely given the uncommon combination of PowerShell execution and DNS TXT query responses. Legitimate use cases for this behavior are extremely rare and should be investigated thoroughly if detected.
+drilldown_searches:
+    - name: View the detection results for - "$user_id$" and "$dest$"
+      search: '%original_detection_search% | search  user_id = "$user_id$" dest = "$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$user_id$" and "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+intermediate_findings:
+    entities:
+        - field: dest
+          type: system
+          score: 20
+          message: A suspicious PowerShell script with the ScriptBlockId [$ScriptBlockId$] containing DNS TXT query commands was executed on host $dest$
+        - field: user_id
+          type: user
+          score: 20
+          message: A suspicious PowerShell script with the ScriptBlockId [$ScriptBlockId$] containing DNS TXT query commands was executed on host $dest$ by user $user_id$
+analytic_story:
+    - Malicious PowerShell
+    - Command And Control
+    - Suspicious DNS Traffic
+asset_type: Endpoint
+mitre_attack_id:
+    - T1071.004
+    - T1059.001
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+security_domain: endpoint
+category: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.004/windows_powershell_commands_from_dns_txt/snapattack_windows.log
+          source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+          sourcetype: XmlWinEventLog
+      test_type: unit

detections/endpoint/windows_suspicious_child_of_consent_exe.yml

@@ -0,0 +1,62 @@
+name: Windows Suspicious Child of Consent.exe
+id: 8194b5d4-41ae-4ce7-adfb-92d375e341d2
+version: 1
+creation_date: '2026-07-30'
+modification_date: '2026-07-30'
+author: Raven Tait, Splunk
+status: production
+type: Anomaly
+description: >-
+    The following analytic detects unexpected child processes spawned by consent.exe,
+    the Windows UAC consent dialog binary. Consent.exe is responsible solely for
+    rendering the UAC elevation prompt and should not spawn child processes under
+    normal operating conditions; child process creation from this parent is a known
+    indicator of UAC bypass and privilege escalation techniques. The detection identifies
+    any executable launched as a child of consent.exe, excluding the expected WerFault.exe
+    error reporting process, which may legitimately appear in crash scenarios. This
+    behavior is associated with UAC bypass exploits and has been observed in multiple
+    post-exploitation frameworks as a means of obtaining elevated privileges without
+    triggering a visible UAC prompt.
+data_source:
+    - Sysmon EventID 1
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*.exe*" Processes.parent_process_name="consent.exe" NOT Processes.process="*WerFault.exe*" by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_suspicious_child_of_consent_exe_filter`'
+how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: Legitimate software installations or system updates may occasionally trigger child processes under consent.exe. Verify any flagged activity against known administrative actions or recent software changes.
+references:
+    - https://securelist.com/cve-2024-30051/112618/
+drilldown_searches:
+    - earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+      name: View the detection results for - "$user$" and "$dest$"
+      search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
+    - name: View risk events for the last 7 days for - "$user$" and "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: '0'
+intermediate_findings:
+    entities:
+        - field: dest
+          type: system
+          score: 20
+          message: Suspicious Child of Consent.exe activity observed on $dest$.
+analytic_story:
+    - Windows Privilege Escalation
+    - Unusual Processes
+asset_type: Endpoint
+mitre_attack_id:
+    - T1068
+    - T1548.002
+    - T1059
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      test_type: unit
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/windows_suspicious_child_of_consent_exe/snapattack_windows.log
+          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: xmlwineventlog

lookups/csv/attacker_tools.csv

@@ -24,6 +24,7 @@ netpass.exe,This process was identified as malicious by DHS Alert TA18-201A and
 NLAChecker.exe,A scanner tool that checks for Windows hosts for Network Level Authentication. This tool allows attackers to detect Windows Servers with RDP without NLA enabled which facilitates the use of brute force non microsoft rdp tools or exploits
 NLBrute.exe,A RDP brute force tool found in botnets for further expansion and and acquisition of targets. This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords.
 nmap.exe,This process is an open source network mapping tool used to identify hosts and listening services on a network.
+netscan.exe,NetScan is a network scanning tool used to discover hosts and services on a network. It is commonly leveraged by threat actors during the discovery phase to enumerate active hosts and open ports within a target environment.
 ns.exe,A commonly used tool used by attackers to scan and map file shares
 ntdll.exe,This process was identified as malicious by DHS Alert TA18-074A.
 OutlookAddressBookView.exe,This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook.