From 9501d7bc6faa605a5560d10c1e1a6b8a26abeb6b Mon Sep 17 00:00:00 2001 From: Raven Tait Date: Wed, 26 Aug 2026 10:07:27 -0400 Subject: [PATCH 1/5] CVE-2026-47301 Detections for coverage of CVE-2026-47301 --- .../windows_builtin_account_name_change.yml | 71 ++++++++++++ .../endpoint/windows_cab_file_on_disk.yml | 6 +- ...ws_suspicious_child_process_of_smsexec.yml | 104 ++++++++++++++++++ .../windows_suspicious_sccm_adsource_dll.yml | 77 +++++++++++++ 4 files changed, 256 insertions(+), 2 deletions(-) create mode 100644 detections/endpoint/windows_builtin_account_name_change.yml create mode 100644 detections/endpoint/windows_suspicious_child_process_of_smsexec.yml create mode 100644 detections/endpoint/windows_suspicious_sccm_adsource_dll.yml diff --git a/detections/endpoint/windows_builtin_account_name_change.yml b/detections/endpoint/windows_builtin_account_name_change.yml new file mode 100644 index 0000000000..91fdc29e9c --- /dev/null +++ b/detections/endpoint/windows_builtin_account_name_change.yml @@ -0,0 +1,71 @@ +name: Windows Builtin Account Name Change +id: 65e6e8b9-c68c-460f-beb8-48cfe91b4d21 +version: 1 +creation_date: '2026-08-24' +modification_date: '2026-08-24' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects renaming of Windows built-in accounts via Event ID 4781. + It identifies renames targeting accounts with well-known reserved RIDs (500–504): Administrator, Guest, krbtgt, DefaultAccount, and WDAGUtilityAccount, by matching the TargetSid field against the S-1-5-21-*-50[0-4] pattern. + Attackers commonly rename the built-in Administrator account to evade detections that alert on the literal account name, while retaining the full privileges of the RID-500 account. + Renaming Guest, krbtgt, or other reserved accounts is highly unusual in any legitimate environment. +data_source: + - Windows Event Log Security 4781 +search: |- + `wineventlog_security` EventCode=4781 + | rex field=_raw "TargetSid\">(?[^<]+)" + | rex field=_raw "NewTargetUserName\">(?[^<]+)" + | rex field=_raw "OldTargetUserName\">(?[^<]+)" + | rex field=_raw "SubjectLogonId\">(?[^<]+)" + | where match(target_sid, "S-1-5-21-.*-50[0-4]$") + | rename Computer as dest + | stats count values(new_name) as new_account_names + min(_time) as firstTime max(_time) as lastTime + by dest old_name new_name target_sid logon_id + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_builtin_account_name_change_filter` +how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. +known_false_positives: |- + Renaming built-in accounts is uncommon in most environments but may occur during initial system hardening or CIS benchmark compliance efforts. + Validate the source user, logon ID, and timing against expected change control windows before tuning. +references: + - https://attack.mitre.org/techniques/T1078/003/ + - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4781 + - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca +drilldown_searches: + - name: View the detection results for - "$dest$" and "$old_name$" + search: '%original_detection_search% | search dest = "$dest$" old_name = "$old_name$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Built-in account [$old_name$] (SID $target_sid$) was renamed to [$new_account_names$] on [$dest$] + entity: + field: dest + type: system + score: 50 +analytic_story: + - Windows Defense Evasion Tactics + - Compromised Windows Host +asset_type: Endpoint +mitre_attack_id: + - T1078.003 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.003/builtin_account_rename/windows_security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_cab_file_on_disk.yml b/detections/endpoint/windows_cab_file_on_disk.yml index 5d9220feba..16cf9adebd 100644 --- a/detections/endpoint/windows_cab_file_on_disk.yml +++ b/detections/endpoint/windows_cab_file_on_disk.yml @@ -1,8 +1,8 @@ name: Windows CAB File on Disk id: 622f08d0-69ef-42c2-8139-66088bc25acd -version: 11 +version: 12 creation_date: '2023-11-16' -modification_date: '2026-05-13' +modification_date: '2026-08-24' author: Michael Haag, Splunk status: production type: Anomaly @@ -46,6 +46,8 @@ analytic_story: - DarkGate Malware - APT37 Rustonotto and FadeStealer asset_type: Endpoint +cve: + - CVE-2026-47301 mitre_attack_id: - T1566.001 product: diff --git a/detections/endpoint/windows_suspicious_child_process_of_smsexec.yml b/detections/endpoint/windows_suspicious_child_process_of_smsexec.yml new file mode 100644 index 0000000000..3f9a05db02 --- /dev/null +++ b/detections/endpoint/windows_suspicious_child_process_of_smsexec.yml @@ -0,0 +1,104 @@ +name: Windows Suspicious Child Process of smsexec +id: 72091a05-3008-4330-b43e-f5e070134ec1 +version: 1 +creation_date: '2026-08-24' +modification_date: '2026-08-24' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects shells, scripting engines, and common post-exploitation utilities spawned as child processes of smsexec.exe. + smsexec.exe is the core SCCM SMS Executive service process and has no legitimate reason to launch interactive shells or scripting interpreters. + An attacker who plants a malicious adsource.dll in the SCCMProvider bin\X64 directory will obtain code execution in the SCCM service context, typically resulting in a SYSTEM-level child process being spawned under smsexec.exe. + If confirmed malicious, this activity represents successful exploitation of the SCCM SMS Executive service and should be treated as a full host compromise. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + from datamodel=Endpoint.Processes where + Processes.parent_process_name="smsexec.exe" + Processes.process_name IN ( + "bitsadmin.exe", + "certutil.exe", + "cmd.exe", + "conhost.exe", + "cscript.exe", + "curl.exe", + "mshta.exe", + "net.exe", + "net1.exe", + "powershell.exe", + "pwsh.exe", + "reg.exe", + "regsvr32.exe", + "rundll32.exe", + "wmic.exe", + "wscript.exe" + ) + by Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name + Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_suspicious_child_process_of_smsexec_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: |- + smsexec.exe is not expected to spawn interactive shells or scripting engines under normal operating conditions. + False positives are unlikely. Validate the full command line and file hash of any match before tuning. +references: + - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca + - https://attack.mitre.org/techniques/T1574/002/ + - https://attack.mitre.org/techniques/T1068/ +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Suspicious child process [$process_name$] spawned by smsexec.exe on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +analytic_story: + - Windows Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2026-47301 +mitre_attack_id: + - T1574.002 + - T1068 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/sccm_adsource_dll/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit diff --git a/detections/endpoint/windows_suspicious_sccm_adsource_dll.yml b/detections/endpoint/windows_suspicious_sccm_adsource_dll.yml new file mode 100644 index 0000000000..e86464800c --- /dev/null +++ b/detections/endpoint/windows_suspicious_sccm_adsource_dll.yml @@ -0,0 +1,77 @@ +name: Windows Suspicious SCCM Adsource DLL +id: 4f55b07b-7aeb-47f4-a234-b222a902276b +version: 1 +creation_date: '2026-08-20' +modification_date: '2026-08-20' +author: Raven Tait, Splunk +status: production +type: TTP +description: |- + The following analytic detects creation or modification of adsource.dll or other staging fiiles within the SCCM SMS Provider bin directory, consistent with exploitation of CVE-2026-47301. + This abuses a DLL side-loading vulnerability in the Microsoft Configuration Manager SMS Provider component. An attacker can plant a malicious adsource.dll in the SCCMProvider bin\X64 path, causing the SMS Provider service to load the attacker-controlled library in a privileged context. + The presence of renamed dlls alongside adsource.dll is a strong indicator of the classic DLL hijacking pattern where the legitimate library has been renamed so the malicious replacement can proxy calls to it. + If confirmed malicious, this activity represents a privilege escalation vector that can result in SYSTEM-level code execution on any host running the SCCM SMS Provider role. +data_source: + - Sysmon EventID 11 +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + from datamodel=Endpoint.Filesystem where + Filesystem.file_name IN ("adsource.dll","adsource_*.dll") + Filesystem.file_path="*Microsoft Configuration Manager\\bin\\X64\\*" + BY Filesystem.action Filesystem.dest Filesystem.file_access_time + Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time + Filesystem.file_name Filesystem.file_path Filesystem.file_acl + Filesystem.file_size Filesystem.process_guid Filesystem.process_id + Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_suspicious_sccm_adsource_dll_filter` +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: |- + Legitimate SCCM upgrades or hotfix installations may create or replace adsource.dll in the bin\X64 directory. + Validate the file hash and digital signature of any detected adsource.dll against the expected version for the installed SCCM build before tuning. +references: + - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: Suspicious SCCM adsource DLL [$file_name$] detected at [$file_path$] on [$dest$] + entity: + field: dest + type: system + score: 50 +threat_objects: + - field: file_name + type: file_name + - field: file_path + type: file_path +analytic_story: + - Windows Privilege Escalation +asset_type: Endpoint +cve: + - CVE-2026-47301 +mitre_attack_id: + - T1574.002 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/sccm_adsource_dll/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + test_type: unit From 0cb8e144251d2df05a5423c9dfd9f2165abfd0d4 Mon Sep 17 00:00:00 2001 From: oerdogan Date: Fri, 28 Aug 2026 12:45:20 +0200 Subject: [PATCH 2/5] incorporate feedbacks --- .../endpoint/windows_builtin_account_name_change.yml | 8 +++++--- .../windows_suspicious_child_process_of_smsexec.yml | 4 +++- .../endpoint/windows_suspicious_sccm_adsource_dll.yml | 5 ++++- 3 files changed, 12 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/windows_builtin_account_name_change.yml b/detections/endpoint/windows_builtin_account_name_change.yml index 91fdc29e9c..7aec0e3368 100644 --- a/detections/endpoint/windows_builtin_account_name_change.yml +++ b/detections/endpoint/windows_builtin_account_name_change.yml @@ -21,8 +21,7 @@ search: |- | rex field=_raw "SubjectLogonId\">(?[^<]+)" | where match(target_sid, "S-1-5-21-.*-50[0-4]$") | rename Computer as dest - | stats count values(new_name) as new_account_names - min(_time) as firstTime max(_time) as lastTime + | stats count min(_time) as firstTime max(_time) as lastTime by dest old_name new_name target_sid logon_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -34,7 +33,9 @@ known_false_positives: |- references: - https://attack.mitre.org/techniques/T1078/003/ - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4781 + - https://nvd.nist.gov/vuln/detail/cve-2026-47301 - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca + - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations drilldown_searches: - name: View the detection results for - "$dest$" and "$old_name$" search: '%original_detection_search% | search dest = "$dest$" old_name = "$old_name$"' @@ -45,7 +46,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: Built-in account [$old_name$] (SID $target_sid$) was renamed to [$new_account_names$] on [$dest$] + title: Built-in account [$old_name$] (SID $target_sid$) was renamed to [$new_name$] on [$dest$] entity: field: dest type: system @@ -56,6 +57,7 @@ analytic_story: asset_type: Endpoint mitre_attack_id: - T1078.003 + - T1036.010 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_suspicious_child_process_of_smsexec.yml b/detections/endpoint/windows_suspicious_child_process_of_smsexec.yml index 3f9a05db02..989cbaab6a 100644 --- a/detections/endpoint/windows_suspicious_child_process_of_smsexec.yml +++ b/detections/endpoint/windows_suspicious_child_process_of_smsexec.yml @@ -61,6 +61,8 @@ references: - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca - https://attack.mitre.org/techniques/T1574/002/ - https://attack.mitre.org/techniques/T1068/ + - https://nvd.nist.gov/vuln/detail/cve-2026-47301 + - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -87,7 +89,7 @@ asset_type: Endpoint cve: - CVE-2026-47301 mitre_attack_id: - - T1574.002 + - T1574.001 - T1068 product: - Splunk Enterprise diff --git a/detections/endpoint/windows_suspicious_sccm_adsource_dll.yml b/detections/endpoint/windows_suspicious_sccm_adsource_dll.yml index e86464800c..dc743c7d56 100644 --- a/detections/endpoint/windows_suspicious_sccm_adsource_dll.yml +++ b/detections/endpoint/windows_suspicious_sccm_adsource_dll.yml @@ -7,7 +7,7 @@ author: Raven Tait, Splunk status: production type: TTP description: |- - The following analytic detects creation or modification of adsource.dll or other staging fiiles within the SCCM SMS Provider bin directory, consistent with exploitation of CVE-2026-47301. + The following analytic detects creation or modification of adsource.dll or other staging files within the SCCM SMS Provider bin directory, consistent with exploitation of CVE-2026-47301. This abuses a DLL side-loading vulnerability in the Microsoft Configuration Manager SMS Provider component. An attacker can plant a malicious adsource.dll in the SCCMProvider bin\X64 path, causing the SMS Provider service to load the attacker-controlled library in a privileged context. The presence of renamed dlls alongside adsource.dll is a strong indicator of the classic DLL hijacking pattern where the legitimate library has been renamed so the malicious replacement can proxy calls to it. If confirmed malicious, this activity represents a privilege escalation vector that can result in SYSTEM-level code execution on any host running the SCCM SMS Provider role. @@ -30,11 +30,14 @@ search: |- | `security_content_ctime(lastTime)` | `windows_suspicious_sccm_adsource_dll_filter` how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + If you are using Sysmon, you must have EventID 11 (FileCreate) enabled, and the FileCreate section of the configuration must include TargetFilename paths ending in .dll or "Microsoft Configuration Manager\bin\X64\" folder. known_false_positives: |- Legitimate SCCM upgrades or hotfix installations may create or replace adsource.dll in the bin\X64 directory. Validate the file hash and digital signature of any detected adsource.dll against the expected version for the installed SCCM build before tuning. references: - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca + - https://nvd.nist.gov/vuln/detail/cve-2026-47301 + - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' From 2988d95d71484b255cd2e47b7131eb33aaced022 Mon Sep 17 00:00:00 2001 From: oerdogan Date: Fri, 28 Aug 2026 13:12:35 +0200 Subject: [PATCH 3/5] minor changes --- ...dows_builtin_account_name_was_changed.yml} | 4 ++-- ...ec_spawned_a_suspicious_child_process.yml} | 20 +++++++++---------- ...lanted_in_sccm_sms_provider_directory.yml} | 4 ++-- 3 files changed, 14 insertions(+), 14 deletions(-) rename detections/endpoint/{windows_builtin_account_name_change.yml => windows_builtin_account_name_was_changed.yml} (97%) rename detections/endpoint/{windows_suspicious_child_process_of_smsexec.yml => windows_smsexec_spawned_a_suspicious_child_process.yml} (92%) rename detections/endpoint/{windows_suspicious_sccm_adsource_dll.yml => windows_suspicious_adsource_dll_was_planted_in_sccm_sms_provider_directory.yml} (96%) diff --git a/detections/endpoint/windows_builtin_account_name_change.yml b/detections/endpoint/windows_builtin_account_name_was_changed.yml similarity index 97% rename from detections/endpoint/windows_builtin_account_name_change.yml rename to detections/endpoint/windows_builtin_account_name_was_changed.yml index 7aec0e3368..46e95ca581 100644 --- a/detections/endpoint/windows_builtin_account_name_change.yml +++ b/detections/endpoint/windows_builtin_account_name_was_changed.yml @@ -1,4 +1,4 @@ -name: Windows Builtin Account Name Change +name: Windows Builtin Account Name Was Changed id: 65e6e8b9-c68c-460f-beb8-48cfe91b4d21 version: 1 creation_date: '2026-08-24' @@ -25,7 +25,7 @@ search: |- by dest old_name new_name target_sid logon_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_builtin_account_name_change_filter` + | `windows_builtin_account_name_was_changed_filter` how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. known_false_positives: |- Renaming built-in accounts is uncommon in most environments but may occur during initial system hardening or CIS benchmark compliance efforts. diff --git a/detections/endpoint/windows_suspicious_child_process_of_smsexec.yml b/detections/endpoint/windows_smsexec_spawned_a_suspicious_child_process.yml similarity index 92% rename from detections/endpoint/windows_suspicious_child_process_of_smsexec.yml rename to detections/endpoint/windows_smsexec_spawned_a_suspicious_child_process.yml index 989cbaab6a..3a51eda020 100644 --- a/detections/endpoint/windows_suspicious_child_process_of_smsexec.yml +++ b/detections/endpoint/windows_smsexec_spawned_a_suspicious_child_process.yml @@ -1,11 +1,11 @@ -name: Windows Suspicious Child Process of smsexec +name: Windows Smsexec.Exe Spawned A Suspicious Child Process id: 72091a05-3008-4330-b43e-f5e070134ec1 version: 1 creation_date: '2026-08-24' modification_date: '2026-08-24' author: Raven Tait, Splunk status: production -type: TTP +type: Anomaly description: |- The following analytic detects shells, scripting engines, and common post-exploitation utilities spawned as child processes of smsexec.exe. smsexec.exe is the core SCCM SMS Executive service process and has no legitimate reason to launch interactive shells or scripting interpreters. @@ -51,7 +51,7 @@ search: |- | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_suspicious_child_process_of_smsexec_filter` + | `windows_smsexec_spawned_a_suspicious_child_process_filter` how_to_implement: |- The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: |- @@ -59,7 +59,7 @@ known_false_positives: |- False positives are unlikely. Validate the full command line and file hash of any match before tuning. references: - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca - - https://attack.mitre.org/techniques/T1574/002/ + - https://attack.mitre.org/techniques/T1574/001/ - https://attack.mitre.org/techniques/T1068/ - https://nvd.nist.gov/vuln/detail/cve-2026-47301 - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations @@ -72,12 +72,12 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -finding: - title: Suspicious child process [$process_name$] spawned by smsexec.exe on [$dest$] - entity: - field: dest - type: system - score: 50 +intermediate_findings: + entities: + - field: dest + type: system + score: 50 + message: Suspicious child process [$process_name$] spawned by smsexec.exe on [$dest$] threat_objects: - field: parent_process_name type: parent_process_name diff --git a/detections/endpoint/windows_suspicious_sccm_adsource_dll.yml b/detections/endpoint/windows_suspicious_adsource_dll_was_planted_in_sccm_sms_provider_directory.yml similarity index 96% rename from detections/endpoint/windows_suspicious_sccm_adsource_dll.yml rename to detections/endpoint/windows_suspicious_adsource_dll_was_planted_in_sccm_sms_provider_directory.yml index dc743c7d56..85d309775e 100644 --- a/detections/endpoint/windows_suspicious_sccm_adsource_dll.yml +++ b/detections/endpoint/windows_suspicious_adsource_dll_was_planted_in_sccm_sms_provider_directory.yml @@ -1,4 +1,4 @@ -name: Windows Suspicious SCCM Adsource DLL +name: Windows Suspicious Adsource DLL Was Planted In SCCM SMS Provider Directory id: 4f55b07b-7aeb-47f4-a234-b222a902276b version: 1 creation_date: '2026-08-20' @@ -28,7 +28,7 @@ search: |- | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_suspicious_sccm_adsource_dll_filter` + | `windows_suspicious_adsource_dll_was_planted_in_sccm_sms_provider_directory_filter` how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. If you are using Sysmon, you must have EventID 11 (FileCreate) enabled, and the FileCreate section of the configuration must include TargetFilename paths ending in .dll or "Microsoft Configuration Manager\bin\X64\" folder. known_false_positives: |- From 7180483d73072bc508660114d5d727ecb2b0d26f Mon Sep 17 00:00:00 2001 From: oerdogan Date: Fri, 28 Aug 2026 13:36:22 +0200 Subject: [PATCH 4/5] fixing errors --- ...cm_adsource_dll_was_planted_in_sms_provider_directory.yml} | 4 ++-- ...ndows_sccm_smsexec_spawned_a_suspicious_child_process.yml} | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) rename detections/endpoint/{windows_suspicious_adsource_dll_was_planted_in_sccm_sms_provider_directory.yml => windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml} (96%) rename detections/endpoint/{windows_smsexec_spawned_a_suspicious_child_process.yml => windows_sccm_smsexec_spawned_a_suspicious_child_process.yml} (97%) diff --git a/detections/endpoint/windows_suspicious_adsource_dll_was_planted_in_sccm_sms_provider_directory.yml b/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml similarity index 96% rename from detections/endpoint/windows_suspicious_adsource_dll_was_planted_in_sccm_sms_provider_directory.yml rename to detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml index 85d309775e..8d73df5cde 100644 --- a/detections/endpoint/windows_suspicious_adsource_dll_was_planted_in_sccm_sms_provider_directory.yml +++ b/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml @@ -1,4 +1,4 @@ -name: Windows Suspicious Adsource DLL Was Planted In SCCM SMS Provider Directory +name: Windows SCCM Adsource DLL Was Planted In SMS Provider Directory id: 4f55b07b-7aeb-47f4-a234-b222a902276b version: 1 creation_date: '2026-08-20' @@ -28,7 +28,7 @@ search: |- | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_suspicious_adsource_dll_was_planted_in_sccm_sms_provider_directory_filter` + | `windows_sccm_adsource_dll_was_planted_in_sms_provider_directory_filter` how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. If you are using Sysmon, you must have EventID 11 (FileCreate) enabled, and the FileCreate section of the configuration must include TargetFilename paths ending in .dll or "Microsoft Configuration Manager\bin\X64\" folder. known_false_positives: |- diff --git a/detections/endpoint/windows_smsexec_spawned_a_suspicious_child_process.yml b/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml similarity index 97% rename from detections/endpoint/windows_smsexec_spawned_a_suspicious_child_process.yml rename to detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml index 3a51eda020..4e7e0eb43d 100644 --- a/detections/endpoint/windows_smsexec_spawned_a_suspicious_child_process.yml +++ b/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml @@ -1,4 +1,4 @@ -name: Windows Smsexec.Exe Spawned A Suspicious Child Process +name: Windows SCCM Smsexec Spawned a Suspicious Child Process id: 72091a05-3008-4330-b43e-f5e070134ec1 version: 1 creation_date: '2026-08-24' @@ -51,7 +51,7 @@ search: |- | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_smsexec_spawned_a_suspicious_child_process_filter` + | `windows_sccm_smsexec_spawned_a_suspicious_child_process_filter` how_to_implement: |- The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: |- From 2fb5a3ada550fd8b5a875c27e3990b554740eeaa Mon Sep 17 00:00:00 2001 From: oerdogan Date: Fri, 28 Aug 2026 14:01:21 +0200 Subject: [PATCH 5/5] fixing errors --- ...sccm_adsource_dll_was_planted_in_sms_provider_directory.yml | 3 +-- ...windows_sccm_smsexec_spawned_a_suspicious_child_process.yml | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml b/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml index 8d73df5cde..3f26dd0ecf 100644 --- a/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml +++ b/detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml @@ -29,8 +29,7 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sccm_adsource_dll_was_planted_in_sms_provider_directory_filter` -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. - If you are using Sysmon, you must have EventID 11 (FileCreate) enabled, and the FileCreate section of the configuration must include TargetFilename paths ending in .dll or "Microsoft Configuration Manager\bin\X64\" folder. +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. If you are using Sysmon, you must have EventID 11 (FileCreate) enabled, and the FileCreate section of the configuration must include TargetFilename paths ending in .dll or "Microsoft Configuration Manager\bin\X64\" folder. known_false_positives: |- Legitimate SCCM upgrades or hotfix installations may create or replace adsource.dll in the bin\X64 directory. Validate the file hash and digital signature of any detected adsource.dll against the expected version for the installed SCCM build before tuning. diff --git a/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml b/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml index 4e7e0eb43d..eb6b26fd6a 100644 --- a/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml +++ b/detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml @@ -72,7 +72,7 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: 7d latest_offset: "0" -intermediate_findings: +intermediate_findings: entities: - field: dest type: system