CVE-2026-47301

detections/endpoint/windows_builtin_account_name_was_changed.yml

@@ -0,0 +1,73 @@
+name: Windows Builtin Account Name Was Changed
+id: 65e6e8b9-c68c-460f-beb8-48cfe91b4d21
+version: 1
+creation_date: '2026-08-24'
+modification_date: '2026-08-24'
+author: Raven Tait, Splunk
+status: production
+type: TTP
+description: |-
+    The following analytic detects renaming of Windows built-in accounts via Event ID 4781.
+    It identifies renames targeting accounts with well-known reserved RIDs (500–504): Administrator, Guest, krbtgt, DefaultAccount, and WDAGUtilityAccount, by matching the TargetSid field against the S-1-5-21-*-50[0-4] pattern.
+    Attackers commonly rename the built-in Administrator account to evade detections that alert on the literal account name, while retaining the full privileges of the RID-500 account.
+    Renaming Guest, krbtgt, or other reserved accounts is highly unusual in any legitimate environment.
+data_source:
+    - Windows Event Log Security 4781
+search: |-
+    `wineventlog_security` EventCode=4781
+    | rex field=_raw "TargetSid\">(?<target_sid>[^<]+)"
+    | rex field=_raw "NewTargetUserName\">(?<new_name>[^<]+)"
+    | rex field=_raw "OldTargetUserName\">(?<old_name>[^<]+)"
+    | rex field=_raw "SubjectLogonId\">(?<logon_id>[^<]+)"
+    | where match(target_sid, "S-1-5-21-.*-50[0-4]$")
+    | rename Computer as dest
+    | stats count min(_time) as firstTime max(_time) as lastTime
+    by dest old_name new_name target_sid logon_id
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `windows_builtin_account_name_was_changed_filter`
+how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
+known_false_positives: |-
+    Renaming built-in accounts is uncommon in most environments but may occur during initial system hardening or CIS benchmark compliance efforts.
+    Validate the source user, logon ID, and timing against expected change control windows before tuning.
+references:
+    - https://attack.mitre.org/techniques/T1078/003/
+    - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4781
+    - https://nvd.nist.gov/vuln/detail/cve-2026-47301
+    - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca
+    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations
+drilldown_searches:
+    - name: View the detection results for - "$dest$" and "$old_name$"
+      search: '%original_detection_search% | search  dest = "$dest$" old_name = "$old_name$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+finding:
+    title: Built-in account [$old_name$] (SID $target_sid$) was renamed to [$new_name$] on [$dest$]
+    entity:
+        field: dest
+        type: system
+        score: 50
+analytic_story:
+    - Windows Defense Evasion Tactics
+    - Compromised Windows Host
+asset_type: Endpoint
+mitre_attack_id:
+    - T1078.003
+    - T1036.010
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.003/builtin_account_rename/windows_security.log
+          source: XmlWinEventLog:Security
+          sourcetype: XmlWinEventLog
+      test_type: unit

detections/endpoint/windows_cab_file_on_disk.yml

@@ -1,8 +1,8 @@
 name: Windows CAB File on Disk
 id: 622f08d0-69ef-42c2-8139-66088bc25acd
-version: 11
+version: 12
 creation_date: '2023-11-16'
-modification_date: '2026-05-13'
+modification_date: '2026-08-24'
 author: Michael Haag, Splunk
 status: production
 type: Anomaly
@@ -46,6 +46,8 @@ analytic_story:
     - DarkGate Malware
     - APT37 Rustonotto and FadeStealer
 asset_type: Endpoint
+cve:
+    - CVE-2026-47301
 mitre_attack_id:
     - T1566.001
 product:

detections/endpoint/windows_sccm_adsource_dll_was_planted_in_sms_provider_directory.yml

@@ -0,0 +1,79 @@
+name: Windows SCCM Adsource DLL Was Planted In SMS Provider Directory
+id: 4f55b07b-7aeb-47f4-a234-b222a902276b
+version: 1
+creation_date: '2026-08-20'
+modification_date: '2026-08-20'
+author: Raven Tait, Splunk
+status: production
+type: TTP
+description: |-
+    The following analytic detects creation or modification of adsource.dll or other staging files within the SCCM SMS Provider bin directory, consistent with exploitation of CVE-2026-47301.
+    This abuses a DLL side-loading vulnerability in the Microsoft Configuration Manager SMS Provider component. An attacker can plant a malicious adsource.dll in the SCCMProvider bin\X64 path, causing the SMS Provider service to load the attacker-controlled library in a privileged context.
+    The presence of renamed dlls alongside adsource.dll is a strong indicator of the classic DLL hijacking pattern where the legitimate library has been renamed so the malicious replacement can proxy calls to it.
+    If confirmed malicious, this activity represents a privilege escalation vector that can result in SYSTEM-level code execution on any host running the SCCM SMS Provider role.
+data_source:
+    - Sysmon EventID 11
+search: |-
+    | tstats `security_content_summariesonly`
+      count min(_time) as firstTime
+            max(_time) as lastTime
+    from datamodel=Endpoint.Filesystem where
+    Filesystem.file_name IN ("adsource.dll","adsource_*.dll")
+    Filesystem.file_path="*Microsoft Configuration Manager\\bin\\X64\\*"
+    BY Filesystem.action Filesystem.dest Filesystem.file_access_time
+        Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
+        Filesystem.file_name Filesystem.file_path Filesystem.file_acl
+        Filesystem.file_size Filesystem.process_guid Filesystem.process_id
+        Filesystem.user Filesystem.vendor_product
+    | `drop_dm_object_name(Filesystem)`
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `windows_sccm_adsource_dll_was_planted_in_sms_provider_directory_filter`
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. If you are using Sysmon, you must have EventID 11 (FileCreate) enabled, and the FileCreate section of the configuration must include TargetFilename paths ending in .dll or "Microsoft Configuration Manager\bin\X64\" folder.
+known_false_positives: |-
+    Legitimate SCCM upgrades or hotfix installations may create or replace adsource.dll in the bin\X64 directory.
+    Validate the file hash and digital signature of any detected adsource.dll against the expected version for the installed SCCM build before tuning.
+references:
+    - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca
+    - https://nvd.nist.gov/vuln/detail/cve-2026-47301
+    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations
+drilldown_searches:
+    - name: View the detection results for - "$dest$"
+      search: '%original_detection_search% | search  dest = "$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+finding:
+    title: Suspicious SCCM adsource DLL [$file_name$] detected at [$file_path$] on [$dest$]
+    entity:
+        field: dest
+        type: system
+        score: 50
+threat_objects:
+    - field: file_name
+      type: file_name
+    - field: file_path
+      type: file_path
+analytic_story:
+    - Windows Privilege Escalation
+asset_type: Endpoint
+cve:
+    - CVE-2026-47301
+mitre_attack_id:
+    - T1574.002
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/sccm_adsource_dll/sysmon.log
+          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
+      test_type: unit

detections/endpoint/windows_sccm_smsexec_spawned_a_suspicious_child_process.yml

@@ -0,0 +1,106 @@
+name: Windows SCCM Smsexec Spawned a Suspicious Child Process
+id: 72091a05-3008-4330-b43e-f5e070134ec1
+version: 1
+creation_date: '2026-08-24'
+modification_date: '2026-08-24'
+author: Raven Tait, Splunk
+status: production
+type: Anomaly
+description: |-
+    The following analytic detects shells, scripting engines, and common post-exploitation utilities spawned as child processes of smsexec.exe.
+    smsexec.exe is the core SCCM SMS Executive service process and has no legitimate reason to launch interactive shells or scripting interpreters.
+    An attacker who plants a malicious adsource.dll in the SCCMProvider bin\X64 directory will obtain code execution in the SCCM service context, typically resulting in a SYSTEM-level child process being spawned under smsexec.exe.
+    If confirmed malicious, this activity represents successful exploitation of the SCCM SMS Executive service and should be treated as a full host compromise.
+data_source:
+    - Sysmon EventID 1
+    - Windows Event Log Security 4688
+    - CrowdStrike ProcessRollup2
+search: |-
+    | tstats `security_content_summariesonly`
+      count min(_time) as firstTime
+            max(_time) as lastTime
+    from datamodel=Endpoint.Processes where
+    Processes.parent_process_name="smsexec.exe"
+    Processes.process_name IN (
+        "bitsadmin.exe",
+        "certutil.exe",
+        "cmd.exe",
+        "conhost.exe",
+        "cscript.exe",
+        "curl.exe",
+        "mshta.exe",
+        "net.exe",
+        "net1.exe",
+        "powershell.exe",
+        "pwsh.exe",
+        "reg.exe",
+        "regsvr32.exe",
+        "rundll32.exe",
+        "wmic.exe",
+        "wscript.exe"
+    )
+    by Processes.action Processes.dest Processes.original_file_name
+       Processes.parent_process Processes.parent_process_exec
+       Processes.parent_process_guid Processes.parent_process_id
+       Processes.parent_process_name Processes.parent_process_path
+       Processes.process Processes.process_exec Processes.process_guid
+       Processes.process_hash Processes.process_id
+       Processes.process_integrity_level Processes.process_name
+       Processes.process_path Processes.user Processes.user_id
+       Processes.vendor_product
+    | `drop_dm_object_name(Processes)`
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `windows_sccm_smsexec_spawned_a_suspicious_child_process_filter`
+how_to_implement: |-
+    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: |-
+    smsexec.exe is not expected to spawn interactive shells or scripting engines under normal operating conditions.
+    False positives are unlikely. Validate the full command line and file hash of any match before tuning.
+references:
+    - https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca
+    - https://attack.mitre.org/techniques/T1574/001/
+    - https://attack.mitre.org/techniques/T1068/
+    - https://nvd.nist.gov/vuln/detail/cve-2026-47301
+    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?source=recommendations
+drilldown_searches:
+    - name: View the detection results for - "$dest$"
+      search: '%original_detection_search% | search  dest = "$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+intermediate_findings:
+    entities:
+        - field: dest
+          type: system
+          score: 50
+          message: Suspicious child process [$process_name$] spawned by smsexec.exe on [$dest$]
+threat_objects:
+    - field: parent_process_name
+      type: parent_process_name
+    - field: process_name
+      type: process_name
+analytic_story:
+    - Windows Privilege Escalation
+asset_type: Endpoint
+cve:
+    - CVE-2026-47301
+mitre_attack_id:
+    - T1574.001
+    - T1068
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/sccm_adsource_dll/sysmon.log
+          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
+      test_type: unit