The documentation for Splunk Enterprise Security versions 8.0 and higher have been rearchitected from previous versions, causing some links to have redirect errors. For documentation on version 8.0, see Splunk Enterprise Security 8.x documentation.
This documentation does not apply to the most recent version of Splunk® Enterprise Security.
For documentation on the most recent version, go to the latest release.
Supported detections in behavioral analytics service
Behavioral analytics service supports the following detections. More information about each detection is available on the Splunk Security Content website.
- Anomalous Usage of Account Credentials
- Anomalous Usage of Archive Tools
- Attempt To Delete Services
- Attempt To Disable Services
- Attempt to Dump Credentials from Registry Using Reg.exe
- BCDEdit Failure Recovery Modification
- Clear Unallocated Sector Using Cipher App
- Credential Extraction Indicative of Lazagne Command Line Options
- Delete A Net User
- Deny Permission using Cacls Utility
- Detect Dump LSASS Memory Using comsvcs
- Detect Kerberoasting
- Detect Prohibited Applications Spawning cmd.exe
- Detect RClone Command-Line Usage
- Disable Net User Account
- Disable Defender AntiVirus Registry
- DNS Exfiltration Using Nslookup App
- Excessive Number of Office Files Copied
- First time seen command line argument
- Fsutil Zeroing File
- Grant Permission Using Cacls Utility
- High File Deletion Frequency
- Hiding Files And Directories With Attrib.exe
- Modify ACL Permission To Files Or Folder
- More than Usual Number of LOLBAS Applications in Short Time Period
- Phishing Email Detection by Machine Learning Method - SSA
- Rare Parent-Child Process Relationship
- Reconnaissance and Access to Shared Resources using PowerSploit Modules
- Reconnaissance of Access and Persistence Opportunities using PowerSploit Modules
- Reconnaissance of Connectivity using PowerSploit modules
- Reconnaissance of Process or Service Hijacking Opportunities using Mimikatz Modules
- Resize ShadowStorage Volume
- Sdelete Application Execution
- System Process Running from Unexpected Location
- TCP Command and Scripting Interpreter Outbound LDAP Traffic
- Unusual Volume of Data Download from Internal Server Per Entity
- WBAdmin Delete System Backups
- WevtUtil Usage to Clear Logs
- WevtUtil Usage to Disable Logs
- Windows Bitsadmin Download File
- Windows Bits Job Persistence
- Windows Curl Upload to Remote Destination
- Windows CertUtil Decode File
- Windows CertUtil URLCache Download
- Windows CertUtil VerifyCtl Download
- Windows Curl Upload to Remote Destination
- Windows Diskshadow Proxy Execution
- Windows Eventvwr UAC Bypass
- Windows MSHTA Child Process
- Windows MSHTA Command-Line URL
- Windows MSHTA Inline HTA Execution
- Windows Powershell Connect to Internet With Hidden Window
- Windows Powershell DownloadFile
- Windows PowerShell Start-BitsTransfer
- Windows Rundll32 Inline HTA Execution
- Windows WSReset UAC Bypass
Last modified on 01 July, 2022
| Supported data sources in behavioral analytics service | Send findings for risk analysis using the Finding Report schema |
This documentation applies to the following versions of Splunk® Enterprise Security: 7.0.0, 7.0.1, 7.0.2
Download manual
Feedback submitted, thanks!