Splunk list all nonstandard admin accounts

SPLUNK detection rule by Rod Soto · Apache-2.0

The following analytic identifies nonstandard Splunk accounts with administrative rights on the instance, excluding the default admin account. It uses REST API calls to retrieve user data and filters for accounts with admin capabilities. This activity is significant as unauthorized admin accounts can indicate potential security breaches or misconfigurations. If confirmed malicious, attackers could leverage these accounts to execute commands, escalate privileges, or persist within the environment, posing a significant risk to the integrity and security of the Splunk instance.

name: Splunk list all nonstandard admin accounts
id: 401d689c-8596-4c6b-a710-7b6fdca296d3
version: 6
creation_date: '2025-05-12'
modification_date: '2026-05-14'
author: Rod Soto
status: removed
type: Hunting
description: 'The following analytic identifies nonstandard Splunk accounts with administrative rights on the instance, excluding the default admin account. It uses REST API calls to retrieve user data and filters for accounts with admin capabilities. This activity is significant as unauthorized admin accounts can indicate potential security breaches or misconfigurations. If confirmed malicious, attackers could leverage these accounts to execute commands, escalate privileges, or persist within the environment, posing a significant risk to the integrity and security of the Splunk instance.'
data_source:
    - Splunk
search: '| rest splunk_server=local /services/authentication/users |search capabilities=admin* OR imported_capabilities=admin* title!=admin | table title roles capabilities splunk_server | `splunk_list_all_nonstandard_admin_accounts_filter`'
how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures.  If there have been admin account, in addition to the standard admin account, intentionally created on this server, then edit the filter macro to exclude them.
known_false_positives: It is not possible to discern from the user table whether or not users with admin rights have been created intentionally, accidentally, or as a result of exploitation. Each user with these rights should be investigated and, if legitimate, added to the filter macro above.  If a user is not believed to be legitimate, then further investigation should take place.
references:
    - https://www.splunk.com/en_us/product-security.html
tags:
    analytic_story:
        - Splunk Vulnerabilities
    asset_type: Endpoint
    cve:
        - CVE-2023-22933
    mitre_attack_id:
        - T1189
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: endpoint
deprecation_info:
    reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release.
    removed_in_version: 5.6.0
    replacement_content: []

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

d67f74dd-deeb-4e3b-8924-874d5298170a

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion