Splunk Command and Scripting Interpreter Risky Commands

SPLUNK detection rule by Michael Haag, Splunk · Apache-2.0

The following analytic identifies the execution of risky commands within the Splunk platform, such as `runshellscript`, `delete`, and `sendemail`. It leverages the Search_Activity data model to detect ad hoc searches containing these commands, excluding those run by the splunk-system-user. This activity is significant because it may indicate attempts at data exfiltration, deletion, or other unauthorized actions by a malicious user. If confirmed malicious, this could lead to data loss, unauthorized data transfer, or system compromise, severely impacting the organization's security posture.

name: Splunk Command and Scripting Interpreter Risky Commands
id: 1cf58ae1-9177-40b8-a26c-8966040f11ae
version: 6
creation_date: '2022-05-26'
modification_date: '2026-05-14'
author: Michael Haag, Splunk
status: removed
type: Hunting
description: The following analytic identifies the execution of risky commands within the Splunk platform, such as `runshellscript`, `delete`, and `sendemail`. It leverages the Search_Activity data model to detect ad hoc searches containing these commands, excluding those run by the splunk-system-user. This activity is significant because it may indicate attempts at data exfiltration, deletion, or other unauthorized actions by a malicious user. If confirmed malicious, this could lead to data loss, unauthorized data transfer, or system compromise, severely impacting the organization's security posture.
data_source:
    - Splunk
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_risky_commands_filter`'
how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index.  In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
known_false_positives: False positives will be present until properly filtered by Username and search name.
references:
    - https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands
    - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json
    - https://advisory.splunk.com/advisories/SVD-2024-0302
tags:
    analytic_story:
        - Splunk Vulnerabilities
    asset_type: Web Server
    cve:
        - CVE-2022-32154
        - CVE-2024-29946
    mitre_attack_id:
        - T1059
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: audit
tests:
    - name: True Positive Test
      attack_data:
          - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log
            source: audittrail
            sourcetype: audittrail
            custom_index: _audit
deprecation_info:
    reason: Detection is deprecated as these commands are regular splunk commands and not recommended to be run as a detection search.
    removed_in_version: 5.12.0
    replacement_content: []

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

1dbdb8db-f9eb-4568-b306-52bd1e4bc18f

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion