nasbench · Oct 5, 2026 · Sep 22, 2026 · Sep 23, 2026 · Sep 23, 2026 · Sep 23, 2026
@@ -1,8 +1,8 @@
 name: Azure AD Privileged Role Assigned
 id: a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a
-version: 16
+version: 17
 creation_date: '2022-08-29'
-modification_date: '2026-05-13'
+modification_date: '2026-09-22'
 author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
 status: production
 type: TTP
@@ -20,7 +20,7 @@ search: |-
         BY dest user src
            vendor_account vendor_product initiatedBy
            result role signature
-      | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description
+      | lookup local=t privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description
       | search isprvilegedadrole = True
       | `security_content_ctime(firstTime)`
       | `security_content_ctime(lastTime)`

@@ -1,8 +1,8 @@
 name: Azure AD Privileged Role Assigned to Service Principal
 id: 5dfaa3d3-e2e4-4053-8252-16d9ee528c41
-version: 14
+version: 15
 creation_date: '2023-04-28'
-modification_date: '2026-05-13'
+modification_date: '2026-09-22'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -24,7 +24,7 @@ search: |-
            vendor_account vendor_product displayName
            initiatedBy result role
            signature
-      | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description
+      | lookup local=t privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description
       | search isprvilegedadrole = True
       | `security_content_ctime(firstTime)`
       | `security_content_ctime(lastTime)`

@@ -1,8 +1,8 @@
 name: Circle CI Disable Security Job
 id: 4a2fdd41-c578-4cd4-9ef7-980e352517f2
-version: 10
+version: 11
 creation_date: '2021-09-02'
-modification_date: '2026-05-13'
+modification_date: '2026-09-22'
 author: Patrick Bareiss, Splunk
 status: production
 type: Anomaly
@@ -15,7 +15,7 @@ search: |-
       | stats values(job_name) as job_names
         BY workflow_id workflow_name user
            commit_message url branch
-      | lookup mandatory_job_for_workflow workflow_name OUTPUTNEW job_name AS mandatory_job
+      | lookup local=t mandatory_job_for_workflow workflow_name OUTPUTNEW job_name AS mandatory_job
       | search mandatory_job=*
       | eval mandatory_job_executed=if(like(job_names, "%".mandatory_job."%"), 1, 0)
       | where mandatory_job_executed=0

@@ -1,8 +1,8 @@
 name: Cloud API Calls From Previously Unseen User Roles
 id: 2181ad1f-1e73-4d0c-9780-e8880482a08f
-version: 11
+version: 12
 creation_date: '2020-10-27'
-modification_date: '2026-05-13'
+modification_date: '2026-09-22'
 author: David Dorsey, Splunk
 status: production
 type: Anomaly
@@ -16,7 +16,7 @@ search: |-
         All_Changes.status=success
       BY All_Changes.user, All_Changes.command All_Changes.object
     | `drop_dm_object_name("All_Changes")`
-    | lookup previously_seen_cloud_api_calls_per_user_role user as user, command as command OUTPUT firstTimeSeen, enough_data
+    | lookup local=t previously_seen_cloud_api_calls_per_user_role user as user, command as command OUTPUT firstTimeSeen, enough_data
     | eventstats max(enough_data) as enough_data
     | where enough_data=1
     | eval firstTimeSeenUserApiCall=min(firstTimeSeen)

@@ -1,8 +1,8 @@
 name: Cloud Compute Instance Created By Previously Unseen User
 id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149
-version: 12
+version: 13
 creation_date: '2019-10-16'
-modification_date: '2026-05-13'
+modification_date: '2026-09-22'
 author: Rico Valdez, Splunk
 status: production
 type: Anomaly
@@ -14,7 +14,7 @@ search: |-
       WHERE All_Changes.action=created
       BY All_Changes.user All_Changes.vendor_region
     | `drop_dm_object_name("All_Changes")`
-    | lookup previously_seen_cloud_compute_creations_by_user user as user OUTPUTNEW firstTimeSeen, enough_data
+    | lookup local=t previously_seen_cloud_compute_creations_by_user user as user OUTPUTNEW firstTimeSeen, enough_data
     | eventstats max(enough_data) as enough_data
     | where enough_data=1
     | eval firstTimeSeenUser=min(firstTimeSeen)

@@ -1,8 +1,8 @@
 name: Cloud Compute Instance Created In Previously Unused Region
 id: fa4089e2-50e3-40f7-8469-d2cc1564ca59
-version: 10
+version: 11
 creation_date: '2020-11-30'
-modification_date: '2026-05-13'
+modification_date: '2026-09-22'
 author: David Dorsey, Splunk
 status: production
 type: Anomaly
@@ -14,7 +14,7 @@ search: |-
       WHERE All_Changes.action=created
       BY All_Changes.vendor_region, All_Changes.user
     | `drop_dm_object_name("All_Changes")`
-    | lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data
+    | lookup local=t previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data
     | eventstats max(enough_data) as enough_data
     | where enough_data=1
     | eval firstTimeSeenRegion=min(firstTimeSeen)

@@ -1,8 +1,8 @@
 name: Cloud Compute Instance Created With Previously Unseen Image
 id: bc24922d-987c-4645-b288-f8c73ec194c4
-version: 10
+version: 11
 creation_date: '2020-04-29'
-modification_date: '2026-05-13'
+modification_date: '2026-09-22'
 author: David Dorsey, Splunk
 status: production
 type: Anomaly
@@ -16,7 +16,7 @@ search: |-
     | `drop_dm_object_name("All_Changes")`
     | `drop_dm_object_name("Instance_Changes")`
     | where image_id != "unknown"
-    | lookup previously_seen_cloud_compute_images image_id as image_id OUTPUT firstTimeSeen, enough_data
+    | lookup local=t previously_seen_cloud_compute_images image_id as image_id OUTPUT firstTimeSeen, enough_data
     | eventstats max(enough_data) as enough_data
     | where enough_data=1
     | eval firstTimeSeenImage=min(firstTimeSeen)

@@ -1,8 +1,8 @@
 name: Cloud Compute Instance Created With Previously Unseen Instance Type
 id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda
-version: 11
+version: 12
 creation_date: '2019-10-16'
-modification_date: '2026-05-13'
+modification_date: '2026-09-22'
 author: David Dorsey, Splunk
 status: production
 type: Anomaly
@@ -26,7 +26,7 @@ search: |-
     | `drop_dm_object_name("All_Changes")`
     | `drop_dm_object_name("Instance_Changes")`
     | where instance_type != "unknown"
-    | lookup previously_seen_cloud_compute_instance_types instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data
+    | lookup local=t previously_seen_cloud_compute_instance_types instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data
     | eventstats max(enough_data) as enough_data
     | where enough_data=1
     | eval firstTimeSeenInstanceType=min(firstTimeSeen)

@@ -1,8 +1,8 @@
 name: Cloud Instance Modified By Previously Unseen User
 id: 7fb15084-b14e-405a-bd61-a6de15a40722
-version: 12
+version: 13
 creation_date: '2020-11-16'
-modification_date: '2026-05-13'
+modification_date: '2026-09-22'
 author: Rico Valdez, Splunk
 status: production
 type: Anomaly
@@ -14,7 +14,7 @@ search: |-
       WHERE All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success
       BY All_Changes.user
     | `drop_dm_object_name("All_Changes")`
-    | lookup previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data
+    | lookup local=t previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data
     | eventstats max(enough_data) as enough_data
     | where enough_data=1
     | eval firstTimeSeenUser=min(firstTimeSeen)

@@ -1,8 +1,8 @@
 name: Cloud Provisioning Activity From Previously Unseen City
 id: e7ecc5e0-88df-48b9-91af-51104c68f02f
-version: 9
+version: 10
 creation_date: '2020-11-30'
-modification_date: '2026-05-13'
+modification_date: '2026-09-22'
 author: Rico Valdez, Bhavin Patel, Splunk
 status: production
 type: Anomaly
@@ -22,7 +22,7 @@ search: |-
     | `drop_dm_object_name("All_Changes")`
     | iplocation src
     | where isnotnull(City)
-    | lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen, enough_data
+    | lookup local=t previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen, enough_data
     | eventstats max(enough_data) as enough_data
     | where enough_data=1
     | eval firstTimeSeenCity=min(firstTimeSeen)

@@ -1,8 +1,8 @@
 name: Cloud Provisioning Activity From Previously Unseen Country
 id: 94994255-3acf-4213-9b3f-0494df03bb31
-version: 9
+version: 10
 creation_date: '2020-12-01'
-modification_date: '2026-05-13'
+modification_date: '2026-09-22'
 author: Rico Valdez, Bhavin Patel, Splunk
 status: production
 type: Anomaly
@@ -22,7 +22,7 @@ search: |-
     | `drop_dm_object_name("All_Changes")`
     | iplocation src
     | where isnotnull(Country)
-    | lookup previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data
+    | lookup local=t previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data
     | eventstats max(enough_data) as enough_data
     | where enough_data=1
     | eval firstTimeSeenCountry=min(firstTimeSeen)

@@ -1,8 +1,8 @@
 name: Cloud Provisioning Activity From Previously Unseen IP Address
 id: f86a8ec9-b042-45eb-92f4-e9ed1d781078
-version: 9
+version: 10
 creation_date: '2020-11-30'
-modification_date: '2026-05-13'
+modification_date: '2026-09-22'
 author: Rico Valdez, Splunk
 status: production
 type: Anomaly
@@ -19,7 +19,7 @@ search: |-
         All_Changes.status=success
       BY All_Changes.src, All_Changes.user, All_Changes.command
     | `drop_dm_object_name("All_Changes")`
-    | lookup previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data
+    | lookup local=t previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data
     | eventstats max(enough_data) as enough_data
     | where enough_data=1
     | eval firstTimeSeenSrc=min(firstTimeSeen)

@@ -1,8 +1,8 @@
 name: Cloud Provisioning Activity From Previously Unseen Region
 id: 5aba1860-9617-4af9-b19d-aecac16fe4f2
-version: 9
+version: 10
 creation_date: '2020-10-26'
-modification_date: '2026-05-13'
+modification_date: '2026-09-22'
 author: Rico Valdez, Bhavin Patel, Splunk
 status: production
 type: Anomaly
@@ -22,7 +22,7 @@ search: |-
     | `drop_dm_object_name("All_Changes")`
     | iplocation src
     | where isnotnull(Region)
-    | lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT firstTimeSeen, enough_data
+    | lookup local=t previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT firstTimeSeen, enough_data
     | eventstats max(enough_data) as enough_data
     | where enough_data=1
     | eval firstTimeSeenRegion=min(firstTimeSeen)

@@ -1,14 +1,14 @@
 name: Kubernetes Nginx Ingress LFI
 id: 0f83244b-425b-4528-83db-7a88c5f66e48
-version: 11
+version: 12
 creation_date: '2021-08-23'
-modification_date: '2026-05-13'
+modification_date: '2026-09-22'
 author: Patrick Bareiss, Splunk
 status: production
 type: TTP
 description: The following analytic detects local file inclusion (LFI) attacks targeting Kubernetes Nginx ingress controllers. It leverages Kubernetes logs, parsing fields such as `request` and `status` to identify suspicious patterns indicative of LFI attempts. This activity is significant because LFI attacks can allow attackers to read sensitive files from the server, potentially exposing critical information. If confirmed malicious, this could lead to unauthorized access to sensitive data, further exploitation, and potential compromise of the Kubernetes environment.
 data_source: []
-search: '`kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+)\s+-\s+-\s+\[(?<time_local>[^\]]*)\]\s\"(?<request>[^\"]*)\"\s(?<status>\S*)\s(?<body_bytes_sent>\S*)\s\"(?<http_referer>[^\"]*)\"\s\"(?<http_user_agent>[^\"]*)\"\s(?<request_length>\S*)\s(?<request_time>\S*)\s\[(?<proxy_upstream_name>[^\]]*)\]\s\[(?<proxy_alternative_upstream_name>[^\]]*)\]\s(?<upstream_addr>\S*)\s(?<upstream_response_length>\S*)\s(?<upstream_response_time>\S*)\s(?<upstream_status>\S*)\s(?<req_id>\S*)" | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | rex field=request "^(?<http_method>\S+)\s(?<url>\S+)\s" | eval phase="operate" | eval severity="high" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, url, http_method, host, http_user_agent, proxy, phase, severity, request | lookup local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT lfi_path | search lfi_path=yes | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter`'
+search: '`kubernetes_container_controller` | rex field=_raw "^(?<remote_addr>\S+)\s+-\s+-\s+\[(?<time_local>[^\]]*)\]\s\"(?<request>[^\"]*)\"\s(?<status>\S*)\s(?<body_bytes_sent>\S*)\s\"(?<http_referer>[^\"]*)\"\s\"(?<http_user_agent>[^\"]*)\"\s(?<request_length>\S*)\s(?<request_time>\S*)\s\[(?<proxy_upstream_name>[^\]]*)\]\s\[(?<proxy_alternative_upstream_name>[^\]]*)\]\s(?<upstream_addr>\S*)\s(?<upstream_response_length>\S*)\s(?<upstream_response_time>\S*)\s(?<upstream_status>\S*)\s(?<req_id>\S*)" | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name as proxy | rex field=request "^(?<http_method>\S+)\s(?<url>\S+)\s" | eval phase="operate" | eval severity="high" | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, url, http_method, host, http_user_agent, proxy, phase, severity, request | lookup local=t local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT lfi_path | search lfi_path=yes | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter`'
 how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
 known_false_positives: No false positives have been identified at this time.
 references:

@@ -1,8 +1,8 @@
 name: O365 BEC Email Hiding Rule Created
 id: 603ebac2-f157-4df7-a6ac-34e8d0350f86
-version: 8
+version: 9
 creation_date: '2025-02-14'
-modification_date: '2026-05-13'
+modification_date: '2026-09-22'
 author: '0xC0FFEEEE, Github Community'
 status: production
 type: TTP
@@ -13,7 +13,7 @@ search: |-
     | stats min(_time) as firstTime, max(_time) as lastTime, values(Operation) as Operation, latest(Name) as Name, latest(MarkAsRead) as MarkAsRead, latest(MoveToFolder) as MoveToFolder by object_id user
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
-    | lookup ut_shannon_lookup word as Name
+    | lookup local=t ut_shannon_lookup word as Name
     | eval entropy_score=if(ut_shannon<=2, 1, 0)
     | eval len_score=if(len(Name)<=3, 1,0)
     | eval read_score=if(MarkAsRead="True", 1, 0)

@@ -1,15 +1,15 @@
 name: O365 Privileged Role Assigned
 id: db435700-4ddc-4c23-892e-49e7525d7d39
-version: 11
+version: 12
 creation_date: '2024-04-13'
-modification_date: '2026-05-13'
+modification_date: '2026-09-22'
 author: Steven Dick
 status: production
 type: TTP
 description: The following analytic identifies the assignment of sensitive and privileged Azure Active Directory roles to an Azure AD user. Adversaries and red teams alike may assign these roles to a compromised account to establish Persistence in an Azure AD environment. This detection leverages the O365 Universal Audit Log data source.
 data_source:
     - Office 365 Universal Audit Log
-search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature, vendor_account, vendor_product, dest | lookup privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category=\"User\" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_filter`"
+search: "`o365_management_activity` Workload=AzureActiveDirectory Operation IN (\"Add member to role.\",\"Add eligible member to role.\") | eval user = ObjectId, src_user = case(match(mvindex('Actor{}.ID',-1),\"User\"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),\"ServicePrincipal\"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)), object_name = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.DisplayName\")), object_id = mvindex('ModifiedProperties{}.NewValue', mvfind('ModifiedProperties{}.Name',\"Role\\.TemplateId\")), signature = Operation, result = ResultStatus, category = mvindex('Target{}.ID',2) | fillnull | stats count, min(_time) as firstTime, max(_time) as lastTime by src_user, src, user, category, result, object_name, object_id, signature, vendor_account, vendor_product, dest | lookup local=t privileged_azure_ad_roles azuretemplateid as object_id OUTPUT isprvilegedadrole | search isprvilegedadrole=\"TRUE\" category=\"User\" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_role_assigned_filter`"
 how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
 known_false_positives: Administrators will legitimately assign the privileged roles users as part of administrative tasks. Microsoft Privileged Identity Management (PIM) may cause false positives / less accurate alerting.
 references: