Detect Compromise Software Dependencies and Development Tools in Splunk

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval ParentImageLower=lower(ParentImage)
| eval ImageLower=lower(Image)
| eval CommandLineLower=lower(CommandLine)
| eval ParentCommandLineLower=lower(ParentCommandLine)
// Check if parent is a package manager
| eval IsPackageManager=if(
    match(ParentImageLower, "(\\\\npm\.cmd$|\\\\npm\.exe$|\\\\node\.exe$|\\\\pip\.exe$|\\\\pip3\.exe$|\\\\python\.exe$|\\\\python3\.exe$|\\\\pipx\.exe$|\\\\yarn\.exe$|\\\\pnpm\.exe$|\\\\gem\.exe$|\\\\bundle\.exe$|\\\\cargo\.exe$|\\\\go\.exe$|\\\\nuget\.exe$|\\\\dotnet\.exe$)"),
    1, 0)
// Check if child is a suspicious process
| eval IsSuspiciousChild=if(
    match(ImageLower, "(\\\\powershell\.exe$|\\\\pwsh\.exe$|\\\\cmd\.exe$|\\\\wscript\.exe$|\\\\cscript\.exe$|\\\\mshta\.exe$|\\\\rundll32\.exe$|\\\\regsvr32\.exe$|\\\\certutil\.exe$|\\\\bitsadmin\.exe$|\\\\curl\.exe$|\\\\wget\.exe$)"),
    1, 0)
// Check for suspicious command line content
| eval SuspiciousCommandLine=if(
    match(CommandLineLower, "(/dev/tcp|base64 -d|bash -i|sh -i|nc -e|ncat -e|python -c|perl -e|ruby -e|downloadstring|downloadfile|invoke-expression|iex\\(|curl http|wget http|--registry http)"),
    1, 0)
// Flag postinstall/preinstall hook indicators in parent command
| eval HookAbuse=if(
    match(ParentCommandLineLower, "(postinstall|preinstall|install\.js|setup\.py|node-pre-gyp)"),
    1, 0)
| eval DetectionArm=case(
    IsPackageManager=1 AND IsSuspiciousChild=1, "PackageManagerSpawnedSuspiciousChild",
    IsPackageManager=1 AND SuspiciousCommandLine=1, "PackageManagerSuspiciousCommandLine",
    HookAbuse=1 AND IsSuspiciousChild=1, "LifecycleHookChildProcess",
    true(), null())
| where DetectionArm IS NOT NULL
| eval RiskScore=IsPackageManager + IsSuspiciousChild + SuspiciousCommandLine + HookAbuse
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine,
        DetectionArm, IsPackageManager, IsSuspiciousChild, SuspiciousCommandLine, HookAbuse, RiskScore
| sort - _time