Detection: Windows Process Accessing IronLanguages Repository On GitHub

Updated Date: 2026-09-16 ID: bcdc2543-8c33-44c8-a723-5b7b93e06788 Author: Onur Mustafa Erdogan, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic identifies a process command line referencing the IronLanguages GitHub repository, which hosts .NET implementation of popular scripting engines. Adversaries have downloaded these .NET implementations to avoid getting detected by security controls while executing their payloads. This activity is uncommon in typical enterprise environments outside of software development contexts.

Search

 1
 2| tstats `security_content_summariesonly`
 3  count min(_time) as firstTime
 4        max(_time) as lastTime
 5FROM datamodel=Endpoint.Processes WHERE
 6
 7Processes.process="*/ironlanguages/*"
 8Processes.process="*github.com*"
 9
10by Processes.action Processes.dest Processes.original_file_name
11   Processes.parent_process Processes.parent_process_exec
12   Processes.parent_process_guid Processes.parent_process_id
13   Processes.parent_process_name Processes.parent_process_path
14   Processes.process Processes.process_exec Processes.process_guid
15   Processes.process_hash Processes.process_id
16   Processes.process_integrity_level Processes.process_name
17   Processes.process_path Processes.user Processes.user_id
18   Processes.vendor_product
19
20
21| `drop_dm_object_name(Processes)`
22
23| `security_content_ctime(firstTime)`
24
25| `security_content_ctime(lastTime)`
26
27| `windows_process_accessing_ironlanguages_repository_on_github_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 1	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'`
CrowdStrike ProcessRollup2	Other	`'crowdstrike:events:sensor'`	`'crowdstrike'`
Windows Event Log Security 4688	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Security'`

Macros Used

Name	Value
security_content_summariesonly	`summariesonly=`summariesonly_config `allow_old_summaries=`oldsummaries_config `fillnull_value=`fillnull_config``
windows_process_accessing_ironlanguages_repository_on_github_filter	`search *`

windows_process_accessing_ironlanguages_repository_on_github_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1059	Command and Scripting Interpreter	Execution
T1105	Ingress Tool Transfer	Command and Control

Command and Control

Installation

DE.AE

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	Yes

Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.

Known False Positives

Software developers or DevOps personnel may legitimately clone or download the IronPython repository from GitHub for development purposes. Filter as needed based on known developer hosts or users in your environment.

Associated Analytic Story

Intermediate Findings

Message	Entity Field	Entity Type	Risk Score
The Process [$process_name$] with the Command Line [$process$] accessed the IronLanguages GitHub repository on [$dest$].	dest	system	20

Threat Objects

Field	Type
process	process

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1