Analytics Story: Tuoni

Date: 2025-12-04 ID: 4687ea3e-7837-4a4a-81a4-11825252c643 Author: Raven Tait, Splunk Product: Splunk Enterprise Security

Description

Tuoni is a sophisticated, cross-platform red teaming framework designed to enhance cybersecurity education and training through large-scale cyber defense exercises.

Why it matters

This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Tuoni. A new wave of cyberattacks has emerged using the Tuoni C2 framework, a sophisticated tool that allows threat actors to deploy malicious payloads directly into system memory. This technique helps attackers avoid detection by traditional security solutions that rely on scanning files stored on disk. The Tuoni framework has gained attention in the cybersecurity community for its modular design and ability to perform multiple attack variations without leaving significant traces on compromised systems.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Windows Access Token Manipulation SeDebugPrivilege	Create Process with Token	Anomaly
Windows Cmdline Tool Execution From Non-Shell Process	JavaScript	Anomaly
Windows File Download Via PowerShell	PowerShell, Ingress Tool Transfer	Anomaly
Windows Service Created with Suspicious Service Name	Service Execution	Anomaly
Windows Suspicious C2 Named Pipe	Inter-Process Communication, SMB/Windows Admin Shares, Process Injection	TTP
Windows Suspicious Named Pipe	Inter-Process Communication, SMB/Windows Admin Shares, Process Injection	TTP

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Cisco Network Visibility Module Flow Data	Network	`cisco:nvm:flowdata`	`not_applicable`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 17	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 18	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4703	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log System 7045	Windows	`XmlWinEventLog`	`XmlWinEventLog:System`

References

Source: GitHub | Version: 1