Analyze scripts using the AI-powered Malware Reversing agent and Phishing Analysis agent in Splunk Enterprise Security

Review and investigate potentially malicious scripts using the AI-powered Malware Reversing Agent and Phishing Analysis Agent in Splunk Enterprise Security.

Note: The automated threat analysis capability in Splunk Enterprise Security Premier Edition includes the Malware Reversing agent and the Phishing Analysis agent. For more information, see Phishing investigation and threat analysis in Splunk Enterprise Security.
Note: The Malware Reversing agent and the Phishing Analysis agent is supported on Splunk Platform version 10.2.x or higher and Splunk Enterprise Security version 8.6 or higher. Additionally, you must pair SOAR on your deployment of Splunk Enterprise Security.

Many attacks use disguised or complex scripts that can be written in different languages, which makes them time-consuming to interpret. Even when a script is flagged as suspicious, you might not have the context you need to understand what it does or how to respond.

With the Malware Reversing Agent and Phishing Analysis Agent, you can automatically generate a structured summary of script behavior to help reverse malware or analyze a phishing attempt. The summary highlights execution steps, code excerpts, severity, MITRE ATT&CK mappings, and indicators of compromise (IOCs), giving you the details you need to triage and investigate without manually reviewing every line of code.

The Malware Reversing Agent and Phishing Analysis Agent capabilities in Splunk Enterprise Security provide the following information:

  • A suggested severity rating

  • A high-level description of script behavior

  • A step-by-step breakdown of what the script does

  • Relevant code snippets that demonstrate malicious activity

  • MITRE ATT&CK mapping for observed behaviors

  • A list of indicators of compromise ( IOCs) with suggested next steps

Supported file types

The following file types can be analyzed by these AI agents to reverse malware and analyze phishing attempts:
Category Supported file type or extension Content analyzed by the AI agent
Script and code files .js, .vbs, .vbe, .wsh, .wsc, .ps1, .psm1, .psd1, .ps1xml, .psc1, .pssc, .bat, .cmd, .html, .htm, .shtml, .hta, .wsf, .ws, .sct, .xsl, .application, .url, .svg (containing scripts or URLs), other detected code files Scripts and URLs
Office documents .doc, .docx, .docm, .dotx, .dotm, .docb, .xls, .xlsx, .xlsm, .xltx, .xltm, .xlsb, .ppt, .pptx, .pptm, .potx, .potm, .ppsx, .ppsm Macros, commands, active content, and screenshots
PDF documents .pdf Embedded JavaScript commands and screenshots with URLs or suspicious content
Image files .png, .jpg, .jpeg, .gif, .bmp, .tif, .tiff, .wmf, .emf, .heic, other formats QR codes and suspicious content
Calendar files .ics

Access the Malware reversing agent and the Phishing Analysis agent in Splunk Enterprise Security

  1. In Splunk Enterprise Security, select Mission Control and go to the Analyst queue.
  2. Select a finding or an investigation and go to the Overview page.
  3. In the Overview page for the selected artifact, select a file or URL from either the Resources Analyzed tree or from the Summary box. If the file type is supported by the AI agent, you can see the AI Analysis under the Resource Summary tab, or after selecting Static Doc Analysis.
    Note: You can also select the URL for further information such as name, title, Verdict,Phished branch, Domain, Task scores, and so on.
  4. In the AI Analysis box, toggle between the following tabs: Summary, MITRE TTPs, and IOCs and Recommendations.
  5. Review the analysis and use the suggested next steps to produce SPL for further investigation.
    Note: If you have multiple files, select a file for analysis from the drop-down menu and review the summary results.

Example: You receive an alert with a script attachment. In the past, you might rely on a sandbox detonation to see if anything suspicious occurs. With the agentic capabilities, Splunk Enterprise Security automatically produces a summary that shows:

  • The script attempts to download a second-stage payload.
  • Hidden PowerShell commands used to execute the payload.
  • MITRE ATT&CK mapping to Command and Scripting Interpreter.
  • IOCs including external IPs and a malicious file library (DLL).

Instead of spending time decoding the script, you can move directly to verifying the IOCs in your environment or escalating the malware.