AI-Powered SPL Rule Generation for WRECKSTEEL IOC Detection

How It Works

Uncoder AI converts complex threat intelligence—like the CERT-UA#14283 report on the WRECKSTEEL PowerShell stealer—into Splunk’s Search Processing Language (SPL) for direct deployment in security analytics workflows. It parses IOC-rich reports containing hashes, URLs, domains, and behavioral indicators to generate multi-index SPL queries aligned with Splunk’s native event and network telemetry.

On the left, the report includes over 30 URLs and multiple PowerShell payloads linked to phishing lures and script downloads. On the right, Uncoder AI turns those into a dual-index SPL rule combining index=web/network with index=host PowerShell execution patterns.

Explore Uncoder AI

Generated SPL Query Breakdown

(index=web OR index=network) (

  http://172.86.114.149/seedcode.exe OR http://167.88.127.254:80/Upload OR

  http://45.61.159.252/visa_letter.exe OR https://mfashara.com OR

  http://172.86.88.186/Spisok_spivrobitnykiv_na_zmenshennya_zarobitnoyi_platy_10_03_PDF.pdf OR

  http://172.86.104.17/scretest.ps1 OR http://144.172.98.178

)

• Matches known threat infrastructure based on IOC traffic patterns
  
  
• Identifies inbound/outbound HTTP requests to known WRECKSTEEL delivery servers
  

(index=host)

(powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "iwr 'http://...' | iex")

• Detects PowerShell cradle activity using:
  
  • iwr (Invoke-WebRequest)
    
  • iex (Invoke-Expression)
    

Variants of obfuscated script loading (DownloadString, Net.WebClient)

Why It’s Innovative

Splunk rule authoring often requires security engineers to manually correlate IOC strings with the correct field names and telemetry sources (index=host, index=network, etc.). Uncoder AI automates this by:

• Normalizing all IOCs into their respective telemetry paths (network events vs process creation)
  
• Generating structured Boolean logic for SPL
  
• Ensuring detection spans pre-execution (URL access) and post-execution (PowerShell activity)
  

This fusion of static and dynamic IOC analysis is rarely automated in traditional workflows.

Operational Value

For Splunk defenders and detection engineers:

• Rapid Threat Rule Deployment
  Use CERT-UA reports as immediate rule templates without parsing effort
  
• Behavioral and IOC Coverage
  Align process telemetry (powershell.exe) with network activity (seedcode.exe, script.ps1, mfashara.com)
  
• Hunting at Scale
  Uncover historical matches across environments by deploying AI-converted SPL
  

Uncoder AI enables teams to go from PDF-based threat reports to real-time, production-grade detection rules in Splunk within minutes.

Explore Uncoder AI