No entries match these filters. Clear filters
└──▷ GET THIS VERSION
copy
$ git clone --branch v6.9.2 https://github.com/splunk/security_content.git
$ git checkout v6.9.2
└──▷ GET THIS VERSION
copy
$ git clone --branch v6.9.1 https://github.com/splunk/security_content.git
$ git checkout v6.9.1
Splunk Security Content v6.9.0 adds 15 new detections spanning Cisco AI Defense, AWS, Zeek, and Braodo Stealer, plus a new GenAI analytic story and alpha threat ops dashboard︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
└──▷ GET THIS VERSION
copy
$ git clone --branch v6.9.0 https://github.com/splunk/security_content.git
$ git checkout v6.9.0
Adds three new Cisco AI Defense detections: Cisco AI Defense Allowed Sensitive Prompt , Cisco AI Defense Allowed Sensitive Response , and Cisco AI Defense Repeated High Risk Activity .︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Introduces a new Abuse of GenAI Systems and Applications analytic story covering GenAI abuse surface. Introduces the Cisco AI Defense Threat Operations dashboard (alpha) for reviewing runtime activity, enforcement outcomes, risky behavior, sensitive data matches, and activity by application and model. Adds AWS Anomalous Secrets Manager Batch Retrieval , AWS Repeated CloudWatch Logs Read Operations, AWS EC2 Multiple SSH Public Keys Uploaded by a Single Identity , AWS EC2 Startup Script Modified on Stopped Instance , and AWS IAM Role Created with External Trust detections for expanded AWS CloudTrail CloudTrail AWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Adds Zeek-based detections: HTTP POST Request with Encoded Payload , Unusual SSH Client Banner , and Unusual HTTP Request Method , along with Zeek HTTP and SSH data sources and macros.
+5 more
show less
Adds PowerShell Download from Code Hosting Service and Windows Process Outbound Connection To Social Media Domain endpoint detections. Adds two new analytics and tags existing detections for the 2026 Braodo Stealer variant under the updated Braodo Stealer analytic story. Advances four M365 Copilot jailbreak analytics to production. Updates atomic_guid values across detections to link with relevant Atomic Red Team tests. Refreshes remote access software coverage and its lookup, adds a file-sharing domains lookup, and updates suspicious-port detection for Cisco Secure Firewall.
Adds three new Cisco AI Defense detections: Cisco AI Defense Allowed Sensitive Prompt , Cisco AI Defense Allowed Sensitive Response , and Cisco AI Defense Repeated High Risk Activity .︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Introduces a new Abuse of GenAI Systems and Applications analytic story covering GenAI abuse surface. Introduces the Cisco AI Defense Threat Operations dashboard (alpha) for reviewing runtime activity, enforcement outcomes, risky behavior, sensitive data matches, and activity by application and model. Adds AWS Anomalous Secrets Manager Batch Retrieval , AWS Repeated CloudWatch Logs Read Operations, AWS EC2 Multiple SSH Public Keys Uploaded by a Single Identity , AWS EC2 Startup Script Modified on Stopped Instance , and AWS IAM Role Created with External Trust detections for expanded AWS CloudTrail CloudTrail AWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Adds Zeek-based detections: HTTP POST Request with Encoded Payload , Unusual SSH Client Banner , and Unusual HTTP Request Method , along with Zeek HTTP and SSH data sources and macros.
+2 more
show less
Adds PowerShell Download from Code Hosting Service and Windows Process Outbound Connection To Social Media Domain endpoint detections. Adds two new analytics and tags existing detections for the 2026 Braodo Stealer variant under the updated Braodo Stealer analytic story.
3 more in Everything
Splunk Security Content v6.7.0 adds 7 new macOS and Windows analytics covering osascript, ClickFix chains, and LOLBin LOLBin A legitimate, pre-installed system binary that attackers abuse to execute malicious code, blend into normal activity, and evade defenses — tools use detection of these to catch living-off-the-land attacks.
└──▷ GET THIS VERSION
copy
$ git clone --branch v6.7.0 https://github.com/splunk/security_content.git
$ git checkout v6.7.0
Adds Cisco NVM - Osascript Network Connection for a Long Duration detection to identify long-lived network connections initiated via osascript on macOS.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Adds MacOS Osascript Executing Interactive Shell detection to catch osascript spawning interactive shells on macOS endpoints. Adds MacOS Osascript Executing JavaScript Code With ObjC detection to identify JavaScript for Automation code using the Objective-C bridge via osascript. Adds Windows Finger.exe Connecting to a Remote Host detection to identify payload retrieval and remote connections through finger.exe. Adds Windows For Loop Usage Within Cmd.exe To Execute Commands detection to catch command execution via for /f loops, a common ClickFix technique.
+5 more
show less
Adds Windows Node.exe Executing JS Script In Immediate Folder detection to flag JavaScript execution by node.exe from unusual directories. Adds Windows Process Accessing IronLanguages Repository On GitHub detection to identify processes reaching out to the IronLanguages repository on GitHub. Updates credential-access and process-injection detections covering LSASS access and termination, credential dumping, Winlogon token manipulation, Rubeus ticket export, handle duplication, and process injection for improved analytic consistency and investigation context. Updates ESXi-related detections ESXi Audit Tampering and ESXi Bulk VM Termination with improved SPL logic and threat metadata. Updates network and web detections including DNS Kerberos Coercion , Internal Horizontal Port Scan NMAP Top 20 , and Plain HTTP POST Exfiltrated Data with better event context and reduced noise.
Adds Cisco NVM - Osascript Network Connection for a Long Duration detection to identify long-lived network connections initiated via osascript on macOS.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Adds MacOS Osascript Executing Interactive Shell detection to catch osascript spawning interactive shells on macOS endpoints. Adds MacOS Osascript Executing JavaScript Code With ObjC detection to identify JavaScript for Automation code using the Objective-C bridge via osascript. Adds Windows Finger.exe Connecting to a Remote Host detection to identify payload retrieval and remote connections through finger.exe. Adds Windows For Loop Usage Within Cmd.exe To Execute Commands detection to catch command execution via for /f loops, a common ClickFix technique.
+2 more
show less
Adds Windows Node.exe Executing JS Script In Immediate Folder detection to flag JavaScript execution by node.exe from unusual directories. Adds Windows Process Accessing IronLanguages Repository On GitHub detection to identify processes reaching out to the IronLanguages repository on GitHub.
3 more in Everything
└──▷ BREAKING ON UPGRADE
! MacOS - Re-opened Applications, Windows Process Injection into Notepad , and XMRIG Driver Loaded detections are scheduled for removal in ESCU version 6.10.0.
Splunk Security Content v6.6.0 adds 12 new analytics for browser shells, LOLBAS LOLBAS Living Off the Land Binaries and Scripts — legitimate Windows executables and scripts that attackers abuse to run malicious code, letting cyber tools detect or emulate attacker behavior without custom malware. NIST AI RMF NIST AI RMF A voluntary framework published by NIST that gives organizations a structured process for identifying, assessing, and managing risks introduced by AI systems, giving cyber tools a common vocabulary and governance scaffold.
└──▷ GET THIS VERSION
copy
$ git clone --branch v6.6.0 https://github.com/splunk/security_content.git
$ git checkout v6.6.0
Adds detection_subcategory_map and nist_ai_rmf_subcategories lookups to support analytic categorization and alignment with NIST AI Risk Management Framework subcategories.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Adds alpha nist_ai_rmf_control_coverage dashboard mapping AI-related ESCU detections to the NIST AI RMF Govern, Map, Measure, and Manage functions to help identify coverage gaps. Adds Cisco NVM - Browser Spawned Unix Shell with External Connection detection to identify command execution or C2 activity originating from browsers on Unix endpoints. Adds LOLBAS Network Connection On Uncommon Port detection to catch rare network activity from trusted system binaries on non-standard ports. Adds LOLBAS Rare Network Connection detection to surface anomalous network connections from LOLBAS binaries with separate process-group and common-port tuning.
+9 more
show less
Adds Socat Network Listener Binding an Executable and Socat Remote TCP Connection with Local Echo Disabled detections for network tunneling, proxying, and C2 via Socat. Adds MacOS AppleScript Shell Execution and Compilation detection to improve visibility into script-based execution on macOS. Adds MacOS Osascript Displaying Suspicious User Prompt detection to catch deceptive user-interaction attacks via osascript on macOS. Adds Windows Builtin Account Name Was Changed detection to identify account manipulation targeting built-in accounts. Adds 'Windows Content Copied from Browser was Executed' detection to catch suspicious execution workflows involving payloads copied from web content. Adds Windows SCCM Adsource DLL Was Planted In SMS Provider Directory detection for DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. Adds Windows SCCM Smsexec Spawned a Suspicious Child Process detection for abnormal child-process execution from smsexec. Adds Linux Crontab Enumeration detection to identify crontab listing activity used for discovery. Updates 18 analytics across Citrix, Windows, Linux, and macOS environments, improving detection fidelity for Citrix ADC exploitation, pipe-based execution, data destruction, Ghostscript exploitation, PowerShell, event-log manipulation, credential access, and more.
Adds detection_subcategory_map and nist_ai_rmf_subcategories lookups to support analytic categorization and alignment with NIST AI Risk Management Framework subcategories.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Adds alpha nist_ai_rmf_control_coverage dashboard mapping AI-related ESCU detections to the NIST AI RMF Govern, Map, Measure, and Manage functions to help identify coverage gaps. Adds Cisco NVM - Browser Spawned Unix Shell with External Connection detection to identify command execution or C2 activity originating from browsers on Unix endpoints. Adds LOLBAS Network Connection On Uncommon Port detection to catch rare network activity from trusted system binaries on non-standard ports. Adds LOLBAS Rare Network Connection detection to surface anomalous network connections from LOLBAS binaries with separate process-group and common-port tuning.
+8 more
show less
Adds Socat Network Listener Binding an Executable and Socat Remote TCP Connection with Local Echo Disabled detections for network tunneling, proxying, and C2 via Socat. Adds MacOS AppleScript Shell Execution and Compilation detection to improve visibility into script-based execution on macOS. Adds MacOS Osascript Displaying Suspicious User Prompt detection to catch deceptive user-interaction attacks via osascript on macOS. Adds Windows Builtin Account Name Was Changed detection to identify account manipulation targeting built-in accounts. Adds 'Windows Content Copied from Browser was Executed' detection to catch suspicious execution workflows involving payloads copied from web content. Adds Windows SCCM Adsource DLL Was Planted In SMS Provider Directory detection for DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. Adds Windows SCCM Smsexec Spawned a Suspicious Child Process detection for abnormal child-process execution from smsexec. Adds Linux Crontab Enumeration detection to identify crontab listing activity used for discovery.
1 more in Everything
Splunk Security Content v6.6.0 adds 12 new analytics for browser shells, LOLBAS LOLBAS Living Off the Land Binaries and Scripts — legitimate Windows executables and scripts that attackers abuse to run malicious code, letting cyber tools detect or emulate attacker behavior without custom malware. NIST AI RMF NIST AI RMF A voluntary framework published by NIST that gives organizations a structured process for identifying, assessing, and managing risks introduced by AI systems, giving cyber tools a common vocabulary and governance scaffold.
└──▷ GET THIS VERSION
copy
$ git clone --branch v6.6.0 https://github.com/splunk/security_content.git
$ git checkout v6.6.0
Adds detection_subcategory_map and nist_ai_rmf_subcategories lookups to support analytic categorization and alignment with NIST AI Risk Management Framework subcategories.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Adds alpha nist_ai_rmf_control_coverage dashboard mapping AI-related ESCU detections to the NIST AI RMF Govern, Map, Measure, and Manage functions to help identify coverage gaps. Adds Cisco NVM - Browser Spawned Unix Shell with External Connection detection to identify command execution or C2 activity originating from browsers on Unix endpoints. Adds LOLBAS Network Connection On Uncommon Port detection to catch rare network activity from trusted system binaries on non-standard ports. Adds LOLBAS Rare Network Connection detection to surface anomalous network connections from LOLBAS binaries with separate process-group and common-port tuning.
+9 more
show less
Adds Socat Network Listener Binding an Executable and Socat Remote TCP Connection with Local Echo Disabled detections for network tunneling, proxying, and C2 via Socat. Adds MacOS AppleScript Shell Execution and Compilation detection to improve visibility into script-based execution on macOS. Adds MacOS Osascript Displaying Suspicious User Prompt detection to catch deceptive user-interaction attacks via osascript on macOS. Adds Windows Builtin Account Name Was Changed detection to identify account manipulation targeting built-in accounts. Adds 'Windows Content Copied from Browser was Executed' detection to catch suspicious execution workflows involving payloads copied from web content. Adds Windows SCCM Adsource DLL Was Planted In SMS Provider Directory detection for DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. Adds Windows SCCM Smsexec Spawned a Suspicious Child Process detection for abnormal child-process execution from smsexec. Adds Linux Crontab Enumeration detection to identify crontab listing activity used for discovery. Updates 18 analytics across Citrix, Windows, Linux, and macOS environments, improving detection fidelity for Citrix ADC exploitation, pipe-based execution, data destruction, Ghostscript exploitation, PowerShell, event-log manipulation, credential access, and more.
Adds detection_subcategory_map and nist_ai_rmf_subcategories lookups to support analytic categorization and alignment with NIST AI Risk Management Framework subcategories.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Adds alpha nist_ai_rmf_control_coverage dashboard mapping AI-related ESCU detections to the NIST AI RMF Govern, Map, Measure, and Manage functions to help identify coverage gaps. Adds Cisco NVM - Browser Spawned Unix Shell with External Connection detection to identify command execution or C2 activity originating from browsers on Unix endpoints. Adds LOLBAS Network Connection On Uncommon Port detection to catch rare network activity from trusted system binaries on non-standard ports. Adds LOLBAS Rare Network Connection detection to surface anomalous network connections from LOLBAS binaries with separate process-group and common-port tuning.
+8 more
show less
Adds Socat Network Listener Binding an Executable and Socat Remote TCP Connection with Local Echo Disabled detections for network tunneling, proxying, and C2 via Socat. Adds MacOS AppleScript Shell Execution and Compilation detection to improve visibility into script-based execution on macOS. Adds MacOS Osascript Displaying Suspicious User Prompt detection to catch deceptive user-interaction attacks via osascript on macOS. Adds Windows Builtin Account Name Was Changed detection to identify account manipulation targeting built-in accounts. Adds 'Windows Content Copied from Browser was Executed' detection to catch suspicious execution workflows involving payloads copied from web content. Adds Windows SCCM Adsource DLL Was Planted In SMS Provider Directory detection for DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. Adds Windows SCCM Smsexec Spawned a Suspicious Child Process detection for abnormal child-process execution from smsexec. Adds Linux Crontab Enumeration detection to identify crontab listing activity used for discovery.
1 more in Everything
Splunk Security Content v6.5.0 adds 13 new detections across Python supply-chain, Vidar stealer, RoguePlanet/ShieldBreak privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources.
└──▷ GET THIS VERSION
copy
$ git clone --branch v6.5.0 https://github.com/splunk/security_content.git
$ git checkout v6.5.0
New analytic story Malicious Python Package Installation with four detections: Python Network Traffic During Package Build , Python PTH File Creation During Package Installation , Python PYTHONPATH Modification During Package Installation , and Python Site Hooks Creation During Package Installation — covering supply-chain threats that execute code during install or persist across Python sessions. New analytic story Vidar Stealer anchored by Windows Cloud Sensitive File Read Access By Uncommon Process , detecting collection of Azure CLI profile metadata, saved credentials, and cookies to support account takeover and cloud reconnaissance. Six new detections added to the RoguePlanet analytic story targeting Windows Defender race-condition and ShieldBreak techniques: Windows Alternate Data Stream Created Over Local Share , Windows Defender MpClient.dll Loaded by Non-Defender Process , Windows Defender Threat Detected on Kernel Object Path , Windows Error Report Created in ReportQueue Manually , Windows Phantom DLL Created on Disk , and Windows Wermgr Spawning System Integrity Process . Two new EDRSilencer behavioral detections via Windows Filtering Platform: Windows EDRSilencer Custom Outbound Filter Added and Windows Filtering Platform Filter Added To Block EDR Process , identifying attempts to block security processes from reaching management infrastructure. 46 existing analytics updated across Windows, Linux, macOS, ESXi, and AWS Bedrock to improve fidelity across AI infrastructure abuse, credential access, browser data theft, process injection, persistence, privilege escalation, and destructive activity.
5 details in Everything
Splunk Security Content v6.4.0 adds 27 new analytics spanning Linux privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources.
└──▷ GET THIS VERSION
copy
$ git clone --branch v6.4.0 https://github.com/splunk/security_content.git
$ git checkout v6.4.0
Adds Linux Binary Executed from Shared Memory Directory analytic to detect execution from shared-memory paths, a common evasion technique. Adds Linux EFI Bootloader File Deletion analytic for detecting bootloader tampering on Linux systems. Adds Linux File Creation In System Generator Directory analytic targeting persistence via systemd generator paths. Adds Linux Ghostscript Exploitation analytic to surface exploitation attempts against Ghostscript. Adds Linux MOTD Script Added analytic for detecting persistence through message-of-the-day scripts.
+22 more
show less
Adds Linux Netcat Outbound Connection analytic to identify reverse-shell and data-exfiltration use of netcat. Adds Linux Possible Bootloader Modification analytic to catch unauthorized bootloader changes. Adds Linux Possible GSM Privilege Escalation analytic for detecting GSM-based privilege escalation paths. Adds Linux Possible Nimbuspwn Privilege Escalation analytic targeting the Nimbuspwn escalation technique. Adds Linux Possible Privilege Escalation via PYTHONPATH analytic to detect PYTHONPATH-based escalation. Adds Linux Possible System Binary Backdoor analytic for identifying backdoored system binaries. Adds Linux Root Execution of id analytic to flag suspicious root-context identity-verification commands. Adds Linux Shell History Access Via Command Line Utility analytic for detecting shell history enumeration. Adds Linux Shell Pseudo Device Reverse Shell analytic targeting pseudo-device reverse-shell techniques. Adds Linux Suspicious Child Process of PostgreSQL analytic to detect database process abuse. Adds Linux Suspicious Docker Build Command Execution analytic for container abuse via docker build. Adds Linux Suspicious GCC Invocation Building Init Shared Object analytic to catch shared-object implant compilation. Adds Linux Suspicious Privileged Container Execution analytic to surface privileged container abuse. Adds Linux Suspicious Redis Activity analytic for detecting Redis abuse as an execution vector. Adds Linux Suspicious Staging of Alternate System Files analytic for detecting system-file replacement staging. Adds Linux Suspicious XDG Autostart analytic to identify persistence via XDG XDG A set of specifications maintained by freedesktop.org that standardise where Linux applications store config, data, and cache files, letting tools respect user-defined paths instead of hardcoding locations. Adds Linux UDEV Rule Created analytic to detect UDEV-based persistence mechanisms. Adds Linux Usermod Root UID Set analytic for detecting UID-0 assignment via usermod. Adds Windows Dir Piped to Findstr Activity analytic to catch directory-listing reconnaissance piped into Findstr. Adds Windows Network Sniffing Tool Executed analytic for detecting execution of known network sniffing utilities. Adds Windows Powershell Commands from DNS TXT analytic to identify PowerShell commands retrieved via DNS TXT DNS TXT A DNS record type that stores arbitrary text strings in a domain's zone data, often used by cyber tools to exfiltrate data, verify domain ownership, or publish policy information like SPF and DMARC. Refreshes the attacker_tools and malware_user_agents lookup CSV files with updated content to improve detection and investigation context.
27 details in Everything
└──▷ BREAKING ON UPGRADE
! The Onboarding Assistant beta is removed from ESCU and is no longer available; it will be reintroduced in Detection Studio in a future release.! The following detections are permanently removed: PowerShell - Connect To Internet With Hidden Window, Regsvr32 with Known Silent Switch Cmdline , Rundll32 CreateRemoteThread In Browser, Splunk App for Lookup File Editing RCE via User XSLT , Splunk Code Injection via custom dashboard leading to RCE , Splunk Enterprise KV Store Incorrect Authorization , Splunk Information Disclosure on Account Login , Splunk Path Traversal In Splunk App For Lookup File Edit , Splunk RCE PDFgen Render , Windows Process Injection Of Wermgr to Known Browser , and Windows Process Injection With Public Source Path . Users relying on any of these detections should review the deprecated analytics documentation and migrate to recommended replacements before upgrading.
Splunk Security Content v6.3.0 adds a Starland RAT campaign story, 4 new Linux/Windows analytics, and expands 67 existing detections.
└──▷ GET THIS VERSION
copy
$ git clone --branch v6.3.0 https://github.com/splunk/security_content.git
$ git checkout v6.3.0
New Analytic Story: Starland RAT Campaign (UAT-11795) — tags analytics across PowerShell abuse, ClickFix social engineering, in-memory execution, credential theft, and Telegram-based C2 for end-to-end campaign visibility. New detection: Linux AppArmor AppArmor A Linux kernel security module, maintained as part of the kernel, that confines programs to a declared set of files, capabilities, and network access — letting cyber tools sandbox processes without writing custom kernel code. New detection: Linux Auditd Possible Setuid Execve Privesc — identifies local privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. New detection: Linux Pedit Offset Out Of Bounds — detects kernel-level exploitation technique targeting pedit. New detection: Windows AppCertDLL Modification Via Registry — covers persistence via AppCertDLL registry manipulation.
+1 more
show less
Expanded coverage across 67 updated analytics spanning Cisco NVM, ransomware extensions/notes, PowerShell abuse, RDP RDP A Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. LLM LLM A large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.
6 details in Everything
Splunk Security Content v6.2.0 adds 10 new detections spanning Linux Dirty Frag, Phantom Stealer, AWS Bedrock Claude AI abuse, and browser process injection.
└──▷ GET THIS VERSION
copy
$ git clone --branch v6.2.0 https://github.com/splunk/security_content.git
$ git checkout v6.2.0
New detection: Linux Dirty Frag Kernel Privilege Escalation (CVE-2026-43284 & CVE-2026-43500) — identifies high-frequency splice() syscall activity followed by setuid binary execution within the same audit session. New analytic story: Phantom Stealer — expands Windows infostealer coverage with a new detection for unauthorized WinSCP security configuration folder access, plus enhanced tagging of existing analytics for credential theft, PowerShell abuse, process injection, and data exfiltration data exfiltration Moving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. New detection: Windows Uncommon Remote Thread Creation In Browser Process — strengthens visibility into CreateRemoteThread-based process injection targeting browser processes using native Sysmon Event ID 8 field mappings. New analytic story: Suspicious AWS Bedrock Claude Activities — introduces 7 new detections covering cross-region inference abuse, excessive token consumption, high-risk filesystem/exec tool invocation, hostile prompt sentiment, prompt injection prompt injection An attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. Updated PowerShell ScriptBlock analytics to omit oversized ScriptBlockText fields from finding messages and convert detections to Anomaly type for clearer triage.
5 details in Everything
Splunk Security Content v6.1.0 adds 34 new detections across Cisco IOS XE, SD-WAN SD-WAN Software-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience.
└──▷ GET THIS VERSION
copy
$ git clone --branch v6.1.0 https://github.com/splunk/security_content.git
$ git checkout v6.1.0
Adds two new Cisco Secure Access detections: Cisco SA - Access to Anonymizer Services and Cisco SA - Automated Web Reconnaissance via HTTP Access Errors to identify evasion and large-scale web reconnaissance via abnormal HTTP error patterns. Introduces BlueHammer and RedSun analytic stories with detections covering suspicious Microsoft Defender engine/signature update activity, unauthorized Defender file modifications, non-administrative password changes, abnormal password reset bursts, and processes interacting with Defender update components. Adds support for Windows Security Event ID 4723 (password change attempts) to improve visibility into credential theft and privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. Expands Linux detection coverage for Copy Fail (CVE-2026-31431) with analytics targeting malformed authentication entries, PF_ALG registration outside normal boot windows, suspicious namespace creation, and process execution with null argv values. Introduces a new Linux kern.log telemetry data source for deeper visibility into low-level system activity and Linux exploitation techniques.
+7 more
show less
Adds nine new Cisco IOS XE detections covering Salt Typhoon-style activity: Guestshell activation/destruction, log clearing sequences, VTY access control tampering, tunnel interface creation, WebUI abuse, remote access probe bursts, reconnaissance commands, and platform package shell interactions. Adds two new Cisco SD-WAN analytics to detect multiple source IPs authenticating to vManage via SSH and repeated SSH key-based authentications from a single source. Introduces a new PTC Windchill Exploitation analytic story with detections for gateway command execution and GW READY/OK probing activity, plus a new Windchill Log4j data source and supporting macro. Adds new analytic stories for RoguePlanet and Salat Stealer. Adds Windows FFmpeg audio/video device discovery and DirectShow video capture detections to identify potential surveillance or data exfiltration data exfiltration Moving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. Adds Windows Cloud Files Filter detections for files loaded by uncommon processes or logs created by non-system processes. Introduces Splunk Secure Application Alerts for Runtime Security detection for runtime-level visibility.
12 details in Everything
└──▷ BREAKING ON UPGRADE
! The detections Attempt To Add Certificate To Untrusted Store , CHCP Command Execution , Ivanti Sentry Authentication Bypass , Processes launching netsh , and Sc exe Manipulating Windows Services have been permanently removed in v6.1.0; any alerts, correlation searches, or workflows depending on them will stop functioning.! PowerShell - Connect To Internet With Hidden Window and Regsvr32 with Known Silent Switch Cmdline are deprecated and scheduled for removal in v6.4.0.
v6.1.0 adds 34 new detections and 5 analytic stories covering Cisco IOS XE, SD-WAN SD-WAN Software-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience.
└──▷ GET THIS VERSION
copy
$ git clone --branch v6.1.0 https://github.com/splunk/security_content.git
$ git checkout v6.1.0
Adds two Cisco Secure Access detections identifying outbound access to anonymizer/privacy services and automated web reconnaissance via abnormal HTTP error patterns. Adds new analytic stories and detections for BlueHammer and RedSun exploit families targeting Microsoft Defender for privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. Introduces support for Windows Security Event ID 4723 (password change attempts) to improve visibility into credential theft and privilege escalation tradecraft. Expands Linux detection coverage for CVE-2026-31431 (Copy Fail) with new analytics targeting malformed authentication entries, PF_ALG registration outside boot windows, suspicious namespace creation, and process execution with null argv values. Introduces a new Linux kern.log data source, providing deeper visibility into low-level system activity and emerging Linux kernel exploitation techniques.
+6 more
show less
Adds nine Cisco IOS XE detections covering Salt Typhoon-style tradecraft: Guestshell activation/destruction, log clearing, VTY access control tampering, tunnel interface creation, WebUI abuse, remote access probe bursts, reconnaissance command activity, and platform package shell interactions. Adds two Cisco SD-WAN analytics detecting multiple source IPs authenticating to vManage via SSH and repeated SSH key-based authentications from a single source, targeting credential sharing and distributed brute-force against SD-WAN management. Introduces a new PTC Windchill Exploitation analytic story with detections for gateway command execution and GW READY/OK probing, plus a new Windchill Log4j data source and supporting macro. Adds new analytic stories for RoguePlanet and Salat Stealer. Breaking change: removes five detections (Attempt To Add Certificate To Untrusted Store, CHCP Command Execution, Ivanti Sentry Authentication Bypass, Processes launching netsh, Sc exe Manipulating Windows Services) — users should review the official removed-detections list and transition where applicable. Schedules two additional detections for removal in v6.4.0: PowerShell - Connect To Internet With Hidden Window and Regsvr32 with Known Silent Switch Cmdline (replaced by Regsvr32 Silent and Install Param Dll Loading).
11 details in Everything
└──▷ BREAKING ON UPGRADE
! The detections Attempt To Add Certificate To Untrusted Store , CHCP Command Execution , Ivanti Sentry Authentication Bypass , Processes launching netsh , and Sc exe Manipulating Windows Services have been permanently removed in v6.1.0 with no replacement content; any alerting or workflows depending on these detections will stop functioning after upgrading.
ESCU 6.0.0 expands Finding support with entity-tagged scores and adds creation/modification date clarity across all content.
└──▷ GET THIS VERSION
copy
$ git clone --branch v6.0.0 https://github.com/splunk/security_content.git
$ git checkout v6.0.0
Detections now create Findings with appropriately tagged entities and real risk scores instead of generic 0-score N/A entity Findings, aligning with Enterprise Security v8.x+ Finding behavior. Detections, Analytic Stories, and related content now expose both creation date and modification date, making content age and recency visible wherever content is viewed. Transitions tooling from contentctl to Detection Studio as the officially supported content-development capability going forward.
3 details in Everything
└──▷ BREAKING ON UPGRADE
! Five detections (CHCP Command Execution, Sc exe Manipulating Windows Services, Processes launching netsh, Ivanti Sentry Authentication Bypass, Attempt To Add Certificate To Untrusted Store) are scheduled for removal in v6.1.0 with no replacement detections available; any correlation searches or use cases depending on them will stop firing after that upgrade.
Splunk Security Content v5.27.0 adds 67 new detections spanning Linux CVE-2026-31431, Cisco Secure Access firewall telemetry, and broad Windows attack-lifecycle coverage.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.27.0 https://github.com/splunk/security_content.git
$ git checkout v5.27.0
New detection: Linux Auditd Copy Fail Privilege Escalation (CVE-2026-31431) uses auditd telemetry to catch unprivileged writes to file page cache targeting setuid binaries. New analytic story: Cisco Secure Access Analytics enables firewall-telemetry-based detection of suspicious access patterns via cloud-delivered security controls. Extends existing detections (Large ICMP Traffic, Outbound SMB SMB A network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. RDP RDP A Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. New analytic story: VIP VIP A Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. New detection: PowerShell Environment Variable Execution surfaces encoded payload staging used in phishing-delivered stealer campaigns.
+21 more
show less
New detection: Windows Anomalous Registry Value Length in Environment Key identifies oversized registry values used for payload staging. New detection: PowerShell PInvoke Process Injection API Chain catches in-memory process injection via P/Invoke API sequences. New detection: Windows Proxy Execution of .NET Utilities via Scripts detects script-driven LOLBin LOLBin A legitimate, pre-installed system binary that attackers abuse to execute malicious code, blend into normal activity, and evade defenses — tools use detection of these to catch living-off-the-land attacks. New detections for Cobalt Strike: Windows Cobalt Strike PowerShell Loader and Windows Default Cobalt Strike PowerShell Beacon. New detections for C2 frameworks: Windows NorthStar C2 Agent Execution and Windows Metasploit Confluence Plugin Execution. New detections for Cloudflared tunnels: Windows Potential Cloudflared Network Connection and Windows Potential Cloudflared Tunnel Execution. New detections for EDR EDR Endpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. New EFI/bootkit detections: Windows EFI Bootloader File Modification, Windows EFI Volume Mount Attempt Via Mountvol, and Windows Suspicious File in EFI Volume. New detection: Windows LAPS LAPS A Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet. New detections for RMM tool abuse: Windows RMM Tool Execution, Windows Level RMM PowerShell Script Installer, and Windows Level RMM Watchdog Task Created. New detections for privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. New detection: Windows Scheduled Task Created in a Group Policy Object for GPO-based persistence. New detection: Windows Downdate Registry Activity for downgrade attack tradecraft. New detection: Windows Devtunnels Execution and Windows Devtunnels Image Loaded for Microsoft Dev Tunnels abuse. New detection: Windows Process Accessing Windows Recall Directory for access to AI-feature sensitive data. New detection: Windows Computer Account Changed to Domain Controller for DCSync DCSync An attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers. New detection: Windows SoftEther VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. New detection: Windows Suspicious QEMU QEMU An open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. New detection: Windows Mustang Panda USB Tool Execution for APT USB-based lateral movement lateral movement Moving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. New detection: Windows TeamCity Plugin Installed and Windows TeamCity Payload Execution from Temp Directory for supply chain tooling abuse. All detections updated to align with MITRE ATT&CK MITRE ATT&CK A publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior.
26 details in Everything
Splunk Security Content v5.26.0 adds 11 new macOS detections across 3 new analytic stories plus Axios supply chain and Microsoft Intune coverage.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.26.0 https://github.com/splunk/security_content.git
$ git checkout v5.26.0
New analytic story: MacOS Persistence Techniques — covers LoginHook persistence, kextload abuse, and hidden files/directories. New analytic story: MacOS Post-Exploitation — covers log removal, data chunking, network share discovery, and firewall rule enumeration. New analytic story: MacOS Privilege Escalation — covers Gatekeeper bypass and keychain dumping. New analytic story: Axios Supply Chain Post Compromise — tags existing analytics to detect post-installation script execution, credential access, exfiltration, and persistence in JavaScript/Node.js supply chain attacks. New detection: MacOS Account Created — visibility into account creation activity on Apple endpoints.
+10 more
show less
New detection: MacOS Data Chunking — identifies attacker data-staging behavior on macOS. New detection: MacOS Gatekeeper Bypass — detects attempts to circumvent macOS code-signing controls. New detection: MacOS Hidden Files and Directories — surfaces use of hidden filesystem artifacts. New detection: MacOS Kextload Usage — monitors abuse of kernel extension loading. New detection: MacOS Keychains Dumped — detects credential harvesting from macOS keychain. New detection: MacOS List Firewall Rules — identifies enumeration of macOS firewall configuration. New detection: MacOS Log Removal — detects clearing of logs to cover attacker tracks. New detection: MacOS LoginHook Persistence — monitors use of LoginHook mechanism for persistence. New detection: MacOS Network Share Discovery — surfaces network share enumeration on macOS. New detection: Microsoft Intune Bulk Wipe — detects mass device wipe actions in Microsoft Intune cloud environments.
15 details in Everything
└──▷ BREAKING ON UPGRADE
! Several detections previously deprecated in ESCU v5.24.0 have now been removed in v5.26.0; users must transition to recommended replacements (see the List of Removed Detections in Splunk documentation).! A new set of detections has been deprecated in v5.26.0 and are scheduled for removal in ESCU v6.1.0.
ESCU v5.25.1 patches ESCU 5.25.0 release notes including two new analytic stories and detections
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.25.1 https://github.com/splunk/security_content.git
$ git checkout v5.25.1
Adds the Gh0st RAT analytic story to group multiple existing analytics related to service creation, registry persistence, command-line execution, and system discovery behaviors alongside new detections. Adds the Void Manticore analytic story to group analytics aligned to data destruction, shadow copy deletion, backup recovery tampering, and suspicious script execution behaviors. Adds detection for Windows Routing and Remote Access Service Registry Key Change to identify persistence via registry modifications.
3 details in Everything
Splunk Security Content v5.24.0 adds 14 new detections covering Cisco SD-WAN SD-WAN Software-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.24.0 https://github.com/splunk/security_content.git
$ git checkout v5.24.0
Adds detections for Cisco SD-WAN arbitrary file overwrite exploitation activity and uncommon user-agent multi-URI HTTP patterns targeting SD-WAN infrastructure. Introduces BlankGrabber stealer coverage with new analytics for browser data access, suspicious registry queries, WMI WMI Windows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. Adds Lotus Blossom (Chrysalis Backdoor) detections including Bitdefender DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. New detection: Windows Bluetooth Service Installed From Uncommon Location — catches persistence via BluetoothService abuse. New detection: Windows TinyCC Shellcode Execution — identifies staged shellcode delivery associated with Lotus Blossom intrusion chains.
+12 more
show less
New detection: Windows Excel Spawning Microsoft Project Application — flags suspicious parent-child process chains indicative of phishing-delivered payloads. New detection: Linux Docker Root Directory Mount — identifies container escape attempts via host root filesystem mounting. New detection: Linux Docker Shell Execution — detects interactive shell spawning inside Docker containers. New detection: Linux Auditd AI CLI Permission Override Activated — covers privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. New detection: Windows MpCmdRun RemoveDefinitions Execution — catches Windows Defender definition removal as a defense evasion technique. New detection: Windows WMI Reconnaissance Class Query — surfaces WMI-based system enumeration consistent with stealer and APT post-compromise behavior. New detection: Windows Hosts File Access — detects suspicious reads of the hosts file used for C2 redirection or lateral movement lateral movement Moving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. New detection: Windows Product Key Registry Query — identifies registry-based system fingerprinting associated with BlankGrabber and similar stealers. New detection: Windows WinRAR Launched Outside Default Installation Directory — flags portable or dropped WinRAR used for data staging and exfiltration. New detection: Windows Rundll32 Execution With Log.DLL — identifies abuse of log.dll via rundll32 for stealthy code execution. Introduces 4 new analytic stories: BlankGrabber Stealer, Lotus Blossom Chrysalis Backdoor, MuddyWater, and QuietVault. Standardizes risk scoring across all analytics: 50 for TTP TTP Tactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind.
17 details in Everything
Splunk Security Content v5.23.0 adds a Cisco Catalyst SD-WAN SD-WAN Software-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.23.0 https://github.com/splunk/security_content.git
$ git checkout v5.23.0
New analytic story: Cisco Catalyst SD-WAN Analytics — covers anomalous control-plane relationships across vManage, vSmart, and edge devices using control-connection telemetry. New detection: Cisco SD-WAN – Low Frequency Rogue Peer — identifies rare or unexpected peer interactions that may indicate unauthorized infrastructure or adversary presence in SD-WAN environments. New detection: Cisco SD-WAN – Peering Activity — surfaces abnormal peering patterns deviating from established network baselines. New detection: Curl Execution with Percent Encoded URL — detects endpoint activity where curl is invoked with percent-encoded URLs, a technique used to evade URL-based controls.
4 details in Everything
Splunk Security Content v5.22.0 adds 5 MCP MCP Model Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. RCE RCE Remote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.22.0 https://github.com/splunk/security_content.git
$ git checkout v5.22.0
New analytic story Suspicious MCP Activities detects abuse of Model Context Protocol Model Context Protocol Model Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. data exfiltration data exfiltration Moving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. lateral movement lateral movement Moving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. New MCP Technology Add-on (TA) for parsing MCP server telemetry to support MCP-related detections. New detection: MCP Sensitive System File Search — identifies malicious file searches via MCP filesystem integrations. New detection: MCP Prompt Injection — detects prompt injection prompt injection An attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. New detection: MCP Postgres Suspicious Query — flags abnormal database queries issued through MCP Postgres integrations.
+9 more
show less
New detection: MCP GitHub Suspicious Operation — surfaces suspicious GitHub API operations invoked via MCP. New detection: MCP Filesystem Server Suspicious Extension Write — catches suspicious file extension writes through MCP filesystem servers. New detection: Windows Execution of Microsoft MSC File In Suspicious Path — detects MSC file execution from non-standard locations. New detection: Windows MMC Loaded Script Engine DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. New analytic story DynoWiper maps Sandworm destructive wiper behaviors including file-overwrite, drive enumeration, and pre-reboot execution. New analytic story ZOVWiper expands coverage for the ZOVWiper destructive malware family attributed to Sandworm. New analytic story SolarWinds WHD RCE Post Exploitation (CVE-2025-26399) tracks post-exploitation activity including process spawning, privilege escalation, and C2 behavior from compromised Web Help Desk services. New analytic story XML Runner Loader provides detection coverage for this loader technique. Updated CrowdStrike Falcon Stream Alerts detection with community-contributed improvements.
14 details in Everything
└──▷ BREAKING ON UPGRADE
! The Cobalt Strike Named Pipes detection has been removed; users must transition to Windows Suspicious C2 Named Pipe .! The HTTP Suspicious Tool User Agent detection has been removed; users must transition to HTTP Scripting Tool User Agent .! A new set of detections has been deprecated and are scheduled for removal in ESCU v5.24.0; see the List of Detections Scheduled for Removal for details.
Splunk Security Content v5.21.0 adds Finding-Based Detections, CVE-2026-24061 telnet coverage, Chromium hijacking analytics, and VoidLink/Storm-0501/StealC threat actor stories.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.21.0 https://github.com/splunk/security_content.git
$ git checkout v5.21.0
Introduces Finding-Based Detections (requires ES 8.4+) — a new analytic type that automatically groups and correlates high volumes of related findings at the entity level to reduce alert noise and surface high-risk users or hosts. Adds new analytic story and detection Linux Telnet Authentication Bypass covering CVE-2026-24061, a critical authentication bypass in GNU InetUtils telnetd allowing unauthenticated root sessions via an unsanitized USER environment variable. Adds new endpoint detections for Windows Chromium browser hijacking, identifying browsers launched with abnormally small window sizes, disabled popup blocking, disabled logging, suppressed extensions, and headless execution — behaviors tied to ad fraud, credential harvesting, and post-exploitation frameworks. Adds new analytic story VoidLink Cloud-Native Linux Malware covering a modular C2 framework with rootkit functionality targeting containerized and cloud environments. Adds new analytic story Storm-0501 Ransomware improving visibility into ransomware execution chains and post-compromise persistence.
+1 more
show less
Adds new analytic story StealC Stealer improving detection of credential theft, downloader behavior, and post-compromise activity.
6 details in Everything
└──▷ BREAKING ON UPGRADE
! The 'Process Creating LNK file in Suspicious Location' detection no longer creates notable alerts/findings on upgrade — it will only create risk events (intermediate findings).
v5.20.0 adds 25 new detections across browser hijacking, Kubernetes eBPF eBPF A Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.20.0 https://github.com/splunk/security_content.git
$ git checkout v5.20.0
Adds 5 new Analytic Stories: Browser Hijacking, Cisco Isovalent Suspicious Activity, PromptFlux, SesameOp, and Suspicious User Agents. New browser hijacking detections identify Chrome auto-update disabling, unauthorized extension allowlisting and force-loading, and command-line flag abuse for persistence. New Cisco Isovalent detections leverage kernel-level eBPF telemetry to surface container escapes, offensive tooling in pods, anomalous kprobe activity, cloud metadata access, and suspicious shell/network behavior in Kubernetes environments. New HTTP user agent detections identify suspicious strings tied to C2 frameworks, malware, RMM tools, PUAs, and scripting tools blending into normal HTTP traffic. New detections for SesameOp and PromptFlux cover AI API abuse as C2 channels and introduce coverage for Windows Potential AppDomainManager Hijack Artifacts Creation.
+1 more
show less
New Cisco IOS and Cisco Secure Firewall detections cover privileged HTTP command execution, SSH connections to non-standard ports, and SSH connections to sshd_operns, correlated via risk-based searches for privileged account creation.
6 details in Everything
└──▷ BREAKING ON UPGRADE
! The Windows Default RDP File Creation detection is removed; replace with Windows Default RDP File Creation By Non MSTSC Process .! The Windows Java Spawning Shells detection is removed; replace with Web or Application Server Spawning a Shell .! The Linux Java Spawning Shell detection is removed; replace with Web or Application Server Spawning a Shell .! The W3WP Spawning Shell detection is removed; replace with Web or Application Server Spawning a Shell .! The Wget Download and Bash Execution detection is removed; replace with File Download or Read to Pipe Execution .! The Curl Download and Bash Execution detection is removed; replace with File Download or Read to Pipe Execution .! The Wmiprsve LOLBAS Execution Process Spawn detection is removed; replace with Wmiprvse LOLBAS Execution Process Spawn .
Splunk Security Content v5.19.0 adds 6 new analytic stories and 31 detections spanning React RCE RCE Remote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.19.0 https://github.com/splunk/security_content.git
$ git checkout v5.19.0
New React2Shell analytic story (CVE-2025-55182) with detections for suspicious Node.js/React/Next.js child processes on Windows and Linux, plus a network-layer detection via Cisco Secure Firewall Threat Defense Intrusion Events for pre-auth RCE attempts. New Tuoni C2 Framework analytic story with detections targeting memory-based execution patterns, suspicious process behaviors, and C2 communication indicators across Windows, Linux, and macOS. New Kerberos Coercion with DNS analytic story (CVE-2025-33073) covering DNS-triggered Kerberos authentication abuse, including detections for short-lived DNS records, DNS-based coercion, and credential target information structures in command lines. New NPM Supply Chain Compromise analytic story detecting malicious lifecycle hook abuse (preinstall/install/postinstall/prepare), GitHub workflow tampering, credential theft, and Shai-Hulud 2.0 worm campaign exfiltration artifacts. New NetSupport RMM Tool Abuse analytic story with analytics identifying NetSupport via loaded DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls.
+4 more
show less
New Suspicious Local LLM LLM A large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. safetensors safetensors A model weight file format that stores only tensors, unlike Python pickle files that can run code when loaded. It is the default on Hugging Face. Expanded Cisco ASA detection coverage with 11 new analytics covering AAA policy tampering, logging filter and message suppression, packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. Added 4 new named-pipe lookups: pua_named_pipes, suspicious_c2_named_pipes, suspicious_named_pipes, and suspicious_rmm_named_pipes to support new Windows named-pipe detections. Added new executable_extensions macro and updated cisco_snort_ids_to_threat_mapping lookup to support expanded detection logic.
9 details in Everything
Splunk Security Content v5.18.0 adds Castle RAT analytic story and 3 new endpoint detections for UAC bypass and browser abuse.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.18.0 https://github.com/splunk/security_content.git
$ git checkout v5.18.0
New analytic story: Castle RAT — covers command execution, file exfiltration, keylogging, and screen capture TTPs TTPs Tactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. New detection: Windows Browser Process Launched with Unusual Flags — improves visibility into browser abuse within Castle RAT infection chains. New detection: Windows ComputerDefaults Spawning a Process — detects ComputerDefaults-based UAC bypass technique. New detection: Windows Handle Duplication in Known UAC-Bypass Binaries — identifies handle duplication abuse in known bypass binaries for privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. Enhanced research.splunk.com detection entries now include attack data, MITRE ATT&CK MITRE ATT&CK A publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior.
5 details in Everything
└──▷ BREAKING ON UPGRADE
! Several detections previously deprecated in ESCU v5.16.0 have been removed in v5.18.0: Windows Change Default File Association For No File Ext , Detect Rundll32 Application Control Bypass - setupapi, Detect Rundll32 Application Control Bypass - syssetup, and Detect Rundll32 Application Control Bypass - advpack. Users must transition to their listed replacement detections.! A new set of detections has been deprecated and is scheduled for removal in ESCU v5.20.0; see the official List of Detections Scheduled for Removal for details.
Splunk Security Content v5.17.0 adds 5 new analytic stories and 18 new detections covering WSUS WSUS Windows Server Update Services, a Microsoft service that lets administrators centrally manage and distribute Windows and software updates to machines on a network instead of each host pulling from the internet. RCE RCE Remote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. EBS EBS Amazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.17.0 https://github.com/splunk/security_content.git
$ git checkout v5.17.0
New analytic story: Microsoft WSUS CVE-2025-59287, covering unauthenticated RCE via WSUS deserialization deserialization Turning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution. New analytic story: HTTP Request Smuggling, with five new detections — *HTTP Suspicious Tool User Agent*, *HTTP Request to Reserved Name on IIS Server*, *HTTP Rapid POST with Mixed Status Codes*, *HTTP Possible Request Smuggling*, and *HTTP Duplicated Header* — targeting CL.TE, TE.TE, and CL.0 abuse patterns. New analytic story: Oracle E-Business Suite Exploitation (Cisco Talos collaboration), with Snort-based detections for anomalous web requests, payload delivery, and lateral movement lateral movement Moving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. New analytic story: Scattered Lapsus$ Hunters, covering TTPs TTPs Tactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. New analytic story: Hellcat Ransomware, tagging TTPs for this RaaS group targeting critical infrastructure, telecom, and government sectors.
+11 more
show less
New detection: *Windows Defender ASR or Threat Configuration Tamper* for identifying tampering with Defender Attack Surface Reduction rules. New detection: *Windows Default RDP RDP A Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. New detection: *Windows Process Execution From RDP Share* for identifying process launches originating from RDP-mapped shares. New detection: *Windows WBAdmin File Recovery From Backup* to detect abuse of the wbadmin utility for file recovery from backups. New detection: *Wmiprvse LOLBAS LOLBAS Living Off the Land Binaries and Scripts — legitimate Windows executables and scripts that attackers abuse to run malicious code, letting cyber tools detect or emulate attacker behavior without custom malware. WMI WMI Windows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. New detection: *Advanced IP or Port Scanner Execution* for identifying reconnaissance tool usage. New detection: *File Download or Read to Pipe Execution* for detecting piped file download-to-execution patterns. New detection: *Windows NirSoft Tool Bundle File Created* for flagging creation of NirSoft credential and forensics tool bundles. New detection: *Windows PowerShell Process Implementing Manual Base64 Decoder* for identifying custom base64 decoding in PowerShell execution chains. New detection: *Windows PsTools Recon Usage* for detecting reconnaissance activity via PsTools utilities. New Cisco Secure Firewall detections: *Oracle E-Business Suite Correlation* and *Oracle E-Business Suite Exploitation* for network-layer ERP attack visibility.
16 details in Everything
└──▷ BREAKING ON UPGRADE
! The detection Windows Change Default File Association For No File Ext is deprecated and scheduled for removal in v5.20.0; replace with Windows Change File Association Command To Notepad .! The detection Detect Rundll32 Application Control Bypass - setupapi is deprecated and scheduled for removal in v5.20.0; replace with Windows Application Whitelisting Bypass Attempt via Rundll32 .! The detection Detect Rundll32 Application Control Bypass - syssetup is deprecated and scheduled for removal in v5.20.0; replace with Windows Application Whitelisting Bypass Attempt via Rundll32 .! The detection Detect Rundll32 Application Control Bypass - advpack is deprecated and scheduled for removal in v5.20.0; replace with Windows Application Whitelisting Bypass Attempt via Rundll32 .
Splunk Security Content v5.16.0 adds 6 new analytic stories and 19 new detections covering Ollama LLM LLM A large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.16.0 https://github.com/splunk/security_content.git
$ git checkout v5.16.0
New Suspicious Ollama Activities analytic story with 8 detections covering abnormal network connectivity, API endpoint scanning, memory exhaustion, model exfiltration, RCE RCE Remote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. prompt injection prompt injection An attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. LLMs LLMs A large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. New Suspicious Microsoft 365 Copilot Activities analytic story with 4 detections: usage pattern anomalies, failed authentication patterns, non-compliant device access, and session origin anomalies for enterprise AI assistant risk. New PromptLock analytic story targeting the first known GenAI-driven ransomware PoC, with detections focused on anomalous AI invocation patterns, file encryption activity, and local LLM API (Ollama/gpt-oss:20b) abuse for malicious automation. New Lokibot analytic story with added Windows Visual Basic Commandline Compiler DNSQuery detection for suspicious DNS communications and credential-stealing exfiltration. New APT37 Rustonotto and FadeStealer analytic story including a detection for Windows Cabinet file extraction via Expand, targeting phishing-based infections and data exfiltration data exfiltration Moving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels.
+2 more
show less
New GhostRedirector IIS Module and Rungan Backdoor analytic story covering malicious IIS module abuse, SQL injection SQL injection An attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. New endpoint detections added: Web or Application Server Spawning a Shell, Windows Application Whitelisting Bypass via Rundll32, Windows Change File Association Command To Notepad, Windows Set Network Profile Category to Private via Registry, Windows Symlink Evaluation Change via Fsutil.
7 details in Everything
└──▷ BREAKING ON UPGRADE
! The notable alert actions are removed from Attempt To Add Certificate To Untrusted Store , Windows Archived Collected Data In TEMP Folder , Windows Rundll32 Apply User Settings Changes , and Windows Scheduled Task Created Via XML — these detections will no longer create notable/findings and will only create risk events.! The notable alert action is added to Windows Certutil Root Certificate Addition — this detection will now create notable/findings in addition to risk events.! Several detections previously deprecated in ESCU v5.14.0 have been removed in v5.16.0; users must transition to recommended replacements. See the List of Removed Detections for the full inventory.! A new set of detections has been deprecated and are scheduled for removal in ESCU v5.18.0; see the List of Detections Scheduled for Removal.
Splunk ESCU v5.15.2 adds a new Suspicious Cisco ASA analytic story and links existing detections to it.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.15.2 https://github.com/splunk/security_content.git
$ git checkout v5.15.2
New analytic story: Suspicious Cisco Adaptive Security Appliance Activity groups Cisco ASA-focused detections for targeted threat hunting. Tags the existing Cisco ASA - Logging Disabled via CLI detection to the new Suspicious Cisco ASA story.
2 details in Everything
Splunk Security Content v5.15.0 adds the ArcaneDoor analytic story with two new Cisco ASA detections for state-sponsored zero-day zero-day A vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.15.0 https://github.com/splunk/security_content.git
$ git checkout v5.15.0
New ArcaneDoor analytic story covering state-sponsored exploitation of Cisco ASA/Firewall zero-days zero-days A vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. New detection: Cisco ASA - Core Syslog Message Volume Drop to identify abnormal reductions in syslog output that may indicate log suppression. New detection: Cisco ASA - Logging Disabled via CLI to catch attempts to disable logging on Cisco ASA devices. Updated Cisco Secure Firewall - Intrusion Events by Threat Activity lookup with the latest Snort IDs for improved ArcaneDoor threat coverage.
4 details in Everything
Splunk Security Content v5.14.0 adds 19 new analytics and 5 analytic stories covering LAMEHUG, NotDoor, Secret Blizzard, ObjectivyStealer, and PathWiper.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.14.0 https://github.com/splunk/security_content.git
$ git checkout v5.14.0
New analytic story and detections for LAMEHUG malware, covering AI-driven command chain generation via Hugging Face API calls, systeminfo/net start/tasklist/dsquery execution, and recursive file copy into %ProgramData%\info\. New analytic story for NotDoor malware (APT28/Fancy Bear Outlook macro backdoor), with detections for suspicious Outlook macro creation, LoadMacroProviderOnBoot persistence, and disabling of security dialogs. New detections for Secret Blizzard TTP TTP Tactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. certutil.exe root certificate installation from temp directories using -addstore root, -f (force), and -Enterprise flags. New analytic story for 0bj3ctivity Stealer, tagging existing content to detect credential theft, session hijacking, and encrypted exfiltration targeting browsers, messaging apps, and cryptocurrency wallets. New analytic story for PathWiper.
+10 more
show less
New detection: Linux Magic SysRq Key Abuse (community contribution). New detection: Windows AI Platform DNS Query for identifying AI platform–related DNS activity. New detection: Windows DLL Module Loaded in Temp Dir to catch DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. New detection: Windows Excel ActiveMicrosoftApp Child Process for suspicious Excel child process spawning. New detection: Windows File Collection Via Copy Utilities targeting staged data collection behavior. New detection: Windows Net System Service Discovery covering net start enumeration. New detection: Windows Set Private Network Profile via Registry for network profile manipulation. New detections for Windows SpeechRuntime COM Hijacking DLL Load and Windows SpeechRuntime Suspicious Child Process. New WMIC-based discovery detections: CPU CPU The main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. wmic. New Outlook-specific detections: macro security modification (Windows Outlook Macro Security Modified ) and dialogs disabled from unusual processes (Windows Outlook Dialogs Disabled from Unusual Process ).
15 details in Everything
└──▷ BREAKING ON UPGRADE
! Several detections previously deprecated in ESCU v5.12.0 have been removed in v5.14.0; users must transition to recommended replacements as listed in the official deprecated analytics documentation.
ESCU v5.13.0 adds 8 new Cisco IOS/IOS XE detections and an analytic story targeting CVE-2018-0171 exploitation by Russian APT Static Tundra.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.13.0 https://github.com/splunk/security_content.git
$ git checkout v5.13.0
New analytic story: Cisco Smart Install Remote Code Execution CVE-2018-0171, covering the full attack chain abused by Russian state-sponsored group Static Tundra against unpatched IOS/IOS XE devices. New detection: Cisco Smart Install Port Discovery and Status — surfaces inbound Smart Install traffic on TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. New detection: Cisco Smart Install Oversized Packet Detection — identifies anomalous SMI packet sizes associated with CVE-2018-0171 exploitation, derived from Cisco Talos PCAP PCAP A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. New detection: Cisco IOS Suspicious Privileged Account Creation — catches post-exploitation persistence via privileged account additions on IOS/IOS XE devices. New detection: Cisco SNMP SNMP A UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale.
+5 more
show less
New detection: Cisco Network Interface Modifications — monitors for unauthorized interface-level changes used to establish persistent access. New detection: Cisco Configuration Archive Logging Analysis — tracks configuration archival events that may indicate staged exfiltration or persistence. New detection: Cisco TFTP TFTP Trivial File Transfer Protocol, a minimal UDP-based file transfer protocol standardized in RFC 1350, used by cyber tools when simplicity and low overhead matter more than authentication or error recovery. New detection: Cisco Secure Firewall – Static Tundra Smart Install Abuse — provides Cisco Secure Firewall-specific mapping for unified triage of Smart Install exploitation activity. Updated detection: Cisco Secure Firewall – Intrusion Events by Threat Activity, extended to incorporate Static Tundra campaign context.
10 details in Everything
Splunk Security Content v5.12.0 adds 22 new detections and 3 analytic stories covering Medusa Rootkit, MSIX abuse, and RDP RDP A Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.12.0 https://github.com/splunk/security_content.git
$ git checkout v5.12.0
New analytic story: Medusa Rootkit (UNC3886) — covers stealthy Linux and Windows persistence malware used by the UNC3886 threat actor. New detection: Linux GDrive Binary Activity — detects GDrive binary usage on Linux systems associated with Medusa Rootkit activity. New detection: Linux Medusa Rootkit — identifies Medusa Rootkit indicators on Linux endpoints. New detection: Windows GDrive Binary Activity — detects GDrive binary usage on Windows systems linked to UNC3886. New detection: Windows Suspicious VMware Tools Child Process — surfaces anomalous child processes spawned from VMware Tools, a Medusa Rootkit persistence technique.
+21 more
show less
New analytic story: MSIX Package Abuse — covers abuse of Microsoft MSIX application packages using AppXDeploymentServer/Operational log telemetry. New detection: Windows Advanced Installer MSIX with AI_STUBS Execution — detects suspicious MSIX packages built with Advanced Installer AI_STUBS. New detection: Windows AppX Deployment Unsigned Package Installation — flags installation of unsigned MSIX packages. New detection: Windows PowerShell MSIX Package Installation — detects PowerShell-driven MSIX package installs. New detection: Windows PowerShell Script From WindowsApps Directory — identifies PowerShell scripts executing from the Windows Apps directory. New detection: Windows MSIX Package Interaction — monitors interactions with Windows Apps directories for potential sideloading or malware delivery. New detection: Windows Developer-Signed MSIX Package Installation — detects installation of developer-signed (non-store) MSIX packages. New detection: Windows AppX Deployment Full Trust Package Installation — surfaces full-trust MSIX package installs that run with elevated permissions. New detection: Windows AppX Deployment Package Installation Success — logs successful MSIX package deployment events for visibility. New analytic story: Windows RDP Artifacts and Defense Evasion — covers RDP usage forensics and artifact cleanup techniques. New detection: Windows Default RDP File Creation — detects creation of Default.rdp files that reveal targeted systems. New detection: Windows Default RDP File Deletion — flags deletion of RDP files as a potential evasion action. New detection: Windows Default RDP File Unhidden — identifies un-hiding of RDP files to expose evasion attempts. New detection: Windows RDP Bitmap Cache File Creation — monitors creation of RDP bitmap cache files as forensic artifacts. New detection: Windows RDP Cache File Deletion — detects deletion of RDP bitmap cache files indicating artifact cleanup. New detection: Windows RDP Server Registry Entry Created — alerts on creation of RDP server registry entries. New detection: Windows RDP Server Registry Deletion — flags removal of RDP server registry keys as an evasion technique. New detection: Windows RDP Client Launched with Admin Session — detects RDP client invocations using administrative session parameters. New detection: Windows RDP Login Session Was Established — provides visibility into RDP session establishment events. New detection: Windows RDP AutomaticDestinations Deletion — detects deletion of RDP AutomaticDestinations jump list entries as artifact cleanup. Updated analytic story: China-Nexus Threat Activity now maps additional existing detections to UNC3886 activity.
26 details in Everything
Splunk Security Content v5.11.0 adds 4 new analytic stories and 2 new detections covering Interlock Ransomware, NaiLaoLocker, Interlock RAT, and Scattered Spider.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.11.0 https://github.com/splunk/security_content.git
$ git checkout v5.11.0
Adds Interlock Ransomware analytic story mapping detections to anomalous PowerShell/CMD processes spawned from Office apps and large-scale file renaming patterns, with updated ransomware extensions and notes lookup files. Adds NaiLaoLocker Ransomware analytic story covering multi-threaded AES-256-CBC encryption with SM2 key wrapping via DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. Adds Interlock RAT analytic story surfacing indicators such as anomalous network beaconing, persistence artifacts, credential-theft behaviors, and fake browser-update installer activity. Adds Scattered Spider analytic story covering SIM-swap attacks, MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. New detection: Splunk AppDynamics Secure Application Alerts integrates AppDynamics security alert telemetry into Splunk detections.
+1 more
show less
New detection: Windows Rundll32 Load DLL in Temp Dir identifies rundll32 loading DLLs from temporary directories, a common DLL side-loading and malware staging technique.
6 details in Everything
Splunk Security Content v5.10.0 adds 5 new analytic stories and 45 new detections covering CitrixBleed 2, SharePoint RCE RCE Remote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.10.0 https://github.com/splunk/security_content.git
$ git checkout v5.10.0
New analytic story: Citrix NetScaler ADC and Gateway CVE-2025-5777 (CitrixBleed 2) — detects HTTP requests to the vulnerable /nf/auth/startwebview.do endpoint to identify scanning and exploitation of Citrix ADC/Gateway appliances. New analytic story: Microsoft SharePoint Vulnerabilities — covers CVE-2025-53770 exploitation via ToolPane.aspx, GET requests to the spinstall0.aspx webshell, and webshell file creation events for both initial and post-exploitation detection. New analytic story: ESXi Post Compromise — 24 new detections spanning VM bulk termination, reverse shells, SSH brute force, system clock manipulation, audit log wiping, unauthorized privilege elevation, and malicious VIB installations. New analytic story: Cisco Duo Suspicious Activity — 14 new detections covering unusual admin logins by browser/OS/country, bypass code generation, and risky policy configurations such as skipping 2FA, allowing tampered devices, or permitting outdated Java/Flash. New analytic story: Quasar RAT — maps 20+ existing detections to Quasar techniques and adds three new detections targeting FileZilla XML config access, IntelliForms registry entries, and Mozilla NSS library loading for stealthy credential harvesting.
+4 more
show less
New detection: Cisco Secure Firewall — Citrix NetScaler Memory Overread Attempt, enabling network-layer visibility into CitrixBleed 2 exploitation attempts. New detections for Windows SharePoint: ToolPane Endpoint Exploitation Attempt, Spinstall0 GET Request, and Spinstall0 Webshell File Creation provide layered coverage of CVE-2025-53770 attack chains. New ESXi detections include: Malicious VIB Forced Install, VIB Acceptance Level Tampering, ESXi Shell Access Enabled, Lockdown Mode Disabled, Firewall Disabled, and Loghost/Syslog Config Tampering for hardening and intrusion detection. New credential-theft detections: Windows Unusual FileZilla XML Config Access, Windows Unusual Intelliform Storage Registry Access, and Windows Unusual Process Load Mozilla NSS-Mozglue Module target post-exploitation credential harvesting patterns.
9 details in Everything
└──▷ BREAKING ON UPGRADE
! Several detections previously deprecated in ESCU v5.8.0 have been removed in v5.10.0; users must transition to recommended replacement detections before upgrading.
Splunk Security Content v5.9.0 adds 19 new detections across Cisco NVM, Disk Wiper, and Linux Auditd, plus 9 CrowdStrike SOAR SOAR Security orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.9.0 https://github.com/splunk/security_content.git
$ git checkout v5.9.0
New analytic story: Disk Wiper — detections targeting destructive malware that performs recursive file deletion and raw access to disk volumes and the primary boot record. New detection: CrowdStrike Falcon Stream Alerts — ingests CrowdStrike Falcon streaming telemetry for endpoint detection. New detections: Linux Auditd Daemon Abort, Shutdown, and Start — monitor auditd lifecycle events on Linux endpoints. New detection: Windows File Download Via PowerShell — identifies file download activity initiated through PowerShell. New lookup: suspicious_ports_list — supports detections flagging outbound connections to suspicious ports.
+3 more
show less
New lookup: typo_squatted_python_packages — backs detection of typosquatted Python package installations via Cisco NVM telemetry. New CrowdStrike EDR EDR Endpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. New macro: cisco_network_visibility_module_flowdata — enables Cisco NVM-based analytics across the new detections.
8 details in Everything
Splunk Security Content v5.8.0 adds Remote Employment Fraud and Inno Setup abuse detections plus four new browser/DNS analytics.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.8.0 https://github.com/splunk/security_content.git
$ git checkout v5.8.0
New analytic story: Remote Employment Fraud — detects threat actors posing as employees via anomalous VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. New analytic story: Malicious Inno Setup Loader — covers malware abusing Inno Setup packaging to achieve execution and persistence via obfuscated payloads and process injection. New detection: Windows Chromium Browser No Security Sandbox Process — identifies malware launching Chromium browsers with the sandbox disabled. New detection: Windows Chromium Browser with Custom User Data Directory — flags suspicious use of a nonstandard user data directory flag when launching Chromium browsers. New detection: Windows DNS Query Request To TinyUrl — alerts on DNS lookups to TinyUrl, a common C2 redirection technique.
+2 more
show less
New detection: Windows Disable Internet Explorer Addons — detects attempts to disable IE add-ons, a persistence/evasion technique. Adds zoom_index macro to support Zoom-related data source lookups in analytics.
7 details in Everything
└──▷ BREAKING ON UPGRADE
! Several detections previously deprecated in ESCU v5.6.0 have been permanently removed in v5.8.0; users must transition to recommended replacement detections.
ESCU 5.7.0 adds a new Cisco FTD detection and extends eStreamer integration across 12 updated network analytics.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.7.0 https://github.com/splunk/security_content.git
$ git checkout v5.7.0
New detection: Cisco Secure Firewall - Remote Access Software Usage Traffic identifies remote access tool traffic via Cisco FTD eStreamer data. Adds lookup cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools for classifying remote management and desktop tool application IDs in Cisco FTD environments. Updates lookups cisco_secure_firewall_filetype_lookup and cisco_snort_ids_to_threat_mapping with expanded coverage. Extends Cisco Secure Firewall Threat Defense (FTD) eStreamer compatibility across 12 updated network and cloud detections, including port scan, TOR traffic, LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory.
4 details in Everything
Splunk Security Content v5.6.0 adds 8 new analytics including 6 Cisco Secure Firewall/Snort rules, Lumma Stealer and Veeam CVE-2023-27532 detections, and two new analytic stories.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.6.0 https://github.com/splunk/security_content.git
$ git checkout v5.6.0
Adds Cisco Secure Firewall - High Priority Intrusion Classification analytic to surface high-priority intrusion events from Cisco Secure Firewall logs. Adds Cisco Secure Firewall - Intrusion Events by Threat Activity analytic to group firewall alerts by threat actor activity using Snort IDs. Adds Cisco Secure Firewall - Lumma Stealer Activity , Lumma Stealer Download Attempt , and Lumma Stealer Outbound Connection Attempt analytics to detect Lumma Stealer behaviors via Cisco Firewall intrusion logs. Adds Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity analytic that correlates specific Snort IDs triggered in a short window to identify exploitation attempts. Adds Windows PowerShell FakeCAPTCHA Clipboard Execution detection to identify Fake CAPTCHA campaign TTPs TTPs Tactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind.
+4 more
show less
Adds Windows Renamed Powershell Execution detection for identifying PowerShell executing under a renamed binary. Introduces a new Threat Activity by Snort IDs dashboard correlating Cisco Firewall eStreamer logs with a curated Snort-to-threat-actor lookup to visualize device activity, file trends, and host risk profiles in Splunk Enterprise Security. Adds two new lookups — cisco_snort_ids_to_threat_mapping and threat_snort_count — mapping Snort intrusion IDs to specific threat actors. Publishes two new analytic stories: Fake CAPTCHA Campaigns and XWorm , providing structured detection coverage for each threat.
9 details in Everything
└──▷ BREAKING ON UPGRADE
! Several detections previously announced for removal in ESCU v5.4.0 have been removed in v5.6.0; users must transition to recommended replacements (see the List of Removed Detections in ESCU v5.6.0).
Splunk Security Content v5.5.0 adds 2 new analytic stories and 5 new detections covering SAP NetWeaver CVE-2025-31324, AMOS Stealer, and Windows post-compromise activity.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.5.0 https://github.com/splunk/security_content.git
$ git checkout v5.5.0
New analytic story: SAP NetWeaver Exploitation, targeting CVE-2025-31324 with the SAP NetWeaver Visual Composer Exploitation Attempt hunting detection. New analytic story: AMOS Stealer, including the MacOS AMOS Stealer - Virtual Machine Check Activity detection that identifies suspicious osascript execution with specific command-line strings. New detection: Windows EventLog Recon Activity Using Log Query Utilities to surface adversary reconnaissance against the Windows Event Log. New detection: Windows Eventlog Cleared Via Wevtutil to alert when an adversary clears the Windows Event Log via Wevtutil. New detection: Windows File Download Via CertUtil to catch malicious file downloads executed through the CertUtil utility.
+1 more
show less
Updated is_nirsoft_software lookup with additional Nirsoft tooling entries.
6 details in Everything
Splunk Security Content v5.4.0 adds 27 new detections across Cisco Firewall, AWS Bedrock, and ransomware campaigns plus 6 new analytic stories.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.4.0 https://github.com/splunk/security_content.git
$ git checkout v5.4.0
New AWS Bedrock Security analytic story with detections for deletion of guardrails, knowledge bases, and logging configurations, plus high-volume model invocation failures. New analytic stories mapping detections to Cactus Ransomware, Earth Alux, Storm-2460 CLFS Zero Day Exploitation, and Water Gamayun threat campaigns. New detection for Windows MSC EvilTwin directory path manipulation technique. New detection for IP address collection via PowerShell Invoke-RestMethod. New detections for CrushFTP authentication bypass exploitation and shell process spawning from CrushFTP.
+2 more
show less
New detection for Volume Shadow Copy deletion via WMIC (anti-forensics). Detections previously announced as removed in ESCU v5.2.0 are now formally removed; replacements are available in documentation.
7 details in Everything
└──▷ BREAKING ON UPGRADE
! Detections previously announced for removal in ESCU v5.2.0 have been removed in this release — any workflows or alerts relying on those detections will stop functioning. Replacements are listed in the ESCU 5.4.0 deprecated analytics documentation.
Splunk Security Content v5.3.0 adds 8 new analytic stories and 15 new detections covering Apache Tomcat RCE RCE Remote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.3.0 https://github.com/splunk/security_content.git
$ git checkout v5.3.0
New analytic story: Apache Tomcat Session Deserialization Deserialization Turning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution. New analytic story: ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day, covering LNK files with abnormal padding, SSH ProxyCommand abuse, and Windows Explorer spawning PowerShell or CMD. New analytic stories for Medusa Ransomware, Termite Ransomware, VanHelsing Ransomware, Salt Typhoon, Seashell Blizzard, and PHP-CGI RCE Attack on Japanese Organizations. New detections: Windows Firewall Rule Added, Windows Firewall Rule Deletion, and Windows Firewall Rule Modification to track unauthorized host-based firewall configuration changes. New detection: Tomcat Session Deserialization Attempt to surface exploitation of Apache Tomcat servers.
+12 more
show less
New detection: Tomcat Session File Upload Attempt to identify attacker-staged file uploads on Tomcat. New detection: Windows Explorer LNK Exploit Process Launch With Padding targeting zero-day zero-day A vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. New detection: Windows Explorer.exe Spawning PowerShell or Cmd to catch stealthy initial access via LNK exploits. New detection: Windows SSH Proxy Command to detect abuse of SSH ProxyCommand as a lateral movement lateral movement Moving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. New detection: Windows AD Self DACL Assignment to identify privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. ACL ACL An access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. New detection: Windows Process Injection into Commonly Abused Processes for detecting process injection TTPs TTPs Tactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. New detection: Detect Large ICMP Traffic for identifying anomalous network covert channel or exfiltration activity. New detections: Windows ConsoleHost History File Deletion and Windows Powershell History File Deletion to catch anti-forensic tampering. New detection: Windows MSTSC RDP RDP A Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. New detection: Windows Remote Host Computer Management Access for tracking lateral movement via remote management. Standardized output fields across the majority of detections and added output_fields enforcement to data source objects, improving correlation and integration with Enterprise Security. Updated ransomware_extensions and remote_access_software lookups with new values expanding coverage for emerging threats.
17 details in Everything
Splunk Security Content v5.2.0 adds 43 new detections across GitHub, O365, and SQL Server, plus 6 new analytic stories.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.2.0 https://github.com/splunk/security_content.git
$ git checkout v5.2.0
New GitHub Malicious Activity analytic story with detections for disabling 2FA requirements, pausing/modifying audit log streams, deleting repositories, disabling Dependabot and branch protection rules, and registering unauthorized self-hosted runners. New O365 Email Threat Monitoring detections covering inbox rule creation, excessive email deletions, send-and-delete exfiltration behavior, suspicious search activity, and payroll/password compromise patterns. New SQL Server Abuse analytic story with detections for malicious SQLCMD execution, xp_cmdshell config changes, unauthorized SQL Server configuration changes, startup procedures, and dangerous extended procedure DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. New analytic stories mapped to Black Basta Ransomware, SnappyBee, and SystemBC malware families. New China-Nexus Threat Activity analytic story added.
+3 more
show less
Adds 5 new macros: github_enterprise, github_organizations, o365_messagetrace, o365_suspect_search_terms_regex, and process_sqlcmd. Adds 2 new lookups: deprecation_info and windows_suspicious_tasks. Deprecated detections from v5.0.0 announcement are now removed starting in v5.2.0, with a published replacement list on Splunk docs.
8 details in Everything
└──▷ BREAKING ON UPGRADE
! Several detections previously marked for deprecation in ESCU v5.0.0 have been removed in v5.2.0; see the full list and replacements at https://docs.splunk.com/Documentation/ESCU/5.2.0/user/DeprecatedAnalytics#List_of_removed_detections_in_ESCU_version_5.2.0
Splunk Security Content v5.1.0 adds 4 analytic stories and 41 new detections spanning RMM abuse, S3 hijacking, Cisco Secure Endpoint tampering, and Windows audit policy manipulation.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.1.0 https://github.com/splunk/security_content.git
$ git checkout v5.1.0
New analytic story: Remote Monitoring and Management Software — detects unauthorized RMM tool usage (AnyDesk, TeamViewer) via phishing and drive-by compromise. New analytic story: AWS S3 Bucket Security Monitoring — tracks public S3 bucket decommissioning, access attempts, and potential bucket hijacking using CloudTrail CloudTrail AWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. New analytic story: Security Solution Tampering — covers Cisco Secure Endpoint service inhibition, disabling, and modification techniques. New analytic story: Windows Audit Policy Tampering — detects auditpol.exe abuse, registry-based audit policy changes, and audit log clearing. Adds 6 new Office 365 detections: email transport rule changes, file access/download/sync exfiltration, multi-OS authentication anomalies, and suspicious SharePoint search behavior.
+9 more
show less
Adds detections for Cisco Secure Endpoint tampering: stopped services, Immunet service manipulation via sfc.exe, and uninstall attempts. Adds Windows audit policy detections covering disabled, cleared, restored, excluded-category, and security-descriptor-tampering scenarios via auditpol and registry. New endpoint detections: Windows RDP RDP A Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. New PowerShell detections: malicious string matching in both process command lines and script block logging, backed by a new malicious_powershell_strings lookup. New Telegram C2 detection: Potential Telegram API Request Via CommandLine. New Windows compatibility telemetry detections: suspicious child processes and registry-based tampering. New baseline: Baseline Of Open S3 Bucket Decommissioning for tracking S3 buckets before deletion. Adds windows_suspicious_services lookup and new macros (important_audit_policy_subcategory_guids, normalized_service_binary_field, process_auditpol, windows_exchange_iis) to support new detections. Adds a dashboard dropdown to the navigation bar in the Splunk Security Content UI.
14 details in Everything
ESCU v5.0.0 adds 52 new detections, 9 analytic stories, a Deprecation Assistant Dashboard, and an Analytic Story Onboarding Assistant.
└──▷ GET THIS VERSION
copy
$ git clone --branch v5.0.0 https://github.com/splunk/security_content.git
$ git checkout v5.0.0
New Deprecation Assistant Dashboard lets ESCU users identify and manage deprecated detection analytics currently enabled in their Splunk environment before removal in v5.2.0. New Analytic Story Onboarding Assistant (preview) streamlines enabling detections from multiple analytics stories where data is available in the Splunk environment. Redesigned home page with enhanced UI provides direct access to release notes, analytics counts, latest Splunkbase version, and a timeline of STRT blogs and updates. Adds 9 new analytic stories covering Backdoor Pingpong, Cleo File Transfer Software, Crypto Stealer, SDDL Tampering Defense Evasion, Derusbi, Earth Estries, Nexus APT Threat Activity, WinDealer RAT, and XorDDos. Adds 52 new detections spanning AWS cloud abuse (access keys, IAM IAM Identity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources.
+1 more
show less
Replaces the observables key with an RBARBA Risk-Based Authentication, an approach that adjusts login challenge strength based on contextual signals like location or device, letting cyber tools step up verification only when anomaly scores cross a threshold.
6 details in Everything
└──▷ BREAKING ON UPGRADE
! The observables key in YAML configurations is replaced with the RBA key; existing content referencing observables will need to be updated.
Splunk Security Content v4.44.0 adds 8 new analytics covering Microsoft Defender ATP, BitLockerToGo abuse, VaultCLI credential theft, RDP RDP A Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.44.0 https://github.com/splunk/security_content.git
$ git checkout v4.44.0
New analytic: Microsoft Defender ATP Alerts — surfaces and summarizes alerts from Microsoft Defender Advanced Threat Protection. New analytic: Microsoft Defender Incident Alerts — surfaces and summarizes Microsoft Defender O365 Incidents. New analytics: Windows BitLockerToGo Process Execution and Windows BitLockerToGo with Network Activity — detect abuse of BitLockerToGo.exe by Lumma Stealer for registry manipulation, credential hunting, and data exfiltration data exfiltration Moving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. New analytic: Windows Credentials Access via VaultCli Module — flags suspicious use of VaultCLI.dll to extract credentials from the Windows Credential Vault, as seen in Meduza Stealer. New analytics: Windows RDP File Execution and Windows RDPClient Connection Sequence Events — detect potentially suspicious Windows RDP activities.
+4 more
show less
New analytic: Windows RunMRU Command Execution — monitors changes to the RunMRU registry key to catch malware-issued commands surfaced via the Windows Run dialog. New Analytic Story: Lumma Stealer — groups detections covering Lumma Stealer TTPs TTPs Tactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. New Analytic Story: Meduza Stealer — groups detections covering Meduza Stealer TTPs. New Analytic Story: PXA Stealer — groups detections covering PXA Stealer TTPs.
9 details in Everything
Splunk Security Content v4.43.0 adds 9 new detections including Braodo Stealer and Critical Alerts, plus drilldowns across all TTP TTP Tactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.43.0 https://github.com/splunk/security_content.git
$ git checkout v4.43.0
New analytic Detect Critical Alerts from Security Tools identifies high-priority alerts from any vendor mapped to the Alerts data model, tested with MS365 Defender and Windows Defender. New Internal Horizontal Port Scan NMAP Top 20 detection identifies internal network reconnaissance targeting the top 20 NMAP ports. New High Volume of Bytes Out to Url and Plain HTTP POST Exfiltrated Data analytics detect data exfiltration data exfiltration Moving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. All TTP, Anomaly, and Correlation detections now include two default drilldowns — one scoped to a specific risk object and one surfacing risk events from the past 7 days — to accelerate investigation workflows. New datasource testing in contentctl v4.4.5 validates detection compatibility when new Technology Add-ons (TAs) are introduced.
+1 more
show less
Automatic version enforcement in contentctl v4.4.5 increments search versions whenever a detection's YAML is modified.
6 details in Everything
Splunk Security Content v4.42.0 adds 10 new detections covering Splunk product vulnerabilities and PowerShell Web Access exploitation.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.42.0 https://github.com/splunk/security_content.git
$ git checkout v4.42.0
Adds detection for Splunk KVStore being disabled via CSRF CSRF Cross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. Adds detection for image file disclosure through PDF exports in Classic Dashboard. Adds detection for low-privileged searches running as nobody via SplunkDeploymentServerConfig App. Adds two detections for persistent XSS XSS Cross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. Adds detection for remote code execution remote code execution Remote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives.
+5 more
show less
Adds detection for sensitive information disclosure in Splunk SG for low-privileged users. Adds detection for sensitive information disclosure in DEBUG logging channels. Adds Windows IIS Server PSWA Console Access to detect unauthorized PowerShell Web Access console sessions via IIS logs. Adds Windows Identify PowerShell Web Access IIS Pool to detect creation and anomalies in PSWA IIS application pool configurations. Updates the CISA AA24-241A analytic story with new PSWA-focused detections targeting privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. lateral movement lateral movement Moving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access.
10 details in Everything
ValleyRAT analytic story lands with 6 new detections covering C2 config, registry abuse, UAC bypass, and task scheduler DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.41.0 https://github.com/splunk/security_content.git
$ git checkout v4.41.0
New ValleyRAT Analytic Story bundles detections for C2 configuration, registry manipulation, privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. New detection: Windows Impair Defenses Disable AV AutoStart via Registry — catches antivirus auto-start being disabled through registry modifications. New detection: Windows Modify Registry Utilize ProgIDs — identifies suspicious use of ProgIDs via registry changes. New detection: Windows Modify Registry ValleyRAT C2 Config — surfaces ValleyRAT command-and-control configuration written to the registry. New detection: Windows Modify Registry ValleyRat PWN Reg Entry — detects ValleyRAT-specific registry entries associated with privilege abuse.
+3 more
show less
New detection: Windows Schedule Task DLL Module Loaded — flags DLL modules loaded through scheduled task activity. New detection: Windows Schedule Tasks for CompMgmtLauncher or Eventvwr — detects UAC bypass attempts via scheduled tasks targeting CompMgmtLauncher or Eventvwr. Updated detections for Add or Set Windows Defender Exclusion, FodHelper UAC Bypass, Eventvwr UAC Bypass, CMLUA/CMSTPLUA UAC Bypass, and related endpoint analytics now include ValleyRAT coverage.
8 details in Everything
Splunk Security Content v4.40.0 adds 52 new detections including 50 Linux Auditd rules and 2 PowerShell Web Access detections, plus 3 new analytic stories.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.40.0 https://github.com/splunk/security_content.git
$ git checkout v4.40.0
Adds 50 new Linux Auditd detections covering unauthorized account creation, kernel module manipulation, privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. Compromised Linux Host analytic story. Adds 2 new detections for PowerShell Web Access installation and enablement (Windows DISM Install PowerShell Web Access; Windows Enable PowerShell Web Access) tied to CISA AA24-241A Iran-based threat actor activity. Introduces BlackSuit Ransomware analytic story tagging existing analytics to TTPs TTPs Tactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. Introduces CISA AA24-241A analytic story aligning detections with the joint advisory on Iran-based cyber actors exploiting U.S. and foreign organizations. Introduces Compromised Linux Host analytic story grouping the 50 new Linux Auditd detections for streamlined investigation workflows.
+1 more
show less
Updates 72 existing analytics across cloud, endpoint, network, and web categories.
6 details in Everything
v4.39.0 adds 29 new detections for Ivanti CVE-2024-7593, Office 365, and Windows AD, plus a new RMM Software Tracking Dashboard.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.39.0 https://github.com/splunk/security_content.git
$ git checkout v4.39.0
New analytic story for Ivanti Virtual Traffic Manager CVE-2024-7593, covering SQL injection SQL injection An attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. RCE RCE Remote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. New analytic story for MoonPeak threat actor. New detection: Ivanti EPM SQL Injection Remote Code Execution. New detection: Ivanti VTM New Account Creation. New detections for password spray attacks: Detect Password Spray Attack Behavior From Source and On User.
+3 more
show less
New Office 365 detections: DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. New Windows Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. ACL ACL An access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. New RMM Software Tracking Dashboard for auditing and monitoring Remote Monitoring and Management alert content.
8 details in Everything
v4.38.0 adds 20 new detections for CrowdStrike identity risk, O365 tenant access, and unusual NTLM NTLM A Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.38.0 https://github.com/splunk/security_content.git
$ git checkout v4.38.0
Adds 9 new CrowdStrike detections covering weak password policies, duplicate passwords across users and admins, identity risk severity (high and medium), privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. Adds 6 new Office 365 detections for cross-tenant access changes, external guest invitations, external identity policy changes, privileged role assignments, and applications available to other tenants. Adds 5 new Windows NTLM detections identifying multiple null-domain authentications and unusual authentication patterns by source, destination, and user. Introduces two new analytic stories: Compromised Windows Host and Handala Wiper , grouping relevant detections for those threat scenarios. Adds three new macros — crowdstrike_identities, crowdstrike_stream, and ntlm_audit — to support the new CrowdStrike and NTLM detections.
5 details in Everything
v4.37.0 adds 16 new detections for AcidPour, Gozi, ShrinkLocker, MOVEit CVE-2024-5806, Ivanti CVE-2024-29824, and VMware ESXi CVE-2024-37085.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.37.0 https://github.com/splunk/security_content.git
$ git checkout v4.37.0
New Analytic Story: AcidPour — covers wiper malware TTPs TTPs Tactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. New Analytic Story: Gozi Malware — detections for Gozi malware techniques including registry-based persistence. New Analytic Story: ShrinkLocker — detections for ShrinkLocker ransomware techniques including BitLocker BitLocker A full-disk encryption feature built into Windows, maintained by Microsoft, that protects data at rest by encrypting entire volumes; cyber tools use it to audit encryption status or recover keys from managed endpoints. New Analytic Story: MOVEit Transfer Authentication Bypass — covers CVE-2024-5806 improper authentication in MOVEit SFTP SFTP SSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. New Analytic Story: Ivanti EPM Vulnerabilities — covers CVE-2024-29824 SQL injection SQL injection An attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. remote code execution remote code execution Remote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. CVSS CVSS Common Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it.
+12 more
show less
New Analytic Story: VMware ESXi AD Integration Authentication Bypass CVE-2024-37085 — detects re-creation of the ESXi Admins AD group to gain full hypervisor access. New detection: Ivanti EPM SQL Injection Remote Code Execution — identifies exploitation of CVE-2024-29824. New detections: MOVEit Certificate Store Access Failure and MOVEit Empty Key Fingerprint Authentication Attempt — surface CVE-2024-5806 exploitation attempts. New detections: Windows ESX Admins Group Creation via Security Event, Net, and PowerShell — catches CVE-2024-37085 privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. New detection: Windows Known Abused DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. New detections: Windows LOLBAS LOLBAS Living Off the Land Binaries and Scripts — legitimate Windows executables and scripts that attackers abuse to run malicious code, letting cyber tools detect or emulate attacker behavior without custom malware. New detections: Windows Modify Registry Configure BitLocker, Delete Firewall Rules, Disable RDP RDP A Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. New detection: Windows Privileged Group Modification — detects unauthorized changes to privileged Windows groups. New macro: remote_access_software_usage_exceptions — enables allowlisting in remote access software detections. New lookup: remote_access_software_exceptions — supports the new exception-based remote access software detection workflow. Updated lookup: remote_access_software — expanded list of known remote access software signatures used across related detections. Updated lookup: lolbas_file_path — expanded reference data supporting the new LOLBAS path/rename detections.
17 details in Everything
Splunk Security Content v4.36.0 adds 9 new detections for AD persistence, password spray, port scans, and vulnerable drivers.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.36.0 https://github.com/splunk/security_content.git
$ git checkout v4.36.0
New detection: Detect Distributed Password Spray Attempts — identifies spray attacks spread across multiple sources. New detection: Detect Password Spray Attempts — identifies localized password spray activity. New detection: Internal Horizontal Port Scan — alerts on internal hosts scanning multiple targets on the same port. New detection: Internal Vertical Port Scan — alerts on internal hosts scanning multiple ports on a single target. New detection: Windows AD add Self to Group — catches adversaries adding their own account to AD groups for privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources.
+5 more
show less
New detection: Windows Increase in Group or Object Modification Activity — surfaces anomalous spikes in AD group/object changes. New detection: Windows Increase in User Modification Activity — surfaces unusual spikes in AD user account modifications. New detection: Windows Network Share Interaction With Net — detects suspicious use of the Net command against network shares. New detection: Windows Vulnerable Driver Installed — alerts when a known-vulnerable driver is installed on a Windows endpoint. Adds new data_source objects to the content library.
10 details in Everything
Adds Gomir analytic story, two new Windows analytics (Debugger execution, Unsigned DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.34.0 https://github.com/splunk/security_content.git
$ git checkout v4.34.0
Adds Windows Debugger Tool Execution new Analytics detection Adds Windows Unsigned DLL Side-Loading In Same Process Path new Analytics detection Adds fillnull_config, oldsummaries_config, and summariesonly_config macros
3 details in Everything
New CrushFTP SSTI SSTI Server-Side Template Injection, a vulnerability class where attacker-controlled input is evaluated by a server-side template engine, enabling remote code execution or data exfiltration.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.33.0 https://github.com/splunk/security_content.git
$ git checkout v4.33.0
Adds new CrushFTP Server Side Template Injection analytic to detect exploitation attempts against CrushFTP versions before 10.7.1 and 11.1.0. Optimizes lookup execution order in existing analytics by running the lookup command after the stats command, reducing replication needs in distributed environments.
2 details in Everything
Splunk Security Content v4.32.0 adds OCSF OCSF An open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. data_sources metadata to analytics
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.32.0 https://github.com/splunk/security_content.git
$ git checkout v4.32.0
Adds six new AWS detections leveraging Open Cybersecurity Schema Framework (OCS) for Amazon Security Lake: ASL AWS Defense Evasion Stop Logging Cloudtrail , ASL AWS Defense Evasion Update Cloudtrail , ASL AWS ECR Container Upload Outside Business Hours , ASL AWS ECR Container Upload Unknown User , ASL AWS IAM Failure Group Deletion , and ASL AWS IAM Successful Group Deletion Introduces a new data_sources object in each detection's YAML metadata to map detections to corresponding Splunkbase TAs and provide sample events, along with listing fields extracted from raw data Adds the aws_ecr_users_asl macro to support ECR ECR Amazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure.
3 details in Everything
Splunk Security Content v4.31.0 adds new analytics and migrates detections to XML logs
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.31.0 https://github.com/splunk/security_content.git
$ git checkout v4.31.0
Adds Windows Process Writing File to World Writable Path analytic Converts 25 existing Windows detections (e.g., kerberos_user_enumeration.yml) to leverage the XML log format
2 details in Everything
v4.30.0 adds new Okta, O365, Windows AppLocker, and Zscaler analytics detections plus AppLocker dashboard and macros
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.30.0 https://github.com/splunk/security_content.git
$ git checkout v4.30.0
Adds Okta Account Takeover analytics story Adds Windows AppLocker analytics story Adds Zscaler Browser Proxy Threats analytics story Adds Okta Authentication Failed During MFA Challenge detection Adds Okta IDP Lifecycle Modifications detection
+37 more
show less
Adds Okta Multi-Factor Authentication Disabled detection Adds Okta Multiple Accounts Locked Out detection Adds Okta Multiple Failed MFA Requests For User detection Adds Okta Multiple Users Failing To Authenticate From Ip detection Adds Okta Successful Single Factor Authentication detection Adds Okta Unauthorized Access to Application detection Adds O365 Compliance Content Search Exported detection Adds O365 Compliance Content Search Started detection Adds O365 Elevated Mailbox Permission Assigned detection Adds O365 Mailbox Email Forwarding Enabled detection Adds O365 Mailbox Folder Read Permission Assigned detection Adds O365 Mailbox Folder Read Permission Granted detection Adds O365 New Email Forwarding Rule Created detection Adds O365 New Email Forwarding Rule Enabled detection Adds O365 New Forwarding Mailflow Rule Created detection Adds O365 Security And Compliance Alert Triggered detection Adds Windows AppLocker Block Events detection Adds Windows AppLocker Execution from Uncommon Locations detection Adds Windows AppLocker Privilege Escalation via Unauthorized Bypass detection Adds Windows AppLocker Rare Application Launch Detection detection Adds Windows Unsigned MS DLL Side-Loading detection Adds Zscaler Adware Activities Threat Blocked detection Adds Zscaler Behavior Analysis Threat Blocked detection Adds Zscaler CryptoMiner Downloaded Threat Blocked detection Adds Zscaler Employment Search Web Activity detection Adds Zscaler Exploit Threat Blocked detection Adds Zscaler Legal Liability Threat Blocked detection Adds Zscaler Malware Activity Threat Blocked detection Adds Zscaler Phishing Activity Threat Blocked detection Adds Zscaler Potentially Abused File Download detection Adds Zscaler Privacy Risk Destinations Threat Blocked detection Adds Zscaler Scam Destinations Threat Blocked detection Adds Zscaler Virus Download threat blocked detection Adds applocker macro Adds zscaler_proxy macro Adds applockereventcodes lookup Adds ESCU - AppLocker dashboard for auditing Windows AppLocker events
42 details in Everything
Adds detection analytics for APT29 Deceptions, Outlook RCE RCE Remote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.29.0 https://github.com/splunk/security_content.git
$ git checkout v4.29.0
Adds APT29 Diplomatic Deceptions with WINELOADER analytics story Adds Outlook RCE CVE-2024-21378 analytics story Adds Windows InProcServer32 New Outlook Form detection analytics Adds Windows MSHTA Writing to World Writable Path detection analytics Adds Windows New InProcServer32 Added detection analytics
+2 more
show less
Adds Windows Phishing Outlook Drop Dll In FORM Dir detection analytics Adds Windows SqlWriter SQLDumper DLL Sideload detection analytics
7 details in Everything
Splunk Security Content v4.28.0 adds Splunk Authentication Token Exposure in Debug Log detection analytics.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.28.0 https://github.com/splunk/security_content.git
$ git checkout v4.28.0
New analytics for browser credential access and AzureHound detection in Splunk Security Content v4.27.0
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.27.0 https://github.com/splunk/security_content.git
$ git checkout v4.27.0
Adds Windows Credential Access From Browser Password Store analytics rule to detect credential dumping via browser password stores on Windows endpoints. Adds Windows Known Abused DLL Created analytics rule to identify creation of known abused dynamic link libraries on Windows systems. Adds Detect AzureHound Command-Line Arguments and Detect AzureHound File Modifications analytics rules for detecting AzureHound reconnaissance tool activity on endpoints. Adds Detect SharpHound Command-Line Arguments, Detect SharpHound File Modifications, and Detect SharpHound Usage analytics rules to monitor for SharpHound execution and file system artifacts. Adds browser_app_list and hijacklibs_loaded lookup tables to support credential access and DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls.
5 details in Everything
Adds new analytics for remote access software detection, TeamCity vulnerabilities, and multiple playbooks for G Suite and Office 365 message handling.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.26.0 https://github.com/splunk/security_content.git
$ git checkout v4.26.0
Adds JetBrains TeamCity Vulnerabilities analytics story Adds Cloud Security Groups Modifications by User analytics Adds Detect Remote Access Software Usage File analytics Adds Detect Remote Access Software Usage FileInfo analytics Adds Detect Remote Access Software Usage Process analytics
+20 more
show less
Adds Windows Multiple Account Passwords Changed analytics Adds Windows Multiple Accounts Deleted analytics Adds Windows Multiple Accounts Disabled analytics Adds Detect Remote Access Software Usage DNS analytics Adds Detect Remote Access Software Usage Traffic analytics Adds High Volume of Bytes Out to Url analytics Adds Detect Remote Access Software Usage URL analytics Adds JetBrains TeamCity Authentication Bypass CVE-2024-27198 analytics Adds JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198 analytics Adds JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199 analytics Adds Nginx ConnectWise ScreenConnect Authentication Bypass analytics Adds nginx_access_logs and suricata macros Adds G Suite for Gmail Message Eviction playbook Adds G Suite for Gmail Search and Purge playbook Adds MS Graph for Office 365 Message Eviction playbook Adds MS Graph for Office 365 Message Identifier Activity Analysis playbook Adds MS Graph for Office 365 Message Restore playbook Adds MS Graph for Office365 Search and Purge playbook Adds MS Graph for Office365 Search and Restore playbook Updates remote_access_software lookup
25 details in Everything
Adds detection for Jenkins Server Vulnerabilities and numerous Kubernetes/Windows security analytics in ESCU v4.23.0
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.23.0 https://github.com/splunk/security_content.git
$ git checkout v4.23.0
Adds Jenkins Server Vulnerabilities new Analytics Story for identifying compromised Jenkins instances. Adds Splunk Information Disclosure in Splunk Add-on Builder detection capability. Adds Windows MsiExec HideWindow Rundll32 Execution and Windows Process Injection In Non-Service SearchIndexer detections. Adds new input macro sourcetype="kube:container:falco" for Falco data ingestion.
4 details in Everything
Adds multiple new Kubernetes and Windows detection analytics in v4.19.0
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.19.0 https://github.com/splunk/security_content.git
$ git checkout v4.19.0
Adds Kubernetes Anomalous Inbound Outbound Network IO analytic for monitoring network traffic ratios in Kubernetes clusters Adds Kubernetes Previously Unseen Container Image Name analytic to detect novel container images Adds Kubernetes Process Running From New Path analytic to flag unfamiliar process execution paths Adds Windows UAC Bypass Suspicious Child Process analytic to detect potential privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. Adds Windows Alternate DataStream - Executable Content analytic to identify suspicious ADS ADS Alternate Data Streams: an NTFS feature that lets a file carry hidden secondary data blobs under the same path, giving cyber tools a place to stash metadata or detect covert storage by malware.
+1 more
show less
Updates ALL Azure AD analytics to use sourcetype = azure:monitor:aad for improved CIM compliance
6 details in Everything
Splunk Security Content v4.18.0 adds new Kubernetes and Windows detections plus updated PingID analytics.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.18.0 https://github.com/splunk/security_content.git
$ git checkout v4.18.0
Adds Kubernetes Abuse of Secret by Unusual Location analytic Adds Kubernetes Abuse of Secret by Unusual User Agent analytic Adds Windows Modify System Firewall with Notable Process Path analytic Adds Kubernetes Abuse of Secret by Unusual User Group analytic Adds Kubernetes Abuse of Secret by Unusual User Name analytic
+12 more
show less
Adds Kubernetes Access Scanning analytic Adds Kubernetes Suspicious Image Pulling analytic Adds Kubernetes Unauthorized Access analytic Adds PingID Mismatch Auth Source and Verification Response analytic Adds PingID Multiple Failed MFA Requests For User analytic Adds PingID New MFA Method After Credential Reset analytic Adds PingID New MFA Method Registered For User analytic Updates Allow File And Printing Sharing In Firewall analytic Updates Azure AD PIM Role Assigned analytic Updates CMD Carry Out String Command Parameter analytic Updates Detect Use of cmd exe to Launch Script Interpreters analytic Updates Modification Of Wallpaper analytic
17 details in Everything
Splunk Security Content v4.17.0 adds new analytic stories and dozens of new O365/Windows analytics for attack detection.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.17.0 https://github.com/splunk/security_content.git
$ git checkout v4.17.0
Adds Office 365 Account Takeover analytic story Adds Office 365 Persistence Mechanisms analytic story Adds Windows Attack Surface Reduction analytic story Adds O365 Service Principal New Client Credentials analytics rule Adds O365 Mailbox Read Access Granted to Application analytics rule
+37 more
show less
Adds O365 Tenant Wide Admin Consent Granted analytics rule Adds O365 Application Registration Owner Added analytics rule Adds O365 Mailbox Inbox Folder Shared with All Users analytics rule Adds O365 Advanced Audit Disabled analytics rule Adds O365 High Number Of Failed Authentications for User analytics rule Adds O365 Multiple Users Failing To Authenticate From Ip analytics rule Adds O365 User Consent Blocked for Risky Application analytics rule Adds O365 User Consent Denied for OAuth Application analytics rule Adds O365 Mail Permissioned Application Consent Granted by User analytics rule Adds O365 ApplicationImpersonation Role Assigned analytics rule Adds O365 File Permissioned Application Consent Granted by User analytics rule Adds O365 Multiple Failed MFA Requests For User analytics rule Adds O365 High Privilege Role Granted analytics rule Adds O365 New MFA Method Registered analytics rule Adds O365 Multiple AppIDs and UserAgents Authentication Spike analytics rule Adds O365 Block User Consent For Risky Apps Disabled analytics rule Adds O365 Multi-Source Failed Authentications Spike analytics rule Adds Powershell Remote Services Add TrustedHost analytics rule Adds Windows Modify Registry AuthenticationLevelOverride analytics rule Adds Windows Modify Registry DisableRemoteDesktopAntiAlias analytics rule Adds Windows Modify Registry DisableSecuritySettings analytics rule Adds Windows Modify Registry DontShowUI analytics rule Adds Windows Modify Registry ProxyEnable analytics rule Adds Windows Modify Registry ProxyServer analytics rule Adds Windows Archive Collected Data via Rar analytics rule Adds Windows Indicator Removal Via Rmdir analytics rule Adds Windows Credentials from Password Stores Creation analytics rule Adds Windows Credentials from Password Stores Deletion analytics rule Adds Windows Defender ASR Rules Stacking analytics rule Adds Windows Defender ASR Rule Disabled analytics rule Adds Windows Defender ASR Registry Modification analytics rule Adds Windows Defender ASR Block Events analytics rule Adds Windows Defender ASR Audit Events analytics rule Adds Windows Masquerading Msdtc Process analytics rule Adds Windows Parent PID Spoofing with Explorer analytics rule Adds Web Remote ShellServlet Access analytics rule Adds Splunk RCE via User XSLT analytics rule
42 details in Everything
Splunk Security Content v4.16.0 adds detection analytics for Azure AD, Windows, Splunk and DarkGate; patches CVE-2023-47246 in SysAid story.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.16.0 https://github.com/splunk/security_content.git
$ git checkout v4.16.0
Adds Azure AD Device Code Authentication analytics Adds Azure AD Tenant Wide Admin Consent Granted analytics Adds Azure AD Multiple AppIDs and UserAgents Authentication Spike analytics Adds Azure AD Block User Consent For Risky Apps Disabled analytics Adds Azure AD User Consent Blocked for Risky Application analytics
+14 more
show less
Adds Azure AD OAuth Application Consent Granted By User analytics Adds Azure AD User Consent Denied for OAuth Application analytics Adds Azure AD New MFA Method Registered analytics Adds Azure AD Multiple Denied MFA Requests For User analytics Adds Azure AD Multi-Source Failed Authentications Spike analytics Adds Risk Rule for Dev Sec Ops by Repository analytics Adds Windows ConHost with Headless Argument analytics Adds Windows CAB File on Disk analytics Adds Windows WinDBG Spawning AutoIt3 analytics Adds Windows MSIExec Spawn WinDBG analytics Adds Windows Modify Registry Default Icon Setting analytics Adds Windows AutoIt3 Execution analytics Adds Splunk App for Lookup File Editing RCE via User XSLT analytics Adds Splunk XSS in Highlighted JSON Events analytics
19 details in Everything
Splunk Security Content v4.15.0 adds Citrix NetScaler ADC/Gateway detections and PlugX analytic story.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.15.0 https://github.com/splunk/security_content.git
$ git checkout v4.15.0
Adds Citrix NetScaler ADC and NetScaler Gateway CVE-2023-4966 as a new analytic story Adds Citrix ADC and Gateway Unauthorized Data Disclosure as a new analytics rule
2 details in Everything
Splunk Security Content v4.13.0 adds NjRat and TeamCity RCE RCE Remote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.13.0 https://github.com/splunk/security_content.git
$ git checkout v4.13.0
Adds NjRat analytic story Adds WS FTP Server Critical Vulnerabilities analytic story Adds JetBrains TeamCity Unauthenticated RCE analytic story Adds Windows Abused Web Services analytics Adds Windows Admin Permission Discovery analytics
+13 more
show less
Adds Windows Delete or Modify System Firewall analytics Adds Windows Disable or Modify Tools Via Taskkill analytics Adds Windows Executable in Loaded Modules analytics Adds Windows Njrat Fileless Storage via Registry analytics Adds Windows Modify Registry With MD5 Reg Key Name analytics Adds Splunk Absolute Path Traversal Using runshellscript analytics Adds Splunk DoS Using Malformed SAML Request analytics Adds Splunk RCE via Serialized Session Payload analytics Adds Splunk Reflected XSS on App Search Table Endpoint analytics Adds WS FTP Remote Code Execution analytics Adds JetBrains TeamCity RCE Attempt analytics Updates lookup file splunk_risky_command with new data Updates pretrained_dga_model_dsdl.ipynb notebook for performance improvements
18 details in Everything
Adds Forest Blizzard analytic story and new Windows AD detection analytics in v4.12.0
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.12.0 https://github.com/splunk/security_content.git
$ git checkout v4.12.0
Introduces the Forest Blizzard analytic story for coordinated threat modeling. Adds five new Windows domain enumeration and privilege discovery analytics: GetDomainOU, FindInterestingDomainAcl, GetForestDomain, FindLocalAdminAccess, and Windows AD Abnormal/Privileged Object Access Activity detections. Adds headless browser monitoring capabilities via Mockbin or Mocky Request and generic Headless Browser Usage analytics. Introduces a new Jira Related Tickets Search playbook for automated incident response workflows.
4 details in Everything
Splunk Security Content v4.11.0 adds six new detections for Juniper, Windows, Ivanti, and Adobe vulnerabilities.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.11.0 https://github.com/splunk/security_content.git
$ git checkout v4.11.0
Adds Juniper Networks Remote Code Execution Exploit Detection analytics for Juniper JunOS RCE RCE Remote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. Adds Windows SQL Spawning CertUtil analytics to detect suspicious PowerShell-to-CertUtil chains Adds Ivanti Sentry Authentication Bypass analytics covering CVE-2023-38035 Adds Adobe ColdFusion Access Control Bypass analytics for new Adobe CF vulnerabilities Adds Adobe ColdFusion Unauthenticated Arbitrary File Read analytics to detect file read attempts
+2 more
show less
Adds Splunk DOS via printf search function analytics to detect denial-of-service attacks via Splunk searches Updates existing Splunk risky Command Abuse analytics based on February 2023 disclosures
7 details in Everything
Splunk Security Content v4.10.0 adds new analytic stories, detections for Windows/UAC/ESCs, and four new AD/AWS/Azure playbooks.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.10.0 https://github.com/splunk/security_content.git
$ git checkout v4.10.0
Adds Warzone RAT as a new Analytic Story to group related detections Adds support for detecting UAC bypass via Pkgmgr Tool Adds detection for Windows Mark Of The Web Bypass Adds detection for Windows Modify Registry MaxConnectionPerServer Adds detection for Windows Unsigned DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls.
+8 more
show less
Adds detection logic for Certify Command Line Arguments Adds detection for Certify with PowerShell Script Block Logging Adds detection for Windows Steal Authentication Certificates (ESC1 Authentication) Adds detection for Windows Suspect Process With Authentication Traffic Adds AD LDAP Account Unlocking as a new Playbook Adds AWS IAM Account Unlocking as a new Playbook Adds Azure AD Account Unlocking as a new Playbook Adds Active Directory Enable Account Dispatch as a new Playbook
13 details in Everything
Splunk Security Content v4.6.0 adds new analytics, stories, playbooks, and macro/API updates.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.6.0 https://github.com/splunk/security_content.git
$ git checkout v4.6.0
Adds new analytic detections for Windows PowerShell ScheduleTask and Windows Files and Dirs Access Rights Modification Via Icacls Adds new Analytic Stories: Scheduled Tasks , Amadey , Graceful Wipe Out Attack , and VMware Aria Operations vRealize CVE-2023-20887 Adds four new Playbooks: URL Outbound Traffic Filtering Dispatch , Panorama Outbound Traffic Filtering , Splunk Message Identifier Activity Analysis , and G Suite for GMail Message Identifier Activity Analysis , plus ZScaler Outbound Traffic Filtering Adds filter macros to the macros.json file served via the API Adds content_changer functionality to security content
5 details in Everything
Adds Volt Typhoon analytic story and six new Windows BA analytics for GPP and network discovery.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.3.0 https://github.com/splunk/security_content.git
$ git checkout v4.3.0
Adds Network Share Discovery Via Dir Command analytics to detect share enumeration using the Dir command. Adds Active Directory Privilege Escalation Identified analytics to identify AD privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. Adds Windows Ldifde Directory Object Behavior analytics to detect LDIFDE directory object operations. Adds Windows Proxy Via Netsh and Windows Proxy Via Registry analytics to detect proxy configuration changes. Adds Windows PowerSploit GPP Discovery, Windows Findstr GPP Discovery, Windows File Share Discovery With Powerview, Windows Default Group Policy Object Modified with GPME, and Windows PowerView AD Access Control List Enumeration BA Analytics.
5 details in Everything
v4.2.0 adds 31 new detection analytics across Azure AD, AWS, PaperCut, and Windows, plus OCSF OCSF An open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.2.0 https://github.com/splunk/security_content.git
$ git checkout v4.2.0
Adds Azure Active Directory Privilege Escalation , PaperCut MF NG Vulnerability, Snake Malware , and Windows BootKits as new Analytic Stories Adds AWS detection analytics: AWS AMI Attribute Modification for Exfiltration , AWS Disable Bucket Versioning , AWS EC2 Snapshot Shared Externally , AWS Exfiltration via Anomalous GetObject API Activity, AWS Exfiltration via Batch Service , AWS Exfiltration via Bucket Replication , AWS Exfiltration via DataSync Task, AWS Exfiltration via EC2 Snapshot , and AWS S3 Exfiltration Behavior Identified Adds Azure AD detection analytics: Azure AD Application Administrator Role Assigned , Azure AD Global Administrator Role Assigned , Azure AD PIM Role Assigned , Azure AD PIM Role Assignment Activated , Azure AD Privileged Authentication Administrator Role Assigned , Azure AD Privileged Role Assigned to Service Principal , and Azure AD Service Principal Owner Added Adds PaperCut detection analytics: PaperCut Remote Web Access Attempt and PaperCut Suspicious Behavior Debug Log Adds Windows detection analytics: Windows PaperCut Spawn Shell, Windows Registry Bootexecute Modification , Windows Snake Malware File Modification Crmlog , Windows Snake Malware Kernel Driver Comadmin , Windows Snake Malware Registry Modification wav OpenWithProgIds, Windows Snake Malware Service Create , and Windows Winlogon with Public Network Connection
+1 more
show less
Adds OCSF fields to BA detections and the conversion tool
6 details in Everything
Splunk Security Content v4.1.0 adds Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.1.0 https://github.com/splunk/security_content.git
$ git checkout v4.1.0
Adds Active Directory Privilege Escalation analytic story for privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. Adds RedLine Stealer analytic story for RedLine malware detection Adds Active Directory Lateral Movement Identified analytics for lateral movement lateral movement Moving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. Adds Impacket Lateral Movement smbexec CommandLine Parameters analytics for Impacket smbexec detection Adds Impacket Lateral Movement WMIExec CommandLine Parameters analytics for Impacket WMIExec detection
+23 more
show less
Adds Steal or Forge Authentication Certificates Behavior Identified analytics for certificate theft/forge detection Adds Windows Administrative Shares Accessed On Multiple Hosts analytics for admin share enumeration Adds Windows Admon Default Group Policy Object Modified analytics for GPO modification Adds Windows Admon Group Policy Object Created analytics for GPO creation Adds Windows Credentials from Password Stores Chrome Extension Access analytics for Chrome extension credential access Adds Windows Credentials from Password Stores Chrome LocalState Access analytics for Chrome LocalState credential access Adds Windows Credentials from Password Stores Chrome Login Data Access analytics for Chrome LoginData credential access Adds Windows Default Group Policy Object Modified analytics for default GPO modification Adds Windows Default Group Policy Object Modified with GPME analytics for GPME-based GPO modification Adds Windows DnsAdmins New Member Added analytics for DnsAdmins membership changes Adds Windows File Share Discovery With Powerview analytics for PowerView share discovery Adds Windows Findstr GPP Discovery analytics for GPP discovery via findstr Adds Windows Group Policy Object Created analytics for general GPO creation Adds Windows Large Number of Computer Service Tickets Requested analytics for excessive service ticket requests Adds Windows Local Administrator Credential Stuffing analytics for local admin credential stuffing Adds multiple registry modification analytics including Modify Registry Auto Minor Updates , Auto Update Notif , Disable WinDefender Notifications, Do Not Connect To Win Update , No Auto Reboot With Logon User , No Auto Update , Tamper Protection , UpdateServiceUrlAlternate, USeWuServer, WuServer, and wuStatusServer for update/service tampering Adds Windows PowerSploit GPP Discovery analytics for PowerSploit GPP discovery Adds Windows PowerView AD Access Control List Enumeration analytics for ACL ACL An access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. Adds Windows Query Registry Browser List Application analytics for browser list registry queries Adds Windows Query Registry UnInstall Program List analytics for uninstall list registry queries Adds Windows Rapid Authentication On Multiple Hosts analytics for rapid auth attempts Adds Windows Service Stop Win Updates analytics for Windows Update service stoppage Adds Windows Special Privileged Logon On Multiple Hosts analytics for special privileged logons
28 details in Everything
v4.0.0 introduces several new detection analytics for Windows threats.
└──▷ GET THIS VERSION
copy
$ git clone --branch v4.0.0 https://github.com/splunk/security_content.git
$ git checkout v4.0.0
Windows Exfiltration Over C2 Via Invoke RestMethodWindows Exfiltration Over C2 Via Powershell UploadStringWindows Scheduled Task Created Via XML Windows Screen Capture Via Powershell Windows DNS Gather Network Info
+3 more
show less
Windows Impair Defenses Disable HVCI Windows BootLoader InventoryWindows RDP Connection Successful
8 details in Everything
v3.64.0 adds eight new analytic rules for PowerShell, WMI WMI Windows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.64.0 https://github.com/splunk/security_content.git
$ git checkout v3.64.0
Adds PowerShell Invoke-WmiExec Usage detection to identify unauthorized WMI execution via PowerShell Adds PowerShell Invoke CIMMethod CIMSession detection to spot suspicious CIM method invocations Adds PowerShell Enable PowerShell Remoting detection for enabling remote PS capabilities Adds PowerShell Start or Stop Service detection for service control via PowerShell Adds Windows PowerShell Get-CIMInstance Remote Computer detection for remote CIM queries
+5 more
show less
Adds Windows Enable Win32_ScheduledJob via Registry detection for scheduled job persistence Adds Windows PowerShell WMI Win32_ScheduledJob detection for WMI-based scheduled jobs Adds Windows Service Create with Tscon detection for service creation using Tscon Adds Windows Lateral Tool Transfer RemCom detection for lateral movement lateral movement Moving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. Adds Windows Service Create RemComSvc detection for RemComSvc service abuse
10 details in Everything
v3.63.0 adds new analytics for the 3CX supply chain attack.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.63.0 https://github.com/splunk/security_content.git
$ git checkout v3.63.0
Adds Hunting 3CXDesktopApp Software analytic Adds Windows Vulnerable 3CX Software analytic Adds 3CX Supply Chain Attack Network Indicators analytic
3 details in Everything
Splunk Security Content v3.62.0 adds eight new Okta and Windows detections plus an Analytic Story for CVE-2023-21716.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.62.0 https://github.com/splunk/security_content.git
$ git checkout v3.62.0
New Okta Mismatch Between Source and Response for Okta Verify Push Request analytics detection New Okta Multiple Failed Requests to Access Applications analytics detection New Okta Suspicious Use of a Session Cookie analytics detection New Okta Phishing Detection with FastPass Origin Check analytics detection New Okta ThreatInsight Login Failure with High Unknown users analytics detection
+4 more
show less
New Okta ThreatInsight Suspected PasswordSpray Attack analytics detection New Windows Rundll32 WebDAV Request analytics detection New Windows Rundll32 WebDav With Network Connection analytics detection New Analytic Story for CVE-2023-21716 Word RTF Heap Corruption and CVE-2023-23397 Outlook Elevation of Privilege
9 details in Everything
v3.61.0 adds new Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.61.0 https://github.com/splunk/security_content.git
$ git checkout v3.61.0
Adds the Sneaky Active Directory Persistence Tricks analytic story for grouped detection coverage Adds the BishopFox Sliver Adversary Emulation Framework analytic story for grouped detection coverage Adds analytics for Notepad with no Command Line Arguments and Windows Process Injection into Notepad Adds multiple new Windows AD SID History, DSRM, Replication, and AdminSDHolder detections Adds seven new analytics detecting unusual failed authentication counts across Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. NTLM NTLM A Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent.
+4 more
show less
Adds the Automated Enrichment (Parent Playbook) which includes Dynamic Attribute Lookup and Dynamic Identifier Reputation Analysis Adds ServiceNow Related Tickets Search and Splunk Notable Related Tickets Search playbook nodes Adds AD LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. Crowdstrike OAuth API Device Attribute playbook node for external enrichment
9 details in Everything
Adds new detection rules for Fortinet FortiNAC, Linux system actions, and Windows Mimikatz techniques in Splunk Security Content v3.60.0.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.60.0 https://github.com/splunk/security_content.git
$ git checkout v3.60.0
Adds Linux Data Destruction Command detection Adds Linux Hardware Addition SwapOff detection Adds Linux Impair Defenses Process Kill detection Adds Linux Indicator Removal Clear Cache detection Adds Linux Indicator Removal Service File Deletion detection
+6 more
show less
Adds Linux System Reboot Via System Request Key detection Adds Linux Unix Shell Enable All SysRq Functions detection Adds Windows Steal Authentication Certificates CryptoAPI detection Adds Windows Mimikatz Crypto Export File Extensions detection Adds AwfulShred analytics story Adds Fortinet FortiNAC CVE-2022-39952 analytics story
11 details in Everything
└──▷ BREAKING ON UPGRADE
! Removed observables from action.escu.annotations in savedsearches.conf
v3.58.0 adds new analytics for AsyncRAT, Windows Certificate Services abuse, and Azure AD anomalies in Splunk Security Content.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.58.0 https://github.com/splunk/security_content.git
$ git checkout v3.58.0
Adds AsyncRAT analytic story covering associated detections Adds Compromised User Account analytic story covering associated detections Adds Swift Slicer analytic story covering associated detections Adds Windows Certificate Services analytic story covering associated detections Adds AWS AD New MFA Method Registered For User analytics detection
+27 more
show less
Adds AWS Concurrent Sessions From Different Ips analytics detection Adds AWS High Number Of Failed Authentications For User analytics detection Adds AWS High Number Of Failed Authentications From Ip analytics detection Adds AWS Password Policy Changes analytics detection Adds AWS Successful Console Authentication From Multiple IPs analytics detection Adds Azure AD Concurrent Sessions From Different Ips analytics detection Adds Azure AD High Number Of Failed Authentications For User analytics detection Adds Azure AD High Number Of Failed Authentications From Ip analytics detection Adds Azure AD New MFA Method Registered For User analytics detection Adds Azure AD Successful Authentication From Different Ips analytics detection Adds Detect suspicious processnames using a pretrained model in DSDL analytics detection Adds Driver Inventory analytics detection Adds LOLBAS With Network Traffic analytics detection Adds Windows Data Destruction Recursive Exec Files Deletion analytics detection Adds Windows Export Certificate analytics detection Adds Windows PowerShell Export Certificate analytics detection Adds Windows PowerShell Export PfxCertificate analytics detection Adds Windows Spearphishing Attachment Onenote Spawn Mshta analytics detection Adds Windows Steal Authentication Certificates Certificate Issued analytics detection Adds Windows Steal Authentication Certificates Certificate Request analytics detection Adds Windows Steal Authentication Certificates CertUtil Backup analytics detection Adds Windows Steal Authentication Certificates CS Backup analytics detection Adds Windows Steal Authentication Certificates Export Certificate analytics detection Adds Windows Steal Authentication Certificates Export PfxCertificate analytics detection Adds Windows Powershell Cryptography Namespace analytics detection Adds Windows Scheduled Task with Highest Privileges analytics detection Adds Windows Spearphishing Attachment Connect To None MS Office Domain analytics detection
32 details in Everything
Splunk Security Content v3.57.0 adds 10 new detection analytics including ransomware stories and malicious shortcut checks.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.57.0 https://github.com/splunk/security_content.git
$ git checkout v3.57.0
Adds Chaos Ransomware and LockBit Ransomware analytic stories Adds a new detection for suspicious DNS TXT records using pretrained model in DSDL Adds Windows Boot or Logon Autostart Execution In Startup Folder analytics Adds Windows Modify Registry Default Icon Setting analytics Adds Windows Phishing PDF File Executes URL Link analytics
+8 more
show less
Adds Windows Replication Through Removable Media analytics Adds Windows User Execution Malicious URL Shortcut File analytics Adds Windows Vulnerable Driver Loaded analytics Adds Linux Ngrok Reverse Proxy Usage analytics Adds Windows Server Software Component GACUtil Install to GAC analytics Adds Windows PowerShell Add Module to Global Assembly Cache analytics Adds Windows Credential Dumping LSASS Memory Createdump analytics Adds playbook files Dynamic Identifier Reputation Analysis , PhishTank URL Reputation Analysis, and VirusTotal v3 Identifier Reputation Analysis from phantomcyber/playbooks
13 details in Everything
v3.56.0 adds IIS-focused detection analytics and a risk_index macro for Splunk Security Content.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.56.0 https://github.com/splunk/security_content.git
$ git checkout v3.56.0
Adds risk_index macro that expands to index=risk in security_content Adds Windows Disable Windows Event Logging Disable HTTP Logging analytics Adds Windows IIS Components Add New Module analytics Adds Windows IIS Components Get-WebGlobalModule Module Query analytics Adds Windows IIS Components Module Failed to Load analytics
+3 more
show less
Adds Windows IIS Components New Module Added analytics Adds Windows PowerShell Disable Windows Event Logging Disable HTTP Logging analytics Adds Windows PowerShell IIS Components WebGlobalModule Usage analytics
8 details in Everything
Adds two new analytic stories (Prestige Ransomware, Windows Post-Exploitation) and 18 new Windows analytics.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.55.0 https://github.com/splunk/security_content.git
$ git checkout v3.55.0
Adds Windows Modify Registry Reg Restore analytics Adds Windows Query Registry Reg Save analytics Adds Windows System User Discovery Via Quser analytics Adds Windows WMI Process And Service List analytics Adds Windows Cached Domain Credentials Reg Query analytics
+14 more
show less
Adds Windows ClipBoard Data via Get-ClipBoard analytics Adds Windows Credentials from Password Stores Query analytics Adds Windows Credentials in Registry Reg Query analytics Adds Windows Indirect Command Execution Via Series Of Forfiles analytics Adds Windows Information Discovery Fsutil analytics Adds Windows Password Managers Discovery analytics Adds Windows Private Keys Discovery analytics Adds Windows Security Support Provider Reg Query analytics Adds Windows Steal or Forge Kerberos Tickets Klist analytics Adds Windows System Network Config Discovery Display DNS analytics Adds Windows System Network Connections Discovery Netsh analytics Adds Windows Change Default File Association For No File Ext analytics Adds Windows Service Stop Via Net and SC Application analytics Adds Prestige Ransomware analytic story
19 details in Everything
Splunk Security Content v3.54.0 adds detection analytics for Ngrok, MetaSploit, Mimikatz, and AgentTesla/Qakbot tagged detections.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.54.0 https://github.com/splunk/security_content.git
$ git checkout v3.54.0
Adds New Analytic Story titled CISA AA22-320A , Reverse Network Proxy , and MetaSploit Adds new analytics for Ngrok Reverse Proxy on Network, Powershell Load Module in Meterpreter, Windows Apache Benchmark Binary, Windows Mimikatz Binary Execution, Windows MSExchange Management Mailbox Cmdlet Usage, Windows Ngrok Reverse Proxy Usage, and Windows Service Created with Suspicious Service Path Adds new BA Analytics: Windows PowerShell Disabled Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. Tags several detections for AgentTesla and Qakbot
4 details in Everything
v3.53.0 adds new detection analytics for Punycode certificates, Qakbot named pipes, and O365 MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.53.0 https://github.com/splunk/security_content.git
$ git checkout v3.53.0
Adds SSL Certificates with Punycode analytic for detecting domain names disguised with Punycode characters. Adds Zeek x509 Certificate with Punycode analytic for detecting punycode domains in Zeek logs. Adds Windows App Layer Protocol Qakbot NamedPipe analytic for detecting Qakbot communication patterns. Updates analytics to detect O365 MFA disabling, rare executables, and suspicious kubectl calls.
4 details in Everything
v3.51.0 adds multiple new detections for Exchange and AWS threats plus a new BA detection script.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.51.0 https://github.com/splunk/security_content.git
$ git checkout v3.51.0
Adds lolbas_enrichment.py to auto-generate Business Analytics (BA) detections from LOLBAS LOLBAS Living Off the Land Binaries and Scripts — legitimate Windows executables and scripts that attackers abuse to run malicious code, letting cyber tools detect or emulate attacker behavior without custom malware. New Analytics: CISA AA22-277A, ProxyNotShell New Analytics: AWS Console Login Failed During MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. New Analytics: Detect Exchange Web Shell, ProxyShell ProxyNotShell Behavior Detected, Windows Create Local Account, Windows Exchange Autodiscover SSRF SSRF Server-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. New BA Analytics: Multiple detections for Windows Rename System Utilities LOLBAS in Non Standard Path (e.g., acccheckconsole.exe, adplus.exe, advpack.dll, agentexecutor.exe, appinstaller.exe, appvlp.exe, aspnet_compiler.exe, at.exe, atbroker.exe)
5 details in Everything
Adds new analytic stories and detections for AgentTesla, AWS IAM AWS IAM AWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.50.0 https://github.com/splunk/security_content.git
$ git checkout v3.50.0
Adds Agent Tesla analytic story to map related detection content Adds AWS Identity and Access Management Account Takeover analytic story to map related detection content Adds CISA AA22-264A analytic story to map related detection content Adds Okta MFA Exhaustion analytic story to map related detection content Adds new analytics for AWS authentication anomalies: AWS Multiple Users Failing To Authenticate From Ip and AWS Unusual Number of Failed Authentications From Ip
+6 more
show less
Adds new deep learning-based detection Detect DGA domains using pretrained model in DSDL for identifying domain generation algorithm traffic Adds eight new Okta-focused analytics covering account lockouts, MFA exhaustion, API token creation, device enrollment, suspicious activity reporting, threat insights, and risk thresholds Adds five Windows-focused analytics including COM hijacking detection via InprocServer32 modification, protocol usage in non-common process paths, and proxy execution patterns Updates Windows System Binary Proxy Execution Compiled HTML File Decompile to use XmlWinEventLog as the source field Adds advanced_port_scanner.exe to the Attacker Tools lookup table Removes the slim dependency from Github Actions workflows
11 details in Everything
Splunk Security Content v3.49.0 adds Azure AD and Windows detection analytics plus behavioral analytic updates.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.49.0 https://github.com/splunk/security_content.git
$ git checkout v3.49.0
Adds Azure Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. Azure AD External Guest User Invited , Azure AD Global Administrator Role Assigned , Azure AD Multiple Failed MFA Requests For User , Azure AD New Custom Domain Added , Azure AD New Federated Domain Added , Azure AD Privileged Role Assigned , Azure AD Service Principal Created , Azure AD Service Principal Credentials Added , Azure AD Service Principal Owner Added , Azure AD User Enabled And Password Reset , Azure AD User ImmutableId Attribute Updated Adds Azure Automation and Runbook monitoring capabilities with new analytics for Azure Automation Account Created , Azure Automation Runbook Created , and Azure Runbook Webhook Created Adds Windows attack technique detections covering access token access token A credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. Introduces new Behavioral Analytics (BA) for Windows arbitrary command execution with MSDT, ingress tool transfer via Explorer, ODBC ODBC A standard API, maintained by Microsoft, for connecting applications to relational databases regardless of vendor. Cyber tools use it to query databases without writing engine-specific code. Updates correlation search behavior by prefixing action.notable.param.rule_tile with 'RBA RBA Risk-Based Authentication, an approach that adjusts login challenge strength based on contextual signals like location or device, letting cyber tools step up verification only when anomaly scores cross a threshold. RBA: Living Off The Land ) and renaming action.correlationsearch.label to follow the ESCU - RIR - <rule_name> - Rule format
5 details in Everything
└──▷ BREAKING ON UPGRADE
! The action.risk, action.risk.param.* fields have been removed from correlation searches.! Correlation rule labels now use the ESCU - RIR - <rule_name> - Rule format instead of the previous naming convention.
Adds 35 new privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.48.0 https://github.com/splunk/security_content.git
$ git checkout v3.48.0
Adds Azure AD Multi-Factor Authentication Disabled detection to identify disabled MFA events. Adds Linux apt-get Privilege Escalation detection for privilege escalation via apt-get. Adds Linux Busybox Privilege Escalation detection for privilege escalation via busybox. Adds Linux c89 Privilege Escalation detection for privilege escalation via c89. Adds Linux c99 Privilege Escalation detection for privilege escalation via c99.
+24 more
show less
Adds Linux Composer Privilege Escalation detection for privilege escalation via Composer. Adds Linux Cpulimit Privilege Escalation detection for privilege escalation via cpulimit. Adds Linux Csvtool Privilege Escalation detection for privilege escalation via csvtool. Adds Linux Emacs Privilege Escalation detection for privilege escalation via Emacs. Adds Linux Find Privilege Escalation detection for privilege escalation via find. Adds Linux GDB Privilege Escalation detection for privilege escalation via GDB. Adds Linux Gem Privilege Escalation detection for privilege escalation via Gem. Adds Linux GNU Awk Privilege Escalation detection for privilege escalation via gawk. Adds Linux Make Privilege Escalation detection for privilege escalation via make. Adds Linux MySQL Privilege Escalation detection for privilege escalation via MySQL. Adds Linux Octave Privilege Escalation detection for privilege escalation via Octave. Adds Linux OpenVPN Privilege Escalation detection for privilege escalation via OpenVPN. Adds Linux Persistence and Privilege Escalation Risk Behavior detection for combined risk behaviors. Adds Linux PHP Privilege Escalation detection for privilege escalation via PHP. Adds Linux Puppet Privilege Escalation detection for privilege escalation via Puppet. Adds Linux RPM Privilege Escalation detection for privilege escalation via RPM. Adds Linux Ruby Privilege Escalation detection for privilege escalation via Ruby. Adds Linux Sqlite3 Privilege Escalation detection for privilege escalation via sqlite3. Adds Windows Autostart Execution LSASS Driver Registry Modification detection for registry-based autostart persistence. Adds Windows DLL Search Order Hijacking Hunt detection for DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. Adds Windows DLL Search Order Hijacking Hunt with Sysmon detection for DLL hijacking via Sysmon. Adds Windows Remote Access Software Hunt detection for remote access tools. Adds fillnull_value=null configuration to the security_content_summariesonly macro. Adds consolidated requirements.txt file for contentctl and docker detection testing.
29 details in Everything
New Analytic Stories for AWS Credential Access and multiple OS-specific analytics; new contentctl CLI subcommands.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.47.0 https://github.com/splunk/security_content.git
$ git checkout v3.47.0
└──▷ TRY IT
Initialize a new repository from scratch using the contentctl CLI.
Deploy a custom Splunk application to Splunk Cloud.
copy
$ contentctl cloud_deploy
Adds init, inspect, and cloud_deploy subcommands to the contentctl project Introduces AWS Credential Access as a new Analytic Story Adds multiple new analytics including AWS Credential Access Failed Login, Linux AWK Privilege Escalation, and Windows DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls.
3 details in Everything
Splunk Security Content v3.46.0 adds new detection analytics and analytic stories for AWS, Azure AD, Linux, and Windows.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.46.0 https://github.com/splunk/security_content.git
$ git checkout v3.46.0
Adds AWS Defense Evasion analytic story covering CloudTrail CloudTrail AWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. Adds Azure Active Directory Account Takeover analytic story with high-risk sign-in and multi-factor challenge failure analytics Adds new Linux detection analytics for living-off-the-land techniques including Base64 decoding, kernel module enumeration, and SSH key modification Adds new Windows detection analytics for system command-line activities (shutdown, reboot, logoff) and DCRat payload detection
4 details in Everything
└──▷ BREAKING ON UPGRADE
! The Container Implantation monitoring and investigation analytic story has been deprecated
v3.45.0 adds Living Off The Land analytics with a new RBA RBA Risk-Based Authentication, an approach that adjusts login challenge strength based on contextual signals like location or device, letting cyber tools step up verification only when anomaly scores cross a threshold.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.45.0 https://github.com/splunk/security_content.git
$ git checkout v3.45.0
Introduces the RBA search type for Living Off The Land detection analytics Adds "Detect Risky SPL using Pretrained ML Model" analytics Adds Windows Defender Tools in Non Standard Path to BA Analytics Adds multiple new Windows analytic stories including Azorult, MSIExec proxy execution, Mavinject DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls.
4 details in Everything
Adds Windows System Binary Proxy Execution analytic story and multiple PowerView detection rules
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.44.0 https://github.com/splunk/security_content.git
$ git checkout v3.44.0
Adds Potential password in username analytics detection Adds PowerView SPN Discovery detection capability Adds PowerView Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. Adds Windows Impair Defense Delete Win Defender Context Menu detection Adds Windows Impair Defense Delete Win Defender Profile Registry detection
+6 more
show less
Adds Windows Impair Defenses Disable Win Defender Auto Logging detection Adds Windows MSIExec DLLRegisterServer detection Adds Windows MSIExec Remote Download detection Adds Windows MSIExec Spawn Discovery Command detection Adds Windows MSIExec Unregister DLLRegisterServer detection Adds Windows MSIExec With Network Connections detection
11 details in Everything
Splunk Security Content v3.43.0 adds new analytic stories, ML detections, and custom index support in test.yml
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.43.0 https://github.com/splunk/security_content.git
$ git checkout v3.43.0
└──▷ USE IT
Replay test data into a specific index rather than the default main
yaml
copy
Add the line custom_index: my_test_index to your `test.yml` file.
Use the new PSAs hunting workbook for incident response
📍 In the Splunk SOAR playbook library, import and run Splunk PSA Hunting 06/22
Adds custom_index field to test.yml to allow replaying data into a custom index instead of the default main Adds new SOAR SOAR Security orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. Splunk PSA Hunting 06/22 Adds new ML Detection: Splunk Command and Scripting Interpreter Risky SPL MLTK Adds new Baseline: Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline
4 details in Everything
New analytics for F5 CVE-2022-1388, VMware SSTI SSTI Server-Side Template Injection, a vulnerability class where attacker-controlled input is evaluated by a server-side template engine, enabling remote code execution or data exfiltration.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.40.0 https://github.com/splunk/security_content.git
$ git checkout v3.40.0
Adds VMware Server Side Template Injection Hunt analytic Adds VMware Workspace ONE Freemarker Server-side Template Injection analytic Adds F5 BIG-IP iControl REST Vulnerability CVE-2022-1388 analytic Adds Linux Adding Crontab Using List Parameter analytic Adds Linux Deleting Critical Directory Using RM Command analytic
+10 more
show less
Adds Linux Disable Services analytic Adds Linux High Frequency Of File Deletion In Boot Folder analytic Adds Linux Shred Overwrite Command analytic Adds Linux Stop Services analytic Adds Windows Hidden Schedule Task Settings analytic Adds Windows Linked Policies In ADSI Discovery analytic Adds Windows Processes Killed By Industroyer2 Malware analytic Adds Windows Root Domain linked policies Discovery analytic Updates Industoyer2 Analytic Story to cover Windows Processes Killed By Industroyer2 Malware and related detections Removes all binaries from bin/ directory in the ESCU package
15 details in Everything
v3.39.0 adds new detections for Splunk-specific threats (SPL injection, XSS XSS Cross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.39.0 https://github.com/splunk/security_content.git
$ git checkout v3.39.0
Adds Path traversal SPL injection analytics to detect SPLi injection via path traversal techniques. Adds Splunk User Enumeration Attempt analytics to identify attempts to enumerate users within the Splunk platform. Adds Splunk XSS in Monitoring Console analytics to detect Cross-Site Scripting attacks targeting the Monitoring Console. Adds Linux Iptables Firewall Modification analytics to detect unauthorized changes to iptables rules. Adds Windows Computer Account Created by Computer Account analytics to detect suspicious computer account creation events.
+4 more
show less
Adds Windows Computer Account Requesting Kerberos Ticket analytics to identify computer accounts requesting Kerberos tickets. Adds Windows Computer Account With SPN analytics to flag computer accounts with Service Principal Names. Adds Windows KrbRelayUp Service Creation analytics to detect service creation associated with the KrbRelayUp exploit chain. Adds Linux deletion Of SSH Key analytics to detect deletion of SSH keys on Linux systems.
9 details in Everything
Splunk Security Content v3.38.0 adds 15 new detection analytics for Spring4Shell, Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.38.0 https://github.com/splunk/security_content.git
$ git checkout v3.38.0
Adds Spring4Shell CVE-2022-22965 analytic story to group related detections for Spring Framework vulnerabilities. Adds Java Writing JSP File detection analytics for identifying malicious JSP file creation. Adds Spring4Shell Payload URL Request detection analytics for detecting Spring4Shell exploit attempts via URLs. Adds Web JSP Request via URL detection analytics for monitoring web requests targeting JSP files. Adds Web Spring4Shell HTTP Request Class Module detection analytics for Spring4Shell class loading attacks.
+10 more
show less
Adds Web Spring Cloud Function FunctionRouter detection analytics for abusing Spring Cloud Function endpoints. Adds Kerberos TGT Request Using RC4 Encryption detection analytics to flag weak encryption Kerberos traffic. Adds Unknown Process Using The Kerberos Protocol detection analytics for identifying unauthorized Kerberos usage. Adds Kerberos User Enumeration detection analytics for detecting user enumeration attempts via Kerberos. Adds Kerberos Service Ticket Request Using RC4 Encryption detection analytics for weak service ticket requests. Adds Windows PowerView Unconstrained Delegation Discovery detection analytics for PowerShell-based delegation discovery. Adds Windows Get-ADComputer Unconstrained Delegation Discovery detection analytics for Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Adds Windows PowerView Constrained Delegation Discovery detection analytics for constrained delegation enumeration. Adds GitHub Actions Disable Security Workflow detection analytics for detecting disabled security workflows in GitHub Actions GitHub Actions GitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. Adds MacOS plutil detection analytics for monitoring use of the plist utility on macOS.
15 details in Everything
Adds new analytic stories and detections for Splunk Security Content v3.37.0
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.37.0 https://github.com/splunk/security_content.git
$ git checkout v3.37.0
Adds the Splunk Vulnerabilities , Double Zero Destructor , and Windows Registry Abuse Analytic Stories to group related detections. Adds new analytics covering Splunk DoS via Malformed S2S Request , Windows Deleted Registry By A Non Critical Process File Path , Windows Terminating Lsass Process , and MacOS LOLbin . Adds new Behavioral Analytics (BA) for Windows DotNet Binary in Non Standard Path , Windows LOLBin Binary in Non Standard Path , Windows Script Host Spawn MSBuild , and Windows WMIPrvse Spawn MSBuild . Updates the underlying tooling by overhauling modules in bin/ and replacing all functionality in bin/contentctl_project." Adds Supported Technical Add-ons (TAs) to research.splunk.com.
+1 more
show less
Enforces a max length of 67 characters for detection names.
6 details in Everything
Adds 12 new Analytic Stories (including Hermetic Wiper) and over 30 new BA analytics for Splunk Security Content.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.36.0 https://github.com/splunk/security_content.git
$ git checkout v3.36.0
Introduces Hermetic Wiper , Living Off The Land , Data Destruction , Network Discovery , and Active Directory Kerberos Attacks as new Analytic Stories Adds support for detecting Windows Modify Show Compress Color And Info Tip Registry changes via new analytics Adds detection for AWS Lambda UpdateFunctionCode events via new analytics Adds detection for Windows Disable Memory Crash Dump events via new analytics Adds detection for Windows File Without Extension In Critical Folder via new analytics
+34 more
show less
Adds detection for Windows Raw Access To Disk Volume Partition via new analytics Adds detection for Windows Event For Service Disabled via new analytics Adds detection for Windows Excessive Disabled Services Event via new analytics Adds detection for Windows Process With NamedPipe CommandLine via new analytics Adds detection for Windows Raw Access To Master Boot Record Drive via new analytics Adds detection for Windows Service Creation Using Registry Entry via new analytics Adds detection for Windows WMI WMI Windows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. Adds detection for Windows Diskshadow Proxy Execution via new analytics Adds detection for Linux DD File Overwrite via new analytics Adds detection for Linux System Network Discovery via new analytics Adds detection for Kerberoasting Kerberoasting An attack that obtains Kerberos service tickets and tries to crack their encrypted contents offline. Recovering a weak service-account password can give the attacker that account's access. Adds detection for Mimikatz PassTheTicket CommandLine Parameters via new BA analytics Adds detection for Rubeus Command Line Parameters via new BA analytics Adds detection for Rubeus Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. Adds detection for Unusual Number of Kerberos Service Tickets Requested via new BA analytics Adds detection for Disabled Kerberos Pre-Authentication Discovery With PowerView via new BA analytics Adds detection for Disabled Kerberos Pre-Authentication Discovery With Get-ADUser via new BA analytics Adds detection for Kerberos Pre-Authentication Flag Disabled in UserAccountControl via new BA analytics Adds detection for Kerberos Pre-Authentication Flag Disabled with PowerShell via new BA analytics Adds Windows Eventvwr UAC Bypass as a new BA Analytics capability Adds Windows MSHTA Command-Line URL as a new BA Analytics capability Adds Windows Rundll32 Inline HTA Execution as a new BA Analytics capability Adds Windows MSHTA Inline HTA Execution as a new BA Analytics capability Adds Windows MSHTA Child Process as a new BA Analytics capability Adds TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. Adds Windows Diskshadow Proxy Execution as a new BA Analytics capability Adds Windows Rasautou DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. Adds Windows Bits Job Persistence as a new BA Analytics capability Adds Windows Bitsadmin Download File as a new BA Analytics capability Adds Windows PowerShell Start-BitsTransfer detection via new BA analytics Adds Windows CertUtil URLCache Download as a new BA Analytics capability Adds Windows CertUtil VerifyCtl Download as a new BA Analytics capability Adds Windows CertUtil Decode File as a new BA Analytics capability Adds Windows WSReset UAC Bypass (experimental) as a new BA Analytics capability
39 details in Everything
Adds Windows Rasautou DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. data exfiltration data exfiltration Moving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.35.0 https://github.com/splunk/security_content.git
$ git checkout v3.35.0
Adds potentially malicious code commandline detection using MLTK-based model Adds New BA Analytics : Windows Powershell Connect to Internet With Hidden Window (SRS) Adds New BA Analytics : Windows Powershell DownloadFile (SRS) Adds New BA Analytics : Unusual Volume of Data Download from Internal Server Per Entity (experimental) Adds Trustar Enrich Indicators playbook
+4 more
show less
Adds Threat Intel Investigate playbook Adds Start Investigation playbook Adds AWS Disable User Accounts playbook Adds AWS Find Inactive Users playbook
9 details in Everything
Adds two new Splunk Security Content detection rules in v3.34.1
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.34.1 https://github.com/splunk/security_content.git
$ git checkout v3.34.1
Adds ssa___clear_unallocated_sector_using_cipher_app.yml SSA detection rule Adds ssa___hiding_files_and_directories_with_attrib_exe.yml SSA detection rule
2 details in Everything
v3.34.0 adds WhisperGate analytic story and eight new analytics; updates existing rules.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.34.0 https://github.com/splunk/security_content.git
$ git checkout v3.34.0
Adds WhisperGate as a new Analytic Story to group related detections. Adds detection for Excessive File Deletion in Windows Defender folder. Adds detection for processes with suspicious Discord DNS queries. Adds detection for Ping Sleep Batch Command execution. Adds detection for PowerShell removing the Windows Defender directory.
+5 more
show less
Adds detection for Windows InstallUtil binaries in non-standard paths. Adds detection for .NET binaries in non-standard paths on Windows. Adds detection for Windows NirSoft AdvancedRun usage. Adds detection for various Windows NirSoft utilities. Adds risk_severity field to Behavioral Analytics (BA) detections.
10 details in Everything
Splunk Security Content v3.33.0 adds 3 new Analytic Stories, 3 New Playbooks, and 35+ new detection analytics for Linux and Windows.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.33.0 https://github.com/splunk/security_content.git
$ git checkout v3.33.0
Adds Linux Privilege Escalation Analytic Story to guide investigation of privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. Adds Linux Persistence Techniques Analytic Story to detect persistence mechanisms on Linux hosts Adds 'sAMAccountName Spoofing and Domain Controller Impersonation' Analytic Story for AD attack detection Adds 3 new Playbooks: Block Indicators , Email Notification for Malware , and Malware Hunt and Contain Adds Windows detection analytics for System Account Targeting Lsass, Non-System Account Targeting Lsass, Suspicious Computer Account Name Change, Suspicious Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application.
+1 more
show less
Adds Linux detection analytics for NOPASSWD sudoers entries, sshd config access, profile config append, SSH key creation, new user accounts, kernel module loading (insmod/modprobe), file owner changes, setuid/setcap usage, crontab/at job manipulation, and Java shell spawning
6 details in Everything
Adds new analytic stories for Log4Shell and AD lateral movement lateral movement Moving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.32.0 https://github.com/splunk/security_content.git
$ git checkout v3.32.0
Adds New Analytics including Curl Download and Bash Execution , Wget Download and Bash Execution , Linux Java Spawning Shell , Windows Java Spawning Shell , Java Class File download by Java User Agent , Outbound Network Connection from Java Using Default Ports , Log4Shell JNDI Payload Injection Attempt , Log4Shell JNDI Payload Injection with Outbound Connection , Detect Outbound LDAP Traffic , Hunting for Log4Shell , Possible Lateral Movement PowerShell Spawn, Short Lived Scheduled Task , Randomly Generated Windows Service Name , Randomly Generated Scheduled Task Name , Unusual Number of Computer Service Tickets Requested , and Unusual Number of Remote Endpoint Authentication Events Adds New BA Analytics including Detect RClone Command-Line Usage , Windows Curl Upload to Remote Destination , DNS Exfiltration Using Nslookup App , Fsutil Zeroing File , BCDEdit Failure Recovery Modification , WBAdmin Delete System Backups , Excessive Number of Office Files Copied , and High File Deletion Frequency Adds New Playbooks for Log4Shell investigation and response workflows
3 details in Everything
Splunk Security Content v3.31.0 adds 49 new analytics across detection categories and updates existing stories.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.31.0 https://github.com/splunk/security_content.git
$ git checkout v3.31.0
Adds Anomalous usage of Archive Tools BA Analytics Adds Sdelete Application Execution BA Analytics Adds Signed Binary Proxy Execution InstallUtil Analytic Story
3 details in Everything
v3.29.0 adds Remcos and Fin7 analytics stories, new detection logic for local group and user discovery, and process macro support.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.29.0 https://github.com/splunk/security_content.git
$ git checkout v3.29.0
Adds Remcos and Fin7 Analytic Stories for enhanced threat coverage Introduces new detection capabilities for system user discovery via whoami, PowerShell Script Block Logging, environment variables, and WMIObject queries Enables local group discovery through Net Localgroup, WMIC, and PowerShell cmdlets Adds network connection discovery detections using ARP ARP A network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. Implements process macros for capturing process_name and original_file_name in content development
+1 more
show less
Adds body field to More than usual number of LOLBAS applications in short time period and Detect Dump LSASS Memory using comsvcs detections
6 details in Everything
Splunk Security Content v3.28.0 adds detections for BlackMatter, ProxyShell, and AD discovery analytics
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.28.0 https://github.com/splunk/security_content.git
$ git checkout v3.28.0
Adds BlackMatter Ransomware Analytic Story for new threat coverage Adds Active Directory Discovery Analytic Story for reconnaissance detection Adds ProxyShell Analytic Story for Exchange vulnerability detection Adds PetitPotam NTLM Relay on Active Directory Certificate Services Analytic Story Adds Microsoft MSHTML Remote Code Execution CVE-2021-40444 Analytic Story (incidental to new capability suite)
+5 more
show less
Adds new analytics: Add DefaultUser And Password In Registry, Auto Admin Logon Registry Entry , and other password policy/AD discovery detection rules Adds new analytics for GitHub activity: GitHub Dependabot Alert, GitHub Pull Request from Unknown User, and Github Commit Changes In Master Adds new G Suite email security analytics: Gsuite Email With Known Abuse Web Service Link , Gsuite Suspicious Shared File Name , and Gsuite Drive Share In External Email Adds AWS ECR ECR Amazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. AWS ECR Container Upload Outside Business Hours and AWS ECR Container Upload Unknown User analytics Adds Exchange PowerShell abuse detection via Exchange PowerShell Module Usage (Experimental) and Exchange PowerShell Abuse via SSRF SSRF Server-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly.
10 details in Everything
New analytics for Kubernetes image pulling, Nginx Ingress LFI/RFI, and GitHub master branch commits
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.27.1 https://github.com/splunk/security_content.git
$ git checkout v3.27.1
Adds Kubernetes Scanner Image Pulling detection rule to identify suspicious image pull activities Adds Kubernetes Nginx Ingress LFI detection rule for Local File Ingression attacks via Nginx Ingress Adds Kubernetes Nginx Ingress RFI detection rule for Remote File Inclusion attacks via Nginx Ingress Adds Github Commit Changes In Master detection rule to monitor commits directly to the master branch
4 details in Everything
v3.27.0 adds three new AWS ECR ECR Amazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.27.0 https://github.com/splunk/security_content.git
$ git checkout v3.27.0
Adds AWS ECR Container Scanning Findings High , AWS ECR Container Scanning Findings Low Informational Unknown , and AWS ECR Container Scanning Findings Medium analytics to detect container scanning findings in AWS ECR Adds Dev Sec Ops as a new analytic story for grouping related detections Extends detection files with new types: TTP TTP Tactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind.
3 details in Everything
Adds IcedID, Attacker Tools, and Rundll32 detection analytics in v3.26.0
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.26.0 https://github.com/splunk/security_content.git
$ git checkout v3.26.0
Adds IcedID analytic story covering multiple new detections for the IcedID loader family Adds Attacker Tools On Endpoint new analytics for detecting known adversary tooling Adds SAM Database File Access Attempt detection to monitor SAM file access attempts Adds Detect shared ec2 snapshot detection to identify public/shared EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Adds CHCP Command Execution detection to monitor CHCP command usage
+12 more
show less
Adds Create Remote Thread In Shell Application detection for remote thread creation events Adds Drop IcedID License dat detection for license file drops by IcedID Adds IcedID Exfiltrated Archived File Creation detection for exfiltration artifacts Adds Office Application Spawn Regsvr32 process detection for Office-to-Regsvr32 spawns Adds Rundll32 Create Remote Thread To A Process detection for Rundll32 remote thread activity Adds Rundll32 CreateRemoteThread In Browser detection for browser-context Rundll32 threads Adds Rundll32 DNSQuery detection for DNS queries via Rundll32 Adds Rundll32 Process Creating Exe Dll Files detection for Rundll32 file creation Adds Sqlite Module In Temp Folder detection for SQLite modules in temp directories Adds Suspicious IcedID Regsvr32 Cmdline detection for suspicious Regsvr32 command lines Adds Suspicious IcedID Rundll32 Cmdline detection for suspicious Rundll32 command lines Adds Suspicious Rundll32 PluginInit detection for PluginInit calls in Rundll32
17 details in Everything
Splunk Security Content v3.25.2 adds Attacker Tools On Endpoint analytics rule
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.25.2 https://github.com/splunk/security_content.git
$ git checkout v3.25.2
Adds the Attacker Tools On Endpoint new detection analytics to identify attacker tool usage on endpoints
1 detail in Everything
Splunk Security Content v3.23.0 adds new detections for Revil/Conti ransomware and SharpHound/AzureHound tools.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.23.0 https://github.com/splunk/security_content.git
$ git checkout v3.23.0
Adds Excessive number of taskhost processes detection Adds Revil Registry Entry detection Adds Revil Common Exec Parameter detection Adds Modification Of Wallpaper detection Adds Wbemprox COM Object Execution detection
+14 more
show less
Adds Known Services Killed by Ransomware detection Adds Delete ShadowCopy With PowerShell detection Adds Conti Common Exec parameter detection Adds Revil Ransomware detection (distinct from the analytic story) Adds Excessive Usage of NSLOOKUP App detection Adds CMD Echo Pipe - Escalation detection Adds Detect AzureHound File Modifications detection Adds Detect SharpHound Command-Line Arguments detection Adds Detect SharpHound File Modifications detection Adds Detect SharpHound Usage detection Adds Detect Renamed Psexec detection Adds Detect Renamed 7-Zip detection Adds Detect Renamed WinRAR detection Adds Detect AzureHound Command-Line Arguments detection
19 details in Everything
Adds 26 new detections including XMRig, WinRM WinRM A Windows-native remote management protocol from Microsoft, implementing the WS-Management standard, that lets tools execute commands and access data on remote Windows hosts over HTTP or HTTPS.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.22.0 https://github.com/splunk/security_content.git
$ git checkout v3.22.0
Adds detection for XMRIG miner activity via the new XMRIG Analytic Story and associated detections Adds detection for WinRM Spawning a Process to identify remote command execution patterns Adds detection for Deleting Of Net Users to monitor account removal via net.exe Adds detection for Disable Windows App Hotkeys to catch UI lockdown attempts Adds detection for Disabling Net User Account to track user state changes
+20 more
show less
Adds detection for Download Files Using Telegram to identify data exfiltration data exfiltration Moving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. Adds detection for Enumerate Users Local Group Using Telegram to catch enumeration techniques leveraging Telegram Adds detection for Excessive Attempt To Disable Services to detect service disruption campaigns Adds detection for Excessive Service Stop Attempt to identify systematic service stoppage Adds detection for Excessive Usage Of Cacls App to flag ACL ACL An access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. Adds detection for Excessive Usage Of Net App to monitor bulk user/computer management via net.exe Adds detection for Excessive Usage Of Taskkill to detect process killing campaigns Adds detection for Executables Or Script Creation In Suspicious Path to catch artifact staging Adds detection for Hide User Account From Sign-In Screen to identify persistence or hiding techniques Adds detection for Icacls Deny Command to track explicit deny ACL modifications Adds detection for ICACLS Grant Command to track explicit grant ACL modifications Adds detection for Modify ACL permission To Files Or Folder to detect broad permission changes Adds detection for Process Kill Base On File Path to identify targeted process termination Adds detection for Schtasks Run Task On Demand to flag scheduled task execution triggers Adds detection for Suspicious Driver Loaded Path to catch driver injection or loading anomalies Adds detection for Suspicious Process File Path to identify execution from unusual directories Adds detection for XMRIG Driver Loaded to detect kernel-level XMRIG association Updates the Data Exfiltration Analytic Story with improved coverage or rules Removes all Javascript code from the app and updates UI elements to eliminate JS libs Eliminates the Analytic story details view in the UI, hot linking users to the ES Use Case Library
25 details in Everything
Splunk Security Content v3.21.0 adds DarkSide and AD password spraying password spraying Trying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.21.0 https://github.com/splunk/security_content.git
$ git checkout v3.21.0
Adds DarkSide Ransomware analytic story to guide detection engineering for this threat group Adds Active Directory Password Spraying analytic story to support credential stuffing detection Adds new detections for SAM registry extraction (Extract SAM from Registry) and elevated SLUI execution (SLUI RunAs Elevated, SLUI Spawning a Process) Adds new detections for RClone abuse via renaming (Detect Renamed RClone) and command-line usage (Detect RClone Command-Line Usage) Adds new detection for CMLUA or CMSTPLUA UAC bypass technique
+6 more
show less
Adds new detections for multiple users failing to authenticate via Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. NTLM NTLM A Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. Adds new detection for multiple invalid users failing to authenticate from a host using Kerberos or NTLM Adds new detection for multiple users attempting to authenticate with explicit credentials Adds new detection for multiple users remotely failing to authenticate from a host Adds experimental PowerShell command (Delete ShadowCopy With PowerShell) to detect shadow copy deletion Updates Ransomware Notes bulk creation and Cobalt Strike Named Pipes detections
11 details in Everything
Splunk Security Content v3.20.0 adds new detection rules for Office lateral movement lateral movement Moving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. AWS IAM AWS IAM AWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.20.0 https://github.com/splunk/security_content.git
$ git checkout v3.20.0
Adds Masquerading - Rename System Utilities, Command and Control , and Trickbot Analytic Stories Adds Winword Spawning Windows Script Host detection rule Adds 'Office Product Spawning Rundll32 with no DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. Adds Office Application Spawn rundll32 process detection rule Adds Office Document Creating Schedule Task detection rule
+27 more
show less
Adds Anomalous Usage of 7z detection rule Adds Office Product Spawning MSHTA detection rule Adds Office Product Spawning Wmic detection rule Adds Office Product Spawning BITSAdmin detection rule Adds Office Product Spawning CertUtil detection rule Adds Office Document Executing Macro Code detection rule Adds Office Document Spawned Child Process To Download detection rule Adds Schedule Task with HTTP Command Arguments detection rule Adds Winword Spawning Cmd detection rule Adds WinEvent Scheduled Task Created Within Public Path detection rule Adds WinEvent Scheduled Task Created to Spawn Shell detection rule Adds Winword Spawning PowerShell detection rule Adds Excel Spawning Windows Script Host detection rule Adds Excel Spawning PowerShell detection rule Adds DNS Exfiltration Using Nslookup App detection rule Adds Excessive Usage of NSLOOKUP App detection rule Adds Multiple Archive Files Http Post Traffic detection rule Adds Plain HTTP POST Exfiltrated Data detection rule Adds AWS IAM AccessDenied Discovery Events detection rule Adds AWS IAM Assume Role Policy Brute Force detection rule Adds AWS IAM Delete Policy detection rule Adds AWS IAM Failure Group Deletion detection rule Adds AWS IAM Successful Group Deletion detection rule Adds 'Rundll32 with no Command Line Arguments with Network' detection rule Adds 'GPUpdate with no Command Line Arguments with Network' detection rule Adds 'DLLHost with no Command Line Arguments with Network' detection rule Adds 'SearchProtocolHost with no Command Line with Network' detection rule
32 details in Everything
Splunk Security Content v3.19.0 adds new analytic stories and detections for persistence and enumeration
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.19.0 https://github.com/splunk/security_content.git
$ git checkout v3.19.0
Adds Bits Jobs Analytic Story Adds Domain Trust Discovery Analytic Story Adds BITSAdmin Download File Detection Adds BITS Job Persistence Detection Adds PowerShell Start-BitsTransfer Detection
+13 more
show less
Adds DSQuery Domain Discovery Detection Adds Disable Registry Tool Detection Adds Disable Show Hidden Files Detection Adds Disable Windows Behavior Monitoring Detection Adds Disable Windows SmartScreen Protection Detection Adds Disabling CMD Application Detection Adds Disabling ControlPanel Detection Adds Disabling Firewall with Netsh Detection Adds Disabling FolderOptions Windows Feature Detection Adds Disabling NoRun Windows App Detection Adds Disabling SystemRestore In Registry Detection Adds Disabling Task Manager Detection Adds AWS Excessive Security Scanning Detection
18 details in Everything
v3.18.0 adds 4 new analytic stories and 19 new detections including Clop ransomware coverage and AWS IAM AWS IAM AWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.18.0 https://github.com/splunk/security_content.git
$ git checkout v3.18.0
Adds Ingress Tool Transfer as a new Analytic Story Adds Deobfuscate/Decode Files or Information as a new Analytic Story Adds AWS IAM Privilege Escalation as a new Analytic Story Adds Clop Ransomware as a new Analytic Story Adds CertUtil Download With URLCache and Split Arguments detection
+17 more
show less
Adds CertUtil Download With VerifyCtl and Split Arguments detection Adds CertUtil with Decode Flag detection Adds AWS Create Policy Version to allow all resources detection Adds AWS SetDefaultPolicyVersion detection Adds AWS CreateAccessKey detection Adds AWS CreateLoginProfile detection Adds AWS UpdateLoginProfile detection Adds Clop Common Exec Parameter detection Adds Clop Ransomware Known Service Name detection Adds Create Service In Suspicious File Path detection Adds High File Deletion Frequency detection Adds High Process Termination Frequency detection Adds Process Deleting Its Process File Path detection Adds Ransomware Notes bulk creation detection Adds Resize ShadowStorage volume detection Updates Detect Exchange Web Shell detection with new content Adds product and risk tag to all cloud searches
22 details in Everything
New detections for Windows discovery, Exchange webshells and Ryuk WoL command
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.17.0 https://github.com/splunk/security_content.git
$ git checkout v3.17.0
Adds Windows Discovery Techniques analytic story to detect enumeration activities across Windows systems Adds Detect Exchange Webshell detection for identifying web shell uploads on Microsoft Exchange servers
2 details in Everything
Adds Silver Sparrow and HAFNIUM Group analytic stories plus 18 new detections for Splunk Security Content.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.16.0 https://github.com/splunk/security_content.git
$ git checkout v3.16.0
Adds Silver Sparrow analytic story Adds HAFNIUM Group analytic story Adds Cobalt Strike Named Pipes detection Adds Suspicious DLLHost no Command Line Arguments detection Adds Suspicious GPUpdate no Command Line Arguments detection
+14 more
show less
Adds Suspicious SearchProtocolHost no Command Line Arguments detection Adds Suspicious PlistBuddy Usage detection Adds Suspicious SQLite3 LSAQuarantine Behavior detection Adds Suspicious Curl Network Connection detection Adds Ryuk Wake on LAN Command detection Adds Suspicious Scheduled Task from Public Directory detection Adds Fodhelper UAC Bypass detection Adds Eventvwr UAC Bypass detection Adds Any PowerShell DownloadString detection Adds Any PowerShell DownloadFile detection Adds Unified Messaging Service Spawning a Process detection Adds Suspicious Unified Messaging Service File Writes detection Adds Nishang PowershellTCPOneLine detection Adds W3WP Spawning Shells detection
19 details in Everything
Splunk Security Content v3.15.0 adds detections for Cobalt Strike, Regsvr32/Rundll32 application control bypasses, and AWS SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.15.0 https://github.com/splunk/security_content.git
$ git checkout v3.15.0
Adds Cloud Federated Credential Abuse story Adds Suspicious Regsvr32 Activity story Adds Suspicious Rundll32 Activity story Adds Suspicious Compiled HTML Activity story Adds Suspicious Regsvcs Regasm Activity story
+30 more
show less
Adds Cobalt Strike story Adds Detect HTML Help URL in Command Line detection Adds Detect HTML Help Spawn Child Process detection Adds Detect HTML Help Renamed detection Adds Detect HTML Help Using InfoTech Storage Handlers detection Adds Detect Regasm Spawning a Child Process detection Adds Detect Regsvcs Spawning a Child Process detection Adds Detect Regsvcs With Network Connection detection Adds Detect Regasm with no Command Line Arguments detection Adds Detect Regasm With Network Connection detection Adds Detect regsvcs with no Command Line Arguments detection Adds Detect Regsvr32 Application Control Bypass detection Adds Suspicious regsvr32 register suspicious path detection Adds Ntdsutil Export NTDS detection Adds Dump lsass via procdump detection Adds Dump lsass via procdump rename detection Adds Creation of lsass dump with taskmgr detection Adds Suspicious rundll32 rename detection Adds Detect Rundll32 Application Control Bypass - advpack & ieadvpack detection Adds Detect Rundll32 Application Control Bypass - syssetup detection Adds Detect Rundll32 Application Control Bypass - setupapi detection Adds Suspicious Rundll32 StartW detection Adds Suspicious Rundll32 DllRegisterServer detection Adds Suspicious Rundll32 with no command line arguments detection Adds Certutil exe certification extraction detection Adds AWS SAML access by provider user and principal detection Adds AWS SAML update identity provider identity provider A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. Adds O365 Excessive SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. Adds O365 added service principal detection Adds O365 new federated domain added detection
35 details in Everything
v3.13.0 adds detections for Trusted Developer Utilities Proxy Execution and MSHTA activity, plus product tag in detection spec.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.13.0 https://github.com/splunk/security_content.git
$ git checkout v3.13.0
Adds detection stories for Trusted Developer Utilities Proxy Execution and Trusted Developer Utilities Proxy Execution MSBuild Adds detection stories for Suspicious MSHTA Activity including checks for mshta child process, inline HTA execution, and URL in command line Adds detection story for Ryuk Ransomware covering NLTest domain trust discovery and WBAdmin backup deletion Introduces backend tool to report detection testing coverage
4 details in Everything
Splunk Security Content v3.12.0 adds new detections for AWS KMS AWS KMS AWS Key Management Service, Amazon's hosted service for creating and controlling cryptographic keys, giving cyber tools a durable, audited place to encrypt data without managing raw key material themselves. MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.12.0 https://github.com/splunk/security_content.git
$ git checkout v3.12.0
Added aws_kms_encrypt_no_mfa detection to identify users creating keys with encrypt policy without MFA Added bcde_recovery_modification detection for BCDEdit failure recovery modification Added network_acl_all_open detection for AWS network access control list access control list An access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. Added network_acl_deleted detection for AWS network access control list deleted Added s3_bucket_open_cli detection to detect new open S3 Buckets over AWS CLI
+4 more
show less
Added o365_mfa_bypass_trusted_ip detection for O365 bypass MFA via trusted IP Added hosts_connecting_dynamic_domains detection to detect hosts connecting to dynamic domain providers Updated aws_kms_encrypt_s3 detection for AWS users with kms keys performing encryption against S3 buckets Updated s3_bucket_open_detection to cover new open S3 buckets
9 details in Everything
Adds five new Splunk security content detections for O365 and webshell activity
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.11.0 https://github.com/splunk/security_content.git
$ git checkout v3.11.0
new detection: Multi-factor authentication Multi-factor authentication Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. new detection: Excessive Authentication Failures Alert (o365)new detection: PST Export Alert (o365)new detection: Detect high number of login failures from a single sourcenew detection: Detect Supernova Webshell (used in SUNBURST)
5 details in Everything
Splunk Security Content v3.10.0 adds new detection rules for Sunburst malware and Office 365 admin activities.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.10.0 https://github.com/splunk/security_content.git
$ git checkout v3.10.0
Adds Sunburst Malware and Office 365 Detections to the Analytic Stories catalog Adds Windows AdFind Exe detection rule for detecting AdFind.exe usage Adds Sunburst Correlation DLL and Network Event detection rule correlating DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. Adds O365 Suspicious Admin Email Forwarding detection rule for suspicious admin email forwarding activities Adds O365 Suspicious Rights Delegation detection rule for detecting rights delegation anomalies in O365
+1 more
show less
Adds O365 Suspicious User Email Forwarding detection rule for detecting suspicious user email forwarding
6 details in Everything
Splunk Security Content v3.9.0 adds new detections including Ryuk file detection, forced connhost.exe launch, and more.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.9.0 https://github.com/splunk/security_content.git
$ git checkout v3.9.0
Ryuk Test Files Detected Windows connhost exe started forcefully Windows DisableAntiSpyware RegistryAttempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass detectionDetect Deleting of Shadow Copies
+11 more
show less
Detect Excessive Account Lockouts From Endpoint Detect mshta exe running scripts in command-line arguments Detect newly created accounts that have been elevated Detect Windows event log cleared Detect Attempt To Add Certificate To Untrusted Store Detect Attempted credentials dump from registry via reg exe Detect Attempted creation_of_shadow_copy_with_wmic_and_powershell.ymlDetect Path Interception By Creation Of program exe Detect malicious powershell process encoded_commandCommon Ransomware Extensions Common Ransomware Notes
16 details in Everything
Splunk Security Content v3.0.8 adds 4 new GCP and Windows detections plus automated testing framework
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.0.8 https://github.com/splunk/security_content.git
$ git checkout v3.0.8
Adds GCP Detect accounts with high risk roles by project detection for GCP identity abuse Adds GCP Detect gcploit framework detection for known exploitation tooling Adds GCP Detect high risk permissions by resource and account detection for privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. Adds System Information Discovery Detection rule for reconnaissance activity Introduces automated detection testing framework to validate new content
5 details in Everything
Splunk Security Content v3.0.7 adds new threat detections (Zerologon, GCP OAuth abuse) and RBA RBA Risk-Based Authentication, an approach that adjusts login challenge strength based on contextual signals like location or device, letting cyber tools step up verification only when anomaly scores cross a threshold.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.0.7 https://github.com/splunk/security_content.git
$ git checkout v3.0.7
Adds detection GCP Detect OAuth Token Abuse Adds detection Detect Computer Changed with Anonymous Account Adds detection Detect Zerologon via Zeek Adds detection Zerologon Attack under New Stories Adds detection GCP Cross Account Activity under New Stories
+1 more
show less
Adds the ability to tag detections with RBA
6 details in Everything
Adds new detection stories for Suspicious GCP Storage Activities and AWS Security Hub Alerts spikes
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.0.6 https://github.com/splunk/security_content.git
$ git checkout v3.0.6
New detection story: Suspicious GCP Storage Activities New detection story: AWS Security Hub Alerts
2 details in Everything
8 new detection rules for Windows DNS, AWS IAM AWS IAM AWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. RCE RCE Remote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.0.5 https://github.com/splunk/security_content.git
$ git checkout v3.0.5
Added detect_windows_dns_sigred_via_splunk_stream.yml Added detect_windows_dns_sigred_via_zeek.yml Added f5_tmui_rce_cve_2020_5902.yml Added aws_detect_attach_to_role_policy.yml Added aws_detect_permanent_key_creation.yml
+3 more
show less
Added aws_detect_role_creation.yml Added aws_detect_sts_assume_role_abuse.yml Added detections/aws_detect_sts_get_session_token_abuse.yml
8 details in Everything
Adds six new Kubernetes GCP detection rules and MITRE MITRE A US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.0.4 https://github.com/splunk/security_content.git
$ git checkout v3.0.4
Adds kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml, kubernetes_gcp_detect_RBAC_authorizations_by_account.yml, kubernetes_gcp_detect_sensitive_object_access.yml, kubernetes_gcp_detect_sensitive_role_access.yml, kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml, and kubernetes_gcp_detect_suspicious_kubectl_calls.yml detection files for Kubernetes on GCP. Adds MITRE tagging for cloud detections to improve threat classification consistency.
2 details in Everything
Adds AWS Investigate Security Hub alerts response task and new Kubernetes analytic stories
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.0.3 https://github.com/splunk/security_content.git
$ git checkout v3.0.3
Adds AWS Investigate Security Hub alerts by dest response task that leverages Security Hub alerts for investigation/response. Adds Kubernetes Sensitive Role Activity detection search to the analytic stories. Adds Kubernetes Sensitive Object Access Activity detection search to the analytic stories.
3 details in Everything
Adds Suspicious Cloud Auth Analytic Story and new detections for Kerberoasting Kerberoasting An attack that obtains Kerberos service tickets and tries to crack their encrypted contents offline. Recovering a weak service-account password can give the attacker that account's access.
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.0.2 https://github.com/splunk/security_content.git
$ git checkout v3.0.2
Adds Suspicious Cloud Auth Activities analytic story using the updated Authentication Data Model on ES 6.2 Adds Kerberoasting spn request with RC4 encryption detection Adds Detect new user AWS Console Login - DM detection
3 details in Everything
Splunk Security Content v3.0.1 adds workbench panel investigations and new Analytic Stories
└──▷ GET THIS VERSION
copy
$ git clone --branch v3.0.1 https://github.com/splunk/security_content.git
$ git checkout v3.0.1
Adds workbench panel investigations via the New UI Enhancements section. Adds Kubernetes Sensitive Object Access Activity as a new Analytic Story. Adds Kubernetes Sensitive Role Activity as a new Analytic Story. Adds Suspicious Zoom Child Processes as a new Analytic Story.
4 details in Everything
Adds Kubernetes Scanning Activity analytic story in v1.0.54
└──▷ GET THIS VERSION
copy
$ git clone --branch v1.0.54 https://github.com/splunk/security_content.git
$ git checkout v1.0.54
Adds Container Implantation Monitoring & Investigation analytic story
└──▷ GET THIS VERSION
copy
$ git clone --branch v1.0.51 https://github.com/splunk/security_content.git
$ git checkout v1.0.51
v1.0.50 adds MacOS - Re-opened Applications detection rule
└──▷ GET THIS VERSION
copy
$ git clone --branch v1.0.50 https://github.com/splunk/security_content.git
$ git checkout v1.0.50
v1.0.49 adds Unload Sysmon Filter Driver detection and macro/lookup enhancements to multiple analytic stories.
└──▷ GET THIS VERSION
copy
$ git clone --branch v1.0.49 https://github.com/splunk/security_content.git
$ git checkout v1.0.49
Adds new detection Unload Sysmon Filter Driver under CRL CRL A Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. Adds input and output filter macros for lateral movement lateral movement Moving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. Adds discovered_dns_records lookup to DNS record changed detection
3 details in Everything
Adds input(pre-filter) and output(post-filter) macros to new detection searches for global macro updates.
└──▷ GET THIS VERSION
copy
$ git clone --branch v1.0.48 https://github.com/splunk/security_content.git
$ git checkout v1.0.48
Adds two new MLTK-based analytic searches for detecting abnormally high AWS EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware.
└──▷ GET THIS VERSION
copy
$ git clone --branch v1.0.45 https://github.com/splunk/security_content.git
$ git checkout v1.0.45
Adds Abnormally High AWS Instances Launched by User - MLTK detection search to the Suspicious AWS EC2 Activities Analytic Story Adds Abnormally High AWS Instances Terminated by User - MLTK detection search to the Suspicious AWS EC2 Activities Analytic Story Adds Abnormally High AWS Instances Launched by User - MLTK detection search to the Cloud Cryptomining Analytic Story
3 details in Everything
Choose a badge style and copy the code →