https://cybertoolchain.io/tools/splunk-security-content New releases and features in Splunk Security Content, tracked by The Cyber Toolchain. en Wed, 28 Oct 2026 22:58:44 GMT https://github.com/splunk/security_content/releases/tag/v6.9.2 https://github.com/splunk/security_content/releases/tag/v6.9.2 Wed, 28 Oct 2026 22:58:44 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v6.9.1 https://github.com/splunk/security_content/releases/tag/v6.9.1 Thu, 22 Oct 2026 22:13:10 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v6.9.0 https://github.com/splunk/security_content/releases/tag/v6.9.0 Wed, 21 Oct 2026 14:14:17 GMT Splunk Security Content v6.9.0 adds 15 new detections spanning Cisco AI Defense, AWS, Zeek, and Braodo Stealer, plus a new GenAI analytic story and alpha threat ops dashboard⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds three new Cisco AI Defense detections: `Cisco AI Defense Allowed Sensitive Prompt`, `Cisco AI Defense Allowed Sensitive Response`, and `Cisco AI Defense Repeated High Risk Activity`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces a new `Abuse of GenAI Systems and Applications` analytic story covering GenAI abuse surface. • Introduces the `Cisco AI Defense Threat Operations` dashboard (alpha) for reviewing runtime activity, enforcement outcomes, risky behavior, sensitive data matches, and activity by application and model. • Adds `AWS Anomalous Secrets Manager Batch Retrieval`, `AWS Repeated CloudWatch Logs Read Operations`, `AWS EC2 Multiple SSH Public Keys Uploaded by a Single Identity`, `AWS EC2 Startup Script Modified on Stopped Instance`, and `AWS IAM Role Created with External Trust` detections for expanded AWS CloudTrail coverage, covering suspicious secret access, log-read activity, and repeated EC2 Instance Connect SSH key uploads. • Adds Zeek-based detections: `HTTP POST Request with Encoded Payload`, `Unusual SSH Client Banner`, and `Unusual HTTP Request Method`, along with Zeek HTTP and SSH data sources and macros. • Adds `PowerShell Download from Code Hosting Service` and `Windows Process Outbound Connection To Social Media Domain` endpoint detections. • Adds two new analytics and tags existing detections for the 2026 Braodo Stealer variant under the updated `Braodo Stealer` analytic story. • Advances four M365 Copilot jailbreak analytics to production. • Updates `atomic_guid` values across detections to link with relevant Atomic Red Team tests. • Refreshes remote access software coverage and its lookup, adds a file-sharing domains lookup, and updates suspicious-port detection for Cisco Secure Firewall. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v6.7.0 https://github.com/splunk/security_content/releases/tag/v6.7.0 Wed, 23 Sep 2026 16:04:24 GMT Splunk Security Content v6.7.0 adds 7 new macOS and Windows analytics covering osascript, ClickFix chains, and LOLBin abuse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Cisco NVM - Osascript Network Connection for a Long Duration` detection to identify long-lived network connections initiated via osascript on macOS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `MacOS Osascript Executing Interactive Shell` detection to catch osascript spawning interactive shells on macOS endpoints. • Adds `MacOS Osascript Executing JavaScript Code With ObjC` detection to identify JavaScript for Automation code using the Objective-C bridge via osascript. • Adds `Windows Finger.exe Connecting to a Remote Host` detection to identify payload retrieval and remote connections through finger.exe. • Adds `Windows For Loop Usage Within Cmd.exe To Execute Commands` detection to catch command execution via for /f loops, a common ClickFix technique. • Adds `Windows Node.exe Executing JS Script In Immediate Folder` detection to flag JavaScript execution by node.exe from unusual directories. • Adds `Windows Process Accessing IronLanguages Repository On GitHub` detection to identify processes reaching out to the IronLanguages repository on GitHub. • Updates credential-access and process-injection detections covering LSASS access and termination, credential dumping, Winlogon token manipulation, Rubeus ticket export, handle duplication, and process injection for improved analytic consistency and investigation context. • Updates ESXi-related detections `ESXi Audit Tampering` and `ESXi Bulk VM Termination` with improved SPL logic and threat metadata. • Updates network and web detections including `DNS Kerberos Coercion`, `Internal Horizontal Port Scan NMAP Top 20`, and `Plain HTTP POST Exfiltrated Data` with better event context and reduced noise. Breaking changes: • `MacOS - Re-opened Applications`, `Windows Process Injection into Notepad`, and `XMRIG Driver Loaded` detections are scheduled for removal in ESCU version 6.10.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v6.6.0 https://github.com/splunk/security_content/releases/tag/v6.6.0 Thu, 10 Sep 2026 14:51:39 GMT Splunk Security Content v6.6.0 adds 12 new analytics for browser shells, LOLBAS, macOS AppleScript, Socat, SCCM abuse, and a NIST AI RMF dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `detection_subcategory_map` and `nist_ai_rmf_subcategories` lookups to support analytic categorization and alignment with NIST AI Risk Management Framework subcategories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds alpha `nist_ai_rmf_control_coverage` dashboard mapping AI-related ESCU detections to the NIST AI RMF Govern, Map, Measure, and Manage functions to help identify coverage gaps. • Adds 'Cisco NVM - Browser Spawned Unix Shell with External Connection' detection to identify command execution or C2 activity originating from browsers on Unix endpoints. • Adds 'LOLBAS Network Connection On Uncommon Port' detection to catch rare network activity from trusted system binaries on non-standard ports. • Adds 'LOLBAS Rare Network Connection' detection to surface anomalous network connections from LOLBAS binaries with separate process-group and common-port tuning. • Adds 'Socat Network Listener Binding an Executable' and 'Socat Remote TCP Connection with Local Echo Disabled' detections for network tunneling, proxying, and C2 via Socat. • Adds 'MacOS AppleScript Shell Execution and Compilation' detection to improve visibility into script-based execution on macOS. • Adds 'MacOS Osascript Displaying Suspicious User Prompt' detection to catch deceptive user-interaction attacks via osascript on macOS. • Adds 'Windows Builtin Account Name Was Changed' detection to identify account manipulation targeting built-in accounts. • Adds 'Windows Content Copied from Browser was Executed' detection to catch suspicious execution workflows involving payloads copied from web content. • Adds 'Windows SCCM Adsource DLL Was Planted In SMS Provider Directory' detection for DLL planting abuse of SCCM components. • Adds 'Windows SCCM Smsexec Spawned a Suspicious Child Process' detection for abnormal child-process execution from smsexec. • Adds 'Linux Crontab Enumeration' detection to identify crontab listing activity used for discovery. • Updates 18 analytics across Citrix, Windows, Linux, and macOS environments, improving detection fidelity for Citrix ADC exploitation, pipe-based execution, data destruction, Ghostscript exploitation, PowerShell, event-log manipulation, credential access, and more. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v6.6.0 https://github.com/splunk/security_content/releases/tag/v6.6.0 Thu, 10 Sep 2026 14:51:39 GMT Splunk Security Content v6.6.0 adds 12 new analytics for browser shells, LOLBAS, macOS AppleScript, Socat, SCCM abuse, and a NIST AI RMF dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `detection_subcategory_map` and `nist_ai_rmf_subcategories` lookups to support analytic categorization and alignment with NIST AI Risk Management Framework subcategories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds alpha `nist_ai_rmf_control_coverage` dashboard mapping AI-related ESCU detections to the NIST AI RMF Govern, Map, Measure, and Manage functions to help identify coverage gaps. • Adds 'Cisco NVM - Browser Spawned Unix Shell with External Connection' detection to identify command execution or C2 activity originating from browsers on Unix endpoints. • Adds 'LOLBAS Network Connection On Uncommon Port' detection to catch rare network activity from trusted system binaries on non-standard ports. • Adds 'LOLBAS Rare Network Connection' detection to surface anomalous network connections from LOLBAS binaries with separate process-group and common-port tuning. • Adds 'Socat Network Listener Binding an Executable' and 'Socat Remote TCP Connection with Local Echo Disabled' detections for network tunneling, proxying, and C2 via Socat. • Adds 'MacOS AppleScript Shell Execution and Compilation' detection to improve visibility into script-based execution on macOS. • Adds 'MacOS Osascript Displaying Suspicious User Prompt' detection to catch deceptive user-interaction attacks via osascript on macOS. • Adds 'Windows Builtin Account Name Was Changed' detection to identify account manipulation targeting built-in accounts. • Adds 'Windows Content Copied from Browser was Executed' detection to catch suspicious execution workflows involving payloads copied from web content. • Adds 'Windows SCCM Adsource DLL Was Planted In SMS Provider Directory' detection for DLL planting abuse of SCCM components. • Adds 'Windows SCCM Smsexec Spawned a Suspicious Child Process' detection for abnormal child-process execution from smsexec. • Adds 'Linux Crontab Enumeration' detection to identify crontab listing activity used for discovery. • Updates 18 analytics across Citrix, Windows, Linux, and macOS environments, improving detection fidelity for Citrix ADC exploitation, pipe-based execution, data destruction, Ghostscript exploitation, PowerShell, event-log manipulation, credential access, and more. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v6.5.0 https://github.com/splunk/security_content/releases/tag/v6.5.0 Thu, 27 Aug 2026 21:45:52 GMT Splunk Security Content v6.5.0 adds 13 new detections across Python supply-chain, Vidar stealer, RoguePlanet/ShieldBreak privilege escalation, and EDRSilencer evasion. • New analytic story 'Malicious Python Package Installation' with four detections: 'Python Network Traffic During Package Build', 'Python PTH File Creation During Package Installation', 'Python PYTHONPATH Modification During Package Installation', and 'Python Site Hooks Creation During Package Installation' — covering supply-chain threats that execute code during install or persist across Python sessions. • New analytic story 'Vidar Stealer' anchored by 'Windows Cloud Sensitive File Read Access By Uncommon Process', detecting collection of Azure CLI profile metadata, saved credentials, and cookies to support account takeover and cloud reconnaissance. • Six new detections added to the 'RoguePlanet' analytic story targeting Windows Defender race-condition and ShieldBreak techniques: 'Windows Alternate Data Stream Created Over Local Share', 'Windows Defender MpClient.dll Loaded by Non-Defender Process', 'Windows Defender Threat Detected on Kernel Object Path', 'Windows Error Report Created in ReportQueue Manually', 'Windows Phantom DLL Created on Disk', and 'Windows Wermgr Spawning System Integrity Process'. • Two new EDRSilencer behavioral detections via Windows Filtering Platform: 'Windows EDRSilencer Custom Outbound Filter Added' and 'Windows Filtering Platform Filter Added To Block EDR Process', identifying attempts to block security processes from reaching management infrastructure. • 46 existing analytics updated across Windows, Linux, macOS, ESXi, and AWS Bedrock to improve fidelity across AI infrastructure abuse, credential access, browser data theft, process injection, persistence, privilege escalation, and destructive activity. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v6.4.0 https://github.com/splunk/security_content/releases/tag/v6.4.0 Wed, 12 Aug 2026 14:34:19 GMT Splunk Security Content v6.4.0 adds 27 new analytics spanning Linux privilege escalation, persistence, containers, and Windows endpoint threats. • Adds `Linux Binary Executed from Shared Memory Directory` analytic to detect execution from shared-memory paths, a common evasion technique. • Adds `Linux EFI Bootloader File Deletion` analytic for detecting bootloader tampering on Linux systems. • Adds `Linux File Creation In System Generator Directory` analytic targeting persistence via systemd generator paths. • Adds `Linux Ghostscript Exploitation` analytic to surface exploitation attempts against Ghostscript. • Adds `Linux MOTD Script Added` analytic for detecting persistence through message-of-the-day scripts. • Adds `Linux Netcat Outbound Connection` analytic to identify reverse-shell and data-exfiltration use of netcat. • Adds `Linux Possible Bootloader Modification` analytic to catch unauthorized bootloader changes. • Adds `Linux Possible GSM Privilege Escalation` analytic for detecting GSM-based privilege escalation paths. • Adds `Linux Possible Nimbuspwn Privilege Escalation` analytic targeting the Nimbuspwn escalation technique. • Adds `Linux Possible Privilege Escalation via PYTHONPATH` analytic to detect PYTHONPATH-based escalation. • Adds `Linux Possible System Binary Backdoor` analytic for identifying backdoored system binaries. • Adds `Linux Root Execution of id` analytic to flag suspicious root-context identity-verification commands. • Adds `Linux Shell History Access Via Command Line Utility` analytic for detecting shell history enumeration. • Adds `Linux Shell Pseudo Device Reverse Shell` analytic targeting pseudo-device reverse-shell techniques. • Adds `Linux Suspicious Child Process of PostgreSQL` analytic to detect database process abuse. • Adds `Linux Suspicious Docker Build Command Execution` analytic for container abuse via docker build. • Adds `Linux Suspicious GCC Invocation Building Init Shared Object` analytic to catch shared-object implant compilation. • Adds `Linux Suspicious Privileged Container Execution` analytic to surface privileged container abuse. • Adds `Linux Suspicious Redis Activity` analytic for detecting Redis abuse as an execution vector. • Adds `Linux Suspicious Staging of Alternate System Files` analytic for detecting system-file replacement staging. • Adds `Linux Suspicious XDG Autostart` analytic to identify persistence via XDG autostart entries. • Adds `Linux UDEV Rule Created` analytic to detect UDEV-based persistence mechanisms. • Adds `Linux Usermod Root UID Set` analytic for detecting UID-0 assignment via usermod. • Adds `Windows Dir Piped to Findstr Activity` analytic to catch directory-listing reconnaissance piped into Findstr. • Adds `Windows Network Sniffing Tool Executed` analytic for detecting execution of known network sniffing utilities. • Adds `Windows Powershell Commands from DNS TXT` analytic to identify PowerShell commands retrieved via DNS TXT record lookup. • Refreshes the `attacker_tools` and `malware_user_agents` lookup CSV files with updated content to improve detection and investigation context. Breaking changes: • The Onboarding Assistant beta is removed from ESCU and is no longer available; it will be reintroduced in Detection Studio in a future release. • The following detections are permanently removed: `PowerShell - Connect To Internet With Hidden Window`, `Regsvr32 with Known Silent Switch Cmdline`, `Rundll32 CreateRemoteThread In Browser`, `Splunk App for Lookup File Editing RCE via User XSLT`, `Splunk Code Injection via custom dashboard leading to RCE`, `Splunk Enterprise KV Store Incorrect Authorization`, `Splunk Information Disclosure on Account Login`, `Splunk Path Traversal In Splunk App For Lookup File Edit`, `Splunk RCE PDFgen Render`, `Windows Process Injection Of Wermgr to Known Browser`, and `Windows Process Injection With Public Source Path`. Users relying on any of these detections should review the deprecated analytics documentation and migrate to recommended replacements before upgrading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v6.3.0 https://github.com/splunk/security_content/releases/tag/v6.3.0 Wed, 29 Jul 2026 14:21:57 GMT Splunk Security Content v6.3.0 adds a Starland RAT campaign story, 4 new Linux/Windows analytics, and expands 67 existing detections. • New Analytic Story: Starland RAT Campaign (UAT-11795) — tags analytics across PowerShell abuse, ClickFix social engineering, in-memory execution, credential theft, and Telegram-based C2 for end-to-end campaign visibility. • New detection: Linux AppArmor Bypass Via Aaexec — covers attempts to evade AppArmor confinement using aaexec. • New detection: Linux Auditd Possible Setuid Execve Privesc — identifies local privilege escalation attempts via setuid execve patterns on Linux. • New detection: Linux Pedit Offset Out Of Bounds — detects kernel-level exploitation technique targeting pedit. • New detection: Windows AppCertDLL Modification Via Registry — covers persistence via AppCertDLL registry manipulation. • Expanded coverage across 67 updated analytics spanning Cisco NVM, ransomware extensions/notes, PowerShell abuse, RDP cache forensics, MSI abuse, Kerberos, LLM framework detection, and more. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v6.2.0 https://github.com/splunk/security_content/releases/tag/v6.2.0 Mon, 13 Jul 2026 18:07:21 GMT Splunk Security Content v6.2.0 adds 10 new detections spanning Linux Dirty Frag, Phantom Stealer, AWS Bedrock Claude AI abuse, and browser process injection. • New detection: Linux Dirty Frag Kernel Privilege Escalation (CVE-2026-43284 & CVE-2026-43500) — identifies high-frequency splice() syscall activity followed by setuid binary execution within the same audit session. • New analytic story: Phantom Stealer — expands Windows infostealer coverage with a new detection for unauthorized WinSCP security configuration folder access, plus enhanced tagging of existing analytics for credential theft, PowerShell abuse, process injection, and data exfiltration. • New detection: Windows Uncommon Remote Thread Creation In Browser Process — strengthens visibility into CreateRemoteThread-based process injection targeting browser processes using native Sysmon Event ID 8 field mappings. • New analytic story: Suspicious AWS Bedrock Claude Activities — introduces 7 new detections covering cross-region inference abuse, excessive token consumption, high-risk filesystem/exec tool invocation, hostile prompt sentiment, prompt injection, sensitive data in prompts, and unusually large prompt submissions. • Updated PowerShell ScriptBlock analytics to omit oversized ScriptBlockText fields from finding messages and convert detections to Anomaly type for clearer triage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v6.1.0 https://github.com/splunk/security_content/releases/tag/v6.1.0 Wed, 17 Jun 2026 18:29:51 GMT Splunk Security Content v6.1.0 adds 34 new detections across Cisco IOS XE, SD-WAN, Linux, BlueHammer/RedSun, PTC Windchill, and more. • Adds two new Cisco Secure Access detections: 'Cisco SA - Access to Anonymizer Services' and 'Cisco SA - Automated Web Reconnaissance via HTTP Access Errors' to identify evasion and large-scale web reconnaissance via abnormal HTTP error patterns. • Introduces BlueHammer and RedSun analytic stories with detections covering suspicious Microsoft Defender engine/signature update activity, unauthorized Defender file modifications, non-administrative password changes, abnormal password reset bursts, and processes interacting with Defender update components. • Adds support for Windows Security Event ID 4723 (password change attempts) to improve visibility into credential theft and privilege escalation tradecraft. • Expands Linux detection coverage for Copy Fail (CVE-2026-31431) with analytics targeting malformed authentication entries, PF_ALG registration outside normal boot windows, suspicious namespace creation, and process execution with null argv values. • Introduces a new Linux kern.log telemetry data source for deeper visibility into low-level system activity and Linux exploitation techniques. • Adds nine new Cisco IOS XE detections covering Salt Typhoon-style activity: Guestshell activation/destruction, log clearing sequences, VTY access control tampering, tunnel interface creation, WebUI abuse, remote access probe bursts, reconnaissance commands, and platform package shell interactions. • Adds two new Cisco SD-WAN analytics to detect multiple source IPs authenticating to vManage via SSH and repeated SSH key-based authentications from a single source. • Introduces a new PTC Windchill Exploitation analytic story with detections for gateway command execution and GW READY/OK probing activity, plus a new Windchill Log4j data source and supporting macro. • Adds new analytic stories for RoguePlanet and Salat Stealer. • Adds Windows FFmpeg audio/video device discovery and DirectShow video capture detections to identify potential surveillance or data exfiltration activity. • Adds Windows Cloud Files Filter detections for files loaded by uncommon processes or logs created by non-system processes. • Introduces 'Splunk Secure Application Alerts for Runtime Security' detection for runtime-level visibility. Breaking changes: • The detections 'Attempt To Add Certificate To Untrusted Store', 'CHCP Command Execution', 'Ivanti Sentry Authentication Bypass', 'Processes launching netsh', and 'Sc exe Manipulating Windows Services' have been permanently removed in v6.1.0; any alerts, correlation searches, or workflows depending on them will stop functioning. • 'PowerShell - Connect To Internet With Hidden Window' and 'Regsvr32 with Known Silent Switch Cmdline' are deprecated and scheduled for removal in v6.4.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v6.1.0 https://github.com/splunk/security_content/releases/tag/v6.1.0 Wed, 17 Jun 2026 18:29:51 GMT v6.1.0 adds 34 new detections and 5 analytic stories covering Cisco IOS XE, SD-WAN, Linux kernel abuse, BlueHammer/RedSun, and PTC Windchill exploitation. • Adds two Cisco Secure Access detections identifying outbound access to anonymizer/privacy services and automated web reconnaissance via abnormal HTTP error patterns. • Adds new analytic stories and detections for BlueHammer and RedSun exploit families targeting Microsoft Defender for privilege escalation and credential access, including suspicious Defender engine/signature updates, unauthorized file modifications, non-admin password changes, and abnormal password reset bursts. • Introduces support for Windows Security Event ID 4723 (password change attempts) to improve visibility into credential theft and privilege escalation tradecraft. • Expands Linux detection coverage for CVE-2026-31431 (Copy Fail) with new analytics targeting malformed authentication entries, PF_ALG registration outside boot windows, suspicious namespace creation, and process execution with null argv values. • Introduces a new Linux kern.log data source, providing deeper visibility into low-level system activity and emerging Linux kernel exploitation techniques. • Adds nine Cisco IOS XE detections covering Salt Typhoon-style tradecraft: Guestshell activation/destruction, log clearing, VTY access control tampering, tunnel interface creation, WebUI abuse, remote access probe bursts, reconnaissance command activity, and platform package shell interactions. • Adds two Cisco SD-WAN analytics detecting multiple source IPs authenticating to vManage via SSH and repeated SSH key-based authentications from a single source, targeting credential sharing and distributed brute-force against SD-WAN management. • Introduces a new PTC Windchill Exploitation analytic story with detections for gateway command execution and GW READY/OK probing, plus a new Windchill Log4j data source and supporting macro. • Adds new analytic stories for RoguePlanet and Salat Stealer. • Breaking change: removes five detections (Attempt To Add Certificate To Untrusted Store, CHCP Command Execution, Ivanti Sentry Authentication Bypass, Processes launching netsh, Sc exe Manipulating Windows Services) — users should review the official removed-detections list and transition where applicable. • Schedules two additional detections for removal in v6.4.0: PowerShell - Connect To Internet With Hidden Window and Regsvr32 with Known Silent Switch Cmdline (replaced by Regsvr32 Silent and Install Param Dll Loading). Breaking changes: • The detections `Attempt To Add Certificate To Untrusted Store`, `CHCP Command Execution`, `Ivanti Sentry Authentication Bypass`, `Processes launching netsh`, and `Sc exe Manipulating Windows Services` have been permanently removed in v6.1.0 with no replacement content; any alerting or workflows depending on these detections will stop functioning after upgrading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v6.0.0 https://github.com/splunk/security_content/releases/tag/v6.0.0 Mon, 01 Jun 2026 19:37:18 GMT ESCU 6.0.0 expands Finding support with entity-tagged scores and adds creation/modification date clarity across all content. • Detections now create Findings with appropriately tagged entities and real risk scores instead of generic 0-score 'N/A' entity Findings, aligning with Enterprise Security v8.x+ Finding behavior. • Detections, Analytic Stories, and related content now expose both creation date and modification date, making content age and recency visible wherever content is viewed. • Transitions tooling from contentctl to Detection Studio as the officially supported content-development capability going forward. Breaking changes: • Five detections (CHCP Command Execution, Sc exe Manipulating Windows Services, Processes launching netsh, Ivanti Sentry Authentication Bypass, Attempt To Add Certificate To Untrusted Store) are scheduled for removal in v6.1.0 with no replacement detections available; any correlation searches or use cases depending on them will stop firing after that upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.27.0 https://github.com/splunk/security_content/releases/tag/v5.27.0 Wed, 06 May 2026 17:39:31 GMT Splunk Security Content v5.27.0 adds 67 new detections spanning Linux CVE-2026-31431, Cisco Secure Access firewall telemetry, and broad Windows attack-lifecycle coverage. • New detection: Linux Auditd Copy Fail Privilege Escalation (CVE-2026-31431) uses auditd telemetry to catch unprivileged writes to file page cache targeting setuid binaries. • New analytic story: Cisco Secure Access Analytics enables firewall-telemetry-based detection of suspicious access patterns via cloud-delivered security controls. • Extends existing detections (Large ICMP Traffic, Outbound SMB Traffic, Outbound LDAP Traffic, Windows RDP Network Brute Force Attempts) to operate with Cisco Secure Access Firewall data. • New analytic story: VIP Keylogger targets .NET-based infostealers with behavioral detections for stealthy execution and persistence. • New detection: PowerShell Environment Variable Execution surfaces encoded payload staging used in phishing-delivered stealer campaigns. • New detection: Windows Anomalous Registry Value Length in Environment Key identifies oversized registry values used for payload staging. • New detection: PowerShell PInvoke Process Injection API Chain catches in-memory process injection via P/Invoke API sequences. • New detection: Windows Proxy Execution of .NET Utilities via Scripts detects script-driven LOLBin abuse of trusted .NET binaries. • New detections for Cobalt Strike: Windows Cobalt Strike PowerShell Loader and Windows Default Cobalt Strike PowerShell Beacon. • New detections for C2 frameworks: Windows NorthStar C2 Agent Execution and Windows Metasploit Confluence Plugin Execution. • New detections for Cloudflared tunnels: Windows Potential Cloudflared Network Connection and Windows Potential Cloudflared Tunnel Execution. • New detections for EDR evasion: Windows EDRSilencer Execution, Windows Filtering Platform Policy Added to Block EDR Process, and Windows CrowdStrike Agent Registry Key Removal. • New EFI/bootkit detections: Windows EFI Bootloader File Modification, Windows EFI Volume Mount Attempt Via Mountvol, and Windows Suspicious File in EFI Volume. • New detection: Windows LAPS Password Gathering Via PowerShell Script for credential access via LAPS harvesting. • New detections for RMM tool abuse: Windows RMM Tool Execution, Windows Level RMM PowerShell Script Installer, and Windows Level RMM Watchdog Task Created. • New detections for privilege escalation: Windows Potato Privilege Escalation Tool Execution and Windows Privilege Escalation Attempt Via MSI Rollback. • New detection: Windows Scheduled Task Created in a Group Policy Object for GPO-based persistence. • New detection: Windows Downdate Registry Activity for downgrade attack tradecraft. • New detection: Windows Devtunnels Execution and Windows Devtunnels Image Loaded for Microsoft Dev Tunnels abuse. • New detection: Windows Process Accessing Windows Recall Directory for access to AI-feature sensitive data. • New detection: Windows Computer Account Changed to Domain Controller for DCSync/DCShadow-style attacks. • New detection: Windows SoftEther VPN Masquerading as Legitimate Binary for VPN-based evasion. • New detection: Windows Suspicious QEMU Execution for hypervisor-based evasion techniques. • New detection: Windows Mustang Panda USB Tool Execution for APT USB-based lateral movement. • New detection: Windows TeamCity Plugin Installed and Windows TeamCity Payload Execution from Temp Directory for supply chain tooling abuse. • All detections updated to align with MITRE ATT&CK v19 technique IDs for improved threat coverage mapping. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.26.0 https://github.com/splunk/security_content/releases/tag/v5.26.0 Wed, 22 Apr 2026 20:58:51 GMT Splunk Security Content v5.26.0 adds 11 new macOS detections across 3 new analytic stories plus Axios supply chain and Microsoft Intune coverage. • New analytic story: MacOS Persistence Techniques — covers LoginHook persistence, kextload abuse, and hidden files/directories. • New analytic story: MacOS Post-Exploitation — covers log removal, data chunking, network share discovery, and firewall rule enumeration. • New analytic story: MacOS Privilege Escalation — covers Gatekeeper bypass and keychain dumping. • New analytic story: Axios Supply Chain Post Compromise — tags existing analytics to detect post-installation script execution, credential access, exfiltration, and persistence in JavaScript/Node.js supply chain attacks. • New detection: MacOS Account Created — visibility into account creation activity on Apple endpoints. • New detection: MacOS Data Chunking — identifies attacker data-staging behavior on macOS. • New detection: MacOS Gatekeeper Bypass — detects attempts to circumvent macOS code-signing controls. • New detection: MacOS Hidden Files and Directories — surfaces use of hidden filesystem artifacts. • New detection: MacOS Kextload Usage — monitors abuse of kernel extension loading. • New detection: MacOS Keychains Dumped — detects credential harvesting from macOS keychain. • New detection: MacOS List Firewall Rules — identifies enumeration of macOS firewall configuration. • New detection: MacOS Log Removal — detects clearing of logs to cover attacker tracks. • New detection: MacOS LoginHook Persistence — monitors use of LoginHook mechanism for persistence. • New detection: MacOS Network Share Discovery — surfaces network share enumeration on macOS. • New detection: Microsoft Intune Bulk Wipe — detects mass device wipe actions in Microsoft Intune cloud environments. Breaking changes: • Several detections previously deprecated in ESCU v5.24.0 have now been removed in v5.26.0; users must transition to recommended replacements (see the List of Removed Detections in Splunk documentation). • A new set of detections has been deprecated in v5.26.0 and are scheduled for removal in ESCU v6.1.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.25.1 https://github.com/splunk/security_content/releases/tag/v5.25.1 Wed, 15 Apr 2026 21:06:08 GMT ESCU v5.25.1 patches ESCU 5.25.0 release notes including two new analytic stories and detections • Adds the `Gh0st RAT` analytic story to group multiple existing analytics related to service creation, registry persistence, command-line execution, and system discovery behaviors alongside new detections. • Adds the `Void Manticore` analytic story to group analytics aligned to data destruction, shadow copy deletion, backup recovery tampering, and suspicious script execution behaviors. • Adds detection for Windows Routing and Remote Access Service Registry Key Change to identify persistence via registry modifications. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.24.0 https://github.com/splunk/security_content/releases/tag/v5.24.0 Wed, 18 Mar 2026 21:20:08 GMT Splunk Security Content v5.24.0 adds 14 new detections covering Cisco SD-WAN exploitation, BlankGrabber stealer, and Lotus Blossom APT, plus 4 new analytic stories. • Adds detections for Cisco SD-WAN arbitrary file overwrite exploitation activity and uncommon user-agent multi-URI HTTP patterns targeting SD-WAN infrastructure. • Introduces BlankGrabber stealer coverage with new analytics for browser data access, suspicious registry queries, WMI reconnaissance, and PowerShell exclusion tampering. • Adds Lotus Blossom (Chrysalis Backdoor) detections including Bitdefender DLL sideloading abuse, BluetoothService-based persistence, and TinyCC shellcode execution tied to the Notepad++ supply chain compromise. • New detection: Windows Bluetooth Service Installed From Uncommon Location — catches persistence via BluetoothService abuse. • New detection: Windows TinyCC Shellcode Execution — identifies staged shellcode delivery associated with Lotus Blossom intrusion chains. • New detection: Windows Excel Spawning Microsoft Project Application — flags suspicious parent-child process chains indicative of phishing-delivered payloads. • New detection: Linux Docker Root Directory Mount — identifies container escape attempts via host root filesystem mounting. • New detection: Linux Docker Shell Execution — detects interactive shell spawning inside Docker containers. • New detection: Linux Auditd AI CLI Permission Override Activated — covers privilege escalation via AI CLI permission manipulation. • New detection: Windows MpCmdRun RemoveDefinitions Execution — catches Windows Defender definition removal as a defense evasion technique. • New detection: Windows WMI Reconnaissance Class Query — surfaces WMI-based system enumeration consistent with stealer and APT post-compromise behavior. • New detection: Windows Hosts File Access — detects suspicious reads of the hosts file used for C2 redirection or lateral movement staging. • New detection: Windows Product Key Registry Query — identifies registry-based system fingerprinting associated with BlankGrabber and similar stealers. • New detection: Windows WinRAR Launched Outside Default Installation Directory — flags portable or dropped WinRAR used for data staging and exfiltration. • New detection: Windows Rundll32 Execution With Log.DLL — identifies abuse of log.dll via rundll32 for stealthy code execution. • Introduces 4 new analytic stories: BlankGrabber Stealer, Lotus Blossom Chrysalis Backdoor, MuddyWater, and QuietVault. • Standardizes risk scoring across all analytics: 50 for TTP detections and 20 for anomaly-based detections to improve alert prioritization and triage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.23.0 https://github.com/splunk/security_content/releases/tag/v5.23.0 Wed, 04 Mar 2026 19:11:12 GMT Splunk Security Content v5.23.0 adds a Cisco Catalyst SD-WAN analytic story with three new detections for rogue peers and abnormal peering. • New analytic story: Cisco Catalyst SD-WAN Analytics — covers anomalous control-plane relationships across vManage, vSmart, and edge devices using control-connection telemetry. • New detection: Cisco SD-WAN – Low Frequency Rogue Peer — identifies rare or unexpected peer interactions that may indicate unauthorized infrastructure or adversary presence in SD-WAN environments. • New detection: Cisco SD-WAN – Peering Activity — surfaces abnormal peering patterns deviating from established network baselines. • New detection: Curl Execution with Percent Encoded URL — detects endpoint activity where curl is invoked with percent-encoded URLs, a technique used to evade URL-based controls. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.22.0 https://github.com/splunk/security_content/releases/tag/v5.22.0 Thu, 19 Feb 2026 18:58:12 GMT Splunk Security Content v5.22.0 adds 5 MCP abuse detections, a new MCP TA, and 5 new analytic stories including DynoWiper, ZOVWiper, and SolarWinds WHD RCE. • New analytic story 'Suspicious MCP Activities' detects abuse of Model Context Protocol server deployments for data exfiltration, privilege escalation, lateral movement, and persistence. • New MCP Technology Add-on (TA) for parsing MCP server telemetry to support MCP-related detections. • New detection: MCP Sensitive System File Search — identifies malicious file searches via MCP filesystem integrations. • New detection: MCP Prompt Injection — detects prompt injection attacks targeting MCP-connected AI tooling. • New detection: MCP Postgres Suspicious Query — flags abnormal database queries issued through MCP Postgres integrations. • New detection: MCP GitHub Suspicious Operation — surfaces suspicious GitHub API operations invoked via MCP. • New detection: MCP Filesystem Server Suspicious Extension Write — catches suspicious file extension writes through MCP filesystem servers. • New detection: Windows Execution of Microsoft MSC File In Suspicious Path — detects MSC file execution from non-standard locations. • New detection: Windows MMC Loaded Script Engine DLL — identifies script engine DLLs loaded by MMC, associated with XML Runner Loader tradecraft. • New analytic story 'DynoWiper' maps Sandworm destructive wiper behaviors including file-overwrite, drive enumeration, and pre-reboot execution. • New analytic story 'ZOVWiper' expands coverage for the ZOVWiper destructive malware family attributed to Sandworm. • New analytic story 'SolarWinds WHD RCE Post Exploitation' (CVE-2025-26399) tracks post-exploitation activity including process spawning, privilege escalation, and C2 behavior from compromised Web Help Desk services. • New analytic story 'XML Runner Loader' provides detection coverage for this loader technique. • Updated CrowdStrike Falcon Stream Alerts detection with community-contributed improvements. Breaking changes: • The 'Cobalt Strike Named Pipes' detection has been removed; users must transition to 'Windows Suspicious C2 Named Pipe'. • The 'HTTP Suspicious Tool User Agent' detection has been removed; users must transition to 'HTTP Scripting Tool User Agent'. • A new set of detections has been deprecated and are scheduled for removal in ESCU v5.24.0; see the List of Detections Scheduled for Removal for details. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.21.0 https://github.com/splunk/security_content/releases/tag/v5.21.0 Thu, 05 Feb 2026 22:37:32 GMT Splunk Security Content v5.21.0 adds Finding-Based Detections, CVE-2026-24061 telnet coverage, Chromium hijacking analytics, and VoidLink/Storm-0501/StealC threat actor stories. • Introduces Finding-Based Detections (requires ES 8.4+) — a new analytic type that automatically groups and correlates high volumes of related findings at the entity level to reduce alert noise and surface high-risk users or hosts. • Adds new analytic story and detection 'Linux Telnet Authentication Bypass' covering CVE-2026-24061, a critical authentication bypass in GNU InetUtils telnetd allowing unauthenticated root sessions via an unsanitized USER environment variable. • Adds new endpoint detections for Windows Chromium browser hijacking, identifying browsers launched with abnormally small window sizes, disabled popup blocking, disabled logging, suppressed extensions, and headless execution — behaviors tied to ad fraud, credential harvesting, and post-exploitation frameworks. • Adds new analytic story 'VoidLink Cloud-Native Linux Malware' covering a modular C2 framework with rootkit functionality targeting containerized and cloud environments. • Adds new analytic story 'Storm-0501 Ransomware' improving visibility into ransomware execution chains and post-compromise persistence. • Adds new analytic story 'StealC Stealer' improving detection of credential theft, downloader behavior, and post-compromise activity. Breaking changes: • The 'Process Creating LNK file in Suspicious Location' detection no longer creates notable alerts/findings on upgrade — it will only create risk events (intermediate findings). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.20.0 https://github.com/splunk/security_content/releases/tag/v5.20.0 Tue, 20 Jan 2026 21:07:24 GMT v5.20.0 adds 25 new detections across browser hijacking, Kubernetes eBPF telemetry, suspicious user agents, AI-abusing malware, and Cisco edge device threats. • Adds 5 new Analytic Stories: Browser Hijacking, Cisco Isovalent Suspicious Activity, PromptFlux, SesameOp, and Suspicious User Agents. • New browser hijacking detections identify Chrome auto-update disabling, unauthorized extension allowlisting and force-loading, and command-line flag abuse for persistence. • New Cisco Isovalent detections leverage kernel-level eBPF telemetry to surface container escapes, offensive tooling in pods, anomalous kprobe activity, cloud metadata access, and suspicious shell/network behavior in Kubernetes environments. • New HTTP user agent detections identify suspicious strings tied to C2 frameworks, malware, RMM tools, PUAs, and scripting tools blending into normal HTTP traffic. • New detections for SesameOp and PromptFlux cover AI API abuse as C2 channels and introduce coverage for Windows Potential AppDomainManager Hijack Artifacts Creation. • New Cisco IOS and Cisco Secure Firewall detections cover privileged HTTP command execution, SSH connections to non-standard ports, and SSH connections to sshd_operns, correlated via risk-based searches for privileged account creation. Breaking changes: • The `Windows Default RDP File Creation` detection is removed; replace with `Windows Default RDP File Creation By Non MSTSC Process`. • The `Windows Java Spawning Shells` detection is removed; replace with `Web or Application Server Spawning a Shell`. • The `Linux Java Spawning Shell` detection is removed; replace with `Web or Application Server Spawning a Shell`. • The `W3WP Spawning Shell` detection is removed; replace with `Web or Application Server Spawning a Shell`. • The `Wget Download and Bash Execution` detection is removed; replace with `File Download or Read to Pipe Execution`. • The `Curl Download and Bash Execution` detection is removed; replace with `File Download or Read to Pipe Execution`. • The `Wmiprsve LOLBAS Execution Process Spawn` detection is removed; replace with `Wmiprvse LOLBAS Execution Process Spawn`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.19.0 https://github.com/splunk/security_content/releases/tag/v5.19.0 Wed, 10 Dec 2025 19:41:28 GMT Splunk Security Content v5.19.0 adds 6 new analytic stories and 31 detections spanning React RCE, Tuoni C2, Kerberos DNS coercion, npm supply chain, Shadow AI, and Cisco ASA abuse. • New React2Shell analytic story (CVE-2025-55182) with detections for suspicious Node.js/React/Next.js child processes on Windows and Linux, plus a network-layer detection via Cisco Secure Firewall Threat Defense Intrusion Events for pre-auth RCE attempts. • New Tuoni C2 Framework analytic story with detections targeting memory-based execution patterns, suspicious process behaviors, and C2 communication indicators across Windows, Linux, and macOS. • New Kerberos Coercion with DNS analytic story (CVE-2025-33073) covering DNS-triggered Kerberos authentication abuse, including detections for short-lived DNS records, DNS-based coercion, and credential target information structures in command lines. • New NPM Supply Chain Compromise analytic story detecting malicious lifecycle hook abuse (preinstall/install/postinstall/prepare), GitHub workflow tampering, credential theft, and Shai-Hulud 2.0 worm campaign exfiltration artifacts. • New NetSupport RMM Tool Abuse analytic story with analytics identifying NetSupport via loaded DLL patterns, executable masquerading, named pipe activity, and registry manipulation to distinguish unauthorized intrusions from legitimate IT use. • New Suspicious Local LLM Frameworks (Shadow AI) analytic story with detections for unauthorized Ollama, LM Studio, GPT4All, Jan, llama.cpp, and KoboldCPP deployments via model file downloads (.gguf, .ggml, safetensors), process execution, and DNS lookups to model repositories. • Expanded Cisco ASA detection coverage with 11 new analytics covering AAA policy tampering, logging filter and message suppression, packet capture activation, device file copy, local user account creation/deletion, privilege level changes, lockout threshold anomalies, and reconnaissance commands. • Added 4 new named-pipe lookups: `pua_named_pipes`, `suspicious_c2_named_pipes`, `suspicious_named_pipes`, and `suspicious_rmm_named_pipes` to support new Windows named-pipe detections. • Added new `executable_extensions` macro and updated `cisco_snort_ids_to_threat_mapping` lookup to support expanded detection logic. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.18.0 https://github.com/splunk/security_content/releases/tag/v5.18.0 Wed, 12 Nov 2025 20:15:32 GMT Splunk Security Content v5.18.0 adds Castle RAT analytic story and 3 new endpoint detections for UAC bypass and browser abuse. • New analytic story: Castle RAT — covers command execution, file exfiltration, keylogging, and screen capture TTPs used in targeted intrusion campaigns. • New detection: Windows Browser Process Launched with Unusual Flags — improves visibility into browser abuse within Castle RAT infection chains. • New detection: Windows ComputerDefaults Spawning a Process — detects ComputerDefaults-based UAC bypass technique. • New detection: Windows Handle Duplication in Known UAC-Bypass Binaries — identifies handle duplication abuse in known bypass binaries for privilege escalation detection. • Enhanced research.splunk.com detection entries now include attack data, MITRE ATT&CK techniques, simulation environment details, attack timestamps, tools used, and step-by-step replay instructions. Breaking changes: • Several detections previously deprecated in ESCU v5.16.0 have been removed in v5.18.0: `Windows Change Default File Association For No File Ext`, `Detect Rundll32 Application Control Bypass - setupapi`, `Detect Rundll32 Application Control Bypass - syssetup`, and `Detect Rundll32 Application Control Bypass - advpack`. Users must transition to their listed replacement detections. • A new set of detections has been deprecated and is scheduled for removal in ESCU v5.20.0; see the official List of Detections Scheduled for Removal for details. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.17.0 https://github.com/splunk/security_content/releases/tag/v5.17.0 Thu, 30 Oct 2025 16:37:22 GMT Splunk Security Content v5.17.0 adds 5 new analytic stories and 18 new detections covering WSUS RCE, HTTP smuggling, Oracle EBS, and ransomware groups. • New analytic story: Microsoft WSUS CVE-2025-59287, covering unauthenticated RCE via WSUS deserialization, with a new *Windows WSUS Spawning Shell* detection for post-exploitation shell activity. • New analytic story: HTTP Request Smuggling, with five new detections — *HTTP Suspicious Tool User Agent*, *HTTP Request to Reserved Name on IIS Server*, *HTTP Rapid POST with Mixed Status Codes*, *HTTP Possible Request Smuggling*, and *HTTP Duplicated Header* — targeting CL.TE, TE.TE, and CL.0 abuse patterns. • New analytic story: Oracle E-Business Suite Exploitation (Cisco Talos collaboration), with Snort-based detections for anomalous web requests, payload delivery, and lateral movement against enterprise ERP systems. • New analytic story: Scattered Lapsus$ Hunters, covering TTPs for Scattered Spider, Lapsus$, and Shiny Hunters — including MFA bypass, credential theft, remote access tool abuse, PowerShell infection chains, and SSH persistence. • New analytic story: Hellcat Ransomware, tagging TTPs for this RaaS group targeting critical infrastructure, telecom, and government sectors. • New detection: *Windows Defender ASR or Threat Configuration Tamper* for identifying tampering with Defender Attack Surface Reduction rules. • New detection: *Windows Default RDP File Creation By Non MSTSC Process* to flag suspicious RDP file creation outside of the standard MSTSC process. • New detection: *Windows Process Execution From RDP Share* for identifying process launches originating from RDP-mapped shares. • New detection: *Windows WBAdmin File Recovery From Backup* to detect abuse of the wbadmin utility for file recovery from backups. • New detection: *Wmiprvse LOLBAS Execution Process Spawn* for identifying LOLBAS child process spawning via WMI provider host. • New detection: *Advanced IP or Port Scanner Execution* for identifying reconnaissance tool usage. • New detection: *File Download or Read to Pipe Execution* for detecting piped file download-to-execution patterns. • New detection: *Windows NirSoft Tool Bundle File Created* for flagging creation of NirSoft credential and forensics tool bundles. • New detection: *Windows PowerShell Process Implementing Manual Base64 Decoder* for identifying custom base64 decoding in PowerShell execution chains. • New detection: *Windows PsTools Recon Usage* for detecting reconnaissance activity via PsTools utilities. • New Cisco Secure Firewall detections: *Oracle E-Business Suite Correlation* and *Oracle E-Business Suite Exploitation* for network-layer ERP attack visibility. Breaking changes: • The detection `Windows Change Default File Association For No File Ext` is deprecated and scheduled for removal in v5.20.0; replace with `Windows Change File Association Command To Notepad`. • The detection `Detect Rundll32 Application Control Bypass - setupapi` is deprecated and scheduled for removal in v5.20.0; replace with `Windows Application Whitelisting Bypass Attempt via Rundll32`. • The detection `Detect Rundll32 Application Control Bypass - syssetup` is deprecated and scheduled for removal in v5.20.0; replace with `Windows Application Whitelisting Bypass Attempt via Rundll32`. • The detection `Detect Rundll32 Application Control Bypass - advpack` is deprecated and scheduled for removal in v5.20.0; replace with `Windows Application Whitelisting Bypass Attempt via Rundll32`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.16.0 https://github.com/splunk/security_content/releases/tag/v5.16.0 Wed, 15 Oct 2025 17:29:13 GMT Splunk Security Content v5.16.0 adds 6 new analytic stories and 19 new detections covering Ollama LLM abuse, M365 Copilot risks, PromptLock GenAI ransomware, LokiBot, and APT37. • New 'Suspicious Ollama Activities' analytic story with 8 detections covering abnormal network connectivity, API endpoint scanning, memory exhaustion, model exfiltration, RCE via model loading, excessive API requests, service crash attacks, and prompt injection/jailbreak against locally hosted LLMs. • New 'Suspicious Microsoft 365 Copilot Activities' analytic story with 4 detections: usage pattern anomalies, failed authentication patterns, non-compliant device access, and session origin anomalies for enterprise AI assistant risk. • New 'PromptLock' analytic story targeting the first known GenAI-driven ransomware PoC, with detections focused on anomalous AI invocation patterns, file encryption activity, and local LLM API (Ollama/gpt-oss:20b) abuse for malicious automation. • New 'Lokibot' analytic story with added 'Windows Visual Basic Commandline Compiler DNSQuery' detection for suspicious DNS communications and credential-stealing exfiltration. • New 'APT37 Rustonotto and FadeStealer' analytic story including a detection for Windows Cabinet file extraction via Expand, targeting phishing-based infections and data exfiltration. • New 'GhostRedirector IIS Module and Rungan Backdoor' analytic story covering malicious IIS module abuse, SQL injection, and stealthy PowerShell for server compromise and web traffic manipulation. • New endpoint detections added: Web or Application Server Spawning a Shell, Windows Application Whitelisting Bypass via Rundll32, Windows Change File Association Command To Notepad, Windows Set Network Profile Category to Private via Registry, Windows Symlink Evaluation Change via Fsutil. Breaking changes: • The notable alert actions are removed from 'Attempt To Add Certificate To Untrusted Store', 'Windows Archived Collected Data In TEMP Folder', 'Windows Rundll32 Apply User Settings Changes', and 'Windows Scheduled Task Created Via XML' — these detections will no longer create notable/findings and will only create risk events. • The notable alert action is added to 'Windows Certutil Root Certificate Addition' — this detection will now create notable/findings in addition to risk events. • Several detections previously deprecated in ESCU v5.14.0 have been removed in v5.16.0; users must transition to recommended replacements. See the List of Removed Detections for the full inventory. • A new set of detections has been deprecated and are scheduled for removal in ESCU v5.18.0; see the List of Detections Scheduled for Removal. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.15.2 https://github.com/splunk/security_content/releases/tag/v5.15.2 Fri, 26 Sep 2025 17:30:13 GMT Splunk ESCU v5.15.2 adds a new Suspicious Cisco ASA analytic story and links existing detections to it. • New analytic story: Suspicious Cisco Adaptive Security Appliance Activity groups Cisco ASA-focused detections for targeted threat hunting. • Tags the existing 'Cisco ASA - Logging Disabled via CLI' detection to the new Suspicious Cisco ASA story. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.15.0 https://github.com/splunk/security_content/releases/tag/v5.15.0 Thu, 25 Sep 2025 19:01:37 GMT Splunk Security Content v5.15.0 adds the ArcaneDoor analytic story with two new Cisco ASA detections for state-sponsored zero-day activity. • New ArcaneDoor analytic story covering state-sponsored exploitation of Cisco ASA/Firewall zero-days (CVE-2025-20333 & CVE-2025-20362). • New detection: 'Cisco ASA - Core Syslog Message Volume Drop' to identify abnormal reductions in syslog output that may indicate log suppression. • New detection: 'Cisco ASA - Logging Disabled via CLI' to catch attempts to disable logging on Cisco ASA devices. • Updated 'Cisco Secure Firewall - Intrusion Events by Threat Activity' lookup with the latest Snort IDs for improved ArcaneDoor threat coverage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.14.0 https://github.com/splunk/security_content/releases/tag/v5.14.0 Wed, 17 Sep 2025 18:21:45 GMT Splunk Security Content v5.14.0 adds 19 new analytics and 5 analytic stories covering LAMEHUG, NotDoor, Secret Blizzard, ObjectivyStealer, and PathWiper. • New analytic story and detections for LAMEHUG malware, covering AI-driven command chain generation via Hugging Face API calls, systeminfo/net start/tasklist/dsquery execution, and recursive file copy into `%ProgramData%\info\`. • New analytic story for NotDoor malware (APT28/Fancy Bear Outlook macro backdoor), with detections for suspicious Outlook macro creation, `LoadMacroProviderOnBoot` persistence, and disabling of security dialogs. • New detections for Secret Blizzard TTP: `certutil.exe` root certificate installation from temp directories using `-addstore root`, `-f` (force), and `-Enterprise` flags. • New analytic story for 0bj3ctivity Stealer, tagging existing content to detect credential theft, session hijacking, and encrypted exfiltration targeting browsers, messaging apps, and cryptocurrency wallets. • New analytic story for PathWiper. • New detection: `Linux Magic SysRq Key Abuse` (community contribution). • New detection: `Windows AI Platform DNS Query` for identifying AI platform–related DNS activity. • New detection: `Windows DLL Module Loaded in Temp Dir` to catch DLL side-loading from temporary directories. • New detection: `Windows Excel ActiveMicrosoftApp Child Process` for suspicious Excel child process spawning. • New detection: `Windows File Collection Via Copy Utilities` targeting staged data collection behavior. • New detection: `Windows Net System Service Discovery` covering `net start` enumeration. • New detection: `Windows Set Private Network Profile via Registry` for network profile manipulation. • New detections for `Windows SpeechRuntime COM Hijacking DLL Load` and `Windows SpeechRuntime Suspicious Child Process`. • New WMIC-based discovery detections: CPU, DiskDrive, Memory Chip, Network, and Systeminfo enumeration via `wmic`. • New Outlook-specific detections: macro security modification (`Windows Outlook Macro Security Modified`) and dialogs disabled from unusual processes (`Windows Outlook Dialogs Disabled from Unusual Process`). Breaking changes: • Several detections previously deprecated in ESCU v5.12.0 have been removed in v5.14.0; users must transition to recommended replacements as listed in the official deprecated analytics documentation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.13.0 https://github.com/splunk/security_content/releases/tag/v5.13.0 Fri, 22 Aug 2025 18:54:15 GMT ESCU v5.13.0 adds 8 new Cisco IOS/IOS XE detections and an analytic story targeting CVE-2018-0171 exploitation by Russian APT Static Tundra. • New analytic story: Cisco Smart Install Remote Code Execution CVE-2018-0171, covering the full attack chain abused by Russian state-sponsored group Static Tundra against unpatched IOS/IOS XE devices. • New detection: Cisco Smart Install Port Discovery and Status — surfaces inbound Smart Install traffic on TCP/4786 using cisco:ios telemetry. • New detection: Cisco Smart Install Oversized Packet Detection — identifies anomalous SMI packet sizes associated with CVE-2018-0171 exploitation, derived from Cisco Talos PCAP patterns. • New detection: Cisco IOS Suspicious Privileged Account Creation — catches post-exploitation persistence via privileged account additions on IOS/IOS XE devices. • New detection: Cisco SNMP Community String Configuration Changes — detects adversary modification of SNMP community strings (as observed in Static Tundra tooling). • New detection: Cisco Network Interface Modifications — monitors for unauthorized interface-level changes used to establish persistent access. • New detection: Cisco Configuration Archive Logging Analysis — tracks configuration archival events that may indicate staged exfiltration or persistence. • New detection: Cisco TFTP Server Configuration for Data Exfiltration — identifies TFTP-based staging and exfiltration of device configurations. • New detection: Cisco Secure Firewall – Static Tundra Smart Install Abuse — provides Cisco Secure Firewall-specific mapping for unified triage of Smart Install exploitation activity. • Updated detection: Cisco Secure Firewall – Intrusion Events by Threat Activity, extended to incorporate Static Tundra campaign context. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.12.0 https://github.com/splunk/security_content/releases/tag/v5.12.0 Wed, 20 Aug 2025 20:49:00 GMT Splunk Security Content v5.12.0 adds 22 new detections and 3 analytic stories covering Medusa Rootkit, MSIX abuse, and RDP artifact evasion. • New analytic story: Medusa Rootkit (UNC3886) — covers stealthy Linux and Windows persistence malware used by the UNC3886 threat actor. • New detection: Linux GDrive Binary Activity — detects GDrive binary usage on Linux systems associated with Medusa Rootkit activity. • New detection: Linux Medusa Rootkit — identifies Medusa Rootkit indicators on Linux endpoints. • New detection: Windows GDrive Binary Activity — detects GDrive binary usage on Windows systems linked to UNC3886. • New detection: Windows Suspicious VMware Tools Child Process — surfaces anomalous child processes spawned from VMware Tools, a Medusa Rootkit persistence technique. • New analytic story: MSIX Package Abuse — covers abuse of Microsoft MSIX application packages using AppXDeploymentServer/Operational log telemetry. • New detection: Windows Advanced Installer MSIX with AI_STUBS Execution — detects suspicious MSIX packages built with Advanced Installer AI_STUBS. • New detection: Windows AppX Deployment Unsigned Package Installation — flags installation of unsigned MSIX packages. • New detection: Windows PowerShell MSIX Package Installation — detects PowerShell-driven MSIX package installs. • New detection: Windows PowerShell Script From WindowsApps Directory — identifies PowerShell scripts executing from the Windows Apps directory. • New detection: Windows MSIX Package Interaction — monitors interactions with Windows Apps directories for potential sideloading or malware delivery. • New detection: Windows Developer-Signed MSIX Package Installation — detects installation of developer-signed (non-store) MSIX packages. • New detection: Windows AppX Deployment Full Trust Package Installation — surfaces full-trust MSIX package installs that run with elevated permissions. • New detection: Windows AppX Deployment Package Installation Success — logs successful MSIX package deployment events for visibility. • New analytic story: Windows RDP Artifacts and Defense Evasion — covers RDP usage forensics and artifact cleanup techniques. • New detection: Windows Default RDP File Creation — detects creation of Default.rdp files that reveal targeted systems. • New detection: Windows Default RDP File Deletion — flags deletion of RDP files as a potential evasion action. • New detection: Windows Default RDP File Unhidden — identifies un-hiding of RDP files to expose evasion attempts. • New detection: Windows RDP Bitmap Cache File Creation — monitors creation of RDP bitmap cache files as forensic artifacts. • New detection: Windows RDP Cache File Deletion — detects deletion of RDP bitmap cache files indicating artifact cleanup. • New detection: Windows RDP Server Registry Entry Created — alerts on creation of RDP server registry entries. • New detection: Windows RDP Server Registry Deletion — flags removal of RDP server registry keys as an evasion technique. • New detection: Windows RDP Client Launched with Admin Session — detects RDP client invocations using administrative session parameters. • New detection: Windows RDP Login Session Was Established — provides visibility into RDP session establishment events. • New detection: Windows RDP AutomaticDestinations Deletion — detects deletion of RDP AutomaticDestinations jump list entries as artifact cleanup. • Updated analytic story: China-Nexus Threat Activity now maps additional existing detections to UNC3886 activity. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.11.0 https://github.com/splunk/security_content/releases/tag/v5.11.0 Wed, 06 Aug 2025 17:42:26 GMT Splunk Security Content v5.11.0 adds 4 new analytic stories and 2 new detections covering Interlock Ransomware, NaiLaoLocker, Interlock RAT, and Scattered Spider. • Adds Interlock Ransomware analytic story mapping detections to anomalous PowerShell/CMD processes spawned from Office apps and large-scale file renaming patterns, with updated ransomware extensions and notes lookup files. • Adds NaiLaoLocker Ransomware analytic story covering multi-threaded AES-256-CBC encryption with SM2 key wrapping via DLL side-loading and mutex creation behaviors. • Adds Interlock RAT analytic story surfacing indicators such as anomalous network beaconing, persistence artifacts, credential-theft behaviors, and fake browser-update installer activity. • Adds Scattered Spider analytic story covering SIM-swap attacks, MFA push-bombing, unauthorized remote-access tool execution (TeamViewer, AnyDesk, Ngrok), and cloud API abuse. • New detection: Splunk AppDynamics Secure Application Alerts integrates AppDynamics security alert telemetry into Splunk detections. • New detection: Windows Rundll32 Load DLL in Temp Dir identifies rundll32 loading DLLs from temporary directories, a common DLL side-loading and malware staging technique. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.10.0 https://github.com/splunk/security_content/releases/tag/v5.10.0 Wed, 23 Jul 2025 17:08:36 GMT Splunk Security Content v5.10.0 adds 5 new analytic stories and 45 new detections covering CitrixBleed 2, SharePoint RCE, ESXi post-compromise, Cisco Duo, and Quasar RAT. • New analytic story: Citrix NetScaler ADC and Gateway CVE-2025-5777 (CitrixBleed 2) — detects HTTP requests to the vulnerable /nf/auth/startwebview.do endpoint to identify scanning and exploitation of Citrix ADC/Gateway appliances. • New analytic story: Microsoft SharePoint Vulnerabilities — covers CVE-2025-53770 exploitation via ToolPane.aspx, GET requests to the spinstall0.aspx webshell, and webshell file creation events for both initial and post-exploitation detection. • New analytic story: ESXi Post Compromise — 24 new detections spanning VM bulk termination, reverse shells, SSH brute force, system clock manipulation, audit log wiping, unauthorized privilege elevation, and malicious VIB installations. • New analytic story: Cisco Duo Suspicious Activity — 14 new detections covering unusual admin logins by browser/OS/country, bypass code generation, and risky policy configurations such as skipping 2FA, allowing tampered devices, or permitting outdated Java/Flash. • New analytic story: Quasar RAT — maps 20+ existing detections to Quasar techniques and adds three new detections targeting FileZilla XML config access, IntelliForms registry entries, and Mozilla NSS library loading for stealthy credential harvesting. • New detection: Cisco Secure Firewall — Citrix NetScaler Memory Overread Attempt, enabling network-layer visibility into CitrixBleed 2 exploitation attempts. • New detections for Windows SharePoint: ToolPane Endpoint Exploitation Attempt, Spinstall0 GET Request, and Spinstall0 Webshell File Creation provide layered coverage of CVE-2025-53770 attack chains. • New ESXi detections include: Malicious VIB Forced Install, VIB Acceptance Level Tampering, ESXi Shell Access Enabled, Lockdown Mode Disabled, Firewall Disabled, and Loghost/Syslog Config Tampering for hardening and intrusion detection. • New credential-theft detections: Windows Unusual FileZilla XML Config Access, Windows Unusual Intelliform Storage Registry Access, and Windows Unusual Process Load Mozilla NSS-Mozglue Module target post-exploitation credential harvesting patterns. Breaking changes: • Several detections previously deprecated in ESCU v5.8.0 have been removed in v5.10.0; users must transition to recommended replacement detections before upgrading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.9.0 https://github.com/splunk/security_content/releases/tag/v5.9.0 Wed, 09 Jul 2025 17:00:30 GMT Splunk Security Content v5.9.0 adds 19 new detections across Cisco NVM, Disk Wiper, and Linux Auditd, plus 9 CrowdStrike SOAR playbooks. • New analytic story: Disk Wiper — detections targeting destructive malware that performs recursive file deletion and raw access to disk volumes and the primary boot record. • New detection: CrowdStrike Falcon Stream Alerts — ingests CrowdStrike Falcon streaming telemetry for endpoint detection. • New detections: Linux Auditd Daemon Abort, Shutdown, and Start — monitor auditd lifecycle events on Linux endpoints. • New detection: Windows File Download Via PowerShell — identifies file download activity initiated through PowerShell. • New lookup: suspicious_ports_list — supports detections flagging outbound connections to suspicious ports. • New lookup: typo_squatted_python_packages — backs detection of typosquatted Python package installations via Cisco NVM telemetry. • New CrowdStrike EDR Playbook Pack for Splunk SOAR — 9 playbooks enabling automated investigation and response via CrowdStrike Falcon OAuth API, covering device isolation, network restore, process termination, file collection/eviction/restore, executable denylisting, endpoint analysis, and device info retrieval. • New macro: cisco_network_visibility_module_flowdata — enables Cisco NVM-based analytics across the new detections. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.7.0 https://github.com/splunk/security_content/releases/tag/v5.7.0 Wed, 04 Jun 2025 19:52:42 GMT ESCU 5.7.0 adds a new Cisco FTD detection and extends eStreamer integration across 12 updated network analytics. • New detection: 'Cisco Secure Firewall - Remote Access Software Usage Traffic' identifies remote access tool traffic via Cisco FTD eStreamer data. • Adds lookup `cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools` for classifying remote management and desktop tool application IDs in Cisco FTD environments. • Updates lookups `cisco_secure_firewall_filetype_lookup` and `cisco_snort_ids_to_threat_mapping` with expanded coverage. • Extends Cisco Secure Firewall Threat Defense (FTD) eStreamer compatibility across 12 updated network and cloud detections, including port scan, TOR traffic, LDAP, and O365 analytics. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.6.0 https://github.com/splunk/security_content/releases/tag/v5.6.0 Wed, 21 May 2025 19:17:57 GMT Splunk Security Content v5.6.0 adds 8 new analytics including 6 Cisco Secure Firewall/Snort rules, Lumma Stealer and Veeam CVE-2023-27532 detections, and two new analytic stories. • Adds 'Cisco Secure Firewall - High Priority Intrusion Classification' analytic to surface high-priority intrusion events from Cisco Secure Firewall logs. • Adds 'Cisco Secure Firewall - Intrusion Events by Threat Activity' analytic to group firewall alerts by threat actor activity using Snort IDs. • Adds 'Cisco Secure Firewall - Lumma Stealer Activity', 'Lumma Stealer Download Attempt', and 'Lumma Stealer Outbound Connection Attempt' analytics to detect Lumma Stealer behaviors via Cisco Firewall intrusion logs. • Adds 'Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity' analytic that correlates specific Snort IDs triggered in a short window to identify exploitation attempts. • Adds 'Windows PowerShell FakeCAPTCHA Clipboard Execution' detection to identify Fake CAPTCHA campaign TTPs involving PowerShell clipboard abuse. • Adds 'Windows Renamed Powershell Execution' detection for identifying PowerShell executing under a renamed binary. • Introduces a new 'Threat Activity by Snort IDs' dashboard correlating Cisco Firewall eStreamer logs with a curated Snort-to-threat-actor lookup to visualize device activity, file trends, and host risk profiles in Splunk Enterprise Security. • Adds two new lookups — `cisco_snort_ids_to_threat_mapping` and `threat_snort_count` — mapping Snort intrusion IDs to specific threat actors. • Publishes two new analytic stories: 'Fake CAPTCHA Campaigns' and 'XWorm', providing structured detection coverage for each threat. Breaking changes: • Several detections previously announced for removal in ESCU v5.4.0 have been removed in v5.6.0; users must transition to recommended replacements (see the List of Removed Detections in ESCU v5.6.0). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.5.0 https://github.com/splunk/security_content/releases/tag/v5.5.0 Thu, 08 May 2025 17:38:13 GMT Splunk Security Content v5.5.0 adds 2 new analytic stories and 5 new detections covering SAP NetWeaver CVE-2025-31324, AMOS Stealer, and Windows post-compromise activity. • New analytic story: SAP NetWeaver Exploitation, targeting CVE-2025-31324 with the 'SAP NetWeaver Visual Composer Exploitation Attempt' hunting detection. • New analytic story: AMOS Stealer, including the 'MacOS AMOS Stealer - Virtual Machine Check Activity' detection that identifies suspicious `osascript` execution with specific command-line strings. • New detection: 'Windows EventLog Recon Activity Using Log Query Utilities' to surface adversary reconnaissance against the Windows Event Log. • New detection: 'Windows Eventlog Cleared Via Wevtutil' to alert when an adversary clears the Windows Event Log via Wevtutil. • New detection: 'Windows File Download Via CertUtil' to catch malicious file downloads executed through the CertUtil utility. • Updated `is_nirsoft_software` lookup with additional Nirsoft tooling entries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.4.0 https://github.com/splunk/security_content/releases/tag/v5.4.0 Wed, 23 Apr 2025 22:01:53 GMT Splunk Security Content v5.4.0 adds 27 new detections across Cisco Firewall, AWS Bedrock, and ransomware campaigns plus 6 new analytic stories. • New AWS Bedrock Security analytic story with detections for deletion of guardrails, knowledge bases, and logging configurations, plus high-volume model invocation failures. • New analytic stories mapping detections to Cactus Ransomware, Earth Alux, Storm-2460 CLFS Zero Day Exploitation, and Water Gamayun threat campaigns. • New detection for Windows MSC EvilTwin directory path manipulation technique. • New detection for IP address collection via PowerShell Invoke-RestMethod. • New detections for CrushFTP authentication bypass exploitation and shell process spawning from CrushFTP. • New detection for Volume Shadow Copy deletion via WMIC (anti-forensics). • Detections previously announced as removed in ESCU v5.2.0 are now formally removed; replacements are available in documentation. Breaking changes: • Detections previously announced for removal in ESCU v5.2.0 have been removed in this release — any workflows or alerts relying on those detections will stop functioning. Replacements are listed in the ESCU 5.4.0 deprecated analytics documentation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.3.0 https://github.com/splunk/security_content/releases/tag/v5.3.0 Wed, 09 Apr 2025 17:11:12 GMT Splunk Security Content v5.3.0 adds 8 new analytic stories and 15 new detections covering Apache Tomcat RCE, Windows LNK exploits, ransomware campaigns, and firewall rule monitoring. • New analytic story: Apache Tomcat Session Deserialization Attacks covering CVE-2025-24813 unauthenticated RCE via partial PUT, with detections for suspicious session deserialization attempts and file uploads. • New analytic story: ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day, covering LNK files with abnormal padding, SSH ProxyCommand abuse, and Windows Explorer spawning PowerShell or CMD. • New analytic stories for Medusa Ransomware, Termite Ransomware, VanHelsing Ransomware, Salt Typhoon, Seashell Blizzard, and PHP-CGI RCE Attack on Japanese Organizations. • New detections: Windows Firewall Rule Added, Windows Firewall Rule Deletion, and Windows Firewall Rule Modification to track unauthorized host-based firewall configuration changes. • New detection: Tomcat Session Deserialization Attempt to surface exploitation of Apache Tomcat servers. • New detection: Tomcat Session File Upload Attempt to identify attacker-staged file uploads on Tomcat. • New detection: Windows Explorer LNK Exploit Process Launch With Padding targeting zero-day LNK abuse patterns. • New detection: Windows Explorer.exe Spawning PowerShell or Cmd to catch stealthy initial access via LNK exploits. • New detection: Windows SSH Proxy Command to detect abuse of SSH ProxyCommand as a lateral movement or initial access technique. • New detection: Windows AD Self DACL Assignment to identify privilege escalation via Active Directory ACL manipulation. • New detection: Windows Process Injection into Commonly Abused Processes for detecting process injection TTPs. • New detection: Detect Large ICMP Traffic for identifying anomalous network covert channel or exfiltration activity. • New detections: Windows ConsoleHost History File Deletion and Windows Powershell History File Deletion to catch anti-forensic tampering. • New detection: Windows MSTSC RDP Commandline to monitor suspicious use of the built-in RDP client. • New detection: Windows Remote Host Computer Management Access for tracking lateral movement via remote management. • Standardized output fields across the majority of detections and added output_fields enforcement to data source objects, improving correlation and integration with Enterprise Security. • Updated ransomware_extensions and remote_access_software lookups with new values expanding coverage for emerging threats. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.2.0 https://github.com/splunk/security_content/releases/tag/v5.2.0 Mon, 24 Mar 2025 18:41:43 GMT Splunk Security Content v5.2.0 adds 43 new detections across GitHub, O365, and SQL Server, plus 6 new analytic stories. • New 'GitHub Malicious Activity' analytic story with detections for disabling 2FA requirements, pausing/modifying audit log streams, deleting repositories, disabling Dependabot and branch protection rules, and registering unauthorized self-hosted runners. • New 'O365 Email Threat Monitoring' detections covering inbox rule creation, excessive email deletions, send-and-delete exfiltration behavior, suspicious search activity, and payroll/password compromise patterns. • New 'SQL Server Abuse' analytic story with detections for malicious SQLCMD execution, xp_cmdshell config changes, unauthorized SQL Server configuration changes, startup procedures, and dangerous extended procedure DLL loading. • New analytic stories mapped to Black Basta Ransomware, SnappyBee, and SystemBC malware families. • New 'China-Nexus Threat Activity' analytic story added. • Adds 5 new macros: github_enterprise, github_organizations, o365_messagetrace, o365_suspect_search_terms_regex, and process_sqlcmd. • Adds 2 new lookups: deprecation_info and windows_suspicious_tasks. • Deprecated detections from v5.0.0 announcement are now removed starting in v5.2.0, with a published replacement list on Splunk docs. Breaking changes: • Several detections previously marked for deprecation in ESCU v5.0.0 have been removed in v5.2.0; see the full list and replacements at https://docs.splunk.com/Documentation/ESCU/5.2.0/user/DeprecatedAnalytics#List_of_removed_detections_in_ESCU_version_5.2.0 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.1.0 https://github.com/splunk/security_content/releases/tag/v5.1.0 Mon, 24 Feb 2025 20:19:12 GMT Splunk Security Content v5.1.0 adds 4 analytic stories and 41 new detections spanning RMM abuse, S3 hijacking, Cisco Secure Endpoint tampering, and Windows audit policy manipulation. • New analytic story: Remote Monitoring and Management Software — detects unauthorized RMM tool usage (AnyDesk, TeamViewer) via phishing and drive-by compromise. • New analytic story: AWS S3 Bucket Security Monitoring — tracks public S3 bucket decommissioning, access attempts, and potential bucket hijacking using CloudTrail logs, DNS queries, and web proxy data. • New analytic story: Security Solution Tampering — covers Cisco Secure Endpoint service inhibition, disabling, and modification techniques. • New analytic story: Windows Audit Policy Tampering — detects auditpol.exe abuse, registry-based audit policy changes, and audit log clearing. • Adds 6 new Office 365 detections: email transport rule changes, file access/download/sync exfiltration, multi-OS authentication anomalies, and suspicious SharePoint search behavior. • Adds detections for Cisco Secure Endpoint tampering: stopped services, Immunet service manipulation via sfc.exe, and uninstall attempts. • Adds Windows audit policy detections covering disabled, cleared, restored, excluded-category, and security-descriptor-tampering scenarios via auditpol and registry. • New endpoint detections: Windows RDP network brute-force, process execution from removable media, process execution in Temp directory, suspicious driver load paths, suspicious process file paths, and USBSTOR/WPDBusEnum registry modifications. • New PowerShell detections: malicious string matching in both process command lines and script block logging, backed by a new `malicious_powershell_strings` lookup. • New Telegram C2 detection: Potential Telegram API Request Via CommandLine. • New Windows compatibility telemetry detections: suspicious child processes and registry-based tampering. • New baseline: Baseline Of Open S3 Bucket Decommissioning for tracking S3 buckets before deletion. • Adds `windows_suspicious_services` lookup and new macros (`important_audit_policy_subcategory_guids`, `normalized_service_binary_field`, `process_auditpol`, `windows_exchange_iis`) to support new detections. • Adds a dashboard dropdown to the navigation bar in the Splunk Security Content UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v5.0.0 https://github.com/splunk/security_content/releases/tag/v5.0.0 Fri, 31 Jan 2025 18:57:18 GMT ESCU v5.0.0 adds 52 new detections, 9 analytic stories, a Deprecation Assistant Dashboard, and an Analytic Story Onboarding Assistant. • New Deprecation Assistant Dashboard lets ESCU users identify and manage deprecated detection analytics currently enabled in their Splunk environment before removal in v5.2.0. • New Analytic Story Onboarding Assistant (preview) streamlines enabling detections from multiple analytics stories where data is available in the Splunk environment. • Redesigned home page with enhanced UI provides direct access to release notes, analytics counts, latest Splunkbase version, and a timeline of STRT blogs and updates. • Adds 9 new analytic stories covering Backdoor Pingpong, Cleo File Transfer Software, Crypto Stealer, SDDL Tampering Defense Evasion, Derusbi, Earth Estries, Nexus APT Threat Activity, WinDealer RAT, and XorDDos. • Adds 52 new detections spanning AWS cloud abuse (access keys, IAM brute force, snapshot exfiltration, S3 lifecycle evasion), Azure AD/O365 service principal enumeration and privilege escalation, Microsoft Intune abuse, Windows SDDL/service descriptor tampering, Office product exploitation chains, network scanner behavior, and more. • Replaces the `observables` key with an `RBA` key in YAML configurations to align with Enterprise Security standards and simplify risk attribution. Breaking changes: • The `observables` key in YAML configurations is replaced with the `RBA` key; existing content referencing `observables` will need to be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v4.44.0 https://github.com/splunk/security_content/releases/tag/v4.44.0 Thu, 05 Dec 2024 22:31:06 GMT Splunk Security Content v4.44.0 adds 8 new analytics covering Microsoft Defender ATP, BitLockerToGo abuse, VaultCLI credential theft, RDP activity, and RunMRU monitoring, plus 3 new threat stories. • New analytic: Microsoft Defender ATP Alerts — surfaces and summarizes alerts from Microsoft Defender Advanced Threat Protection. • New analytic: Microsoft Defender Incident Alerts — surfaces and summarizes Microsoft Defender O365 Incidents. • New analytics: Windows BitLockerToGo Process Execution and Windows BitLockerToGo with Network Activity — detect abuse of BitLockerToGo.exe by Lumma Stealer for registry manipulation, credential hunting, and data exfiltration. • New analytic: Windows Credentials Access via VaultCli Module — flags suspicious use of VaultCLI.dll to extract credentials from the Windows Credential Vault, as seen in Meduza Stealer. • New analytics: Windows RDP File Execution and Windows RDPClient Connection Sequence Events — detect potentially suspicious Windows RDP activities. • New analytic: Windows RunMRU Command Execution — monitors changes to the RunMRU registry key to catch malware-issued commands surfaced via the Windows Run dialog. • New Analytic Story: Lumma Stealer — groups detections covering Lumma Stealer TTPs. • New Analytic Story: Meduza Stealer — groups detections covering Meduza Stealer TTPs. • New Analytic Story: PXA Stealer — groups detections covering PXA Stealer TTPs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v4.43.0 https://github.com/splunk/security_content/releases/tag/v4.43.0 Thu, 14 Nov 2024 01:21:21 GMT Splunk Security Content v4.43.0 adds 9 new detections including Braodo Stealer and Critical Alerts, plus drilldowns across all TTP/Anomaly rules. • New analytic 'Detect Critical Alerts from Security Tools' identifies high-priority alerts from any vendor mapped to the Alerts data model, tested with MS365 Defender and Windows Defender. • New 'Internal Horizontal Port Scan NMAP Top 20' detection identifies internal network reconnaissance targeting the top 20 NMAP ports. • New 'High Volume of Bytes Out to Url' and 'Plain HTTP POST Exfiltrated Data' analytics detect data exfiltration over web channels. • All TTP, Anomaly, and Correlation detections now include two default drilldowns — one scoped to a specific risk object and one surfacing risk events from the past 7 days — to accelerate investigation workflows. • New datasource testing in contentctl v4.4.5 validates detection compatibility when new Technology Add-ons (TAs) are introduced. • Automatic version enforcement in contentctl v4.4.5 increments search versions whenever a detection's YAML is modified. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v4.42.0 https://github.com/splunk/security_content/releases/tag/v4.42.0 Mon, 14 Oct 2024 22:21:54 GMT Splunk Security Content v4.42.0 adds 10 new detections covering Splunk product vulnerabilities and PowerShell Web Access exploitation. • Adds detection for Splunk KVStore being disabled via CSRF to enable maintenance mode. • Adds detection for image file disclosure through PDF exports in Classic Dashboard. • Adds detection for low-privileged searches running as 'nobody' via SplunkDeploymentServerConfig App. • Adds two detections for persistent XSS attacks — via props.conf and via scheduled views. • Adds detection for remote code execution through arbitrary file writes to the Windows system root. • Adds detection for sensitive information disclosure in Splunk SG for low-privileged users. • Adds detection for sensitive information disclosure in DEBUG logging channels. • Adds 'Windows IIS Server PSWA Console Access' to detect unauthorized PowerShell Web Access console sessions via IIS logs. • Adds 'Windows Identify PowerShell Web Access IIS Pool' to detect creation and anomalies in PSWA IIS application pool configurations. • Updates the CISA AA24-241A analytic story with new PSWA-focused detections targeting privilege escalation, lateral movement, and remote code execution in Windows environments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v4.41.0 https://github.com/splunk/security_content/releases/tag/v4.41.0 Thu, 26 Sep 2024 17:25:32 GMT ValleyRAT analytic story lands with 6 new detections covering C2 config, registry abuse, UAC bypass, and task scheduler DLL loading. • New ValleyRAT Analytic Story bundles detections for C2 configuration, registry manipulation, privilege escalation, and defense impairment on Windows. • New detection: Windows Impair Defenses Disable AV AutoStart via Registry — catches antivirus auto-start being disabled through registry modifications. • New detection: Windows Modify Registry Utilize ProgIDs — identifies suspicious use of ProgIDs via registry changes. • New detection: Windows Modify Registry ValleyRAT C2 Config — surfaces ValleyRAT command-and-control configuration written to the registry. • New detection: Windows Modify Registry ValleyRat PWN Reg Entry — detects ValleyRAT-specific registry entries associated with privilege abuse. • New detection: Windows Schedule Task DLL Module Loaded — flags DLL modules loaded through scheduled task activity. • New detection: Windows Schedule Tasks for CompMgmtLauncher or Eventvwr — detects UAC bypass attempts via scheduled tasks targeting CompMgmtLauncher or Eventvwr. • Updated detections for Add or Set Windows Defender Exclusion, FodHelper UAC Bypass, Eventvwr UAC Bypass, CMLUA/CMSTPLUA UAC Bypass, and related endpoint analytics now include ValleyRAT coverage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v4.40.0 https://github.com/splunk/security_content/releases/tag/v4.40.0 Wed, 11 Sep 2024 16:48:49 GMT Splunk Security Content v4.40.0 adds 52 new detections including 50 Linux Auditd rules and 2 PowerShell Web Access detections, plus 3 new analytic stories. • Adds 50 new Linux Auditd detections covering unauthorized account creation, kernel module manipulation, privilege escalation, data destruction, credential access, and suspicious service stoppages under the new 'Compromised Linux Host' analytic story. • Adds 2 new detections for PowerShell Web Access installation and enablement (Windows DISM Install PowerShell Web Access; Windows Enable PowerShell Web Access) tied to CISA AA24-241A Iran-based threat actor activity. • Introduces 'BlackSuit Ransomware' analytic story tagging existing analytics to TTPs associated with Black Suit ransomware for targeted ransomware threat detection. • Introduces 'CISA AA24-241A' analytic story aligning detections with the joint advisory on Iran-based cyber actors exploiting U.S. and foreign organizations. • Introduces 'Compromised Linux Host' analytic story grouping the 50 new Linux Auditd detections for streamlined investigation workflows. • Updates 72 existing analytics across cloud, endpoint, network, and web categories. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v4.39.0 https://github.com/splunk/security_content/releases/tag/v4.39.0 Thu, 29 Aug 2024 16:37:31 GMT v4.39.0 adds 29 new detections for Ivanti CVE-2024-7593, Office 365, and Windows AD, plus a new RMM Software Tracking Dashboard. • New analytic story for Ivanti Virtual Traffic Manager CVE-2024-7593, covering SQL injection RCE and unauthorized account creation detections. • New analytic story for MoonPeak threat actor. • New detection: Ivanti EPM SQL Injection Remote Code Execution. • New detection: Ivanti VTM New Account Creation. • New detections for password spray attacks: Detect Password Spray Attack Behavior From Source and On User. • New Office 365 detections: DLP Rule Triggered, Email Access By Security Administrator, Email Reported By Admin/User Found Malicious, Email Security Feature Changed, Email Suspicious Behavior Alert, Safe Links Detection, SharePoint Allowed Domains Policy Changed, SharePoint Malware Detection, Threat Intelligence Suspicious Email Delivered, Threat Intelligence Suspicious File Detected, and ZAP Activity Detection. • New Windows Active Directory detections covering DCShadow privilege ACL addition, dangerous deny/group/user ACL modifications, domain root ACL deletion and modification, GPO deletion/disabling/new CSE addition, hidden OU creation, AD object owner updates, self DACL assignment, and suspicious attribute modification. • New RMM Software Tracking Dashboard for auditing and monitoring Remote Monitoring and Management alert content. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v4.38.0 https://github.com/splunk/security_content/releases/tag/v4.38.0 Fri, 16 Aug 2024 00:15:01 GMT v4.38.0 adds 20 new detections for CrowdStrike identity risk, O365 tenant access, and unusual NTLM authentication patterns, plus two new analytic stories. • Adds 9 new CrowdStrike detections covering weak password policies, duplicate passwords across users and admins, identity risk severity (high and medium), privilege escalation for non-admin users, and medium/multiple-low severity alerts. • Adds 6 new Office 365 detections for cross-tenant access changes, external guest invitations, external identity policy changes, privileged role assignments, and applications available to other tenants. • Adds 5 new Windows NTLM detections identifying multiple null-domain authentications and unusual authentication patterns by source, destination, and user. • Introduces two new analytic stories: 'Compromised Windows Host' and 'Handala Wiper', grouping relevant detections for those threat scenarios. • Adds three new macros — `crowdstrike_identities`, `crowdstrike_stream`, and `ntlm_audit` — to support the new CrowdStrike and NTLM detections. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v4.37.0 https://github.com/splunk/security_content/releases/tag/v4.37.0 Wed, 31 Jul 2024 18:30:02 GMT v4.37.0 adds 16 new detections for AcidPour, Gozi, ShrinkLocker, MOVEit CVE-2024-5806, Ivanti CVE-2024-29824, and VMware ESXi CVE-2024-37085. • New Analytic Story: AcidPour — covers wiper malware TTPs targeting Windows environments via registry modifications. • New Analytic Story: Gozi Malware — detections for Gozi malware techniques including registry-based persistence. • New Analytic Story: ShrinkLocker — detections for ShrinkLocker ransomware techniques including BitLocker configuration abuse. • New Analytic Story: MOVEit Transfer Authentication Bypass — covers CVE-2024-5806 improper authentication in MOVEit SFTP service. • New Analytic Story: Ivanti EPM Vulnerabilities — covers CVE-2024-29824 SQL injection leading to remote code execution (CVSS 9.8). • New Analytic Story: VMware ESXi AD Integration Authentication Bypass CVE-2024-37085 — detects re-creation of the 'ESXi Admins' AD group to gain full hypervisor access. • New detection: Ivanti EPM SQL Injection Remote Code Execution — identifies exploitation of CVE-2024-29824. • New detections: MOVEit Certificate Store Access Failure and MOVEit Empty Key Fingerprint Authentication Attempt — surface CVE-2024-5806 exploitation attempts. • New detections: Windows ESX Admins Group Creation via Security Event, Net, and PowerShell — catches CVE-2024-37085 privilege escalation on ESXi hosts. • New detection: Windows Known Abused DLL Loaded Suspiciously — flags suspicious loading of commonly abused DLLs. • New detections: Windows LOLBAS Executed As Renamed File and Windows LOLBAS Executed Outside Expected Path — identify living-off-the-land binary abuse by name/path anomalies. • New detections: Windows Modify Registry Configure BitLocker, Delete Firewall Rules, Disable RDP, on Smart Card Group Policy, to Add or Modify Firewall Rule, and Outlook WebView Registry Modification — cover registry-based attack techniques used by AcidPour, Gozi, and ShrinkLocker. • New detection: Windows Privileged Group Modification — detects unauthorized changes to privileged Windows groups. • New macro: remote_access_software_usage_exceptions — enables allowlisting in remote access software detections. • New lookup: remote_access_software_exceptions — supports the new exception-based remote access software detection workflow. • Updated lookup: remote_access_software — expanded list of known remote access software signatures used across related detections. • Updated lookup: lolbas_file_path — expanded reference data supporting the new LOLBAS path/rename detections. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content https://github.com/splunk/security_content/releases/tag/v4.36.0 https://github.com/splunk/security_content/releases/tag/v4.36.0 Wed, 17 Jul 2024 23:06:52 GMT Splunk Security Content v4.36.0 adds 9 new detections for AD persistence, password spray, port scans, and vulnerable drivers. • New detection: Detect Distributed Password Spray Attempts — identifies spray attacks spread across multiple sources. • New detection: Detect Password Spray Attempts — identifies localized password spray activity. • New detection: Internal Horizontal Port Scan — alerts on internal hosts scanning multiple targets on the same port. • New detection: Internal Vertical Port Scan — alerts on internal hosts scanning multiple ports on a single target. • New detection: Windows AD add Self to Group — catches adversaries adding their own account to AD groups for privilege escalation. • New detection: Windows Increase in Group or Object Modification Activity — surfaces anomalous spikes in AD group/object changes. • New detection: Windows Increase in User Modification Activity — surfaces unusual spikes in AD user account modifications. • New detection: Windows Network Share Interaction With Net — detects suspicious use of the Net command against network shares. • New detection: Windows Vulnerable Driver Installed — alerts when a known-vulnerable driver is installed on a Windows endpoint. • Adds new data_source objects to the content library. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/splunk-security-content