Branch was auto-updated.

dist/escu/app.manifest

@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "4.0.1"
+      "version": "4.1.0"
     }, 
     "author": [
       {

dist/escu/default/app.conf

@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 13253
+build = 13737
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 4.0.1
+version = 4.1.0
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]

dist/escu/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-04-24T21:58:20 UTC
+# On Date: 2023-05-02T22:09:51 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/content-version.conf

@@ -1,2 +1,2 @@
 [content-version]
-version = 4.0.1
+version = 4.1.0

dist/escu/default/es_investigations.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-04-24T21:58:20 UTC
+# On Date: 2023-05-02T22:09:51 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-04-24T21:58:20 UTC
+# On Date: 2023-05-02T22:09:51 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -877,6 +877,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[detect_mimikatz_using_loaded_images_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [detect_mimikatz_via_powershell_and_eventcode_4703_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -1161,6 +1165,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[active_directory_lateral_movement_identified_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [active_setup_registry_autostart_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -1457,10 +1465,6 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[detect_mimikatz_using_loaded_images_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
 [detect_mimikatz_with_powershell_script_block_logging_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -1581,7 +1585,7 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[detect_suspicious_processnames_using_a_pretrained_model_in_dsdl_filter]
+[detect_suspicious_processnames_using_pretrained_model_in_dsdl_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
@@ -2121,6 +2125,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[impacket_lateral_movement_smbexec_commandline_parameters_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[impacket_lateral_movement_wmiexec_commandline_parameters_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [interactive_session_on_remote_endpoint_with_powershell_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3289,6 +3301,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[steal_or_forge_authentication_certificates_behavior_identified_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [sunburst_correlation_dll_and_network_event_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3737,6 +3753,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_credentials_from_password_stores_chrome_extension_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_credentials_from_password_stores_chrome_localstate_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_credentials_from_password_stores_chrome_login_data_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_credentials_from_password_stores_query_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4101,6 +4129,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_modify_registry_auto_minor_updates_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_modify_registry_auto_update_notif_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_modify_registry_default_icon_setting_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4113,6 +4149,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_modify_registry_disable_windefender_notifications_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_modify_registry_disable_windows_security_center_notif_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4125,6 +4165,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_modify_registry_do_not_connect_to_win_update_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_modify_registry_no_auto_reboot_with_logon_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_modify_registry_no_auto_update_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_modify_registry_qakbot_binary_data_registry_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4141,6 +4193,26 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_modify_registry_tamper_protection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_modify_registry_updateserviceurlalternate_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_modify_registry_usewuserver_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_modify_registry_wuserver_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_modify_registry_wustatusserver_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_modify_show_compress_color_and_info_tip_registry_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4357,10 +4429,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_query_registry_browser_list_application_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_query_registry_reg_save_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_query_registry_uninstall_program_list_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_raccine_scheduled_task_deletion_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4529,6 +4609,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_service_stop_win_updates_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_spearphishing_attachment_connect_to_none_ms_office_domain_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.

dist/escu/default/transforms.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-04-24T21:58:20 UTC
+# On Date: 2023-05-02T22:09:51 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -335,10 +335,6 @@ match_type = WILDCARD(prohibited_applications)
 filename = prohibited_processes.csv
 # description = A list of processes that have been marked as prohibited
 
-[prohibited_softwares]
-filename = prohibited_softwares.csv
-# description = A list of processes that have been marked as prohibited
-
 [ransomware_extensions_lookup]
 filename = ransomware_extensions.csv
 default_match = false

dist/escu/default/workflow_actions.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-04-24T21:58:20 UTC
+# On Date: 2023-05-02T22:09:51 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############