admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
28,167 Commits 697 Branches 195 Tags
develop
Commit Graph

11802 Commits

Author SHA1 Message Date
David Sarkisyan 1610a7cf68 Fix regsvr32 typo (#4117) 
Co-authored-by: David Sarkisyan <281478990+srkyn@users.noreply.github.com>
 2026-06-08 16:16:26 +02:00
Bhavin Patel 0c3e5887e8 Bump contentctl.yml and build.yml to 6.1.0 (#4113) 
* chore: bump contentctl.yml and build.yml to 6.1.0

* move to removed

* status is removed

---------

Co-authored-by: research bot <research@splunk.com>
 2026-06-08 15:58:54 +02:00
ljstella 0c869bfc93 yamlfmt 2026-05-20 15:15:09 -04:00
ljstella d7b8c0f0d8 Reordering key 2026-05-19 14:25:35 -04:00
Lou Stella d235c3e7d2 Update detections/web/monitor_web_traffic_for_brand_abuse.yml 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-05-19 14:22:21 -04:00
ljstella bc18194661 Reordering keys 2026-05-19 14:21:30 -04:00
ljstella b196ddcf95 Baseline cleanup 2026-05-19 12:23:15 -04:00
ljstella 53565febce message cleanup 2026-05-19 12:15:48 -04:00
ljstella 15c349bde3 Multiple user type entities 2026-05-19 11:45:53 -04:00
ljstella e52095cb16 Unbalanced $ in message 2026-05-19 10:35:40 -04:00
ljstella baf4b85578 Multiple non-user but no user 2026-05-19 10:34:15 -04:00
ljstella 9dfb1706f9 Manual Review of correlation searches 2026-05-19 10:10:45 -04:00
Eric McGinnis db8c7c8509 Initial commit of modified objects. A small set of 5 kvstore lookups could not be git moved AND updated in the same operation because git instead interpreted this as deleting the old file and creating a new one. To preserve git history, the files have been moved in this commit and will be updated in the next commit. 2026-05-13 14:02:27 -07:00
Lou Stella 9c183fa110 Update Analytics to Support ATT&CK v19 (#4036) 
---------

Co-authored-by: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-05-05 17:29:28 +02:00
Raven Tait 917fe77cc0 Add Big Batch of Snap Attack Converted Rules (#4015) 
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
 2026-05-05 16:11:18 +02:00
Raven Tait 4d4c7ee091 Add Analytic for Copy Fail (#4063) 
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-05-05 03:13:57 +02:00
p4t12ick a9aaf494f6 Improved detections based on telemetry data (#4011) 
---------

Co-authored-by: P4T12ICK <pbareiss@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-05-04 13:31:26 +02:00
Bhavin Patel becdb58b9f Add Secure Access Firewall Detections (#3986) 
---------

Co-authored-by: Lou Stella <ljstella@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-04-29 20:41:09 +02:00
jwindley c5e9d4a573 Fixed two detections, and improved macos keychain dumping for more coverage of the technique (#4034) 
* Fix and improve azure high-risk sign-in, curl percent-encoded URL, and macOS keychain dump detections

* Apply suggestions from code review

* Update azure_active_directory_high_risk_sign_in.yml

* Update curl_execution_with_percent_encoded_url.yml

* beautify spl

* Update macos_keychains_dumped.yml

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-04-29 15:20:25 +02:00
Br3akp0int 9972c09298 vip_keylogger (#4024) 
* vip_keylogger

* vip_keylogger

* vip_keylogger

* vip_keylogger

* vip_keylogger

* vip_keylogger

* vip_keylogger

* vip_keylogger

* vip_keylogger

* vip_keylogger

* Update vip_keylogger.yml

* Update windows_proxy_execution_of__net_utilities_via_scripts.yml

* Update windows_anomalous_registry_value_length_in_environment_key.yml

* Update powershell_loading_dotnet_into_memory_via_reflection.yml

* Update executables_or_script_creation_in_temp_path.yml

* Update executables_or_script_creation_in_suspicious_path.yml

* Update powershell_pinvoke_process_injection_api_chain.yml

* vip_keylogger

* Update powershell_environment_variable_execution.yml

* Update windows_anomalous_registry_value_length_in_environment_key.yml

* Update windows_anomalous_registry_value_length_in_environment_key.yml

---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-04-29 17:55:13 +05:30
Bhavin Patel ba59855b1d updating risk drilldowns (#4016) 
* updating drilldows

* inspect failures

* updating versions

* updating versins

* chore: empty commit to trigger CI
 2026-04-17 17:28:53 +05:30
Nasreddine Bencherchali ea5bd52238 Fix Issues - 2nd Round (#3996) 
* Fix #3993

* Fix incorrect DS entries

* fix security_domain issue

* Fix #3992

* Fix #3988

* Update dump_lsass_via_procdump.yml

* Fix #3987

* Fix #3977

* Update network_connection_discovery_with_arp.yml

* Fix #3998

* Fix #3997

* fix versions

* revert change

* Fix #4012

* Update linux_file_creation_in_init_boot_directory.yml

* Update linux_file_creation_in_init_boot_directory.yml

* Fix #4010 and related

* fix typo

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-04-16 05:24:43 +00:00
Andrei Banaru c6241660c7 Remove missing fields in Windows Event Log Cleared detection (#4001) 
* fix: remove missing fields in Windows Event Log Cleared detection

* fix: source should be XmlWinEventLog:System

* update ds and output fields

* Update windows_event_log_security_1102.yml

---------

Co-authored-by: Andrei Banaru <a.banaru@iaea.org>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-04-16 10:52:16 +05:30
pyth0n1c 3c16b138e6 Merge branch 'develop' into 5.25.1_changes_for_develop 2026-04-15 15:11:36 -07:00
Eric McGinnis 6a8bfe977c Fix version and date and update contentctl version in prep for release. 2026-04-15 12:00:44 -07:00
jwindley 80b29d6651 New MacOS detections T1016 (#4017) 
* New MacOS detections T1016

* Fix pre-commit formatting issues

* Fix based on Bhavin's comments

* update version

* Update linux_system_network_discovery.yml

* Update macos_list_firewall_rules.yml

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
 2026-04-15 23:36:58 +05:30
Bhavin Patel c90d744007 Duplicate - Microsoft Intune Bulk Wipe Detected (#4014) 
* updating search

* Update microsoft_intune_bulk_wipe_detected.yml

* Rename microsoft_intune_bulk_wipe_detected.yml to microsoft_intune_bulk_wipe.yml

* Update microsoft_intune_bulk_wipe.yml

* Update detections/cloud/microsoft_intune_bulk_wipe.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* updating refs

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-04-15 23:08:02 +05:30
Raven Tait 8050483569 Snap Mac Detections (#3935) 
* Snap Mac Detections

* add osquery

* Update links and formatting

* update datasource name

* update formatting

* bump version

* Updates per PR comments

* Add commandline to RBA for gatekeeper bypass

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
 2026-04-14 19:48:42 +05:30
Lou Stella 8d2510235b Spelling Fixes (#4002) 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-04-13 13:38:11 +02:00
Br3akp0int 7293d75700 Tagged Analytics Covering the Axios Compromise Post-Exploitation Activity (#3982) 
---------

Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com>
 2026-04-02 16:07:20 +00:00
Raven Tait f416da59fe Add Filter for VMware Tools (#3983) 2026-04-02 18:06:04 +02:00
Bhavin Patel 8c6453e0ea Bump contentctl.yml to 5.26.0 (#3989) 
* chore: bump contentctl.yml to 5.26.0

* remove detections

---------

Co-authored-by: research bot <research@splunk.com>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
 2026-04-02 17:41:06 +02:00
Nasreddine Bencherchali fd53a2186b Fix Broken RBA Message (#3984) 2026-03-31 15:34:07 +00:00
ljstella d38d8e1519 First pass of RBA message fix 2026-03-30 15:09:36 -04:00
Br3akp0int ff78e2d159 gh0st (#3973) 
* gh0st

* gh0st

* gh0st

* gh0st

* gh0st

* gh0st

* gh0st

* gh0st

* gh0st

* gh0st

* gh0st

* small changes

* another update

* final fix

---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-30 19:46:33 +05:30
Nasreddine Bencherchali bc1b413923 Fix Reported Issues - April Batch (#3962) 
* Fix #3961

* Fix #3909

* Fix output fields

* Remove duplicate process_name entry

* Update outbound_network_connection_from_java_using_default_ports.yml

* Update detect_computer_changed_with_anonymous_account.yml

* Update detect_computer_changed_with_anonymous_account.yml

* Fix #3969

* update palo alto TA and beautify analytics

* Update vmware_aria_operations_exploit_attempt.yml

* fix source

* enhance metadata and fp info

* beautify spl for ease of reading

* add some missing attack techniques

* remove unnecessary usage of regex

* Update windows_uac_bypass_suspicious_escalation_behavior.yml

* small fix

* Refine description and improve regex

* Update windows_uac_bypass_suspicious_escalation_behavior.yml

* Update possible_lateral_movement_powershell_spawn.yml

* Update possible_lateral_movement_powershell_spawn.yml

* Update windows_event_log_security_4756.yml

* description update

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-03-30 14:34:11 +05:30
Nasreddine Bencherchali b87507b551 Update Suricata TA and Related Analytics (#3974) 
* update suricata ta

* update analytics for new TA

* Update ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078.yml

---------

Co-authored-by: Lou Stella <ljstella@gmail.com>
 2026-03-28 10:09:22 +00:00
Bhavin Patel 89391cf877 Tune detections based on Athena FPs (#3972) 
---------

Co-authored-by: p4t12ick <patrickbareiss1989@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
 2026-03-27 16:58:41 +01:00
nasbench 30e0c54198 Update ryuk_wake_on_lan_command.yml 2026-03-27 12:21:22 +01:00
P4T12ICK 44f3125d35 bug fix 2026-03-27 10:13:56 +01:00
P4T12ICK 0b219a6b1e bug fix 2026-03-27 08:28:10 +01:00
P4T12ICK 8be3693cf3 changed back to Anomaly 2026-03-27 08:00:36 +01:00
P4T12ICK c40b390d3f updated suggestions 2026-03-27 07:58:29 +01:00
p4t12ick b4c002efb5 Update detections/endpoint/windows_account_access_removal_via_logoff_exec.yml 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-26 16:45:57 +01:00
p4t12ick 3c1d41e219 Update detections/endpoint/windows_application_whitelisting_bypass_attempt_via_rundll32.yml 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-26 16:45:40 +01:00
p4t12ick 4912e09184 Update detections/endpoint/system_user_discovery_with_whoami.yml 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-26 16:44:53 +01:00
p4t12ick b4c800deb2 Update detections/endpoint/conti_common_exec_parameter.yml 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-26 16:43:29 +01:00
p4t12ick 6d5d970ee6 Update detections/endpoint/anomalous_usage_of_7zip.yml 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-26 16:43:13 +01:00
P4T12ICK 520bfc060c bug fix 2026-03-26 10:19:11 +01:00
P4T12ICK dc3f50b24b bug fix 2026-03-26 10:13:15 +01:00