0c3e5887e8
Bump contentctl.yml and build.yml to 6.1.0 ( #4113 )
...
* chore: bump contentctl.yml and build.yml to 6.1.0
* move to removed
* status is removed
---------
Co-authored-by: research bot <research@splunk.com >
2026-06-08 15:58:54 +02:00
db8c7c8509
Initial commit of modified objects. A small set of 5 kvstore lookups could not be git moved AND updated in the same operation because git instead interpreted this as deleting the old file and creating a new one. To preserve git history, the files have been moved in this commit and will be updated in the next commit.
2026-05-13 14:02:27 -07:00
9c183fa110
Update Analytics to Support ATT&CK v19 ( #4036 )
...
---------
Co-authored-by: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com >
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2026-05-05 17:29:28 +02:00
8c6453e0ea
Bump contentctl.yml to 5.26.0 ( #3989 )
...
* chore: bump contentctl.yml to 5.26.0
* remove detections
---------
Co-authored-by: research bot <research@splunk.com >
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com >
2026-04-02 17:41:06 +02:00
b87507b551
Update Suricata TA and Related Analytics ( #3974 )
...
* update suricata ta
* update analytics for new TA
* Update ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078.yml
---------
Co-authored-by: Lou Stella <ljstella@gmail.com >
2026-03-28 10:09:22 +00:00
c40b390d3f
updated suggestions
2026-03-27 07:58:29 +01:00
90efd9a8ef
bumped version numbers and dates
2026-03-26 08:01:41 +01:00
e556cac279
Improved detections based on telemetry.
2026-03-26 07:46:49 +01:00
9c7ef33e81
Fix Issue #3950 ( #3957 )
...
---------
Co-authored-by: Bhavin Patel <bpatel@splunk.com >
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2026-03-16 16:18:01 +01:00
b3fed38275
Deprecate MLTK detections ( #3922 )
...
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
Co-authored-by: Lou Stella <ljstella@gmail.com >
2026-03-16 14:59:40 +01:00
b1425aadfa
Split and tweak of linux_docker_privilege_escalation ( #3929 )
...
* Splitting linux_docker_privilege_escalation into two detections, modifying the queries to more precisely trigger on the activity
* Adding back original author, removing trailing whitespace
* deprecate and update metadata
* Update linux_docker_shell_execution.yml
---------
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com >
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2026-03-10 12:46:59 +05:30
5440317966
Removed detection for v5.24.0
2026-03-05 09:12:44 -05:00
11c909f725
Add YAML Formatting Job ( #3889 )
...
* Add YAML formatting and validation infrastructure
- Add yamlfmt configuration (.yamlfmt) with 4-space indent, LF line endings
- Add yamllint configuration (.yamllint) for syntax validation (detections/ only)
- Add pre-commit hook for automatic YAML formatting
- Add CI validation script with unified error output
- Add GitHub Actions workflow for PR validation
- Add documentation for setup and usage
- Support custom yamlfmt binary path via --yamlfmt-path flag
* comment yaml check from pre-commit
* apply yamlfmt
* Update yaml-validation.yml
* Update yaml-validation.yml
* application folder search formatting
* cloud folder search formatting
* web folder search formatting
* network folder search formatting
* endpoint folder search formatting
* resolve first conflict
* apply formatting
* remove additional pipe
* Update README.md
* update versions
* restore and update formatting (#3920 )
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2026-02-26 00:00:35 +05:30
79d24587f6
Issue - 3901 ( #3905 )
...
* cosolidation of detections
* updating test
2026-02-11 22:33:49 +05:30
d13e377a27
Bump contentctl.yml to 5.22.0 ( #3894 )
...
* chore: bump contentctl.yml to 5.22.0
* remove detections
---------
Co-authored-by: research bot <research@splunk.com >
Co-authored-by: Lou Stella <ljstella@gmail.com >
2026-02-10 10:27:49 +05:30
498a80d469
Detections for default user agents ( #3842 )
...
* Detections for default user agents
* various updates for user agent detections
* Apply suggestions from code review
* Rename suspicious_user_agent.yml to suspicious_user_agents.yml
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2026-01-07 09:34:04 +05:30
2bcff6573a
Bump contentctl.yml to 5.20.0 ( #3829 )
...
* chore: bump contentctl.yml to 5.20.0
* move removed detections
---------
Co-authored-by: research bot <research@splunk.com >
2025-12-15 23:12:19 +05:30
6032db5edb
Add tuoni content and named pipe detection ( #3816 )
...
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-12-08 21:25:09 +01:00
c5413e93f2
updating version and removing detections ( #3749 )
2025-10-30 10:29:04 -07:00
d2ca19aab5
detection_fixed ( #3746 )
...
* detection_fixed
* detection_fixed
* detection_fixed
* Update deprecation_mapping.YML
---------
Co-authored-by: Teoderick Contreras <tcontreras@splunk.com >
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2025-10-27 10:23:56 -07:00
58bf9a1bc8
WSUSpect in Custody: CVE-2025-59287 ( #3743 )
...
* WSUSpect in Custody: CVE-2025-59287
* WSUS and Updates
* :jt_stare:
* Update windows_wsus_spawning_shell.yml
* Update w3wp_spawning_shell.yml
* deprecate rules and map analytic stories
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-10-27 09:48:44 -07:00
9fc8942993
New Rules & Updates - Oct 25 ( #3726 )
...
* new rules and updates
* fix issues with ci
* rename for accurate macro
* update description and logic
* new wbadmin rule and fix pwsh dataset
* more updates for the weekend
* update network rules filters
* downgrade versions
* Update windows_file_transfer_protocol_in_non_common_process_path.yml
* add missing DS for some rules
* update nirsoft lookup and add new rules
* update more nirsoft stuff
* update snort message
* Update cisco_secure_firewall_filetype_lookup.yml
* new analytic and updates / incl. fix #3730
* Update detect_new_local_admin_account.yml
* add lnx dataset and fix wildcards
2025-10-24 14:19:48 -07:00
66aa9e9232
Duplicate - 3737 ( #3738 )
...
* deprecate detection
* yaml fix
* Update possible_lateral_movement_powershell_spawn.yml
* Update detections/deprecated/wmiprsve_lolbas_execution_process_spawn.yml
* Update detections/endpoint/wmiprvse_lolbas_execution_process_spawn.yml
* Update removed/deprecation_mapping.YML
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-10-21 12:42:28 -07:00
21ee673940
Fix Issues & Updates ( #3705 )
...
* Fix Issues and Updates
* Update add_or_set_windows_defender_exclusion.yml
* Update windows_curl_download_to_suspicious_path.yml
* Fix more issues and bugs
* Update deprecation_mapping.YML
* Update windows_application_whitelisting_bypass_attempt_via_rundll32.yml
* More updates and fixes
* update `Windows Change Default File Association For No File Ext`
* A couple more updates for ya
* rename
* add / update rules
* Update windows_symlink_evaluation_change_via_fsutil.yml
* Update windows_symlink_evaluation_change_via_fsutil.yml
* Update linux_service_started_or_enabled.yml
* Update linux_service_started_or_enabled.yml
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2025-10-13 09:18:21 -07:00
e41bd98cb9
fix_net_profile_analytic ( #3689 )
...
* fix_net_profile_analytic
* fix_net_profile_analytic
* fix_net_profile_analytic
* fix_net_profile_analytic
* fix_net_profile_analytic
* fix_net_profile_analytic
* fix_net_profile_analytic
* Update windows_set_network_profile_category_to_private_via_registry.yml
* Update deprecation_mapping.YML
* Remove deprecated web fraud detection mapping
Removed deprecated analytic story for web fraud detection.
---------
Co-authored-by: Teoderick Contreras <tcontreras@splunk.com >
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-10-10 17:20:14 +00:00
a69230f087
removing staged detection
2025-08-26 09:46:54 -07:00
5097cd5fef
removed detections and version bump
2025-08-06 14:08:17 -05:00
716592ff40
updating spl
2025-08-04 14:48:58 -05:00
8a8e24ff29
adding macro
2025-08-04 14:45:49 -05:00
ab80c31b85
appinspect
2025-08-04 14:38:02 -05:00
2c6248de85
updating based on request from Ryan Long
2025-08-04 13:56:35 -05:00
ea0121c2f1
Scattered Spider Tags
2025-07-31 10:54:21 -06:00
3666bfa9f4
prep for next release
2025-07-09 11:25:06 -07:00
f49bd318d9
update time 🚀
2025-06-30 13:55:55 +02:00
64aac40e82
Remove deprecated detections in line with prepublished guidance
2025-06-17 12:44:39 -07:00
6c5aa91dbf
more updates
2025-06-16 23:38:10 +02:00
23d0f236b5
Move deprecated detections to removed. update status too
2025-05-08 14:52:52 -07:00
d9960562b8
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
7742f511b3
Merge branch 'develop' into deprecate_rmm_hunt
2025-05-01 11:53:34 -07:00
4d1ff91ee3
updated messaging
2025-04-30 12:24:55 -07:00
884eede4ce
updating search
2025-04-30 12:14:30 -07:00
1dc4f1c45a
bump versions
2025-04-24 19:53:19 +02:00
60164de4e7
updates and tunings
2025-04-24 15:15:09 +02:00
bf3fe8b361
remove yamls and update mapping
2025-04-15 15:19:48 -07:00
23219463dc
Merge branch 'develop' into jp_paranoid
2025-04-02 12:07:51 -07:00
6c40990600
fixes
2025-04-01 15:05:10 -06:00
7541027f8e
Merge branch 'develop' into output_normalization_endpoint
2025-04-01 09:41:58 +02:00
6408f290aa
Merge branch 'develop' into jp_paranoid
2025-03-28 13:38:11 -07:00
12356f996f
updating detection to previous
2025-03-28 11:39:59 -07:00
3f274b9b83
deprecate and add new
2025-03-28 11:32:34 -07:00
Bhavin Patel