admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
28,167 Commits 697 Branches 195 Tags
develop
Commit Graph

54 Commits

Author SHA1 Message Date
Bhavin Patel 0c3e5887e8 Bump contentctl.yml and build.yml to 6.1.0 (#4113) 
* chore: bump contentctl.yml and build.yml to 6.1.0

* move to removed

* status is removed

---------

Co-authored-by: research bot <research@splunk.com>
 2026-06-08 15:58:54 +02:00
Eric McGinnis db8c7c8509 Initial commit of modified objects. A small set of 5 kvstore lookups could not be git moved AND updated in the same operation because git instead interpreted this as deleting the old file and creating a new one. To preserve git history, the files have been moved in this commit and will be updated in the next commit. 2026-05-13 14:02:27 -07:00
Lou Stella aa672c674a Pushing deprecations (#4003) 2026-04-09 12:12:20 +02:00
Bhavin Patel 8c6453e0ea Bump contentctl.yml to 5.26.0 (#3989) 
* chore: bump contentctl.yml to 5.26.0

* remove detections

---------

Co-authored-by: research bot <research@splunk.com>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
 2026-04-02 17:41:06 +02:00
Nasreddine Bencherchali b87507b551 Update Suricata TA and Related Analytics (#3974) 
* update suricata ta

* update analytics for new TA

* Update ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078.yml

---------

Co-authored-by: Lou Stella <ljstella@gmail.com>
 2026-03-28 10:09:22 +00:00
P4T12ICK c40b390d3f updated suggestions 2026-03-27 07:58:29 +01:00
P4T12ICK e86354e45b bug fix 2026-03-26 07:55:10 +01:00
P4T12ICK e556cac279 Improved detections based on telemetry. 2026-03-26 07:46:49 +01:00
Br3akp0int 9c7ef33e81 Fix Issue #3950 (#3957) 
---------

Co-authored-by: Bhavin Patel <bpatel@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-16 16:18:01 +01:00
Bhavin Patel b3fed38275 Deprecate MLTK detections (#3922) 
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Lou Stella <ljstella@gmail.com>
 2026-03-16 14:59:40 +01:00
Emil b1425aadfa Split and tweak of linux_docker_privilege_escalation (#3929) 
* Splitting linux_docker_privilege_escalation into two detections, modifying the queries to more precisely trigger on the activity

* Adding back original author, removing trailing whitespace

* deprecate and update metadata

* Update linux_docker_shell_execution.yml

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-03-10 12:46:59 +05:30
ljstella 8f80f086b3 Actually remove the detection 2026-03-05 09:15:43 -05:00
Bhavin Patel 79d24587f6 Issue - 3901 (#3905) 
* cosolidation of detections

* updating test
 2026-02-11 22:33:49 +05:30
Bhavin Patel d13e377a27 Bump contentctl.yml to 5.22.0 (#3894) 
* chore: bump contentctl.yml to 5.22.0

* remove detections

---------

Co-authored-by: research bot <research@splunk.com>
Co-authored-by: Lou Stella <ljstella@gmail.com>
 2026-02-10 10:27:49 +05:30
Bhavin Patel 3ca19718c6 minor changes to deprecation_mapping.YML‎ (#3855) 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-01-08 11:02:53 +00:00
Raven Tait 498a80d469 Detections for default user agents (#3842) 
* Detections for default user agents

* various updates for user agent detections

* Apply suggestions from code review

* Rename suspicious_user_agent.yml to suspicious_user_agents.yml

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-01-07 09:34:04 +05:30
Bhavin Patel 2bcff6573a Bump contentctl.yml to 5.20.0 (#3829) 
* chore: bump contentctl.yml to 5.20.0

* move removed detections

---------

Co-authored-by: research bot <research@splunk.com>
 2025-12-15 23:12:19 +05:30
Raven Tait 6032db5edb Add tuoni content and named pipe detection (#3816) 
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2025-12-08 21:25:09 +01:00
Bhavin Patel c5413e93f2 updating version and removing detections (#3749) 2025-10-30 10:29:04 -07:00
Br3akp0int d2ca19aab5 detection_fixed (#3746) 
* detection_fixed

* detection_fixed

* detection_fixed

* Update deprecation_mapping.YML

---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2025-10-27 10:23:56 -07:00
Michael Haag 58bf9a1bc8 WSUSpect in Custody: CVE-2025-59287 (#3743) 
* WSUSpect in Custody: CVE-2025-59287

* WSUS and Updates

* :jt_stare:

* Update windows_wsus_spawning_shell.yml

* Update w3wp_spawning_shell.yml

* deprecate rules and map analytic stories

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2025-10-27 09:48:44 -07:00
Nasreddine Bencherchali 9fc8942993 New Rules & Updates - Oct 25 (#3726) 
* new rules and updates

* fix issues with ci

* rename for accurate macro

* update description and logic

* new wbadmin rule and fix pwsh dataset

* more updates for the weekend

* update network rules filters

* downgrade versions

* Update windows_file_transfer_protocol_in_non_common_process_path.yml

* add missing DS for some rules

* update nirsoft lookup and add new rules

* update more nirsoft stuff

* update snort message

* Update cisco_secure_firewall_filetype_lookup.yml

* new analytic and updates / incl. fix #3730

* Update detect_new_local_admin_account.yml

* add lnx dataset and fix wildcards
 2025-10-24 14:19:48 -07:00
Bhavin Patel 66aa9e9232 Duplicate - 3737 (#3738) 
* deprecate detection

* yaml fix

* Update possible_lateral_movement_powershell_spawn.yml

* Update detections/deprecated/wmiprsve_lolbas_execution_process_spawn.yml

* Update detections/endpoint/wmiprvse_lolbas_execution_process_spawn.yml

* Update removed/deprecation_mapping.YML

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2025-10-21 12:42:28 -07:00
Nasreddine Bencherchali 21ee673940 Fix Issues & Updates (#3705) 
* Fix Issues and Updates

* Update add_or_set_windows_defender_exclusion.yml

* Update windows_curl_download_to_suspicious_path.yml

* Fix more issues and bugs

* Update deprecation_mapping.YML

* Update windows_application_whitelisting_bypass_attempt_via_rundll32.yml

* More updates and fixes

* update `Windows Change Default File Association For No File Ext`

* A couple more updates for ya

* rename

* add / update rules

* Update windows_symlink_evaluation_change_via_fsutil.yml

* Update windows_symlink_evaluation_change_via_fsutil.yml

* Update linux_service_started_or_enabled.yml

* Update linux_service_started_or_enabled.yml

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2025-10-13 09:18:21 -07:00
Br3akp0int e41bd98cb9 fix_net_profile_analytic (#3689) 
* fix_net_profile_analytic

* fix_net_profile_analytic

* fix_net_profile_analytic

* fix_net_profile_analytic

* fix_net_profile_analytic

* fix_net_profile_analytic

* fix_net_profile_analytic

* Update windows_set_network_profile_category_to_private_via_registry.yml

* Update deprecation_mapping.YML

* Remove deprecated web fraud detection mapping

Removed deprecated analytic story for web fraud detection.

---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2025-10-10 17:20:14 +00:00
Bhavin Patel a69230f087 removing staged detection 2025-08-26 09:46:54 -07:00
Bhavin Patel 5097cd5fef removed detections and version bump 2025-08-06 14:08:17 -05:00
Bhavin Patel 2c6248de85 updating based on request from Ryan Long 2025-08-04 13:56:35 -05:00
Bhavin Patel 3666bfa9f4 prep for next release 2025-07-09 11:25:06 -07:00
Nasreddine Bencherchali cb8f4bb6f3 Update removed/deprecation_mapping.YML 2025-07-07 17:13:15 +02:00
Nasreddine Bencherchali f49bd318d9 update time 🚀 2025-06-30 13:55:55 +02:00
Eric McGinnis 81efb271c3 fixed status of newly removed detection 2025-06-17 12:47:33 -07:00
Eric McGinnis 64aac40e82 Remove deprecated detections in line with prepublished guidance 2025-06-17 12:44:39 -07:00
Nasreddine Bencherchali 6c5aa91dbf more updates 2025-06-16 23:38:10 +02:00
Eric McGinnis 23d0f236b5 Move deprecated detections to removed. update status too 2025-05-08 14:52:52 -07:00
Bhavin Patel 7742f511b3 Merge branch 'develop' into deprecate_rmm_hunt 2025-05-01 11:53:34 -07:00
Bhavin Patel a7f0e38586 updating removed in version 2025-05-01 11:33:07 -07:00
Bhavin Patel 884eede4ce updating search 2025-04-30 12:14:30 -07:00
Nasreddine Bencherchali eb99c36454 Update deprecation_mapping.YML 2025-04-24 19:48:12 +02:00
Nasreddine Bencherchali 44b110d9e6 update date and deprecation replacement 2025-04-24 19:43:37 +02:00
Nasreddine Bencherchali ce07cb9ded Update deprecation_mapping.YML 2025-04-24 19:40:31 +02:00
Nasreddine Bencherchali 75cb7af28d Update deprecation_mapping.YML 2025-04-24 19:14:31 +02:00
Nasreddine Bencherchali 194d99c655 Update deprecation_mapping.YML 2025-04-24 18:55:29 +02:00
Nasreddine Bencherchali 5676c6691c Update deprecation_mapping.YML 2025-04-24 18:36:06 +02:00
Bhavin Patel f26d6beda1 updating yaml 2025-04-18 13:42:29 -07:00
Bhavin Patel 93a1b752fe updating this detection 2025-04-18 13:35:11 -07:00
Bhavin Patel 3e51bbca2c updating replacement name 2025-04-16 15:29:16 -07:00
Bhavin Patel 5c7c567a3f updating status 2025-04-16 15:07:32 -07:00
Bhavin Patel 1a8c89957b baseline to removed 2025-04-16 15:00:47 -07:00
Bhavin Patel e424e64086 remove private from this mapping 2025-04-16 13:20:07 -07:00