admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
28,119 Commits 697 Branches 195 Tags
push_security
Commit Graph

28119 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Bhavin Patel 9584988e94 Merge branch 'develop' into push_security 2026-05-12 14:12:36 +05:30
Bhavin Patel d37930351c Bump contentctl.yml to 6.0.0 (#4067) 
* chore: bump contentctl.yml to 5.28.0

* Update contentctl.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

---------

Co-authored-by: research bot <research@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-05-12 11:19:34 +05:30
Bhavin Patel 76dbdce682 Updated TAs (#4069) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-05-07 19:32:10 +05:30
Lou Stella 9c183fa110 Update Analytics to Support ATT&CK v19 (#4036) 
---------

Co-authored-by: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
v5.27.0 		2026-05-05 17:29:28 +02:00
Raven Tait 917fe77cc0 Add Big Batch of Snap Attack Converted Rules (#4015) 
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
 2026-05-05 16:11:18 +02:00
Raven Tait 4d4c7ee091 Add Analytic for Copy Fail (#4063) 
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-05-05 03:13:57 +02:00
p4t12ick a9aaf494f6 Improved detections based on telemetry data (#4011) 
---------

Co-authored-by: P4T12ICK <pbareiss@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-05-04 13:31:26 +02:00
Bhavin Patel ccc7f9bfd0 Updated TAs (#4055) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-05-02 13:04:05 +02:00
Bhavin Patel 9335358685 Merge branch 'develop' into push_security 2026-04-30 17:05:37 +05:30
Bhavin Patel becdb58b9f Add Secure Access Firewall Detections (#3986) 
---------

Co-authored-by: Lou Stella <ljstella@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-04-29 20:41:09 +02:00
jwindley c5e9d4a573 Fixed two detections, and improved macos keychain dumping for more coverage of the technique (#4034) 
* Fix and improve azure high-risk sign-in, curl percent-encoded URL, and macOS keychain dump detections

* Apply suggestions from code review

* Update azure_active_directory_high_risk_sign_in.yml

* Update curl_execution_with_percent_encoded_url.yml

* beautify spl

* Update macos_keychains_dumped.yml

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-04-29 15:20:25 +02:00
Br3akp0int 9972c09298 vip_keylogger (#4024) 
* vip_keylogger

* vip_keylogger

* vip_keylogger

* vip_keylogger

* vip_keylogger

* vip_keylogger

* vip_keylogger

* vip_keylogger

* vip_keylogger

* vip_keylogger

* Update vip_keylogger.yml

* Update windows_proxy_execution_of__net_utilities_via_scripts.yml

* Update windows_anomalous_registry_value_length_in_environment_key.yml

* Update powershell_loading_dotnet_into_memory_via_reflection.yml

* Update executables_or_script_creation_in_temp_path.yml

* Update executables_or_script_creation_in_suspicious_path.yml

* Update powershell_pinvoke_process_injection_api_chain.yml

* vip_keylogger

* Update powershell_environment_variable_execution.yml

* Update windows_anomalous_registry_value_length_in_environment_key.yml

* Update windows_anomalous_registry_value_length_in_environment_key.yml

---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-04-29 17:55:13 +05:30
Lou Stella b12fbf3ba0 Merge pull request #4035 from splunk/playbook_update 
Playbook Updates
 2026-04-28 13:17:31 -04:00
ljstella 75a07833e7 Quotes, ugh. 2026-04-28 11:43:00 -04:00
ljstella 4c48e608dc Pinning ATT&CK 2026-04-28 11:40:32 -04:00
ljstella 7b6dab17f4 SOARHELP-6700 2026-04-28 10:47:57 -04:00
Bhavin Patel 1e1748cec6 Updated TAs (#4033) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-04-28 11:25:21 +02:00
Bhavin Patel 3e040d77b6 yaml failures 2026-04-28 11:36:33 +05:30
Bhavin Patel 3c9904cac4 adding 1st detection and files 2026-04-28 10:35:06 +05:30
Bhavin Patel a94a743b63 Automated Splunk TA Update 610 (#4029) 
---------

Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
Co-authored-by: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
 2026-04-24 08:36:18 +00:00
Bhavin Patel e98b868b8d chore: bump contentctl.yml to 5.27.0 (#4028) 
Co-authored-by: research bot <research@splunk.com>
 2026-04-24 10:34:16 +02:00
Bhavin Patel 063a6fc38b Updated TAs (#4026) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-04-23 10:16:37 +05:30
Lou Stella 8c50bcae82 Merge pull request #4025 from splunk/kbouchard-patch-1 
Delete response_templates/NIST80061_v2.json
v5.26.0 		2026-04-21 15:29:52 -04:00
kbouchard b27f1889ac Delete response_templates/NIST80061_v2.json 
Remove Unwanted Response Template that will cause customer confusion.  The plan out there will start with v3.
 2026-04-21 08:11:45 -07:00
Bhavin Patel 6ee1a47e71 Updated TAs (#4022) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-04-20 12:18:40 +02:00
Lou Stella 4de7141a2b Merge pull request #4019 from splunk/dependabot_TA_update 
data sources dependabot bug
 2026-04-17 09:36:22 -04:00
Bhavin Patel 3337b9cd55 adding content.yml 2026-04-17 18:07:45 +05:30
Bhavin Patel 55f8c51579 update commit paths 2026-04-17 18:03:32 +05:30
Bhavin Patel ba59855b1d updating risk drilldowns (#4016) 
* updating drilldows

* inspect failures

* updating versions

* updating versins

* chore: empty commit to trigger CI
 2026-04-17 17:28:53 +05:30
Nasreddine Bencherchali ea5bd52238 Fix Issues - 2nd Round (#3996) 
* Fix #3993

* Fix incorrect DS entries

* fix security_domain issue

* Fix #3992

* Fix #3988

* Update dump_lsass_via_procdump.yml

* Fix #3987

* Fix #3977

* Update network_connection_discovery_with_arp.yml

* Fix #3998

* Fix #3997

* fix versions

* revert change

* Fix #4012

* Update linux_file_creation_in_init_boot_directory.yml

* Update linux_file_creation_in_init_boot_directory.yml

* Fix #4010 and related

* fix typo

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-04-16 05:24:43 +00:00
Andrei Banaru c6241660c7 Remove missing fields in Windows Event Log Cleared detection (#4001) 
* fix: remove missing fields in Windows Event Log Cleared detection

* fix: source should be XmlWinEventLog:System

* update ds and output fields

* Update windows_event_log_security_1102.yml

---------

Co-authored-by: Andrei Banaru <a.banaru@iaea.org>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-04-16 10:52:16 +05:30
Lou Stella 7c439aeda8 Merge pull request #4018 from splunk/5.25.1_changes_for_develop 2026-04-15 18:23:32 -04:00
pyth0n1c 3c16b138e6 Merge branch 'develop' into 5.25.1_changes_for_develop 2026-04-15 15:11:36 -07:00
Eric McGinnis 6a8bfe977c Fix version and date and update contentctl version in prep for release. v5.25.1 2026-04-15 12:00:44 -07:00
jwindley 80b29d6651 New MacOS detections T1016 (#4017) 
* New MacOS detections T1016

* Fix pre-commit formatting issues

* Fix based on Bhavin's comments

* update version

* Update linux_system_network_discovery.yml

* Update macos_list_firewall_rules.yml

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
 2026-04-15 23:36:58 +05:30
Bhavin Patel c90d744007 Duplicate - Microsoft Intune Bulk Wipe Detected (#4014) 
* updating search

* Update microsoft_intune_bulk_wipe_detected.yml

* Rename microsoft_intune_bulk_wipe_detected.yml to microsoft_intune_bulk_wipe.yml

* Update microsoft_intune_bulk_wipe.yml

* Update detections/cloud/microsoft_intune_bulk_wipe.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* updating refs

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-04-15 23:08:02 +05:30
Bhavin Patel 48698cbc4f updating osquery (#4013) 2026-04-15 12:39:38 +02:00
Raven Tait 8050483569 Snap Mac Detections (#3935) 
* Snap Mac Detections

* add osquery

* Update links and formatting

* update datasource name

* update formatting

* bump version

* Updates per PR comments

* Add commandline to RBA for gatekeeper bypass

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
 2026-04-14 19:48:42 +05:30
Lou Stella 8d2510235b Spelling Fixes (#4002) 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-04-13 13:38:11 +02:00
Lou Stella aa672c674a Pushing deprecations (#4003) 2026-04-09 12:12:20 +02:00
Lou Stella 290486b6fe Merge pull request #3994 from splunk/update-template-script-2 2026-04-07 07:29:09 -05:00
Henry Yu e182e32f51 quote the file 2026-04-06 21:04:14 -07:00
Henry Yu e791773e97 unquote the file 2026-04-06 20:44:11 -07:00
Lou Stella 6e75fc6407 Merge pull request #3991 from splunk/update-template-script 2026-04-06 17:05:24 -05:00
Lou Stella 806f6bdd32 Merge branch 'develop' into update-template-script 2026-04-06 17:03:05 -05:00
Lou Stella 95b35f77c1 Merge pull request #3990 from splunk/kbouchard-patch-1 2026-04-06 17:02:40 -05:00
Lou Stella 93cb3bedd9 Merge branch 'develop' into kbouchard-patch-1 2026-04-06 16:59:28 -05:00
Henry Yu 9b5c9aa7b9 remove the ignore . file change 2026-04-06 14:47:08 -07:00
Henry Yu 924a89e249 add validation for unique name, version pair 2026-04-02 13:06:15 -07:00
Henry Yu 9bc34d412f group by actual template names instead of file name 2026-04-02 12:38:37 -07:00