admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
27,823 Commits 697 Branches 195 Tags
test_svc
Commit Graph

27823 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Bhavin Patel 9663e97c73 updating app to 9.1.0 2025-11-06 15:21:37 -08:00
Bhavin Patel 136c5a0981 testing 2025-11-06 13:48:58 -08:00
lyonheart14 5b8befee38 Removed grouping by dest (#3759) 
* Removed grouping by dest

Grouping by the 'dest' field causes the search to filter out alerts where dest is empty (which doesn't make sense with the base search stipulating user="*" or dest="*"). Filtering out alerts where dest doesn't contain a value can be done with the filter macro.

* adding values(dest) before by clause

* version, date, author update

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2025-11-05 11:17:48 -08:00
Bhavin Patel d1a15f9e91 Ollama TA (#3757) 
* updating ta

* updating weird things
 2025-11-05 09:50:50 -08:00
Bhavin Patel d401d3a33b updating raw log (#3756) 2025-11-04 13:17:53 -08:00
Bhavin Patel bd66e7a1d3 remove TA (#3755) 2025-11-04 11:05:19 -08:00
Lou Stella c664c282b9 Merge pull request #3748 from splunk/dependabot/github_actions/actions/upload-artifact-5 
Bump actions/upload-artifact from 4 to 5
 2025-10-30 12:36:44 -05:00
dependabot[bot] 6f3c42cac5 Bump actions/upload-artifact from 4 to 5 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 5.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-10-30 17:30:15 +00:00
Bhavin Patel c5413e93f2 updating version and removing detections (#3749) 2025-10-30 10:29:04 -07:00
Bhavin Patel 437a5cdf62 revert - Splunk Add-on for Microsoft Security (#3747) 
* revert this app

* revert versions
v5.17.0 		2025-10-27 15:38:58 -07:00
Br3akp0int d2ca19aab5 detection_fixed (#3746) 
* detection_fixed

* detection_fixed

* detection_fixed

* Update deprecation_mapping.YML

---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2025-10-27 10:23:56 -07:00
Michael Haag 58bf9a1bc8 WSUSpect in Custody: CVE-2025-59287 (#3743) 
* WSUSpect in Custody: CVE-2025-59287

* WSUS and Updates

* :jt_stare:

* Update windows_wsus_spawning_shell.yml

* Update w3wp_spawning_shell.yml

* deprecate rules and map analytic stories

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2025-10-27 09:48:44 -07:00
Nasreddine Bencherchali 9fc8942993 New Rules & Updates - Oct 25 (#3726) 
* new rules and updates

* fix issues with ci

* rename for accurate macro

* update description and logic

* new wbadmin rule and fix pwsh dataset

* more updates for the weekend

* update network rules filters

* downgrade versions

* Update windows_file_transfer_protocol_in_non_common_process_path.yml

* add missing DS for some rules

* update nirsoft lookup and add new rules

* update more nirsoft stuff

* update snort message

* Update cisco_secure_firewall_filetype_lookup.yml

* new analytic and updates / incl. fix #3730

* Update detect_new_local_admin_account.yml

* add lnx dataset and fix wildcards
 2025-10-24 14:19:48 -07:00
Nasreddine Bencherchali 0227a4f5f1 Add Oracle Exploitation Snort Coverage (#3742) 
* add oracle snort coverage

* fix refs

* Update cisco_secure_firewall___oracle_e_business_suite_exploitation.yml
 2025-10-23 14:49:04 -07:00
Raven Tait 7c092c7eb6 HTTP Request Smuggling (#3731) 
* HTTP Request Smuggling

* Updates from PR comments

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2025-10-21 14:08:57 -07:00
Bhavin Patel 66aa9e9232 Duplicate - 3737 (#3738) 
* deprecate detection

* yaml fix

* Update possible_lateral_movement_powershell_spawn.yml

* Update detections/deprecated/wmiprsve_lolbas_execution_process_spawn.yml

* Update detections/endpoint/wmiprvse_lolbas_execution_process_spawn.yml

* Update removed/deprecation_mapping.YML

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2025-10-21 12:42:28 -07:00
Michael Haag 7b9274f9fb Scattered Lapsus$ Hunters (#3724) 
* Scattered Lapsus$ Hunters

* fixes

* 👀

* bump versions

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2025-10-21 11:27:25 -07:00
Bhavin Patel 1286d0fcd8 ctl_bump (#3734) 2025-10-17 12:25:15 -07:00
Bhavin Patel 22da3767c5 version bumps (#3732) 2025-10-17 11:15:52 -07:00
Michael Haag a548ed769a Hellcat United (#3723) 
* Hellcat United

* fixes

* 🍱

* 1 mas

* Update powershell_4104_hunting.yml
 2025-10-16 16:53:02 -07:00
Michael Haag 64ed5bb1e8 APT 37 and The No Good Rustonotto (#3686) 
* APT 37 and The No Good Rustonotto

## Updated analytics
```
detections/application/detect_html_help_spawn_child_process.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/bitsadmin_download_file.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/cobalt_strike_named_pipes.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_html_help_renamed.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_html_help_url_in_command_line.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_mshta_inline_hta_execution.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_mshta_renamed.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_mshta_url_in_command_line.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_rundll32_inline_hta_execution.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/executables_or_script_creation_in_temp_path.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/icedid_exfiltrated_archived_file_creation.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/lolbas_with_network_traffic.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/powershell_4104_hunting.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/processes_tapping_keyboard_events.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/registry_keys_used_for_persistence.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/suspicious_curl_network_connection.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/suspicious_image_creation_in_appdata_folder.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/suspicious_mshta_spawn.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/suspicious_process_executed_from_container_file.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/suspicious_scheduled_task_from_public_directory.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_alternate_datastream___base64_content.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_archive_collected_data_via_powershell.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_archive_collected_data_via_rar.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_archived_collected_data_in_temp_folder.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_cab_file_on_disk.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_curl_download_to_suspicious_path.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_file_download_via_powershell.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_high_file_deletion_frequency.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_http_network_communication_from_msiexec.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_indicator_removal_via_rmdir.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_input_capture_using_credential_ui_dll.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_iso_lnk_file_creation.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_office_product_spawned_child_process_for_download.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_office_product_spawned_uncommon_process.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_process_executed_from_removable_media.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_process_execution_from_programdata.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_process_injection_into_notepad.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_replication_through_removable_media.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_scheduled_task_with_suspicious_command.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_scheduled_task_with_suspicious_name.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_screen_capture_in_temp_folder.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_screen_capture_via_powershell.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_service_created_with_suspicious_service_path.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_suspicious_driver_loaded_path.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_usbstor_registry_key_modification.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_wpdbusenum_registry_key_modification.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/winevent_scheduled_task_created_within_public_path.yml — APT37 Rustonotto and FadeStealer
detections/web/multiple_archive_files_http_post_traffic.yml — APT37 Rustonotto and FadeStealer
detections/web/plain_http_post_exfiltrated_data.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_expand_cabinet_file_extraction.yml — APT37 Rustonotto and FadeStealer
```

## New Story

```
stories/apt37_rustonotto_and_fadestealer.yml — APT37 Rustonotto and FadeStealer
```

* Create windows_expand_cabinet_file_extraction.yml

* Apply suggestion from @nasbench

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_expand_cabinet_file_extraction.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_expand_cabinet_file_extraction.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_expand_cabinet_file_extraction.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* updating conflicts

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
v5.16.0 		2025-10-13 13:54:03 -07:00
Rod Soto 0bcb54b6f9 Ollama TA detections (#3710) 
* commit1oll

* olldet2

* olldet3

* fixeddet3

* fixsp

* olldet4

* olldet5

* detoll6

* olldet7

* olldet8

* datasets

* testfixes

* modifiedtasearch

* lotsofixes

* fixednewta

* addedmorerefs

* fixedatasource

* fixedthreatobject

* fixedetectionandalertmessage

* fixedalermessage

* fixedquotes

* fixedhowtoimp

* fixeddescriptionandhowto

* changedestforuripat

* fixedowasplink

* Update detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/application/ollama_possible_rce_via_model_loading.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* protoexnassuggestions

* mionr

* remove index=*

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
 2025-10-13 21:54:37 +02:00
Rod Soto 6cf5b0f8f6 Copilot based Detections (#3693) 
* det1

* fixeddt1

* det2

* d3

* det4

* djbk

* d6

* d7

* d8

* addedlnkds

* fixsctype

* pipegone

* fixp

* fixdevices

* jbfix

* datasetfix

* exp

* fixsynthax

* changedstory

* changeprinus

* improvedht

* changedSenderuser

* datas

* fixdoublesearch

* fixedpi

* fixeddescriptionsuser

* fixdatalink

* exportedlogsdatasource

* fixedhowtodatasource

* updating risk stuff

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
 2025-10-13 12:14:09 -07:00
Nasreddine Bencherchali 547be58923 Update windows_ad_self_dacl_assignment.yml (#3721) 
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2025-10-13 09:30:50 -07:00
Nasreddine Bencherchali 21ee673940 Fix Issues & Updates (#3705) 
* Fix Issues and Updates

* Update add_or_set_windows_defender_exclusion.yml

* Update windows_curl_download_to_suspicious_path.yml

* Fix more issues and bugs

* Update deprecation_mapping.YML

* Update windows_application_whitelisting_bypass_attempt_via_rundll32.yml

* More updates and fixes

* update `Windows Change Default File Association For No File Ext`

* A couple more updates for ya

* rename

* add / update rules

* Update windows_symlink_evaluation_change_via_fsutil.yml

* Update windows_symlink_evaluation_change_via_fsutil.yml

* Update linux_service_started_or_enabled.yml

* Update linux_service_started_or_enabled.yml

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2025-10-13 09:18:21 -07:00
Bhavin Patel ae022339ac Remove manual test (#3717) 
* remove manual test

* Update potential_password_in_username.yml
 2025-10-10 11:51:50 -07:00
Br3akp0int a52d560c80 lokibot (#3701) 
* lokibot

* lokibot

* lokibot

---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2025-10-10 18:32:18 +00:00
Br3akp0int e41bd98cb9 fix_net_profile_analytic (#3689) 
* fix_net_profile_analytic

* fix_net_profile_analytic

* fix_net_profile_analytic

* fix_net_profile_analytic

* fix_net_profile_analytic

* fix_net_profile_analytic

* fix_net_profile_analytic

* Update windows_set_network_profile_category_to_private_via_registry.yml

* Update deprecation_mapping.YML

* Remove deprecated web fraud detection mapping

Removed deprecated analytic story for web fraud detection.

---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2025-10-10 17:20:14 +00:00
Nasreddine Bencherchali 86f5ad09e2 Merge pull request #3719 from splunk/auto-ta-update-414 
Automated Splunk TA Update 414
 2025-10-10 11:39:36 +02:00
patel-bhavin 5f36e1ea07 Updated TAs 2025-10-10 06:57:53 +00:00
pyth0n1c 7cb7c973cf bump contentctl version to latest (#3718) 
in support of new playbooks
 2025-10-09 15:46:34 -07:00
Bhavin Patel 188099c364 Merge pull request #3715 from splunk/auto-ta-update-413 
Automated Splunk TA Update 413
 2025-10-09 08:37:24 -07:00
patel-bhavin 73097a131f Updated TAs 2025-10-09 06:58:04 +00:00
Lou Stella 1a9c8ffbd6 Merge pull request #3713 from splunk/auto-ta-update-412 
Automated Splunk TA Update 412
 2025-10-08 08:13:50 -05:00
patel-bhavin 50284777f7 Updated TAs 2025-10-08 06:57:56 +00:00
Bhavin Patel 64a821213e Merge pull request #3712 from splunk/auto-ta-update-411 
Automated Splunk TA Update 411
 2025-10-07 10:04:27 -07:00
patel-bhavin 96cfc3ee82 Updated TAs 2025-10-07 06:58:20 +00:00
Bhavin Patel 342f49f82d Merge pull request #3711 from splunk/auto-ta-update-410 
Automated Splunk TA Update 410
 2025-10-06 09:21:16 -07:00
patel-bhavin 807bd7730e Updated TAs 2025-10-06 06:58:11 +00:00
Bhavin Patel 5b9a84c3f0 Merge pull request #3707 from splunk/auto-ta-update-406 
Automated Splunk TA Update 406
 2025-10-02 09:27:31 -07:00
patel-bhavin 4f4485d8bd Updated TAs 2025-10-02 06:58:12 +00:00
Bhavin Patel 60060eda68 Merge pull request #3688 from splunk/issue_2980 
issue_2980
 2025-10-01 11:46:08 -07:00
Bhavin Patel 55980f5867 Merge branch 'develop' into issue_2980 2025-10-01 11:45:03 -07:00
Bhavin Patel b156c3607a Merge pull request #3683 from splunk/ctl_515 
Issue - 3677
 2025-10-01 11:44:38 -07:00
Bhavin Patel e6cb8bc384 Merge branch 'develop' into ctl_515 2025-09-30 11:57:33 -07:00
Bhavin Patel 68e7778b8a Update azure_ad_multi_source_failed_authentications_spike.yml 2025-09-29 14:45:01 -07:00
Bhavin Patel a64e29cbcc Merge branch 'develop' into issue_2980 2025-09-29 14:44:43 -07:00
Bhavin Patel dcc0850ba3 Merge pull request #3679 from splunk/promptlock 
promptlock
 2025-09-29 13:54:28 -07:00
Bhavin Patel 52b42c0da9 Merge branch 'develop' into promptlock 2025-09-29 13:31:36 -07:00
Bhavin Patel 57afb6b9b7 Merge pull request #3691 from splunk/fix-issue-3690 
Fix #3690
 2025-09-29 13:30:41 -07:00