admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
27,943 Commits 697 Branches 195 Tags
f6ea72fa204496d50042e5ef05be4e65a026b1e1
Commit Graph

27943 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Eric McGinnis f6ea72fa20 bump dates and verisons 2026-01-28 11:54:20 -08:00
Eric McGinnis 5786c3164f Accidentally renamed extension for file 2026-01-28 11:47:22 -08:00
Eric McGinnis adba89740a fix wrong format failing validations 2026-01-28 11:44:39 -08:00
pyth0n1c 0f9014f4b6 Merge branch 'develop' into yml_validation_cleanups 2026-01-28 11:36:47 -08:00
Bhavin Patel 29ece397e8 Update Outlook writing zip Analytic (#3877) 
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-01-28 13:49:21 +01:00
Alex f1693a1a0a Fix search typo in windows abused web services analytic (#3878) 2026-01-24 14:38:30 +01:00
Bhavin Patel 060feb0a42 Updating Query Based on XS Data (#3876) 2026-01-23 15:49:23 +01:00
Bhavin Patel d080ba9f06 Updating Terminology for ES8+ (#3875) 
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-01-22 22:59:29 +01:00
Michael Haag b6b0b47a66 Storm-0501 Ransomware Analytic Story and Tagging (#3871) 
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
 2026-01-22 22:32:14 +01:00
Michael Haag d08d829807 VoidLink Tagging (#3870) 
* VoidLink

* Update linux_adding_crontab_using_list_parameter.yml

* version

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-01-22 19:53:15 +05:30
Br3akp0int 73e69c0b84 stealc (#3833) 
* stealc

* stealc

* stealc

* updating versions

---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
 2026-01-22 18:51:16 +05:30
Emil 9c9482bfb9 Additional information in Risk Message for Services LOLBAS spawn detection (#3874) 
* Adding process_name to risk_message as this gives a better further insigth into the LOLBAS activity observed

* Ensuring message is a string

* Adding suggestions from @nasbench, sticking with process as threat_object as this gives the most information, also bumping version and date

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-01-22 12:38:58 +00:00
Nasreddine Bencherchali 76f629eb2f Update Analytics Performance (#3866) 
* Update common_ransomware_notes.yml

* Update detect_rare_executables.yml

* update samsam ext

* update where clause to include null checks

* appinspect fixes

* reduce version

* fix where issue

* Update ransomware_notes_lookup.csv

* more perf enhancements

* Update windows_dotnet_binary_in_non_standard_path.yml

* fix ci issue and enhance description

* Update common_ransomware_extensions.yml

* Update common_ransomware_extensions.yml

* remove unknown and dash values

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-01-22 12:36:31 +00:00
Bhavin Patel ce2de7a83c chore: bump contentctl.yml to 5.21.0 (#3872) 
Co-authored-by: research bot <research@splunk.com>
 2026-01-21 16:04:40 +01:00
Oliver Springer 2008331fbb O365 - Expand Detection of New MFA Devices (#3868) 
* Also detect the registration of new mobile authenticator apps

* Update o365_new_mfa_method_registered.yml

---------

Co-authored-by: Oliver Springer <9538543+JTweet@users.noreply.github.com>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
v5.20.0 		2026-01-20 09:22:23 +05:30
Lou Stella d51b057f0b Merge pull request #3865 from LaLaGuy/patch---ESCU---Prohibited-Network-Traffic-Allowed---Rule 
Refactor search query for prohibited network traffic
 2026-01-16 13:35:52 -06:00
ljstella c84715dd99 New Year, New Fixes 2026-01-16 13:19:35 -05:00
Lou Stella 0fd8a68691 Merge branch 'develop' into patch---ESCU---Prohibited-Network-Traffic-Allowed---Rule 2026-01-16 11:24:33 -06:00
LaLaGuy 4ce7a1ddcc Update version and date in prohibited network traffic config 2026-01-16 16:45:48 +01:00
Raven Tait 20b0368e51 Added New HijackLibs Entry (#3864) 
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-01-15 20:40:42 +01:00
LaLaGuy f9e8e6e601 Fix formatting and syntax in prohibited network traffic YAML 
space to activate CI.
 2026-01-15 19:59:08 +01:00
LaLaGuy e2443809bb Refactor search query for prohibited network traffic 
### **Describe the bug**
When interesting_ports_lookup is used, only the port is checked, not the protocol.
Plus, only the first result is returned.
This lookup include several entries for the same port (like 514 rsh/syslog) and the wrong entry can get returned.
This create false match. The wrong enrichment is given (including a wrong transport method) and a notable is generated when it shouldn't.
It can also be greatly optimized by moving the filter logic to the where of the tstats.

### **Expected behavior**
If a 514 udp is detected by the firewall, it should match syslog and not create a notable (or risk) telling me we detected a rsh 514 tcp.

### **Additional context**
Here is a solution (we get the transport from the log instead of adding it from the lookup, add transport to the match and move the filter logique up).
 2026-01-15 19:44:41 +01:00
Bhavin Patel 26b24aaa6e in prep for v5.20.0 (#3862) 2026-01-15 01:20:02 +05:30
Eric McGinnis 457ac84af8 rename deprecation mapping file 2026-01-13 22:22:15 -08:00
Bhavin Patel 5f2d1c77e1 fix (#3859) 2026-01-14 11:12:32 +05:30
Nasreddine Bencherchali 6cc12a9b29 Analytic Enhancements and Fixes (#3850) 
* update `Windows LOLBAS Executed Outside Expected Path`

* Update suspicious_email_attachment_extensions.yml

* update susp extension lookup

* some additional fixes

* Update system_processes_run_from_unexpected_locations.yml

* small changes

* Update detect_rtlo_in_file_name.yml

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-01-12 18:36:12 +05:30
Br3akp0int 49673747bf Add Browser Hijack Analytics (#3841) 
---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-01-12 13:05:22 +01:00
Nasreddine Bencherchali 7941673530 Add Snort/IOS Correlation and Other Things (#3857) 2026-01-12 12:15:11 +01:00
Bhavin Patel 06db914290 Updated TAs (#3858) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-01-10 14:20:32 +01:00
Bhavin Patel 478ecc0a4b Updated TAs (#3856) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-01-09 20:23:37 +00:00
Lou Stella a56f85f2a7 Merge pull request #3843 from splunk/add_henry_allow_rt_schema_updates 
add henry and allow updates to response template openapi schema
 2026-01-09 13:38:03 -06:00
pyth0n1c 0c7bd266b4 Merge branch 'develop' into add_henry_allow_rt_schema_updates 2026-01-09 11:35:46 -08:00
Eric McGinnis b8ac2c2b8e migrate deprecation info 2026-01-09 11:17:23 -08:00
Bhavin Patel 1360c8df28 Merge branch 'develop' into yml_validation_cleanups 2026-01-09 14:25:37 +05:30
Eric McGinnis aca791beef remove mitre lookup as an apptemplate file so it can later be added as just a normal csvlookup. 2026-01-08 16:15:02 -08:00
Eric McGinnis bc46ab2f27 Remove the default.xml due to conflict. It is not required. 2026-01-08 15:46:21 -08:00
Bhavin Patel 3ca19718c6 minor changes to deprecation_mapping.YML‎ (#3855) 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-01-08 11:02:53 +00:00
Br3akp0int edd6db09d9 Add New Analytics Covering SesameOp and PromptFlux (#3827) 
---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-01-08 00:58:33 +01:00
Bhavin Patel 0f5eeb8ceb Updated TAs (#3854) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
 2026-01-07 10:17:04 +05:30
Raven Tait 498a80d469 Detections for default user agents (#3842) 
* Detections for default user agents

* various updates for user agent detections

* Apply suggestions from code review

* Rename suspicious_user_agent.yml to suspicious_user_agents.yml

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-01-07 09:34:04 +05:30
Br3akp0int af847b6343 Update Driver and Extensionless Files Related Detections (#3846) 
---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-01-06 02:02:25 +01:00
Bhavin Patel 6d1b940663 Cisco Isovalent - Add first batch of new detections (#3706) 
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-01-06 01:24:39 +01:00
Lou Stella ab6a3f046e Merge pull request #3852 from splunk/dependabot/github_actions/actions/checkout-6 
Bump actions/checkout from 5 to 6
 2025-12-23 10:12:26 -06:00
Lou Stella 3f62a1873f Merge branch 'develop' into dependabot/github_actions/actions/checkout-6 2025-12-23 10:08:37 -06:00
Lou Stella 497301220e Merge pull request #3851 from splunk/dependabot/github_actions/actions/upload-artifact-6 
Bump actions/upload-artifact from 5 to 6
 2025-12-23 10:07:50 -06:00
dependabot[bot] e2147cd6c4 Bump actions/checkout from 5 to 6 
Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-12-22 23:09:39 +00:00
dependabot[bot] 62403fcde4 Bump actions/upload-artifact from 5 to 6 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5 to 6.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-12-22 23:09:30 +00:00
pyth0n1c 3b49316ebd Merge branch 'develop' into yml_validation_cleanups 2025-12-22 13:21:53 -08:00
Eric McGinnis 0f1862c4eb add deprecation info to one detection 2025-12-22 13:21:40 -08:00
Nasreddine Bencherchali 7fe10bbef8 Move Unused Macros to Deprecate Sub-Folder (#3847) 2025-12-22 14:01:09 +01:00