Raven Tait 498a80d469 Detections for default user agents (#3842) ...

* Detections for default user agents

* various updates for user agent detections

* Apply suggestions from code review

* Rename suspicious_user_agent.yml to suspicious_user_agents.yml

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

2026-01-07 09:34:04 +05:30

..

access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

adobe_coldfusion_access_control_bypass.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

adobe_coldfusion_unauthenticated_arbitrary_file_read.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

cisco_ios_xe_implant_access.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

citrix_adc_and_gateway_citrixbleed_2_memory_disclosure.yml

add ftd equivalent analytic

2025-07-17 20:43:29 +02:00

citrix_adc_and_gateway_unauthorized_data_disclosure.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

citrix_adc_exploitation_cve_2023_3519.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

citrix_sharefile_exploitation_cve_2023_24489.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

confluence_cve_2023_22515_trigger_vulnerability.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

confluence_data_center_and_server_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

connectwise_screenconnect_authentication_bypass.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

crushftp_authentication_bypass_exploitation.yml

Hellcat United (#3723)

2025-10-16 16:53:02 -07:00

crushftp_max_simultaneous_users_from_ip.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_attackers_scanning_for_vulnerable_jboss_servers.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_f5_tmui_rce_cve_2020_5902.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_malicious_requests_to_exploit_jboss_servers.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_remote_access_software_usage_url.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

detect_web_access_to_decommissioned_s3_bucket.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

exploit_public_facing_application_via_apache_commons_text.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

exploit_public_facing_fortinet_fortinac_cve_2022_39952.yml

Hellcat United (#3723)

2025-10-16 16:53:02 -07:00

f5_tmui_authentication_bypass.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

fortinet_appliance_auth_bypass.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

high_volume_of_bytes_out_to_url.yml

Hellcat United (#3723)

2025-10-16 16:53:02 -07:00

http_duplicated_header.yml

HTTP Request Smuggling (#3731)

2025-10-21 14:08:57 -07:00

http_possible_request_smuggling.yml

HTTP Request Smuggling (#3731)

2025-10-21 14:08:57 -07:00

http_rapid_post_with_mixed_status_codes.yml

HTTP Request Smuggling (#3731)

2025-10-21 14:08:57 -07:00

http_request_to_reserved_name_on_iis_server.yml

HTTP Request Smuggling (#3731)

2025-10-21 14:08:57 -07:00

http_scripting_tool_user_agent.yml

Detections for default user agents (#3842)

2026-01-07 09:34:04 +05:30

hunting_for_log4shell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

ivanti_connect_secure_command_injection_attempts.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

ivanti_connect_secure_ssrf_in_saml_component.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

ivanti_connect_secure_system_information_access_via_auth_bypass.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

ivanti_epm_sql_injection_remote_code_execution.yml

version bumps (#3732)

2025-10-17 11:15:52 -07:00

ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

ivanti_sentry_authentication_bypass.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

java_class_file_download_by_java_user_agent.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

jenkins_arbitrary_file_read_cve_2024_23897.yml

Hellcat United (#3723)

2025-10-16 16:53:02 -07:00

jetbrains_teamcity_authentication_bypass_cve_2024_27198.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

jetbrains_teamcity_authentication_bypass_suricata_cve_2024_27198.yml

Hellcat United (#3723)

2025-10-16 16:53:02 -07:00

jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

jetbrains_teamcity_rce_attempt.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

juniper_networks_remote_code_execution_exploit_detection.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

log4shell_jndi_payload_injection_attempt.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

log4shell_jndi_payload_injection_with_outbound_connection.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

microsoft_sharepoint_server_elevation_of_privilege.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

monitor_web_traffic_for_brand_abuse.yml

Update Macro Usage (#3840)

2025-12-18 21:42:06 +05:30

multiple_archive_files_http_post_traffic.yml

version bumps (#3732)

2025-10-17 11:15:52 -07:00

nginx_connectwise_screenconnect_authentication_bypass.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

papercut_ng_remote_web_access_attempt.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

plain_http_post_exfiltrated_data.yml

APT 37 and The No Good Rustonotto (#3686)

2025-10-13 13:54:03 -07:00

proxyshell_proxynotshell_behavior_detected.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

sap_netweaver_visual_composer_exploitation_attempt.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

spring4shell_payload_url_request.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

sql_injection_with_long_urls.yml

GhostRedirectors

2025-09-18 13:39:40 -06:00

supernova_webshell.yml

GhostRedirectors

2025-09-18 13:39:40 -06:00

tomcat_session_deserialization_attempt.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

tomcat_session_file_upload_attempt.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

unusually_long_content_type_length.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

vmware_aria_operations_exploit_attempt.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

vmware_server_side_template_injection_hunt.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

vmware_workspace_one_freemarker_server_side_template_injection.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

web_jsp_request_via_url.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

web_remote_shellservlet_access.yml

GhostRedirectors

2025-09-18 13:39:40 -06:00

web_spring4shell_http_request_class_module.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

web_spring_cloud_function_functionrouter.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_exchange_autodiscover_ssrf_abuse.yml

Updated docs links in detections

2025-06-24 11:27:59 -05:00

windows_iis_server_pswa_console_access.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_sharepoint_spinstall0_get_request.yml

Create windows_sharepoint_spinstall0_get_request.yml

2025-07-21 09:28:05 -06:00

windows_sharepoint_toolpane_endpoint_exploitation_attempt.yml

Update windows_sharepoint_toolpane_endpoint_exploitation_attempt.yml

2025-07-21 13:11:43 -06:00

wordpress_bricks_builder_plugin_rce.yml

Hellcat United (#3723)

2025-10-16 16:53:02 -07:00

ws_ftp_remote_code_execution.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

zscaler_adware_activities_threat_blocked.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

zscaler_behavior_analysis_threat_blocked.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

zscaler_cryptominer_downloaded_threat_blocked.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

zscaler_employment_search_web_activity.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

zscaler_exploit_threat_blocked.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

zscaler_legal_liability_threat_blocked.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

zscaler_malware_activity_threat_blocked.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

zscaler_phishing_activity_threat_blocked.yml

Hellcat United (#3723)

2025-10-16 16:53:02 -07:00

zscaler_potentially_abused_file_download.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

zscaler_privacy_risk_destinations_threat_blocked.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

zscaler_scam_destinations_threat_blocked.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

zscaler_virus_download_threat_blocked.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00