Skip to content

Commit cc7ff7e

Browse files
nasbenchnasbench
committed
update status
1 parent 15bccc1 commit cc7ff7e

11 files changed

Lines changed: 22 additions & 22 deletions

‎removed/detections/powershell___connect_to_internet_with_hidden_window.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ name: PowerShell - Connect To Internet With Hidden Window
22
id: ee18ed37-0802-4268-9435-b3b91aaa18db
33
version: 17
44
creation_date: '2020-04-29'
5-
modification_date: '2026-06-04'
5+
modification_date: '2026-07-29'
66
author: David Dorsey, Michael Haag Splunk
7-
status: deprecated
7+
status: removed
88
type: Hunting
99
description: The following analytic detects PowerShell commands using the WindowStyle parameter to hide the window while connecting to the Internet. This behavior is identified through Endpoint Detection and Response (EDR) telemetry, focusing on command-line executions that include variations of the WindowStyle parameter. This activity is significant because it attempts to bypass default PowerShell execution policies and conceal its actions, which is often indicative of malicious intent. If confirmed malicious, this could allow an attacker to execute commands stealthily, potentially leading to unauthorized data exfiltration or further compromise of the endpoint.
1010
data_source:

‎removed/detections/regsvr32_with_known_silent_switch_cmdline.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ name: Regsvr32 with Known Silent Switch Cmdline
22
id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122
33
version: 15
44
creation_date: '2021-07-29'
5-
modification_date: '2026-06-09'
5+
modification_date: '2026-07-29'
66
author: Teoderick Contreras, Splunk
7-
status: deprecated
7+
status: removed
88
deprecation_info:
99
reason: Detection has been deprecated since its logic is already covered by another more improved detection.
1010
removed_in_version: 6.4.0

‎removed/detections/rundll32_createremotethread_in_browser.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ name: Rundll32 CreateRemoteThread In Browser
22
id: f8a22586-ee2d-11eb-a193-acde48001122
33
version: 11
44
creation_date: '2021-07-29'
5-
modification_date: '2026-06-29'
5+
modification_date: '2026-07-29'
66
author: Teoderick Contreras, Splunk
7-
status: deprecated
7+
status: removed
88
type: TTP
99
description: |-
1010
The following analytic detects the suspicious creation of a remote thread by rundll32.exe targeting browser processes such as firefox.exe, chrome.exe, iexplore.exe, and microsoftedgecp.exe.

‎removed/detections/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ name: Splunk App for Lookup File Editing RCE via User XSLT
22
id: a053e6a6-2146-483a-9798-2d43652f3299
33
version: 8
44
creation_date: '2023-11-16'
5-
modification_date: '2026-06-24'
5+
modification_date: '2026-07-29'
66
author: Rod Soto, Splunk
7-
status: deprecated
7+
status: removed
88
type: Hunting
99
description: The following analytic identifies the creation of lookup files in Splunk, which could indicate an attempt to exploit remote code execution via user-supplied XSLT. It leverages REST API queries to monitor the creation of these lookups, focusing on fields such as title, author, and access control lists. This activity is significant because it targets a known vulnerability in Splunk versions 9.1.x, potentially allowing attackers to execute arbitrary code. If confirmed malicious, this could lead to unauthorized code execution, compromising the integrity and security of the Splunk environment.
1010
data_source: []

‎removed/detections/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ name: Splunk Code Injection via custom dashboard leading to RCE
22
id: b06b41d7-9570-4985-8137-0784f582a1b3
33
version: 8
44
creation_date: '2022-12-19'
5-
modification_date: '2026-06-24'
5+
modification_date: '2026-07-29'
66
author: Rod Soto
7-
status: deprecated
7+
status: removed
88
type: Hunting
99
description: The following analytic identifies attempts to exploit a vulnerability in Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, where an authenticated user can execute arbitrary code via the dashboard PDF generation component. It detects this activity by analyzing events in the _internal index with the file=export parameter. This behavior is significant because it indicates a potential code injection attack, which could lead to remote code execution (RCE). If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary commands, and potentially compromise the entire Splunk environment.
1010
data_source: []

‎removed/detections/splunk_enterprise_kv_store_incorrect_authorization.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ name: Splunk Enterprise KV Store Incorrect Authorization
22
id: 8f0e8380-a835-4f2b-b749-9ce119364df0
33
version: 9
44
creation_date: '2024-01-22'
5-
modification_date: '2026-06-24'
5+
modification_date: '2026-07-29'
66
author: Rod Soto, Eric McGinnis, Chase Franklin
7-
status: deprecated
7+
status: removed
88
type: Hunting
99
description: The following analytic detects unauthorized attempts to reload Splunk KV Store collections via the REST API. It leverages internal index logs to identify POST requests to the `/servicesNS/nobody/search/admin/collections-conf/_reload` endpoint, focusing on status codes starting with '2'. This activity is significant as it may indicate improper permission handling, potentially leading to unauthorized deletion of KV Store collections. If confirmed malicious, this could result in data loss or unauthorized data manipulation, impacting the integrity and availability of critical Splunk data.
1010
data_source:

‎removed/detections/splunk_information_disclosure_on_account_login.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ name: Splunk Information Disclosure on Account Login
22
id: 2bae5d19-6d1b-4db0-82ab-0af5ac5f836c
33
version: 8
44
creation_date: '2024-07-01'
5-
modification_date: '2026-06-24'
5+
modification_date: '2026-07-29'
66
author: Rod Soto
7-
status: deprecated
7+
status: removed
88
type: Hunting
99
description: This is a composed hunting search that looks for possible user enumeration attempts when SAML is enabled on a Splunk instance by capturing different responses from server.
1010
data_source:

‎removed/detections/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ name: Splunk Path Traversal In Splunk App For Lookup File Edit
22
id: 8ed58987-738d-4917-9e44-b8ef6ab948a6
33
version: 9
44
creation_date: '2023-06-01'
5-
modification_date: '2026-06-24'
5+
modification_date: '2026-07-29'
66
author: Rod Soto, Eric McGinnis
7-
status: deprecated
7+
status: removed
88
type: Hunting
99
description: The following analytic identifies path traversal attempts in the Splunk App for Lookup File Editing. It detects specially crafted web requests targeting lookup files by analyzing the `uri_query` field in the `_internal` index. This activity is significant because it allows low-privilege users to read and write to restricted areas of the Splunk installation directory, potentially accessing sensitive files like password hashes. If confirmed malicious, this could lead to unauthorized access, data breaches, and further exploitation of the Splunk environment.
1010
data_source:

‎removed/detections/splunk_rce_pdfgen_render.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ name: Splunk RCE PDFgen Render
22
id: bc2b7437-0400-438b-9537-21ab5b7d2d53
33
version: 8
44
creation_date: '2024-07-01'
5-
modification_date: '2026-06-24'
5+
modification_date: '2026-07-29'
66
author: Rod Soto, Chase Franklin
7-
status: deprecated
7+
status: removed
88
type: TTP
99
description: This is a hunting search designed to find and discover exploitation attempts against Splunk pdfgen render endpoint which results in remote
1010
data_source:

‎removed/detections/windows_process_injection_of_wermgr_to_known_browser.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ name: Windows Process Injection Of Wermgr to Known Browser
22
id: aec755a5-3a2c-4be0-ab34-6540e68644e9
33
version: 12
44
creation_date: '2022-10-28'
5-
modification_date: '2026-06-29'
5+
modification_date: '2026-07-29'
66
author: Teoderick Contreras, Splunk
7-
status: deprecated
7+
status: removed
88
type: TTP
99
description: The following analytic identifies the suspicious remote thread execution of the wermgr.exe process into known browsers such as firefox.exe, chrome.exe, and others. It leverages Sysmon EventCode 8 logs to detect this behavior by monitoring SourceImage and TargetImage fields. This activity is significant because it is indicative of Qakbot malware, which injects malicious code into legitimate processes to steal information. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, and exfiltrate sensitive data from the compromised host.
1010
data_source:

0 commit comments

Comments
 (0)