From e28ed4e8d8ccf6c90f13ccf7778f9479f6233739 Mon Sep 17 00:00:00 2001 From: research bot Date: Wed, 29 Jul 2026 14:22:42 +0000 Subject: [PATCH 1/3] chore: bump contentctl.yml and build.yml to 6.4.0 --- build.yml | 2 +- contentctl.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build.yml b/build.yml index d0447873f6..ddabf18dcc 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.3.0 +app_version: 6.4.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index c7d57446e8..d066a0ef9e 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.3.0 + version: 6.4.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU From 15bccc1dfcc7d3adde787b7be2a21bbfbb634830 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 29 Jul 2026 09:05:10 -0700 Subject: [PATCH 2/3] remove deprecated stuff --- .../powershell___connect_to_internet_with_hidden_window.yml | 0 .../detections}/regsvr32_with_known_silent_switch_cmdline.yml | 0 .../detections}/rundll32_createremotethread_in_browser.yml | 0 .../splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml | 0 .../splunk_code_injection_via_custom_dashboard_leading_to_rce.yml | 0 .../splunk_enterprise_kv_store_incorrect_authorization.yml | 0 .../splunk_information_disclosure_on_account_login.yml | 0 .../splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml | 0 .../detections}/splunk_rce_pdfgen_render.yml | 0 .../windows_process_injection_of_wermgr_to_known_browser.yml | 0 .../windows_process_injection_with_public_source_path.yml | 0 11 files changed, 0 insertions(+), 0 deletions(-) rename {detections/deprecated => removed/detections}/powershell___connect_to_internet_with_hidden_window.yml (100%) rename {detections/deprecated => removed/detections}/regsvr32_with_known_silent_switch_cmdline.yml (100%) rename {detections/deprecated => removed/detections}/rundll32_createremotethread_in_browser.yml (100%) rename {detections/deprecated => removed/detections}/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml (100%) rename {detections/deprecated => removed/detections}/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml (100%) rename {detections/deprecated => removed/detections}/splunk_enterprise_kv_store_incorrect_authorization.yml (100%) rename {detections/deprecated => removed/detections}/splunk_information_disclosure_on_account_login.yml (100%) rename {detections/deprecated => removed/detections}/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml (100%) rename {detections/deprecated => removed/detections}/splunk_rce_pdfgen_render.yml (100%) rename {detections/deprecated => removed/detections}/windows_process_injection_of_wermgr_to_known_browser.yml (100%) rename {detections/deprecated => removed/detections}/windows_process_injection_with_public_source_path.yml (100%) diff --git a/detections/deprecated/powershell___connect_to_internet_with_hidden_window.yml b/removed/detections/powershell___connect_to_internet_with_hidden_window.yml similarity index 100% rename from detections/deprecated/powershell___connect_to_internet_with_hidden_window.yml rename to removed/detections/powershell___connect_to_internet_with_hidden_window.yml diff --git a/detections/deprecated/regsvr32_with_known_silent_switch_cmdline.yml b/removed/detections/regsvr32_with_known_silent_switch_cmdline.yml similarity index 100% rename from detections/deprecated/regsvr32_with_known_silent_switch_cmdline.yml rename to removed/detections/regsvr32_with_known_silent_switch_cmdline.yml diff --git a/detections/deprecated/rundll32_createremotethread_in_browser.yml b/removed/detections/rundll32_createremotethread_in_browser.yml similarity index 100% rename from detections/deprecated/rundll32_createremotethread_in_browser.yml rename to removed/detections/rundll32_createremotethread_in_browser.yml diff --git a/detections/deprecated/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml b/removed/detections/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml similarity index 100% rename from detections/deprecated/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml rename to removed/detections/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml diff --git a/detections/deprecated/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml b/removed/detections/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml similarity index 100% rename from detections/deprecated/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml rename to removed/detections/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml diff --git a/detections/deprecated/splunk_enterprise_kv_store_incorrect_authorization.yml b/removed/detections/splunk_enterprise_kv_store_incorrect_authorization.yml similarity index 100% rename from detections/deprecated/splunk_enterprise_kv_store_incorrect_authorization.yml rename to removed/detections/splunk_enterprise_kv_store_incorrect_authorization.yml diff --git a/detections/deprecated/splunk_information_disclosure_on_account_login.yml b/removed/detections/splunk_information_disclosure_on_account_login.yml similarity index 100% rename from detections/deprecated/splunk_information_disclosure_on_account_login.yml rename to removed/detections/splunk_information_disclosure_on_account_login.yml diff --git a/detections/deprecated/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml b/removed/detections/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml similarity index 100% rename from detections/deprecated/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml rename to removed/detections/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml diff --git a/detections/deprecated/splunk_rce_pdfgen_render.yml b/removed/detections/splunk_rce_pdfgen_render.yml similarity index 100% rename from detections/deprecated/splunk_rce_pdfgen_render.yml rename to removed/detections/splunk_rce_pdfgen_render.yml diff --git a/detections/deprecated/windows_process_injection_of_wermgr_to_known_browser.yml b/removed/detections/windows_process_injection_of_wermgr_to_known_browser.yml similarity index 100% rename from detections/deprecated/windows_process_injection_of_wermgr_to_known_browser.yml rename to removed/detections/windows_process_injection_of_wermgr_to_known_browser.yml diff --git a/detections/deprecated/windows_process_injection_with_public_source_path.yml b/removed/detections/windows_process_injection_with_public_source_path.yml similarity index 100% rename from detections/deprecated/windows_process_injection_with_public_source_path.yml rename to removed/detections/windows_process_injection_with_public_source_path.yml From cc7ff7ed37dceb61886aa2dbcd35bab497f7fc46 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Wed, 29 Jul 2026 18:21:01 +0200 Subject: [PATCH 3/3] update status --- .../powershell___connect_to_internet_with_hidden_window.yml | 4 ++-- .../detections/regsvr32_with_known_silent_switch_cmdline.yml | 4 ++-- removed/detections/rundll32_createremotethread_in_browser.yml | 4 ++-- .../splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml | 4 ++-- ...unk_code_injection_via_custom_dashboard_leading_to_rce.yml | 4 ++-- .../splunk_enterprise_kv_store_incorrect_authorization.yml | 4 ++-- .../splunk_information_disclosure_on_account_login.yml | 4 ++-- ...lunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml | 4 ++-- removed/detections/splunk_rce_pdfgen_render.yml | 4 ++-- .../windows_process_injection_of_wermgr_to_known_browser.yml | 4 ++-- .../windows_process_injection_with_public_source_path.yml | 4 ++-- 11 files changed, 22 insertions(+), 22 deletions(-) diff --git a/removed/detections/powershell___connect_to_internet_with_hidden_window.yml b/removed/detections/powershell___connect_to_internet_with_hidden_window.yml index 1d49d65adb..41c33b583d 100644 --- a/removed/detections/powershell___connect_to_internet_with_hidden_window.yml +++ b/removed/detections/powershell___connect_to_internet_with_hidden_window.yml @@ -2,9 +2,9 @@ name: PowerShell - Connect To Internet With Hidden Window id: ee18ed37-0802-4268-9435-b3b91aaa18db version: 17 creation_date: '2020-04-29' -modification_date: '2026-06-04' +modification_date: '2026-07-29' author: David Dorsey, Michael Haag Splunk -status: deprecated +status: removed type: Hunting description: The following analytic detects PowerShell commands using the WindowStyle parameter to hide the window while connecting to the Internet. This behavior is identified through Endpoint Detection and Response (EDR) telemetry, focusing on command-line executions that include variations of the WindowStyle parameter. This activity is significant because it attempts to bypass default PowerShell execution policies and conceal its actions, which is often indicative of malicious intent. If confirmed malicious, this could allow an attacker to execute commands stealthily, potentially leading to unauthorized data exfiltration or further compromise of the endpoint. data_source: diff --git a/removed/detections/regsvr32_with_known_silent_switch_cmdline.yml b/removed/detections/regsvr32_with_known_silent_switch_cmdline.yml index b9f41a3708..50d253b995 100644 --- a/removed/detections/regsvr32_with_known_silent_switch_cmdline.yml +++ b/removed/detections/regsvr32_with_known_silent_switch_cmdline.yml @@ -2,9 +2,9 @@ name: Regsvr32 with Known Silent Switch Cmdline id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122 version: 15 creation_date: '2021-07-29' -modification_date: '2026-06-09' +modification_date: '2026-07-29' author: Teoderick Contreras, Splunk -status: deprecated +status: removed deprecation_info: reason: Detection has been deprecated since its logic is already covered by another more improved detection. removed_in_version: 6.4.0 diff --git a/removed/detections/rundll32_createremotethread_in_browser.yml b/removed/detections/rundll32_createremotethread_in_browser.yml index 538e8124ba..d6fd3203da 100644 --- a/removed/detections/rundll32_createremotethread_in_browser.yml +++ b/removed/detections/rundll32_createremotethread_in_browser.yml @@ -2,9 +2,9 @@ name: Rundll32 CreateRemoteThread In Browser id: f8a22586-ee2d-11eb-a193-acde48001122 version: 11 creation_date: '2021-07-29' -modification_date: '2026-06-29' +modification_date: '2026-07-29' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: |- The following analytic detects the suspicious creation of a remote thread by rundll32.exe targeting browser processes such as firefox.exe, chrome.exe, iexplore.exe, and microsoftedgecp.exe. diff --git a/removed/detections/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml b/removed/detections/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml index a377c05c21..be485288dc 100644 --- a/removed/detections/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml +++ b/removed/detections/splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml @@ -2,9 +2,9 @@ name: Splunk App for Lookup File Editing RCE via User XSLT id: a053e6a6-2146-483a-9798-2d43652f3299 version: 8 creation_date: '2023-11-16' -modification_date: '2026-06-24' +modification_date: '2026-07-29' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic identifies the creation of lookup files in Splunk, which could indicate an attempt to exploit remote code execution via user-supplied XSLT. It leverages REST API queries to monitor the creation of these lookups, focusing on fields such as title, author, and access control lists. This activity is significant because it targets a known vulnerability in Splunk versions 9.1.x, potentially allowing attackers to execute arbitrary code. If confirmed malicious, this could lead to unauthorized code execution, compromising the integrity and security of the Splunk environment. data_source: [] diff --git a/removed/detections/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml b/removed/detections/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml index 16c8972fdd..1d542bc409 100644 --- a/removed/detections/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml +++ b/removed/detections/splunk_code_injection_via_custom_dashboard_leading_to_rce.yml @@ -2,9 +2,9 @@ name: Splunk Code Injection via custom dashboard leading to RCE id: b06b41d7-9570-4985-8137-0784f582a1b3 version: 8 creation_date: '2022-12-19' -modification_date: '2026-06-24' +modification_date: '2026-07-29' author: Rod Soto -status: deprecated +status: removed type: Hunting description: The following analytic identifies attempts to exploit a vulnerability in Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, where an authenticated user can execute arbitrary code via the dashboard PDF generation component. It detects this activity by analyzing events in the _internal index with the file=export parameter. This behavior is significant because it indicates a potential code injection attack, which could lead to remote code execution (RCE). If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary commands, and potentially compromise the entire Splunk environment. data_source: [] diff --git a/removed/detections/splunk_enterprise_kv_store_incorrect_authorization.yml b/removed/detections/splunk_enterprise_kv_store_incorrect_authorization.yml index 048f7f1d47..7853338daa 100644 --- a/removed/detections/splunk_enterprise_kv_store_incorrect_authorization.yml +++ b/removed/detections/splunk_enterprise_kv_store_incorrect_authorization.yml @@ -2,9 +2,9 @@ name: Splunk Enterprise KV Store Incorrect Authorization id: 8f0e8380-a835-4f2b-b749-9ce119364df0 version: 9 creation_date: '2024-01-22' -modification_date: '2026-06-24' +modification_date: '2026-07-29' author: Rod Soto, Eric McGinnis, Chase Franklin -status: deprecated +status: removed type: Hunting description: The following analytic detects unauthorized attempts to reload Splunk KV Store collections via the REST API. It leverages internal index logs to identify POST requests to the `/servicesNS/nobody/search/admin/collections-conf/_reload` endpoint, focusing on status codes starting with '2'. This activity is significant as it may indicate improper permission handling, potentially leading to unauthorized deletion of KV Store collections. If confirmed malicious, this could result in data loss or unauthorized data manipulation, impacting the integrity and availability of critical Splunk data. data_source: diff --git a/removed/detections/splunk_information_disclosure_on_account_login.yml b/removed/detections/splunk_information_disclosure_on_account_login.yml index 2e3d38b171..fc0d6959d8 100644 --- a/removed/detections/splunk_information_disclosure_on_account_login.yml +++ b/removed/detections/splunk_information_disclosure_on_account_login.yml @@ -2,9 +2,9 @@ name: Splunk Information Disclosure on Account Login id: 2bae5d19-6d1b-4db0-82ab-0af5ac5f836c version: 8 creation_date: '2024-07-01' -modification_date: '2026-06-24' +modification_date: '2026-07-29' author: Rod Soto -status: deprecated +status: removed type: Hunting description: This is a composed hunting search that looks for possible user enumeration attempts when SAML is enabled on a Splunk instance by capturing different responses from server. data_source: diff --git a/removed/detections/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml b/removed/detections/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml index ec3f314307..e211c92821 100644 --- a/removed/detections/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml +++ b/removed/detections/splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml @@ -2,9 +2,9 @@ name: Splunk Path Traversal In Splunk App For Lookup File Edit id: 8ed58987-738d-4917-9e44-b8ef6ab948a6 version: 9 creation_date: '2023-06-01' -modification_date: '2026-06-24' +modification_date: '2026-07-29' author: Rod Soto, Eric McGinnis -status: deprecated +status: removed type: Hunting description: The following analytic identifies path traversal attempts in the Splunk App for Lookup File Editing. It detects specially crafted web requests targeting lookup files by analyzing the `uri_query` field in the `_internal` index. This activity is significant because it allows low-privilege users to read and write to restricted areas of the Splunk installation directory, potentially accessing sensitive files like password hashes. If confirmed malicious, this could lead to unauthorized access, data breaches, and further exploitation of the Splunk environment. data_source: diff --git a/removed/detections/splunk_rce_pdfgen_render.yml b/removed/detections/splunk_rce_pdfgen_render.yml index 666040de17..3d3aa7b3b2 100644 --- a/removed/detections/splunk_rce_pdfgen_render.yml +++ b/removed/detections/splunk_rce_pdfgen_render.yml @@ -2,9 +2,9 @@ name: Splunk RCE PDFgen Render id: bc2b7437-0400-438b-9537-21ab5b7d2d53 version: 8 creation_date: '2024-07-01' -modification_date: '2026-06-24' +modification_date: '2026-07-29' author: Rod Soto, Chase Franklin -status: deprecated +status: removed type: TTP description: This is a hunting search designed to find and discover exploitation attempts against Splunk pdfgen render endpoint which results in remote data_source: diff --git a/removed/detections/windows_process_injection_of_wermgr_to_known_browser.yml b/removed/detections/windows_process_injection_of_wermgr_to_known_browser.yml index 31a5198164..268c78c9d9 100644 --- a/removed/detections/windows_process_injection_of_wermgr_to_known_browser.yml +++ b/removed/detections/windows_process_injection_of_wermgr_to_known_browser.yml @@ -2,9 +2,9 @@ name: Windows Process Injection Of Wermgr to Known Browser id: aec755a5-3a2c-4be0-ab34-6540e68644e9 version: 12 creation_date: '2022-10-28' -modification_date: '2026-06-29' +modification_date: '2026-07-29' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic identifies the suspicious remote thread execution of the wermgr.exe process into known browsers such as firefox.exe, chrome.exe, and others. It leverages Sysmon EventCode 8 logs to detect this behavior by monitoring SourceImage and TargetImage fields. This activity is significant because it is indicative of Qakbot malware, which injects malicious code into legitimate processes to steal information. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, and exfiltrate sensitive data from the compromised host. data_source: diff --git a/removed/detections/windows_process_injection_with_public_source_path.yml b/removed/detections/windows_process_injection_with_public_source_path.yml index 83a6938abc..a282a5827a 100644 --- a/removed/detections/windows_process_injection_with_public_source_path.yml +++ b/removed/detections/windows_process_injection_with_public_source_path.yml @@ -2,9 +2,9 @@ name: Windows Process Injection With Public Source Path id: 492f09cf-5d60-4d87-99dd-0bc325532dda version: 11 creation_date: '2022-09-05' -modification_date: '2026-06-29' +modification_date: '2026-07-29' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic detects a process from a non-standard file path on Windows attempting to create a remote thread in another process. This is identified using Sysmon EventCode 8, focusing on processes not originating from typical system directories. This behavior is significant as it often indicates process injection, a technique used by adversaries to evade detection or escalate privileges. If confirmed malicious, this activity could allow an attacker to execute arbitrary code within another process, potentially leading to unauthorized actions and further compromise of the system. data_source: