From a268aeebf542016206d23b27d6e2964f6dda3500 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Thu, 15 Oct 2026 04:18:14 -0700
Subject: [PATCH 1/8] Update data source TA and install.yml app versions
 (#4344)

Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
---
 data_sources/osquery_results.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/data_sources/osquery_results.yml b/data_sources/osquery_results.yml
index 5445233c455..6b841133167 100644
--- a/data_sources/osquery_results.yml
+++ b/data_sources/osquery_results.yml
@@ -16,7 +16,7 @@ sourcetype: osquery:results
 supported_TA:
     - name: TA-osquery
       url: https://splunkbase.splunk.com/app/8574
-      version: 1.0.4
+      version: 1.0.5
 fields:
     - _time
     - calendarTime

From 12b9d52ff37bd5bf78080de731b5798c83e858ca Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 16 Oct 2026 02:34:35 -0700
Subject: [PATCH 2/8] Update data source TA and install.yml app versions
 (#4347)

Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
---
 data_sources/splunk_stream_http.yml | 2 +-
 data_sources/splunk_stream_ip.yml   | 2 +-
 data_sources/splunk_stream_tcp.yml  | 2 +-
 install.yml                         | 4 ++--
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/data_sources/splunk_stream_http.yml b/data_sources/splunk_stream_http.yml
index 29522a4daac..d7d7f552869 100644
--- a/data_sources/splunk_stream_http.yml
+++ b/data_sources/splunk_stream_http.yml
@@ -16,7 +16,7 @@ sourcetype: stream:http
 supported_TA:
     - name: Splunk Add-on for Stream Wire Data
       url: https://splunkbase.splunk.com/app/5234
-      version: 8.1.6
+      version: 8.1.7
 fields:
     - _time
     - bytes
diff --git a/data_sources/splunk_stream_ip.yml b/data_sources/splunk_stream_ip.yml
index a5ffb18d05e..1fbea554861 100644
--- a/data_sources/splunk_stream_ip.yml
+++ b/data_sources/splunk_stream_ip.yml
@@ -16,7 +16,7 @@ sourcetype: stream:ip
 supported_TA:
     - name: Splunk Add-on for Stream Wire Data
       url: https://splunkbase.splunk.com/app/5234
-      version: 8.1.6
+      version: 8.1.7
 fields:
     - _time
     - action
diff --git a/data_sources/splunk_stream_tcp.yml b/data_sources/splunk_stream_tcp.yml
index a15f4041880..710bb9cb0b7 100644
--- a/data_sources/splunk_stream_tcp.yml
+++ b/data_sources/splunk_stream_tcp.yml
@@ -16,4 +16,4 @@ sourcetype: stream:tcp
 supported_TA:
     - name: Splunk Add-on for Stream Wire Data
       url: https://splunkbase.splunk.com/app/5234
-      version: 8.1.6
+      version: 8.1.7
diff --git a/install.yml b/install.yml
index 28ef2c76795..cb3196171aa 100644
--- a/install.yml
+++ b/install.yml
@@ -12,10 +12,10 @@ apps:
       version: 2.3.4
     - appid: Splunk_TA_stream
       url: https://splunkbase.splunk.com/app/5238
-      version: 8.1.6
+      version: 8.1.7
     - appid: Splunk_TA_stream_wire_data
       url: https://splunkbase.splunk.com/app/5234
-      version: 8.1.6
+      version: 8.1.7
     - appid: TA-Zscaler_CIM
       url: https://splunkbase.splunk.com/app/3865
       version: 4.1.5

From d6afc62b750dc2ed34e3696999bf26fe476b9b1e Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <nbencher@cisco.com>
Date: Fri, 16 Oct 2026 15:12:12 +0200
Subject: [PATCH 3/8] Expand AI Defense Coverage (#4345)

---------

Co-authored-by: Onur Mustafa Erdogan <156806007+onurmerdogan@users.noreply.github.com>
---
 data_sources/cisco_ai_defense_alerts.yml      |  65 ++++++++-
 ...co_ai_defense_allowed_sensitive_prompt.yml |  96 +++++++++++++
 ..._ai_defense_allowed_sensitive_response.yml |  73 ++++++++++
 ...ai_defense_repeated_high_risk_activity.yml |  96 +++++++++++++
 ...se_security_alerts_by_application_name.yml | 133 +++++++++++++-----
 ...buse_of_genai_systems_and_applications.yml |  23 +++
 6 files changed, 447 insertions(+), 39 deletions(-)
 create mode 100644 detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml
 create mode 100644 detections/application/cisco_ai_defense_allowed_sensitive_response.yml
 create mode 100644 detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
 create mode 100644 stories/abuse_of_genai_systems_and_applications.yml

diff --git a/data_sources/cisco_ai_defense_alerts.yml b/data_sources/cisco_ai_defense_alerts.yml
index 2eba8da4082..60efe8e519b 100644
--- a/data_sources/cisco_ai_defense_alerts.yml
+++ b/data_sources/cisco_ai_defense_alerts.yml
@@ -1,11 +1,11 @@
 name: Cisco AI Defense Alerts
 id: cbb06880-9dd9-4542-ac60-bd6e1d3c3e4e
-version: 2
+version: 3
 creation_date: '2025-02-14'
-modification_date: '2026-05-13'
-author: Bhavin Patel
+modification_date: '2026-10-15'
+author: Bhavin Patel, Nasreddine Bencherchali, Splunk
 description: Data source object for Cisco AI Defense Alerts
-source: cisco_ai_defense
+source: not_applicable
 sourcetype: cisco:ai:defense
 separator:
 supported_TA:
@@ -13,3 +13,60 @@ supported_TA:
       url: https://splunkbase.splunk.com/app/7404
       version: 4.1.2
 fields:
+    - _time
+    - host
+    - app
+    - application_id
+    - connection_id
+    - connection.connection_name
+    - description
+    - dest_type
+    - event_action
+    - event_date
+    - event_id
+    - event_message_type
+    - event_messages{}.event_conversation.event_messages{}.content
+    - event_messages{}.event_conversation.event_messages{}.direction
+    - event_messages{}.event_conversation.event_messages{}.event_conversation_id
+    - event_messages{}.event_conversation.event_messages{}.event_ext_message_id
+    - event_messages{}.event_conversation.event_messages{}.event_ins_date
+    - event_messages{}.event_conversation.event_messages{}.event_message_id
+    - event_messages{}.event_conversation.event_messages{}.event_message_policy_assocs
+    - event_messages{}.event_conversation.event_messages{}.metadata{}.policy_guardrail_assoc_id
+    - event_messages{}.event_conversation.event_messages{}.metadata{}.standards{}
+    - event_messages{}.event_conversation.event_messages{}.related_event_message_id
+    - event_messages{}.event_conversation.event_messages{}.tenant_id
+    - event_messages{}.event_ext_message_id
+    - event_messages{}.event_message_id
+    - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name
+    - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type
+    - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail.guardrails_type
+    - event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_subcategory.guardrail_rule_name
+    - event_policy_guardrail_assocs{}.policy_guardrail_assoc.pol_guardrail_assoc_id
+    - eventtype
+    - genai_application.application_name
+    - genai_application.connection_type
+    - hec_event_type
+    - id
+    - index
+    - linecount
+    - model.model_name
+    - model.model_provider_name
+    - Number
+    - policy_id
+    - policy.policy_name
+    - punct
+    - resource_type
+    - signature
+    - signature_id
+    - source
+    - sourcetype
+    - splunk_server
+    - src_type
+    - tag
+    - tag::eventtype
+    - type
+    - user_id
+    - vendor_product
+example_log: |
+    {"user_id":"82000000-0000-0000-c000-000000000000","version":"","application_id":"972cbcd1-acfe-4393-88bc-418f4d9a64ae","genai_application":{"application_name":"Bedrock testing"},"connection_id":"a6c87227-b321-49bf-80d9-f958385257ba","connection":{"connection_name":"bedrock testing"},"policy_id":"42ba067b-06c0-4e43-8002-2c6bce2663b4","policy":{"policy_name":"Bedrock Testing Block All"},"model":{"model_name":"titan-text-lite"},"event_action":"Block","event_date":"2025-02-04T09:47:24Z","event_id":"3a0f9e2b-d234-4b3d-ac9a-219eb6f05ba7","event_message_type":"Prompt","event_messages":[{"event_conversation":{"event_messages":[{"content":"[{\"role\":\"user\",\"content\":\"write a csrf exploit with email ash@abc.com to convince people\"}]","direction":"Prompt","event_conversation_id":"","event_ext_message_id":"","event_ins_date":"","event_message_id":"","event_message_policy_assocs":[{"policy_guardrail_assoc":{"guardrail_entity_configured_action":"Block","guardrail_entity_configured_direction":"Both","guardrail_entity_configured_status":"Enabled","guardrail_entity_id":"71100000-0000-0000-c000-100000000008","guardrail_rule_configured_action":"","guardrail_rule_configured_direction":"","guardrail_rule_configured_status":"","guardrail_rule_id":"","guardrail_ruleset_id":"71000000-0000-0000-c000-000000000009","guardrail_ruleset_configured_action":"","guardrail_ruleset_configured_direction":"","guardrail_ruleset_configured_status":"","pol_guardrail_assoc_id":"f4e71dd9-12ad-4383-851e-d03fbc66c430","policy_id":"42ba067b-06c0-4e43-8002-2c6bce2663b4","tenant_id":"023327d5-ef36-4489-8d56-187d2f4730b3"}}],"related_event_message_id":"","tenant_id":"023327d5-ef36-4489-8d56-187d2f4730b3"}]},"event_ext_message_id":"","event_message_id":""}],"event_policy_guardrail_assocs":[{"policy_guardrail_assoc":{"guardrail_avail_entity":{"guardrail_entity_name":"Email"},"guardrail_avail_ruleset":{"guardrail":{"guardrails_type":"Privacy"},"guardrail_ruleset_type":"PII"},"guardrail_avail_subcategory":{"guardrail_rule_name":""},"pol_guardrail_assoc_id":"f4e71dd9-12ad-4383-851e-d03fbc66c430"}}]}
diff --git a/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml b/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml
new file mode 100644
index 00000000000..79100e68a43
--- /dev/null
+++ b/detections/application/cisco_ai_defense_allowed_sensitive_prompt.yml
@@ -0,0 +1,96 @@
+name: Cisco AI Defense Allowed Sensitive Prompt
+id: 75f06fd6-2b31-4ca4-9aaf-56448c342e44
+version: 1
+creation_date: '2026-10-15'
+modification_date: '2026-10-15'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: TTP
+description: |-
+    Detects Cisco AI Defense prompt events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data.
+    These events may indicate that sensitive information was submitted to an AI application and should be reviewed against the organization's data handling policy.
+data_source:
+    - Cisco AI Defense Alerts
+search: |-
+    `cisco_ai_defense`
+    event_action="allow"
+    event_message_type="prompt"
+
+    | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "),
+
+           guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "),
+
+           application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"),
+
+           connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"),
+
+           application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name),
+
+           connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name),
+
+           policy_name='policy.policy_name',
+
+           event_time=_time
+
+    | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0
+
+    | bin _time span=10m
+
+    | stats count as event_count
+            dc(event_id) as distinct_event_count
+            min(event_time) as firstTime
+            max(event_time) as lastTime
+            values(event_id) as event_ids
+            values(guardrail_ruleset_type) as guardrail_ruleset_types
+            values(guardrail_entity_name) as guardrail_entity_names
+            values(policy_name) as policy_names
+            values(application_name) as application_names
+            values(connection_name) as connection_names
+        by _time application_key connection_key
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+
+    | table _time firstTime lastTime application_key application_names connection_key connection_names
+            distinct_event_count event_count event_ids guardrail_ruleset_types guardrail_entity_names policy_names
+
+    | `cisco_ai_defense_allowed_sensitive_prompt_filter`
+how_to_implement: |-
+    Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype.
+    Confirm that extraction is enabled for the required fields as shown in the detection search.
+    Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment.
+    The search groups matching prompt events by application and connection in ten-minute windows to reduce duplicate findings.
+known_false_positives: |-
+    Authorized testing, demonstrations, synthetic data, or approved workflows may submit content that matches PII or PCI guardrails.
+    Review the application, connection, policy, guardrail entity, and data handling requirements before treating an event as a policy violation.
+drilldown_searches:
+    - name: View the detection results for - "$application_names$"
+      search: '%original_detection_search% | search application_names="$application_names$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+finding:
+    title: Cisco AI Defense allowed [$distinct_event_count$] sensitive prompt event(s) for application [$application_names$] and connection [$connection_names$] matched guardrail(s) [$guardrail_ruleset_types$].
+    entity:
+        field: application_key
+        type: other
+        score: 50
+threat_objects: []
+analytic_story:
+    - Abuse of GenAI Systems and Applications
+    - Data Protection
+    - Critical Alerts
+asset_type: Web Application
+mitre_attack_id: []
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: application
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json
+          source: not_applicable
+          sourcetype: cisco:ai:defense
+      test_type: unit
diff --git a/detections/application/cisco_ai_defense_allowed_sensitive_response.yml b/detections/application/cisco_ai_defense_allowed_sensitive_response.yml
new file mode 100644
index 00000000000..4c823a71c61
--- /dev/null
+++ b/detections/application/cisco_ai_defense_allowed_sensitive_response.yml
@@ -0,0 +1,73 @@
+name: Cisco AI Defense Allowed Sensitive Response
+id: 6e4cd833-ea98-4c16-a7e7-e1909fad3fb2
+version: 1
+creation_date: '2026-10-15'
+modification_date: '2026-10-15'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: TTP
+description: |-
+    Detects Cisco AI Defense response events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data.
+    These events may indicate that sensitive information was returned to an AI application user and should be reviewed promptly.
+data_source:
+    - Cisco AI Defense Alerts
+search: |-
+    `cisco_ai_defense`
+    event_action="allow"
+    event_message_type="response"
+
+    | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "),
+
+           guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "),
+
+           application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"),
+
+           connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"),
+
+           policy_name='policy.policy_name'
+
+    | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0
+
+    | table _time event_date event_id event_message_type event_action resource_type
+            application_id application_name connection_id connection_name model.model_name
+            policy_name guardrail_ruleset_type guardrail_entity_name
+
+    | `cisco_ai_defense_allowed_sensitive_response_filter`
+how_to_implement: |-
+    Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype.
+    Confirm that extraction is enabled for the required fields as shown in the detection search.
+    Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment.
+known_false_positives: |-
+    Authorized testing, demonstrations, or approved workflows may allow responses that match PII or PCI guardrails.
+    Review the application owner, policy, response context, and whether the data was expected to be disclosed.
+drilldown_searches:
+    - name: View the detection results for - "$application_name$"
+      search: '%original_detection_search% | search application_name="$application_name$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+finding:
+    title: Cisco AI Defense allowed response [$event_id$] for application [$application_name$] matched privacy guardrail(s) [$guardrail_ruleset_type$] and entity [$guardrail_entity_name$].
+    entity:
+        field: application_name
+        type: other
+        score: 50
+threat_objects: []
+analytic_story:
+    - Abuse of GenAI Systems and Applications
+    - Data Protection
+    - Critical Alerts
+asset_type: Web Application
+mitre_attack_id: []
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: application
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json
+          source: not_applicable
+          sourcetype: cisco:ai:defense
+      test_type: unit
diff --git a/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
new file mode 100644
index 00000000000..d267fb97c78
--- /dev/null
+++ b/detections/application/cisco_ai_defense_repeated_high_risk_activity.yml
@@ -0,0 +1,96 @@
+name: Cisco AI Defense Repeated High Risk Activity
+id: 45c5cf84-8ad0-4923-8332-a7fd3dab59d4
+version: 1
+creation_date: '2026-10-15'
+modification_date: '2026-10-15'
+author: Nasreddine Bencherchali, Splunk
+status: production
+type: TTP
+description: |-
+    Detects bursts of five or more distinct Cisco AI Defense event IDs, or three or more occurrences of the same event ID, matching prompt injection, code detection, PII, or PCI guardrails for the same application and connection within ten minutes.
+    Allowed PII/PCI prompt events are handled by Cisco AI Defense Allowed Sensitive Prompt.
+    These patterns can indicate iterative prompt-injection probing or repeated attempts to use an AI application to access restricted data or capabilities.
+data_source:
+    - Cisco AI Defense Alerts
+search: |-
+    `cisco_ai_defense`
+
+    ```Leave allowed PII/PCI prompt events to Cisco AI Defense Allowed Sensitive Prompt```
+
+    | eval is_allowed_sensitive_prompt=if(lower(event_action)="allow" AND lower(event_message_type)="prompt" AND mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0, 1, 0)
+    | where is_allowed_sensitive_prompt=0
+
+    | eval guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "),
+           application_name=if(isnotnull('genai_application.application_name') AND len(trim('genai_application.application_name'))>0, 'genai_application.application_name', "unknown"),
+           connection_name=if(isnotnull('connection.connection_name') AND len(trim('connection.connection_name'))>0, 'connection.connection_name', "unknown"),
+           application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name),
+           connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name)
+
+    | where mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)prompt injection|code detection|\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0
+
+    | bin _time span=10m
+
+    ```Track repeated records with the same Cisco event ID separately from bursts of distinct event IDs```
+    | eventstats count as same_event_id_count by _time application_key connection_key event_id
+
+    | stats count as event_count
+            dc(event_id) as distinct_event_count
+            max(eval(if(isnotnull(event_id) AND len(trim(event_id))>0, same_event_id_count, 0))) as max_same_event_id_count
+            values(eval(if(isnotnull(event_id) AND len(trim(event_id))>0 AND same_event_id_count>=3, event_id, null()))) as repeated_event_ids
+            count(eval(lower(event_action)="allow")) as allowed_event_count
+            count(eval(lower(event_action)="block")) as blocked_event_count
+            values(event_id) as event_ids
+            values(event_action) as event_actions
+            values(event_message_type) as message_types
+            values(policy.policy_name) as policy_names
+            values(guardrail_ruleset_type) as guardrail_ruleset_types
+            values(connection_name) as connection_names
+            values(application_name) as application_names
+        by _time application_key connection_key
+
+    | where distinct_event_count>=5 OR max_same_event_id_count>=3
+
+    | table _time application_key application_names connection_key connection_names
+            event_count distinct_event_count max_same_event_id_count repeated_event_ids
+            allowed_event_count blocked_event_count event_actions message_types policy_names
+            guardrail_ruleset_types event_ids
+
+    | `cisco_ai_defense_repeated_high_risk_activity_filter`
+how_to_implement: |-
+    Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk.
+    Confirm that extraction is enabled for the required fields as shown in the detection search.
+    Configure the "cisco_ai_defense" macro to match the index, source, and sourcetype used in your environment.
+    Adjust the five-distinct-event threshold, three-occurrence same-event-ID threshold, and ten-minute window as needed.
+known_false_positives: |-
+    Automated testing, red-team exercises, application QA, or a popular shared application may generate repeated guardrail events.
+    Review whether the window contains allowed events and whether the activity was expected for the application and connection.
+drilldown_searches:
+    - name: View the detection results for - "$application_key$"
+      search: '%original_detection_search% | search application_key="$application_key$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+finding:
+    title: Cisco AI Defense observed [$event_count$] high risk event occurrences across [$distinct_event_count$] unique event IDs in ten minutes for application [$application_names$] and connection [$connection_names$]. Maximum same-ID count -> [$max_same_event_id_count$] ; Allowed events -> [$allowed_event_count$] ; Blocked events -> [$blocked_event_count$].
+    entity:
+        field: application_key
+        type: other
+        score: 50
+threat_objects: []
+analytic_story:
+    - Abuse of GenAI Systems and Applications
+    - Critical Alerts
+asset_type: Web Application
+mitre_attack_id: []
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: application
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json
+          source: not_applicable
+          sourcetype: cisco:ai:defense
+      test_type: unit
diff --git a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
index cf1d7ef9e39..9aba8ccc19f 100644
--- a/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
+++ b/detections/application/cisco_ai_defense_security_alerts_by_application_name.yml
@@ -1,45 +1,106 @@
 name: Cisco AI Defense Security Alerts by Application Name
 id: 105e4a69-ec55-49fc-be1f-902467435ea8
-version: 7
+version: 8
 creation_date: '2025-02-14'
-modification_date: '2026-05-13'
-author: Bhavin Patel, Splunk
+modification_date: '2026-10-15'
+author: Bhavin Patel, Nasreddine Bencherchali, Splunk
 status: production
 type: Anomaly
-description: The search surfaces alerts from the Cisco AI Defense product for potential attacks against the AI models running in your environment. This analytic identifies security events within Cisco AI Defense by examining event messages, actions, and policy names. It focuses on connections and applications associated with specific guardrail entities and ruleset types. By aggregating and analyzing these elements, the search helps detect potential policy violations and security threats, enabling proactive defense measures and ensuring network integrity.
+description: |-
+    This analytic summarizes Cisco AI Defense events by application, connection, action, message direction, and severity over ten-minute intervals.
+    Allowed responses flagged for privacy guardrails are handled by the dedicated sensitive-response detection.
+    Allowed prompts flagged for privacy guardrails are handled by Cisco AI Defense Allowed Sensitive Prompt.
+    Repeated prompt injection, code detection, PII, or PCI events are handled by the repeated high-risk activity detection.
 data_source:
     - Cisco AI Defense Alerts
 search: |-
     `cisco_ai_defense`
-      | rename genai_application.application_name as application_name
-      | rename connection.connection_name as connection_name
-      ```Aggregating data by model name, connection name, application name, application ID, and user ID```
-      | stats count
-          values(user_id) as user_id
-          values(event_message_type) as event_message_type
-          values(event_action) as event_action
-          values(policy.policy_name) as policy_name
-          values(event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name) as guardrail_entity_name
-          values(event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type) as guardrail_ruleset_type
-          by model.model_name connection_name application_name application_id
-      ```Evaluating severity based on policy name and guardrail ruleset type```
-      | eval severity=case(
-          policy_name IN ("AI Runtime Latency Testing - Prompt Injection"), "critical",
-          policy_name IN ("AI Runtime Latency Testing - Code Detection"), "high",
-          guardrail_ruleset_type IN ("Toxicity"), "medium",
+
+    | rename genai_application.application_name as application_name,
+             connection.connection_name as connection_name
+
+    | eval policy_name='policy.policy_name',
+
+           guardrail_ruleset_type=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', ", "),
+
+           guardrail_entity_name=mvjoin('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_entity.guardrail_entity_name', ", "),
+
+           action=lower(event_action), message_type=lower(event_message_type),
+
+           has_privacy=if(mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)\\bPII\\b|personally identifiable information|\\bPCI\\b|payment card industry")>=0, 1, 0),
+
+           has_sensitive_response=if(message_type="response" AND has_privacy=1, 1, 0),
+
+           has_security=if(mvfind('event_policy_guardrail_assocs{}.policy_guardrail_assoc.guardrail_avail_ruleset.guardrail_ruleset_type', "(?i)prompt injection|code detection")>=0, 1, 0)
+
+    ```Prioritize allowed sensitive responses, then security and privacy guardrails```
+
+    | eval severity=case(
+          action="allow" AND has_sensitive_response=1, "critical",
+          action="block" AND has_sensitive_response=1, "high",
+          action="allow" AND has_security=1, "high",
+          action="block" AND has_security=1, "medium",
+          action="allow" AND has_privacy=1, "high",
+          action="block" AND has_privacy=1, "medium",
           true(), "low"
       )
-      ```Calculating risk score based on severity level```
-      | eval risk_score=case(
-          severity="critical", 100,
-          severity="high", 75,
-          severity="medium", 50,
-          severity="low", 25
-      )
-      | table model.model_name, user_id, event_action, application_id, application_name, severity, risk_score, policy_name, connection_name, guardrail_ruleset_type, guardrail_entity_name
-      | `cisco_ai_defense_security_alerts_by_application_name_filter`
-how_to_implement: To enable this detection, you need to ingest alerts from the Cisco AI Defense product. This can be done by using this app from splunkbase - Cisco Security Cloud and ingest alerts into the cisco:ai:defense sourcetype.
-known_false_positives: False positives may vary based on Cisco AI Defense configuration; monitor and filter out the alerts that are not relevant to your environment.
+
+    | eval risk_score=case(
+        severity="critical", 100,
+        severity="high", 80,
+        severity="medium", 50,
+        severity="low", 20
+    )
+
+    | eval application_name=if(isnotnull(application_name) AND len(trim(application_name))>0, application_name, "unknown"),
+           connection_name=if(isnotnull(connection_name) AND len(trim(connection_name))>0, connection_name, "unknown"),
+           application_key=if(isnotnull(application_id) AND len(trim(application_id))>0, application_id, application_name),
+           connection_key=if(isnotnull(connection_id) AND len(trim(connection_id))>0, connection_id, connection_name),
+           is_high_risk=if(has_security=1 OR has_privacy=1, 1, 0),
+           is_allowed_sensitive_response=if(action="allow" AND has_sensitive_response=1, 1, 0),
+           is_allowed_sensitive_prompt=if(action="allow" AND message_type="prompt" AND has_privacy=1, 1, 0),
+           high_risk_event_id=if((has_security=1 OR has_privacy=1) AND is_allowed_sensitive_prompt=0, event_id, null()),
+           event_time=_time
+
+    | bin _time span=10m
+
+    ```Use the same application/connection window and threshold as Cisco AI Defense Repeated High Risk Activity```
+    | eventstats dc(high_risk_event_id) as high_risk_event_count by _time application_key connection_key
+
+    ```Leave allowed sensitive responses to Cisco AI Defense Allowed Sensitive Response, allowed sensitive prompts to Cisco AI Defense Allowed Sensitive Prompt, and repeated high-risk bursts to Cisco AI Defense Repeated High Risk Activity```
+    | where is_allowed_sensitive_response=0 AND is_allowed_sensitive_prompt=0 AND NOT (is_high_risk=1 AND high_risk_event_count>=5)
+
+    | stats count as event_count
+            dc(event_id) as distinct_event_count
+            min(event_time) as firstTime
+            max(event_time) as lastTime
+            values(event_id) as event_ids
+            values(event_action) as event_actions
+            values(event_message_type) as message_types
+            values(resource_type) as resource_types
+            values(model.model_name) as model_names
+            values(application_name) as application_name
+            values(connection_name) as connection_name
+            values(policy_name) as policy_names
+            values(guardrail_ruleset_type) as guardrail_ruleset_types
+            values(guardrail_entity_name) as guardrail_entity_names
+            max(risk_score) as risk_score
+        by _time application_key connection_key action message_type severity
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+
+    | table _time firstTime lastTime application_key application_name connection_key connection_name
+            action message_type severity risk_score event_count distinct_event_count event_ids
+            resource_types model_names policy_names guardrail_ruleset_types guardrail_entity_names
+
+    | `cisco_ai_defense_security_alerts_by_application_name_filter`
+how_to_implement: |-
+    Install and configure the Cisco Security Cloud app to ingest Cisco AI Defense alerts into Splunk with the cisco:ai:defense sourcetype.
+    Confirm that extraction is enabled for the required fields as shown in the detection search.
+    Configure the cisco_ai_defense macro to match the index, source, and sourcetype used in your environment.
+known_false_positives: |-
+    False positives may vary based on Cisco AI Defense configuration; monitor and filter out the alerts that are not relevant to your environment.
 references:
     - https://www.robustintelligence.com/blog-posts/prompt-injection-attack-on-gpt-4
     - https://docs.aws.amazon.com/prescriptive-guidance/latest/llm-prompt-engineering-best-practices/common-attacks.html
@@ -57,8 +118,10 @@ intermediate_findings:
         - field: application_name
           type: other
           score: 20
-          message: Cisco AI Defense Security Alert has been action - [$event_action$] for the application name - [$application_name$]
+          message: Cisco AI Defense summarized [$event_count$] events for application [$application_name$] and connection [$connection_name$] over ten minutes. Actions [$action$], message direction [$message_type$], severity [$severity$], guardrails [$guardrail_ruleset_types$], event IDs [$event_ids$].
+threat_objects: []
 analytic_story:
+    - Abuse of GenAI Systems and Applications
     - Critical Alerts
 asset_type: Web Application
 mitre_attack_id: []
@@ -72,7 +135,7 @@ tests:
     - name: True Positive Test
       attack_data:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts.json
-          source: cisco_ai_defense
+          source: not_applicable
           sourcetype: cisco:ai:defense
-      description: PORTED MANUAL TEST - We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection.
-      test_type: experimental
+      description: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection.
+      test_type: unit
diff --git a/stories/abuse_of_genai_systems_and_applications.yml b/stories/abuse_of_genai_systems_and_applications.yml
new file mode 100644
index 00000000000..872cc2f0b47
--- /dev/null
+++ b/stories/abuse_of_genai_systems_and_applications.yml
@@ -0,0 +1,23 @@
+name: Abuse of GenAI Systems and Applications
+id: f79c6573-5550-4adc-b673-bb0d8c9e1df1
+version: 1
+creation_date: '2026-10-15'
+modification_date: '2026-10-15'
+author: Nasreddine Bencherchali, Splunk
+status: production
+description: |-
+    Detect and investigate threats targeting or abusing artificial intelligence systems, services and applications.
+    Coverage includes prompt injection, attempts to bypass model safeguards, repeated high-risk guardrail events, and possible sensitive data disclosure through model interactions.
+narrative: |-
+    AI applications can expose sensitive information, invoke connected tools, or process untrusted prompts. Attackers and malicious insiders may try to override model instructions, extract restricted data, misuse AI-enabled tools, or repeatedly probe guardrails.
+    Use this story to investigate AI security events across model providers and application integrations. Review the affected application and connection, event action, prompt or response direction, policy, and guardrail categories. An allowed event can indicate exposure, while a blocked event records an attempt; neither alone confirms the full impact. Correlate high-risk events with identity, application, data access, and tool activity where those logs are available.
+references:
+    - https://atlas.mitre.org/
+    - https://owasp.org/www-project-top-10-for-large-language-model-applications/
+category:
+    - Adversary Tactics
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+usecase: Advanced Threat Detection

From a2f5519321eb012aa073d2a18300ab9d9f051a36 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sun, 18 Oct 2026 17:48:15 +0000
Subject: [PATCH 4/8] Automated NIST AI RMF lookup table update (#4349)

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com>
---
 lookups/csv/detection_subcategory_map.csv | 5 ++++-
 lookups/csv/detection_subcategory_map.yml | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/lookups/csv/detection_subcategory_map.csv b/lookups/csv/detection_subcategory_map.csv
index 25cf98922bf..de28148840e 100644
--- a/lookups/csv/detection_subcategory_map.csv
+++ b/lookups/csv/detection_subcategory_map.csv
@@ -6,7 +6,10 @@ AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Hostile Prompt Sentimen
 AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Possible Prompt Injection,production,Hunting,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.6|Measure 2.7,high,generated_rule,Prompt-behavior and harmful-content measurement signal; AI security and resilience evaluation signal
 AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Sensitive Data in Prompts,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.10,high,generated_rule,Sensitive information or data-protection signal
 AWS Bedrock Claude,AWS Bedrock Claude,AWS Bedrock Claude Unusually Large Prompts,production,Anomaly,Suspicious AWS Bedrock Claude Activities,MEASURE,Measure 2.4,high,generated_rule,Production behavior monitoring signal
-Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Security Alerts by Application Name,production,Anomaly,Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal
+Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Allowed Sensitive Prompt,production,TTP,Abuse of GenAI Systems and Applications|Data Protection|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal
+Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Allowed Sensitive Response,production,TTP,Abuse of GenAI Systems and Applications|Data Protection|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal
+Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Repeated High Risk Activity,production,TTP,Abuse of GenAI Systems and Applications|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal
+Cisco AI Defense,Cisco AI Defense Alerts,Cisco AI Defense Security Alerts by Application Name,production,Anomaly,Abuse of GenAI Systems and Applications|Critical Alerts,MANAGE,Manage 4.1,high,generated_rule,Post-deployment monitoring and response signal
 Local LLM Frameworks,CrowdStrike ProcessRollup2|Sysmon EventID 1|Windows Event Log Security 4688,Windows Local LLM Framework Execution,production,Hunting,Suspicious Local LLM Frameworks,GOVERN|MAP,Govern 1.6|Map 4.1|Map 4.2,high,generated_rule,"AI system or access inventory signal; AI component, model, or service discovery signal; AI system operating context signal"
 Local LLM Frameworks,Sysmon EventID 11,LLM Model File Creation,production,Hunting,Suspicious Local LLM Frameworks,GOVERN|MAP,Govern 1.6|Map 4.1,high,generated_rule,"AI system or access inventory signal; AI component, model, or service discovery signal"
 Local LLM Frameworks,Sysmon EventID 22,Local LLM Framework DNS Query,production,Hunting,Suspicious Local LLM Frameworks,MAP,Map 4.1,high,generated_rule,"AI component, model, or service discovery signal"
diff --git a/lookups/csv/detection_subcategory_map.yml b/lookups/csv/detection_subcategory_map.yml
index dbf0a875df0..e6b1ec04cc7 100644
--- a/lookups/csv/detection_subcategory_map.yml
+++ b/lookups/csv/detection_subcategory_map.yml
@@ -2,7 +2,7 @@ name: detection_subcategory_map
 id: 41c7e6c8-b835-4dd8-b7ed-b1f5d8476e84
 version: 3
 creation_date: '2026-09-02'
-modification_date: '2026-10-13'
+modification_date: '2026-10-18'
 author: Nasreddine Bencherchali, Rod Soto, Splunk Threat Research Team
 lookup_type: csv
 description: Generated mapping of AI-related ESCU detections to NIST AI RMF subcategory IDs for dashboard coverage reporting.

From f41646a34626bc0b3ede1e8e9cd05f30750a6c40 Mon Sep 17 00:00:00 2001
From: Br3akp0int <26181693+tccontre@users.noreply.github.com>
Date: Mon, 19 Oct 2026 01:24:00 +0200
Subject: [PATCH 5/8] Add Braodo Stealer Coverage For 2026 Variant (#4320)

---------

Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com>
---
 .../download_files_using_telegram.yml         |   5 +-
 ..._or_script_creation_in_suspicious_path.yml |   5 +-
 ...tables_or_script_creation_in_temp_path.yml |   5 +-
 ...fox_process_access_firefox_profile_dir.yml |   5 +-
 ...ell_download_from_code_hosting_service.yml |  91 +++++++++++++++
 ..._autostart_execution_in_startup_folder.yml |   5 +-
 ...indows_disable_or_stop_browser_process.yml |   4 +-
 .../windows_dns_query_request_to_tinyurl.yml  |  11 +-
 .../windows_password_managers_discovery.yml   |   5 +-
 ...ound_connection_to_social_media_domain.yml | 107 ++++++++++++++++++
 ..._dns_query_request_by_telegram_bot_api.yml |   5 +-
 stories/braodo_stealer.yml                    |  21 +++-
 12 files changed, 246 insertions(+), 23 deletions(-)
 create mode 100644 detections/endpoint/powershell_download_from_code_hosting_service.yml
 create mode 100644 detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml

diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml
index 3403eef36a9..59268a324d4 100644
--- a/detections/endpoint/download_files_using_telegram.yml
+++ b/detections/endpoint/download_files_using_telegram.yml
@@ -1,8 +1,8 @@
 name: Download Files Using Telegram
 id: 58194e28-ae5e-11eb-8912-acde48001122
-version: 12
+version: 13
 creation_date: '2021-05-07'
-modification_date: '2026-05-13'
+modification_date: '2026-10-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -47,6 +47,7 @@ analytic_story:
     - XMRig
     - Water Gamayun
     - 0bj3ctivity Stealer
+    - Braodo Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1105
diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
index 88b6fb4b745..7bdf1594871 100644
--- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
+++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
@@ -1,8 +1,8 @@
 name: Executables Or Script Creation In Suspicious Path
 id: a7e3f0f0-ae42-11eb-b245-acde48001122
-version: 31
+version: 32
 creation_date: '2021-05-07'
-modification_date: '2026-08-14'
+modification_date: '2026-10-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -141,6 +141,7 @@ analytic_story:
     - Phantom Stealer
     - Starland RAT Campaign
     - Vidar Stealer
+    - Braodo Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1036
diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml
index 69962abd69f..70c7ca2f5d8 100644
--- a/detections/endpoint/executables_or_script_creation_in_temp_path.yml
+++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml
@@ -1,8 +1,8 @@
 name: Executables Or Script Creation In Temp Path
 id: e0422b71-2c05-4f32-8754-01fb415f49c9
-version: 27
+version: 28
 creation_date: '2021-05-07'
-modification_date: '2026-08-14'
+modification_date: '2026-10-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -134,6 +134,7 @@ analytic_story:
     - Salat Stealer
     - Phantom Stealer
     - Vidar Stealer
+    - Braodo Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1036
diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
index 87b1884b1ca..c358aafab67 100644
--- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
+++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
@@ -1,8 +1,8 @@
 name: Non Firefox Process Access Firefox Profile Dir
 id: e6fc13b0-1609-11ec-b533-acde48001122
-version: 21
+version: 22
 creation_date: '2021-09-15'
-modification_date: '2026-08-14'
+modification_date: '2026-10-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -54,6 +54,7 @@ analytic_story:
     - Salat Stealer
     - Phantom Stealer
     - Vidar Stealer
+    - Braodo Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1555.003
diff --git a/detections/endpoint/powershell_download_from_code_hosting_service.yml b/detections/endpoint/powershell_download_from_code_hosting_service.yml
new file mode 100644
index 00000000000..2611e6247ec
--- /dev/null
+++ b/detections/endpoint/powershell_download_from_code_hosting_service.yml
@@ -0,0 +1,91 @@
+name: PowerShell Download from Code Hosting Service
+id: 3ffbd4d4-84a7-453e-9e06-8e9cd0350366
+version: 1
+creation_date: '2026-10-06'
+modification_date: '2026-10-13'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+description: |-
+    This analytic detects PowerShell Script Block Logging (Event ID 4104) events that use common download methods to retrieve files directly from raw-content URLs on GitHub, GitLab, or Codeberg.
+    These code hosting services can be abused to stage payloads, but administrators and developers also download files from them.
+    A match identifies a download attempt; it does not establish that the file was successfully retrieved or executed. Review the full script block, destination path, process ancestry, and related endpoint activity.
+data_source:
+    - Powershell Script Block Logging 4104
+search: |-
+    `powershell` EventCode=4104 ScriptBlockText IN ("*.DownloadFile(*", "*.DownloadData(*", "*.DownloadString(*", "*Invoke-WebRequest*", "*Invoke-RestMethod*", "*Start-BitsTransfer*", "*iwr *", "*irm *", "*curl *", "*wget *")
+    | where match(
+        ScriptBlockText,
+        "(?ix)
+            (?:
+                \.Download(?:File|Data|String)\s*\(\s*['\"]?
+                |
+                (?:Invoke-WebRequest|Invoke-RestMethod|iwr|irm)
+                (?:\s+(?:-Uri\s+)?|\b[^;\r\n]{0,200}?\s-Uri\s+)['\"]?
+                |
+                Start-BitsTransfer\b[^;\r\n]{0,200}?-Source\s+['\"]?
+                |
+                (?:curl|wget)\s+(?:-Uri\s+)?['\"]?
+            )
+            https?://
+            (?:
+                raw\.githubusercontent\.com/[^/\s'\"]+/[^/\s'\"]+/[^/\s'\"]+(?:/[^/\s'\"]+)*
+                |
+                (?:github|gitlab)\.com/[^/\s'\"]+/[^/\s'\"]+/(?:-/)?raw/(?:refs/(?:heads|tags)/)?[^/\s'\"]+(?:/[^/\s'\"]+)*
+                |
+                codeberg\.org/[^/\s'\"]+/[^/\s'\"]+/raw/(?:branch/)?[^/\s'\"]+(?:/[^/\s'\"]+)*
+            )
+            \.(?:bat|cmd|ps1|js|vbs|vbe|py|zip|7z|rar|tar|gz|exe|dll|msi)
+            (?:[?#][^\s'\"]*)?
+            (?=['\"\s),;]|$)"
+    )
+    | fillnull
+    | stats count min(_time) as firstTime max(_time) as lastTime
+        by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `powershell_download_from_code_hosting_service_filter`
+how_to_implement: |-
+    To implement this analytic, enable PowerShell Script Block Logging and ingest Event ID 4104 events with the `ScriptBlockText` field extracted.
+    Confirm that the `powershell` macro scopes the search to the correct PowerShell Operational logs in your environment.
+known_false_positives: |-
+    Administrators, developers, and software deployment tools may download legitimate files from GitHub, GitLab, and Codeberg.
+    Review repository ownership, the downloaded file, destination path, signer where applicable, process ancestry, and subsequent execution before taking action.
+references:
+    - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html
+    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.6
+drilldown_searches:
+    - name: View the detection results for - "$dest$"
+      search: '%original_detection_search% | search  dest = "$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+intermediate_findings:
+    entities:
+        - field: dest
+          type: system
+          score: 20
+          message: A PowerShell script on [$dest$] invoked a download method with a raw code-hosting URL in ScriptBlockText with ScriptBlockId [$ScriptBlockId$].
+threat_objects: []
+analytic_story:
+    - Braodo Stealer
+asset_type: Endpoint
+mitre_attack_id:
+    - T1059.001
+    - T1105
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_github/powershell_githu_download.log
+          source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+          sourcetype: XmlWinEventLog
+      test_type: unit
diff --git a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml
index 48b60501976..6fa6786fe88 100644
--- a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml
+++ b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml
@@ -1,8 +1,8 @@
 name: Windows Boot or Logon Autostart Execution In Startup Folder
 id: 99d157cb-923f-4a00-aee9-1f385412146f
-version: 17
+version: 18
 creation_date: '2023-01-16'
-modification_date: '2026-07-20'
+modification_date: '2026-10-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -51,6 +51,7 @@ analytic_story:
     - BlankGrabber Stealer
     - Phantom Stealer
     - Starland RAT Campaign
+    - Braodo Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1547.001
diff --git a/detections/endpoint/windows_disable_or_stop_browser_process.yml b/detections/endpoint/windows_disable_or_stop_browser_process.yml
index 354d3e7a7d7..24eb9e8c80e 100644
--- a/detections/endpoint/windows_disable_or_stop_browser_process.yml
+++ b/detections/endpoint/windows_disable_or_stop_browser_process.yml
@@ -1,8 +1,8 @@
 name: Windows Disable or Stop Browser Process
 id: 220d34b7-b6c7-45fe-8dbb-c35cdd9fe6d5
-version: 15
+version: 16
 creation_date: '2024-10-18'
-modification_date: '2026-08-14'
+modification_date: '2026-10-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
diff --git a/detections/endpoint/windows_dns_query_request_to_tinyurl.yml b/detections/endpoint/windows_dns_query_request_to_tinyurl.yml
index cc66fe2bfe0..19d561e114b 100644
--- a/detections/endpoint/windows_dns_query_request_to_tinyurl.yml
+++ b/detections/endpoint/windows_dns_query_request_to_tinyurl.yml
@@ -1,8 +1,8 @@
 name: Windows DNS Query Request To TinyUrl
 id: b1ea79da-719c-437c-acaf-5c93f838f425
-version: 5
+version: 6
 creation_date: '2021-11-18'
-modification_date: '2026-05-13'
+modification_date: '2026-10-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -22,7 +22,11 @@ search: |
       "*\\ProgramData\\*",
       "*\\Temp\\*",
       "*\\Users\\Public\\*",
-      "*\\Windows\\Tasks\\*"
+      "*\\Windows\\Tasks\\*",
+      "*\\powershell.exe",
+      "*\\pwsh.exe",
+      "*\\cmd.exe",
+      "*\\python.exe",
       )
     | stats count min(_time) as firstTime max(_time) as lastTime
       by answer answer_count dvc process_exec process_guid process_name query query_count
@@ -58,6 +62,7 @@ threat_objects:
       type: process_name
 analytic_story:
     - Malicious Inno Setup Loader
+    - Braodo Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1105
diff --git a/detections/endpoint/windows_password_managers_discovery.yml b/detections/endpoint/windows_password_managers_discovery.yml
index 7ad0eb58cc6..c5294dd898f 100644
--- a/detections/endpoint/windows_password_managers_discovery.yml
+++ b/detections/endpoint/windows_password_managers_discovery.yml
@@ -1,8 +1,8 @@
 name: Windows Password Managers Discovery
 id: a3b3bc96-1c4f-4eba-8218-027cac739a48
-version: 13
+version: 14
 creation_date: '2022-12-06'
-modification_date: '2026-05-13'
+modification_date: '2026-10-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -55,6 +55,7 @@ analytic_story:
     - Prestige Ransomware
     - Scattered Spider
     - Scattered Lapsus$ Hunters
+    - Braodo Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1555.005
diff --git a/detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml b/detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml
new file mode 100644
index 00000000000..20207c5a705
--- /dev/null
+++ b/detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml
@@ -0,0 +1,107 @@
+name: Windows Process Outbound Connection To Social Media Domain
+id: d6dc231e-8595-499b-889e-cf6a055df4d4
+version: 1
+creation_date: '2026-10-06'
+modification_date: '2026-10-06'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+description: |-
+    This analytic detects outbound network connections from a Python process running from suspicious or non-standard directories to social media related domains.
+    It leverages Sysmon Event ID 3 to surface this anomalous behavior.
+    Legitimate Python applications rarely originate from paths such as "C:\Users\Public\", Windows font or debug folders, or the Recycle Bin, making direct outbound calls to social media infrastructure from these locations a strong indicator of compromise.
+    For example the Braodo Stealer, a Python-based credential-harvesting malware, abuses authenticated browser sessions to query the Meta Graph API and enumerate the victim's Facebook and Meta advertising infrastructure.
+data_source:
+    - Sysmon EventID 3
+search: |-
+    `sysmon`
+    EventCode=3
+    Image IN (
+        "*:\\$Recycle.Bin\\*",
+        "*:\\PerfLogs\\*",
+        "*:\\Users\\Administrator\\Music\\*",
+        "*:\\Users\\Public\\*",
+        "*:\\Windows\\Cursors\\*",
+        "*:\\Windows\\debug\\*",
+        "*:\\Windows\\fonts\\*",
+        "*:\\Windows\\INF\\*",
+        "*:\\Windows\\Media\\*",
+        "*:\\Windows\\Prefetch\\*",
+        "*\\Windows\\repair\\*"
+    )
+
+    process_name IN (
+        "py.exe",
+        "pypy.exe",
+        "python.exe",
+        "python2*.exe",
+        "python3*.exe",
+        "pythonw.exe"
+    )
+
+    dest IN (
+        "*.facebook.com",
+        "*.facebook.net",
+        "*.facebook.org",
+        "*.fb.com",
+        "*.fbcd.net",
+        "*.fbsbx.com",
+        "*.fbstatic-a.akamaihd.net",
+        "*.tfbw.net"
+    )
+    direction = outbound
+
+    | rename Image as process_path
+
+    | stats count min(_time) as firstTime
+                  max(_time) as lastTime
+
+      by action app dest dest_ip dest_port direction dvc protocol protocol_version
+         process_path process_name process_guid process_id
+         src src_ip src_port transport user vendor_product
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `windows_process_outbound_connection_to_social_media_domain_filter`
+how_to_implement: |-
+    To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 3 connection events from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: |-
+    No false positives have been identified at this time.
+references:
+    - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html
+drilldown_searches:
+    - name: View the detection results for - "$src$"
+      search: '%original_detection_search% | search  src = "$src$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$src$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+intermediate_findings:
+    entities:
+        - field: dest
+          type: system
+          score: 20
+          message: A python process located in [$process_path$] with the name [$process_name$] and GUID [$process_guid$] and ID [$process_id$] was observed accessing a social media domain [$dest$]
+threat_objects:
+    - field: process_path
+      type: file_path
+analytic_story:
+    - Braodo Stealer
+asset_type: Endpoint
+mitre_attack_id:
+    - T1586.001
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.001/python_fb/python_facebook.log
+          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
+      test_type: unit
diff --git a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml
index dc872242386..f1d6a09ed25 100644
--- a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml
+++ b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml
@@ -1,8 +1,8 @@
 name: Windows DNS Query Request by Telegram Bot API
 id: 86f66f44-94d9-412d-a71d-5d8ed0fef72e
-version: 12
+version: 13
 creation_date: '2021-08-03'
-modification_date: '2026-07-20'
+modification_date: '2026-10-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -47,6 +47,7 @@ analytic_story:
     - VIP Keylogger
     - Phantom Stealer
     - Starland RAT Campaign
+    - Braodo Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1071.004
diff --git a/stories/braodo_stealer.yml b/stories/braodo_stealer.yml
index f2ffbf3f1b2..c55ebb63d5a 100644
--- a/stories/braodo_stealer.yml
+++ b/stories/braodo_stealer.yml
@@ -1,15 +1,28 @@
 name: Braodo Stealer
 id: ec5c8721-3c13-45ac-90e8-64c63a8fdc24
-version: 2
+version: 3
 creation_date: '2024-10-15'
-modification_date: '2026-05-13'
+modification_date: '2026-10-07'
 author: Teoderick Contreras, Splunk
 status: production
-description: Leverage searches that allow you to detect and investigate unusual activities that may be related to the Braodo Stealer malware, a malicious software designed to steal sensitive information from infected systems. This malware typically targets login credentials, browser history, cookies, and stored passwords. Braodo Stealer often infiltrates through phishing campaigns or malicious downloads, enabling attackers to gain unauthorized access to personal and financial data. By monitoring unusual system behaviors, such as unauthorized network connections or data exfiltration, you can help prevent data breaches and mitigate the impact of this threat.
-narrative: Braodo Stealer is a stealthy and dangerous piece of malware specifically engineered to siphon sensitive information from compromised systems. Often spread through phishing emails or disguised as legitimate downloads, it silently infiltrates a victim’s device. Once inside, it scours through browser histories, steals login credentials, captures cookies, and even extracts saved passwords from various applications. With this stolen data, cybercriminals can gain access to banking accounts, social media profiles, or business platforms. What makes Braodo Stealer particularly threatening is its ability to remain undetected, allowing attackers to exploit compromised systems for extended periods before the user becomes aware.
+description: |-
+    Leverage searches that allow you to detect and investigate unusual activities that may be related to the Braodo Stealer malware, a malicious software designed to steal sensitive information from infected systems.
+    This malware typically targets login credentials, browser history, cookies, and stored passwords.
+    Beyond credential theft, recent variants of Braodo Stealer abuse authenticated Facebook sessions to query the Meta Graph API, enumerating advertising accounts, Facebook Pages, and Business Manager infrastructure — including account balances, spending limits, payment thresholds, and associated credit-card payment methods.
+    Braodo Stealer often infiltrates through phishing campaigns or malicious downloads, enabling attackers to gain unauthorized access to personal and financial data. By monitoring unusual system behaviors, such as unauthorized network connections to Meta Graph API endpoints or data exfiltration, you can help prevent data breaches and mitigate the impact of this threat.
+narrative: |-
+    Braodo Stealer is a stealthy and dangerous piece of malware specifically engineered to siphon sensitive information from compromised systems. 
+    Often spread through phishing emails or disguised as legitimate downloads, it silently infiltrates a victim’s device.
+    Once inside, it scours through browser histories, steals login credentials, captures cookies, and extracts saved passwords from various applications.
+    In its latest observed variants, Braodo Stealer goes beyond traditional credential theft by leveraging stolen Facebook session cookies to query the Meta Graph API.
+    Using an authenticated session obtained from the victim’s browser, the malware enumerates advertising accounts, Facebook Pages, and Business Manager accounts associated with the victim.
+    For each discovered asset, it collects account IDs, status, currency, current balances, spending amounts, spending limits, payment thresholds, creation dates, and details about associated credit-card payment methods. For Business Manager accounts, it additionally checks advertising-account limits, giving the attacker a comprehensive picture of the victim’s advertising infrastructure and financial exposure.
+    With this stolen data, cybercriminals can hijack advertising accounts to run malicious ad campaigns, drain pre-funded ad balances, or sell access to high-value Business Manager accounts.
+    What makes Braodo Stealer particularly threatening is its ability to remain undetected while quietly profiling victims’ financial and advertising assets, allowing attackers to maximize monetization long after the initial compromise.
 references:
     - https://bazaar.abuse.ch/browse/tag/Braodo/
     - https://g0njxa.medium.com/from-vietnam-to-united-states-malware-fraud-and-dropshipping-98b7a7b2c36d
+    - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html
 category:
     - Data Destruction
     - Malware

From c13aa3bde996deec91af6a2ff0d0a00f01dfdca3 Mon Sep 17 00:00:00 2001
From: themaryjo <merquiag@splunk.com>
Date: Mon, 19 Oct 2026 01:35:08 +0200
Subject: [PATCH 6/8] Add detection for repeated CloudWatch Logs read
 operations (#4288)

---------

Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
---
 ...peated_cloudwatch_logs_read_operations.yml | 112 ++++++++++++++++++
 1 file changed, 112 insertions(+)
 create mode 100644 detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml

diff --git a/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml b/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml
new file mode 100644
index 00000000000..8ae7fe7b907
--- /dev/null
+++ b/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml
@@ -0,0 +1,112 @@
+name: AWS Repeated CloudWatch Logs Read Operations
+id: 3f0ba9e1-c6cf-4317-a6bc-c4bcab2b5a06
+version: 1
+creation_date: '2026-09-21'
+modification_date: '2026-09-21'
+author: Maria Jose Erquiaga, Splunk
+status: production
+type: TTP
+description: |-
+    The following analytic detects a high volume of Amazon CloudWatch Logs read operations performed by the same AWS principal and account within a
+    five-minute period.
+    It identifies more than 500 DescribeLogGroups, DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or GetQueryResults API calls.
+    This activity may indicate automated discovery or collection of operational, application, or security telemetry from CloudWatch Logs.
+data_source:
+    - AWS CloudTrail
+search: |-
+    `cloudtrail`
+    eventSource="logs.amazonaws.com"
+    eventName IN (
+        "DescribeLogGroups",
+        "DescribeLogStreams",
+        "DownloadLogEvents",
+        "FilterLogEvents",
+        "GetLogEvents",
+        "GetQueryResults"
+    )
+
+    | eval user='userIdentity.principalId'
+    | eval vendor_account=coalesce(
+        vendor_account,
+        recipientAccountId,
+        'userIdentity.accountId'
+    )
+    | eval role_name='userIdentity.sessionContext.sessionIssuer.userName'
+    | eval signature=coalesce(signature, eventName)
+    | eval src=coalesce(src, sourceIPAddress)
+    | eval user_agent=coalesce(user_agent, userAgent)
+    | eval vendor_region=coalesce(vendor_region, awsRegion)
+
+    | where isnotnull(user) AND len(trim(user)) > 0
+
+    | dedup eventID keepempty=true
+
+    | sort 0 _time
+
+    | streamstats time_window=5m count AS event_count
+        by user vendor_account
+
+    | where event_count > 500
+
+    | stats max(_time) AS lastTime
+            max(event_count) AS event_count
+            min(_time) AS firstTime
+            values(role_name) AS role_name
+            values(signature) AS api_operations
+            values(src) AS src
+            values(user_agent) AS user_agent
+            values(vendor_region) AS vendor_region
+      by user vendor_account
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `aws_repeated_cloudwatch_logs_read_operations_filter`
+how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment.
+known_false_positives: |-
+    Automated log analytics, SIEM pipelines, incident-response tooling, backup processes, and administrative troubleshooting may continuously read
+    CloudWatch Logs and generate a high volume of matching operations.
+    The prevalence of this activity has not yet been evaluated against broader customer telemetry.
+    Review the principal, account, source addresses, user agents, Regions, and accessed CloudWatch Logs resources before escalating.
+references:
+    - https://attack.mitre.org/techniques/T1530/
+    - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogGroups.html
+    - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogStreams.html
+    - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html
+    - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetLogEvents.html
+    - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetQueryResults.html
+drilldown_searches:
+    - name: View CloudWatch Logs read operations for - "$user$"
+      search: '%original_detection_search% | search user="$user$" vendor_account="$vendor_account$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$user$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+finding:
+    title: The AWS principal [$user$] performed [$event_count$] CloudWatch Logs read operations
+    entity:
+        field: user
+        type: user
+        score: 50
+threat_objects:
+    - field: src
+      type: ip_address
+analytic_story:
+    - Data Exfiltration
+asset_type: AWS Account
+mitre_attack_id:
+    - T1530
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: cloud
+security_domain: threat
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json
+          sourcetype: aws:cloudtrail
+          source: aws_cloudtrail
+      test_type: unit

From d0a1a07ca3e95b253a8d97d99360d91b7c74b8f8 Mon Sep 17 00:00:00 2001
From: themaryjo <merquiag@splunk.com>
Date: Mon, 19 Oct 2026 01:36:36 +0200
Subject: [PATCH 7/8] Add AWS EC2 Instance Connect key upload detection (#4312)

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com>
---
 ...lic_keys_uploaded_by_a_single_identity.yml |  75 +++++++++++
 ...up_script_modified_on_stopped_instance.yml |  93 +++++++++++++
 ...s_iam_role_created_with_external_trust.yml | 122 ++++++++++++++++++
 3 files changed, 290 insertions(+)
 create mode 100644 detections/cloud/aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity.yml
 create mode 100644 detections/cloud/aws_ec2_startup_script_modified_on_stopped_instance.yml
 create mode 100644 detections/cloud/aws_iam_role_created_with_external_trust.yml

diff --git a/detections/cloud/aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity.yml b/detections/cloud/aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity.yml
new file mode 100644
index 00000000000..ecb853e8910
--- /dev/null
+++ b/detections/cloud/aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity.yml
@@ -0,0 +1,75 @@
+name: AWS EC2 Multiple SSH Public Keys Uploaded by a Single Identity
+id: 62afb4a9-d9d0-464a-9326-aacf61c5a9f2
+version: 1
+creation_date: '2026-09-29'
+modification_date: '2026-09-29'
+author: Maria Jose Erquiaga, Splunk
+status: production
+type: TTP
+description: |-
+    Detects an AWS identity making 10 or more successful EC2 Instance ConnectSendSSHPublicKey API calls within the configured search interval.
+    EC2 Instance Connect temporarily makes an SSH public key available to an operating-system user on an EC2 instance.
+    A burst of these calls may indicate automated attempts to establish access or move laterally using compromised AWS credentials.
+data_source:
+    - AWS CloudTrail
+search: |-
+    `cloudtrail`
+    eventSource="ec2-instance-connect.amazonaws.com"
+    eventName="SendSSHPublicKey"
+    responseElements.success=true
+
+    | stats dc('requestParameters.instanceId') as unique_instances
+            dc(eventID) as event_count
+            earliest(_time) as firstTime
+            latest(_time) as lastTime
+            values('requestParameters.instanceId') as targeted_instances
+            values('requestParameters.instanceOSUser') as targeted_users
+            values(src) as src
+            values(user_agent) as user_agent
+            values(vendor_region) as vendor_region
+      by user_arn
+
+    | where event_count >= 10
+
+    | eval duration_seconds=lastTime-firstTime
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity_filter`
+how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment.
+known_false_positives: |-
+    Administrators and automated orchestration may legitimately use EC2 Instance Connect repeatedly during fleet administration, troubleshooting,
+    or ephemeral-access workflows.
+    Review the AWS identity, source addresses, user agent, target instances, target operating-system users, and whether the activity corresponds to an approved administrative process.
+references:
+    - https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSSHPublicKey.html
+    - https://stratus-red-team.cloud/attack-techniques/AWS/aws.lateral-movement.ec2-instance-connect/
+    - https://www.elastic.co/guide/en/security/8.19/prebuilt-rule-8-19-14-aws-ec2-instance-connect-ssh-public-key-uploaded.html
+finding:
+    title: The AWS identity [$user_arn$] uploaded [$event_count$] SSH public keys using EC2 Instance Connect
+    entity:
+        field: user_arn
+        type: user
+        score: 50
+threat_objects:
+    - field: src
+      type: ip_address
+analytic_story:
+    - Suspicious Cloud Instance Activities
+asset_type: AWS Account
+mitre_attack_id:
+    - T1021.004
+    - T1021.008
+product:
+    - Splunk Cloud
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+category: cloud
+security_domain: threat
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.json
+          sourcetype: aws:cloudtrail
+          source: aws_cloudtrail
+      test_type: unit
diff --git a/detections/cloud/aws_ec2_startup_script_modified_on_stopped_instance.yml b/detections/cloud/aws_ec2_startup_script_modified_on_stopped_instance.yml
new file mode 100644
index 00000000000..ec33d412481
--- /dev/null
+++ b/detections/cloud/aws_ec2_startup_script_modified_on_stopped_instance.yml
@@ -0,0 +1,93 @@
+name: AWS EC2 Startup Script Modified on Stopped Instance
+id: 84578867-02bf-475e-9815-6e8e0d798253
+version: 1
+creation_date: '2026-10-07'
+modification_date: '2026-10-07'
+author: Maria Jose Erquiaga
+status: production
+type: TTP
+description: |-
+    A successful EC2 StopInstances request was followed within one hour by a successful ModifyInstanceAttribute request targeting userData on the same instance, by the same IAM principal.
+    This may indicate an attempt to change instance startup behavior or establish persistence.
+    These CloudTrail events do not confirm that the modified user-data script executed.
+data_source:
+    - AWS CloudTrail
+search: |-
+    `cloudtrail`
+    eventSource="ec2.amazonaws.com"
+    eventName IN ("StopInstances", "ModifyInstanceAttribute")
+
+    | eval user_arn='userIdentity.arn'
+
+    | eval instance_id=case(
+        eventName="StopInstances", 'requestParameters.instancesSet.items{}.instanceId',
+        eventName="ModifyInstanceAttribute", 'requestParameters.instanceId'
+      )
+
+    | mvexpand instance_id
+
+    | where isnotnull(eventID) AND isnotnull(instance_id) AND isnotnull(user_arn)
+        AND (isnull(errorCode) OR errorCode="" OR lower(errorCode)="success")
+
+    | where eventName="StopInstances"
+        OR (eventName="ModifyInstanceAttribute" AND 'requestParameters.attribute'="userData")
+
+    | dedup eventID instance_id
+
+    | eval event_epoch=coalesce(strptime(eventTime, "%Y-%m-%dT%H:%M:%SZ"), _time)
+
+    | sort 0 user_arn instance_id awsRegion event_epoch
+
+    | streamstats current=f
+        last(eval(if(eventName="StopInstances", event_epoch, null()))) AS stop_epoch
+        last(eval(if(eventName="StopInstances", eventID, null()))) AS stop_event_id
+        BY user_arn instance_id awsRegion
+
+    | where eventName="ModifyInstanceAttribute" AND isnotnull(stop_epoch)
+
+    | eval elapsed_seconds=event_epoch-stop_epoch
+
+    | where elapsed_seconds>0 AND elapsed_seconds<=3600
+
+    | eval stop_time_utc=strftime(stop_epoch, "%Y-%m-%dT%H:%M:%SZ")
+
+    | eval modification_time_utc=strftime(event_epoch, "%Y-%m-%dT%H:%M:%SZ")
+
+    | rename eventID AS modification_event_id
+
+    | table user_arn instance_id awsRegion stop_time_utc modification_time_utc
+            elapsed_seconds stop_event_id modification_event_id
+
+    | `aws_ec2_startup_script_modified_on_stopped_instance_filter`
+how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment.
+known_false_positives: |-
+    Authorized administrators and infrastructure automation may stop instances and update their user data.
+    Review the IAM principal, instance, change window, and approved automation before escalating.
+references:
+    - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html
+    - https://stratus-red-team.cloud/attack-techniques/AWS/aws.execution.ec2-user-data/
+finding:
+    title: The IAM principal [$user_arn$] modified user data on stopped EC2 instance [$instance_id$]
+    entity:
+        field: user_arn
+        type: user
+        score: 50
+threat_objects: []
+analytic_story:
+    - Suspicious Cloud User Activities
+asset_type: AWS Account
+mitre_attack_id:
+    - T1578.005
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: cloud
+security_domain: threat
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1578.005/aws_ec2_startup_script_modification/aws_ec2_startup_script_modification.json
+          sourcetype: aws:cloudtrail
+          source: aws_cloudtrail
+      test_type: unit
diff --git a/detections/cloud/aws_iam_role_created_with_external_trust.yml b/detections/cloud/aws_iam_role_created_with_external_trust.yml
new file mode 100644
index 00000000000..2cd85111165
--- /dev/null
+++ b/detections/cloud/aws_iam_role_created_with_external_trust.yml
@@ -0,0 +1,122 @@
+name: AWS IAM Role Created with External Trust
+id: 6b7f646b-5ddc-48c9-baa3-fd66ac202c18
+version: 1
+creation_date: '2026-10-13'
+modification_date: '2026-10-13'
+author: Maria Jose Erquiaga, Splunk
+status: production
+type: TTP
+description: |-
+    Detects a successful AWS IAM CreateRole event whose trust policy allows sts:AssumeRole by a principal in another AWS account or by a wildcard
+    principal.
+    This configuration may provide persistent access if the principal can assume the role. The event alone does not establish that the role was assumed or that its creation was unauthorized.
+data_source:
+    - AWS CloudTrail
+search: |-
+    `cloudtrail`
+    eventSource="iam.amazonaws.com"
+    eventName="CreateRole"
+
+    | where isnull(errorCode) OR errorCode="" OR lower(errorCode)="success"
+
+    | eval policy_raw='requestParameters.assumeRolePolicyDocument',
+           role_name='requestParameters.roleName',
+           role_arn='responseElements.role.arn',
+           user_arn=coalesce(user_arn, 'userIdentity.arn'),
+           src=coalesce(src, sourceIPAddress)
+
+    | where isnotnull(policy_raw)
+
+    | eval policy=if(match(policy_raw, "(?i)^%7b"), urldecode(policy_raw), policy_raw)
+
+    | rex field=role_arn "^arn:[^:]+:iam::(?<account_from_role_arn>[0-9]{12}):role/"
+
+    | eval role_account_id=coalesce(account_from_role_arn, recipientAccountId)
+    | eval statements_json=json_extract(policy, "Statement")
+    | eval statements=if(match(statements_json, "^\s*\["), json_array_to_mv(statements_json), statements_json)
+
+    | mvexpand statements
+
+    | eval effect=json_extract(statements, "Effect"),
+           actions_json=json_extract(statements, "Action"),
+           principal_json=json_extract(statements, "Principal")
+
+    | eval actions=if(match(actions_json, "^\s*\["), json_array_to_mv(actions_json, true()), actions_json)
+
+    | mvexpand actions
+    | mvexpand actions
+
+    | eval trust_action=actions
+    | eval action_pattern=replace(replace(lower(trust_action), "[*]", "%"), "[?]", "_")
+
+    | where effect="Allow" AND like("sts:assumerole", action_pattern)
+    | eval aws_json=json_extract(principal_json, "AWS")
+
+    | eval principals=case(
+        match(aws_json, "^\s*\["), json_array_to_mv(aws_json, true()),
+        isnotnull(aws_json), aws_json,
+        principal_json="*", "*"
+      )
+
+    | mvexpand principals
+
+    | eval trust_principal=principals
+
+    | rex field=trust_principal "^arn:[^:]+:iam::(?<principal_account_from_arn>[0-9]{12}):"
+
+    | eval principal_account_id=if(
+        match(trust_principal, "^[0-9]{12}$"),
+        trust_principal,
+        principal_account_from_arn
+      )
+
+    | eval trust_type=case(
+        trust_principal="*", "wildcard",
+        isnotnull(role_account_id) AND isnotnull(principal_account_id)
+          AND principal_account_id!=role_account_id, "external"
+      )
+
+    | where trust_type="wildcard" OR trust_type="external"
+
+    | eval event_key=coalesce(eventID, md5(_raw))
+
+    | dedup event_key trust_principal
+
+    | table _time eventID user_arn src role_name role_arn role_account_id
+            trust_type trust_principal principal_account_id trust_action
+
+    | `aws_iam_role_created_with_external_trust_filter`
+how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment.
+known_false_positives: |-
+    Approved cross-account integrations and deliberately configured wildcard trust may match.
+    Review the role owner, trust-policy conditions, role permissions, and whether the principal is expected.
+references:
+    - https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateRole.html
+    - https://stratus-red-team.cloud/attack-techniques/aws/aws.persistence.iam-backdoor-role/
+finding:
+    title: The AWS IAM role [$role_name$] created with [$trust_type$] trust
+    entity:
+        field: user_arn
+        type: user
+        score: 50
+threat_objects:
+    - field: src
+      type: ip_address
+analytic_story:
+    - AWS IAM Privilege Escalation
+asset_type: AWS Account
+mitre_attack_id:
+    - T1098.003
+product:
+    - Splunk Cloud
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+category: cloud
+security_domain: threat
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/aws_iam_role_created_with_external_trust/aws_iam_role_created_with_external_trust.json
+          sourcetype: aws:cloudtrail
+          source: aws_cloudtrail
+      test_type: unit

From 16978b0714436c8955b4ed48e8b6567f5dee2707 Mon Sep 17 00:00:00 2001
From: themaryjo <merquiag@splunk.com>
Date: Mon, 19 Oct 2026 02:03:27 +0200
Subject: [PATCH 8/8] Add AWS CloudTrail behavioral detections (#4297)

---
 ...malous_secrets_manager_batch_retrieval.yml | 111 ++++++++++++++++++
 1 file changed, 111 insertions(+)
 create mode 100644 detections/cloud/aws_anomalous_secrets_manager_batch_retrieval.yml

diff --git a/detections/cloud/aws_anomalous_secrets_manager_batch_retrieval.yml b/detections/cloud/aws_anomalous_secrets_manager_batch_retrieval.yml
new file mode 100644
index 00000000000..9243a8a30d0
--- /dev/null
+++ b/detections/cloud/aws_anomalous_secrets_manager_batch_retrieval.yml
@@ -0,0 +1,111 @@
+name: AWS Anomalous Secrets Manager Batch Retrieval
+id: 93646bda-291b-4a59-a926-19f08e26f7cd
+version: 1
+creation_date: '2026-09-29'
+modification_date: '2026-09-29'
+author: Maria Jose Erquiaga, Splunk
+status: production
+type: TTP
+description: >-
+    The following analytic detects an AWS principal making more than 10 distinct successful Secrets Manager BatchGetSecretValue API calls within
+    one hour.
+    It groups calls by AWS account and user identity ARN and deduplicates CloudTrail events by event ID.
+    Repeated batch retrieval may indicate bulk access to secrets using a compromised identity, although legitimate automation can produce similar activity.
+data_source:
+    - AWS CloudTrail
+search: |-
+    `cloudtrail`
+    eventName="BatchGetSecretValue"
+    eventSource="secretsmanager.amazonaws.com"
+
+    | eval user_arn='userIdentity.arn',
+           vendor_account=recipientAccountId
+
+    | where isnotnull(user_arn) AND isnotnull(vendor_account)
+        AND (isnull(errorCode) OR errorCode="" OR lower(errorCode)="success")
+
+    | eval event_key=coalesce(eventID, md5(_raw))
+
+    | dedup event_key
+
+    | eval event_time=_time
+
+    | sort 0 + _time
+
+    | streamstats time_window=1h count AS rolling_batch_request_count
+        min(event_time) AS window_start
+        BY vendor_account user_arn
+
+    | eventstats max(eval(if(rolling_batch_request_count>10, event_time, null()))) AS qualifying_end
+        BY vendor_account user_arn
+
+    | eventstats min(eval(if(event_time=qualifying_end, window_start, null()))) AS qualifying_start
+        BY vendor_account user_arn
+
+    | where isnotnull(qualifying_start)
+            AND event_time>=qualifying_start
+            AND event_time<=qualifying_end
+
+    | stats count AS batch_request_count
+            values(sourceIPAddress) AS src
+            values(userAgent) AS user_agent
+            values(awsRegion) AS vendor_region
+            earliest(event_time) AS firstTime
+            latest(event_time) AS lastTime
+
+      BY vendor_account user_arn
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `aws_anomalous_secrets_manager_batch_retrieval_filter`
+how_to_implement: |-
+    Ingest AWS CloudTrail management events into Splunk using the aws:cloudtrail sourcetype.
+known_false_positives: |-
+    Legitimate administrators, deployment systems, credential-rotation services, incident-response tooling, or newly deployed applications may use BatchGetSecretValue for the first time.
+    A principal may trigger the detection again when it has not used the API during the preceding seven days.
+    Review the principal, source IP address, user agent, account, region, requested secret identifiers, and surrounding CloudTrail activity to determine whether the request was authorized.
+references:
+    - https://attack.mitre.org/techniques/T1555/006/
+    - https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_BatchGetSecretValue.html
+    - https://docs.aws.amazon.com/secretsmanager/latest/userguide/cloudtrail_log_entries.html
+    - https://www.elastic.co/guide/en/security/8.19/aws-secrets-manager-rapid-secrets-retrieval.html
+drilldown_searches:
+    - name: View detection results for - "$user_arn$"
+      search: '%original_detection_search% | search user_arn="$user_arn$" vendor_account="$vendor_account$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View Secrets Manager activity for the last 7 days for - "$user_arn$"
+      search: '`cloudtrail` eventSource="secretsmanager.amazonaws.com" | eval user_arn=''userIdentity.arn'', vendor_account=recipientAccountId | where (isnull(errorCode) OR errorCode="" OR lower(errorCode)="success") | search user_arn="$user_arn$" vendor_account="$vendor_account$" | table _time user_arn vendor_account eventName sourceIPAddress userAgent awsRegion requestParameters'
+      earliest_offset: 7d
+      latest_offset: "0"
+    - name: View risk events for the last 7 days for - "$user_arn$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object="$user_arn$" | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+finding:
+    title: The identity [$user_arn$] made [$batch_request_count$] successful AWS Secrets Manager BatchGetSecretValue requests within one hour
+    entity:
+        field: user_arn
+        type: user
+        score: 40
+threat_objects:
+    - field: src
+      type: ip_address
+analytic_story:
+    - AWS Identity and Access Management Account Takeover
+asset_type: AWS Account
+mitre_attack_id:
+    - T1555.006
+product:
+    - Splunk Cloud
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+category: cloud
+security_domain: threat
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.json
+          source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
+      test_type: unit