diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml
index 3403eef36a..59268a324d 100644
--- a/detections/endpoint/download_files_using_telegram.yml
+++ b/detections/endpoint/download_files_using_telegram.yml
@@ -1,8 +1,8 @@
 name: Download Files Using Telegram
 id: 58194e28-ae5e-11eb-8912-acde48001122
-version: 12
+version: 13
 creation_date: '2021-05-07'
-modification_date: '2026-05-13'
+modification_date: '2026-10-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -47,6 +47,7 @@ analytic_story:
     - XMRig
     - Water Gamayun
     - 0bj3ctivity Stealer
+    - Braodo Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1105
diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
index 88b6fb4b74..7bdf159487 100644
--- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
+++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
@@ -1,8 +1,8 @@
 name: Executables Or Script Creation In Suspicious Path
 id: a7e3f0f0-ae42-11eb-b245-acde48001122
-version: 31
+version: 32
 creation_date: '2021-05-07'
-modification_date: '2026-08-14'
+modification_date: '2026-10-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -141,6 +141,7 @@ analytic_story:
     - Phantom Stealer
     - Starland RAT Campaign
     - Vidar Stealer
+    - Braodo Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1036
diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml
index 69962abd69..70c7ca2f5d 100644
--- a/detections/endpoint/executables_or_script_creation_in_temp_path.yml
+++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml
@@ -1,8 +1,8 @@
 name: Executables Or Script Creation In Temp Path
 id: e0422b71-2c05-4f32-8754-01fb415f49c9
-version: 27
+version: 28
 creation_date: '2021-05-07'
-modification_date: '2026-08-14'
+modification_date: '2026-10-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -134,6 +134,7 @@ analytic_story:
     - Salat Stealer
     - Phantom Stealer
     - Vidar Stealer
+    - Braodo Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1036
diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
index 87b1884b1c..c358aafab6 100644
--- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
+++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
@@ -1,8 +1,8 @@
 name: Non Firefox Process Access Firefox Profile Dir
 id: e6fc13b0-1609-11ec-b533-acde48001122
-version: 21
+version: 22
 creation_date: '2021-09-15'
-modification_date: '2026-08-14'
+modification_date: '2026-10-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -54,6 +54,7 @@ analytic_story:
     - Salat Stealer
     - Phantom Stealer
     - Vidar Stealer
+    - Braodo Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1555.003
diff --git a/detections/endpoint/powershell_download_from_code_hosting_service.yml b/detections/endpoint/powershell_download_from_code_hosting_service.yml
new file mode 100644
index 0000000000..2611e6247e
--- /dev/null
+++ b/detections/endpoint/powershell_download_from_code_hosting_service.yml
@@ -0,0 +1,91 @@
+name: PowerShell Download from Code Hosting Service
+id: 3ffbd4d4-84a7-453e-9e06-8e9cd0350366
+version: 1
+creation_date: '2026-10-06'
+modification_date: '2026-10-13'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+description: |-
+    This analytic detects PowerShell Script Block Logging (Event ID 4104) events that use common download methods to retrieve files directly from raw-content URLs on GitHub, GitLab, or Codeberg.
+    These code hosting services can be abused to stage payloads, but administrators and developers also download files from them.
+    A match identifies a download attempt; it does not establish that the file was successfully retrieved or executed. Review the full script block, destination path, process ancestry, and related endpoint activity.
+data_source:
+    - Powershell Script Block Logging 4104
+search: |-
+    `powershell` EventCode=4104 ScriptBlockText IN ("*.DownloadFile(*", "*.DownloadData(*", "*.DownloadString(*", "*Invoke-WebRequest*", "*Invoke-RestMethod*", "*Start-BitsTransfer*", "*iwr *", "*irm *", "*curl *", "*wget *")
+    | where match(
+        ScriptBlockText,
+        "(?ix)
+            (?:
+                \.Download(?:File|Data|String)\s*\(\s*['\"]?
+                |
+                (?:Invoke-WebRequest|Invoke-RestMethod|iwr|irm)
+                (?:\s+(?:-Uri\s+)?|\b[^;\r\n]{0,200}?\s-Uri\s+)['\"]?
+                |
+                Start-BitsTransfer\b[^;\r\n]{0,200}?-Source\s+['\"]?
+                |
+                (?:curl|wget)\s+(?:-Uri\s+)?['\"]?
+            )
+            https?://
+            (?:
+                raw\.githubusercontent\.com/[^/\s'\"]+/[^/\s'\"]+/[^/\s'\"]+(?:/[^/\s'\"]+)*
+                |
+                (?:github|gitlab)\.com/[^/\s'\"]+/[^/\s'\"]+/(?:-/)?raw/(?:refs/(?:heads|tags)/)?[^/\s'\"]+(?:/[^/\s'\"]+)*
+                |
+                codeberg\.org/[^/\s'\"]+/[^/\s'\"]+/raw/(?:branch/)?[^/\s'\"]+(?:/[^/\s'\"]+)*
+            )
+            \.(?:bat|cmd|ps1|js|vbs|vbe|py|zip|7z|rar|tar|gz|exe|dll|msi)
+            (?:[?#][^\s'\"]*)?
+            (?=['\"\s),;]|$)"
+    )
+    | fillnull
+    | stats count min(_time) as firstTime max(_time) as lastTime
+        by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `powershell_download_from_code_hosting_service_filter`
+how_to_implement: |-
+    To implement this analytic, enable PowerShell Script Block Logging and ingest Event ID 4104 events with the `ScriptBlockText` field extracted.
+    Confirm that the `powershell` macro scopes the search to the correct PowerShell Operational logs in your environment.
+known_false_positives: |-
+    Administrators, developers, and software deployment tools may download legitimate files from GitHub, GitLab, and Codeberg.
+    Review repository ownership, the downloaded file, destination path, signer where applicable, process ancestry, and subsequent execution before taking action.
+references:
+    - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html
+    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.6
+drilldown_searches:
+    - name: View the detection results for - "$dest$"
+      search: '%original_detection_search% | search  dest = "$dest$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$dest$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+intermediate_findings:
+    entities:
+        - field: dest
+          type: system
+          score: 20
+          message: A PowerShell script on [$dest$] invoked a download method with a raw code-hosting URL in ScriptBlockText with ScriptBlockId [$ScriptBlockId$].
+threat_objects: []
+analytic_story:
+    - Braodo Stealer
+asset_type: Endpoint
+mitre_attack_id:
+    - T1059.001
+    - T1105
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_github/powershell_githu_download.log
+          source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+          sourcetype: XmlWinEventLog
+      test_type: unit
diff --git a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml
index 48b6050197..6fa6786fe8 100644
--- a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml
+++ b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml
@@ -1,8 +1,8 @@
 name: Windows Boot or Logon Autostart Execution In Startup Folder
 id: 99d157cb-923f-4a00-aee9-1f385412146f
-version: 17
+version: 18
 creation_date: '2023-01-16'
-modification_date: '2026-07-20'
+modification_date: '2026-10-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -51,6 +51,7 @@ analytic_story:
     - BlankGrabber Stealer
     - Phantom Stealer
     - Starland RAT Campaign
+    - Braodo Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1547.001
diff --git a/detections/endpoint/windows_disable_or_stop_browser_process.yml b/detections/endpoint/windows_disable_or_stop_browser_process.yml
index 354d3e7a7d..24eb9e8c80 100644
--- a/detections/endpoint/windows_disable_or_stop_browser_process.yml
+++ b/detections/endpoint/windows_disable_or_stop_browser_process.yml
@@ -1,8 +1,8 @@
 name: Windows Disable or Stop Browser Process
 id: 220d34b7-b6c7-45fe-8dbb-c35cdd9fe6d5
-version: 15
+version: 16
 creation_date: '2024-10-18'
-modification_date: '2026-08-14'
+modification_date: '2026-10-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
diff --git a/detections/endpoint/windows_dns_query_request_to_tinyurl.yml b/detections/endpoint/windows_dns_query_request_to_tinyurl.yml
index cc66fe2bfe..19d561e114 100644
--- a/detections/endpoint/windows_dns_query_request_to_tinyurl.yml
+++ b/detections/endpoint/windows_dns_query_request_to_tinyurl.yml
@@ -1,8 +1,8 @@
 name: Windows DNS Query Request To TinyUrl
 id: b1ea79da-719c-437c-acaf-5c93f838f425
-version: 5
+version: 6
 creation_date: '2021-11-18'
-modification_date: '2026-05-13'
+modification_date: '2026-10-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -22,7 +22,11 @@ search: |
       "*\\ProgramData\\*",
       "*\\Temp\\*",
       "*\\Users\\Public\\*",
-      "*\\Windows\\Tasks\\*"
+      "*\\Windows\\Tasks\\*",
+      "*\\powershell.exe",
+      "*\\pwsh.exe",
+      "*\\cmd.exe",
+      "*\\python.exe",
       )
     | stats count min(_time) as firstTime max(_time) as lastTime
       by answer answer_count dvc process_exec process_guid process_name query query_count
@@ -58,6 +62,7 @@ threat_objects:
       type: process_name
 analytic_story:
     - Malicious Inno Setup Loader
+    - Braodo Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1105
diff --git a/detections/endpoint/windows_password_managers_discovery.yml b/detections/endpoint/windows_password_managers_discovery.yml
index 7ad0eb58cc..c5294dd898 100644
--- a/detections/endpoint/windows_password_managers_discovery.yml
+++ b/detections/endpoint/windows_password_managers_discovery.yml
@@ -1,8 +1,8 @@
 name: Windows Password Managers Discovery
 id: a3b3bc96-1c4f-4eba-8218-027cac739a48
-version: 13
+version: 14
 creation_date: '2022-12-06'
-modification_date: '2026-05-13'
+modification_date: '2026-10-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -55,6 +55,7 @@ analytic_story:
     - Prestige Ransomware
     - Scattered Spider
     - Scattered Lapsus$ Hunters
+    - Braodo Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1555.005
diff --git a/detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml b/detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml
new file mode 100644
index 0000000000..20207c5a70
--- /dev/null
+++ b/detections/endpoint/windows_process_outbound_connection_to_social_media_domain.yml
@@ -0,0 +1,107 @@
+name: Windows Process Outbound Connection To Social Media Domain
+id: d6dc231e-8595-499b-889e-cf6a055df4d4
+version: 1
+creation_date: '2026-10-06'
+modification_date: '2026-10-06'
+author: Teoderick Contreras, Splunk
+status: production
+type: Anomaly
+description: |-
+    This analytic detects outbound network connections from a Python process running from suspicious or non-standard directories to social media related domains.
+    It leverages Sysmon Event ID 3 to surface this anomalous behavior.
+    Legitimate Python applications rarely originate from paths such as "C:\Users\Public\", Windows font or debug folders, or the Recycle Bin, making direct outbound calls to social media infrastructure from these locations a strong indicator of compromise.
+    For example the Braodo Stealer, a Python-based credential-harvesting malware, abuses authenticated browser sessions to query the Meta Graph API and enumerate the victim's Facebook and Meta advertising infrastructure.
+data_source:
+    - Sysmon EventID 3
+search: |-
+    `sysmon`
+    EventCode=3
+    Image IN (
+        "*:\\$Recycle.Bin\\*",
+        "*:\\PerfLogs\\*",
+        "*:\\Users\\Administrator\\Music\\*",
+        "*:\\Users\\Public\\*",
+        "*:\\Windows\\Cursors\\*",
+        "*:\\Windows\\debug\\*",
+        "*:\\Windows\\fonts\\*",
+        "*:\\Windows\\INF\\*",
+        "*:\\Windows\\Media\\*",
+        "*:\\Windows\\Prefetch\\*",
+        "*\\Windows\\repair\\*"
+    )
+
+    process_name IN (
+        "py.exe",
+        "pypy.exe",
+        "python.exe",
+        "python2*.exe",
+        "python3*.exe",
+        "pythonw.exe"
+    )
+
+    dest IN (
+        "*.facebook.com",
+        "*.facebook.net",
+        "*.facebook.org",
+        "*.fb.com",
+        "*.fbcd.net",
+        "*.fbsbx.com",
+        "*.fbstatic-a.akamaihd.net",
+        "*.tfbw.net"
+    )
+    direction = outbound
+
+    | rename Image as process_path
+
+    | stats count min(_time) as firstTime
+                  max(_time) as lastTime
+
+      by action app dest dest_ip dest_port direction dvc protocol protocol_version
+         process_path process_name process_guid process_id
+         src src_ip src_port transport user vendor_product
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `windows_process_outbound_connection_to_social_media_domain_filter`
+how_to_implement: |-
+    To successfully implement this search, you need to be ingesting logs with the process name and sysmon eventcode = 3 connection events from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: |-
+    No false positives have been identified at this time.
+references:
+    - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html
+drilldown_searches:
+    - name: View the detection results for - "$src$"
+      search: '%original_detection_search% | search  src = "$src$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View risk events for the last 7 days for - "$src$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+intermediate_findings:
+    entities:
+        - field: dest
+          type: system
+          score: 20
+          message: A python process located in [$process_path$] with the name [$process_name$] and GUID [$process_guid$] and ID [$process_id$] was observed accessing a social media domain [$dest$]
+threat_objects:
+    - field: process_path
+      type: file_path
+analytic_story:
+    - Braodo Stealer
+asset_type: Endpoint
+mitre_attack_id:
+    - T1586.001
+product:
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+    - Splunk Cloud
+category: endpoint
+security_domain: endpoint
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.001/python_fb/python_facebook.log
+          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+          sourcetype: XmlWinEventLog
+      test_type: unit
diff --git a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml
index dc87224238..f1d6a09ed2 100644
--- a/detections/network/windows_dns_query_request_by_telegram_bot_api.yml
+++ b/detections/network/windows_dns_query_request_by_telegram_bot_api.yml
@@ -1,8 +1,8 @@
 name: Windows DNS Query Request by Telegram Bot API
 id: 86f66f44-94d9-412d-a71d-5d8ed0fef72e
-version: 12
+version: 13
 creation_date: '2021-08-03'
-modification_date: '2026-07-20'
+modification_date: '2026-10-06'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -47,6 +47,7 @@ analytic_story:
     - VIP Keylogger
     - Phantom Stealer
     - Starland RAT Campaign
+    - Braodo Stealer
 asset_type: Endpoint
 mitre_attack_id:
     - T1071.004
diff --git a/stories/braodo_stealer.yml b/stories/braodo_stealer.yml
index f2ffbf3f1b..c55ebb63d5 100644
--- a/stories/braodo_stealer.yml
+++ b/stories/braodo_stealer.yml
@@ -1,15 +1,28 @@
 name: Braodo Stealer
 id: ec5c8721-3c13-45ac-90e8-64c63a8fdc24
-version: 2
+version: 3
 creation_date: '2024-10-15'
-modification_date: '2026-05-13'
+modification_date: '2026-10-07'
 author: Teoderick Contreras, Splunk
 status: production
-description: Leverage searches that allow you to detect and investigate unusual activities that may be related to the Braodo Stealer malware, a malicious software designed to steal sensitive information from infected systems. This malware typically targets login credentials, browser history, cookies, and stored passwords. Braodo Stealer often infiltrates through phishing campaigns or malicious downloads, enabling attackers to gain unauthorized access to personal and financial data. By monitoring unusual system behaviors, such as unauthorized network connections or data exfiltration, you can help prevent data breaches and mitigate the impact of this threat.
-narrative: Braodo Stealer is a stealthy and dangerous piece of malware specifically engineered to siphon sensitive information from compromised systems. Often spread through phishing emails or disguised as legitimate downloads, it silently infiltrates a victim’s device. Once inside, it scours through browser histories, steals login credentials, captures cookies, and even extracts saved passwords from various applications. With this stolen data, cybercriminals can gain access to banking accounts, social media profiles, or business platforms. What makes Braodo Stealer particularly threatening is its ability to remain undetected, allowing attackers to exploit compromised systems for extended periods before the user becomes aware.
+description: |-
+    Leverage searches that allow you to detect and investigate unusual activities that may be related to the Braodo Stealer malware, a malicious software designed to steal sensitive information from infected systems.
+    This malware typically targets login credentials, browser history, cookies, and stored passwords.
+    Beyond credential theft, recent variants of Braodo Stealer abuse authenticated Facebook sessions to query the Meta Graph API, enumerating advertising accounts, Facebook Pages, and Business Manager infrastructure — including account balances, spending limits, payment thresholds, and associated credit-card payment methods.
+    Braodo Stealer often infiltrates through phishing campaigns or malicious downloads, enabling attackers to gain unauthorized access to personal and financial data. By monitoring unusual system behaviors, such as unauthorized network connections to Meta Graph API endpoints or data exfiltration, you can help prevent data breaches and mitigate the impact of this threat.
+narrative: |-
+    Braodo Stealer is a stealthy and dangerous piece of malware specifically engineered to siphon sensitive information from compromised systems. 
+    Often spread through phishing emails or disguised as legitimate downloads, it silently infiltrates a victim’s device.
+    Once inside, it scours through browser histories, steals login credentials, captures cookies, and extracts saved passwords from various applications.
+    In its latest observed variants, Braodo Stealer goes beyond traditional credential theft by leveraging stolen Facebook session cookies to query the Meta Graph API.
+    Using an authenticated session obtained from the victim’s browser, the malware enumerates advertising accounts, Facebook Pages, and Business Manager accounts associated with the victim.
+    For each discovered asset, it collects account IDs, status, currency, current balances, spending amounts, spending limits, payment thresholds, creation dates, and details about associated credit-card payment methods. For Business Manager accounts, it additionally checks advertising-account limits, giving the attacker a comprehensive picture of the victim’s advertising infrastructure and financial exposure.
+    With this stolen data, cybercriminals can hijack advertising accounts to run malicious ad campaigns, drain pre-funded ad balances, or sell access to high-value Business Manager accounts.
+    What makes Braodo Stealer particularly threatening is its ability to remain undetected while quietly profiling victims’ financial and advertising assets, allowing attackers to maximize monetization long after the initial compromise.
 references:
     - https://bazaar.abuse.ch/browse/tag/Braodo/
     - https://g0njxa.medium.com/from-vietnam-to-united-states-malware-fraud-and-dropshipping-98b7a7b2c36d
+    - https://www.splunk.com/en_us/blog/security/cracking-braodo-stealer-analyzing-python-malware-and-its-obfuscated-loader.html
 category:
     - Data Destruction
     - Malware