diff --git a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml index 15f820549c..72bbe5d099 100644 --- a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml +++ b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Browser Spawned Unix Shell with External Connection id: 6f2de8d1-9a2d-4c7a-9b8c-3b8a2f7d0e41 -version: 2 +version: 1 creation_date: '2026-09-02' modification_date: '2026-09-22' author: Maria Jose Erquiaga, Splunk diff --git a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml index 4291c2f1be..62be4e512f 100644 --- a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml +++ b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Curl Execution With Insecure Flags id: cc695238-3117-4e60-aa83-4beac2a42c69 -version: 9 +version: 8 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml index e2b0c93aa3..ff2f2a1108 100644 --- a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml +++ b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml @@ -1,6 +1,6 @@ name: Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI id: f2a9df84-9b01-4a21-9e3a-7aa1a217f69e -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml index dc296fbfa2..5d9707b471 100644 --- a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml +++ b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Non-Network Binary Making Network Connection id: c6db35af-8a0e-4b61-88ed-738e66f15715 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml index 1d63ae1c37..f9a7a87931 100644 --- a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml +++ b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Osascript Network Connection for a Long Duration id: 6bc88a9d-f7de-4257-b526-acf15bc5a517 -version: 2 +version: 1 creation_date: '2026-09-18' modification_date: '2026-09-22' author: Radka Viskova, Splunk diff --git a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml index 002d7f3c79..f08391700b 100644 --- a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml +++ b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Rclone Execution With Network Activity id: 719f8c78-b20d-4bb9-8c33-6d1a762e7a9a -version: 8 +version: 7 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml index c8caad0967..b64b3f4cbe 100644 --- a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml +++ b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download id: 18f0d27d-569e-4bc4-96e1-09b214fa73c0 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml index d98e0f72d8..fe101b8b27 100644 --- a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml +++ b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Susp Script From Archive Triggering Network Activity id: 8b07c2c9-0cde-4c44-9fa6-59dcf2b25777 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml index 2d0f030e05..790d763268 100644 --- a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious Download From File Sharing Website id: 94ebc001-35e7-4ae8-9b0e-52766b2f99c7 -version: 8 +version: 7 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml index 9e5dd3c33f..868531d281 100644 --- a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml +++ b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious File Download via Headless Browser id: cd0e816f-f67d-4dbe-a153-480b546e867e -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml index f2e4760a56..c3ab060c00 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious Network Connection From Process With No Args id: 54fa06c5-96a2-4406-a4a7-44d93ddbd173 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml index e4cc59a7ea..7a99176ded 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious Network Connection Initiated via MsXsl id: 1cbcf75f-0e45-4f29-8c1b-7fcd7e55cc55 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml index c7c2ad43c3..6586f1d026 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious Network Connection to IP Lookup Service API id: 568cb83e-d79e-4a23-85ec-6e1f6c30cb2f -version: 9 +version: 8 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk, Janantha Marasinghe diff --git a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml index f1360e9e90..e79046f8d0 100644 --- a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Webserver Download From File Sharing Website id: 1984f997-3b49-4d4b-a7e9-dc5dbf88370e -version: 8 +version: 7 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk