From c324183503fe293aee96b0e3bd96a4230a92795a Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 6 Oct 2026 20:58:11 -0500 Subject: [PATCH 1/3] Decrement version on detection that should not have been bumped because no stanza fields were changed, this detection should not have been bumped. --- ...vm___browser_spawned_unix_shell_with_external_connection.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml index 15f820549c..72bbe5d099 100644 --- a/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml +++ b/detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Browser Spawned Unix Shell with External Connection id: 6f2de8d1-9a2d-4c7a-9b8c-3b8a2f7d0e41 -version: 2 +version: 1 creation_date: '2026-09-02' modification_date: '2026-09-22' author: Maria Jose Erquiaga, Splunk From d339507b4cf7dbd290df265549c9c835f2124ec2 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 6 Oct 2026 21:33:32 -0500 Subject: [PATCH 2/3] another detection that was bumped accidentally --- .../endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml index 4291c2f1be..62be4e512f 100644 --- a/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml +++ b/detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Curl Execution With Insecure Flags id: cc695238-3117-4e60-aa83-4beac2a42c69 -version: 9 +version: 8 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk From 52449e2a8a9f3743e82ea02c3860d962d02010a5 Mon Sep 17 00:00:00 2001 From: Eric McGinnis Date: Tue, 6 Oct 2026 21:54:32 -0500 Subject: [PATCH 3/3] Push changed to a bunch of files that should not have been bumped --- ...m___mshtml_or_mshta_network_execution_without_url_in_cli.yml | 2 +- ...cisco_nvm___non_network_binary_making_network_connection.yml | 2 +- ...o_nvm___osascript_network_connection_for_a_long_duration.yml | 2 +- .../cisco_nvm___rclone_execution_with_network_activity.yml | 2 +- ..._nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml | 2 +- ...m___susp_script_from_archive_triggering_network_activity.yml | 2 +- ...isco_nvm___suspicious_download_from_file_sharing_website.yml | 2 +- ...isco_nvm___suspicious_file_download_via_headless_browser.yml | 2 +- ..._suspicious_network_connection_from_process_with_no_args.yml | 2 +- ..._nvm___suspicious_network_connection_initiated_via_msxsl.yml | 2 +- ...__suspicious_network_connection_to_ip_lookup_service_api.yml | 2 +- ...cisco_nvm___webserver_download_from_file_sharing_website.yml | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml index e2b0c93aa3..ff2f2a1108 100644 --- a/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml +++ b/detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml @@ -1,6 +1,6 @@ name: Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI id: f2a9df84-9b01-4a21-9e3a-7aa1a217f69e -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml index dc296fbfa2..5d9707b471 100644 --- a/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml +++ b/detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Non-Network Binary Making Network Connection id: c6db35af-8a0e-4b61-88ed-738e66f15715 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml index 1d63ae1c37..f9a7a87931 100644 --- a/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml +++ b/detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Osascript Network Connection for a Long Duration id: 6bc88a9d-f7de-4257-b526-acf15bc5a517 -version: 2 +version: 1 creation_date: '2026-09-18' modification_date: '2026-09-22' author: Radka Viskova, Splunk diff --git a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml index 002d7f3c79..f08391700b 100644 --- a/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml +++ b/detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Rclone Execution With Network Activity id: 719f8c78-b20d-4bb9-8c33-6d1a762e7a9a -version: 8 +version: 7 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml index c8caad0967..b64b3f4cbe 100644 --- a/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml +++ b/detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download id: 18f0d27d-569e-4bc4-96e1-09b214fa73c0 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml index d98e0f72d8..fe101b8b27 100644 --- a/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml +++ b/detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Susp Script From Archive Triggering Network Activity id: 8b07c2c9-0cde-4c44-9fa6-59dcf2b25777 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml index 2d0f030e05..790d763268 100644 --- a/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious Download From File Sharing Website id: 94ebc001-35e7-4ae8-9b0e-52766b2f99c7 -version: 8 +version: 7 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml index 9e5dd3c33f..868531d281 100644 --- a/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml +++ b/detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious File Download via Headless Browser id: cd0e816f-f67d-4dbe-a153-480b546e867e -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml index f2e4760a56..c3ab060c00 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious Network Connection From Process With No Args id: 54fa06c5-96a2-4406-a4a7-44d93ddbd173 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml index e4cc59a7ea..7a99176ded 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious Network Connection Initiated via MsXsl id: 1cbcf75f-0e45-4f29-8c1b-7fcd7e55cc55 -version: 7 +version: 6 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk diff --git a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml index c7c2ad43c3..6586f1d026 100644 --- a/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml +++ b/detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Suspicious Network Connection to IP Lookup Service API id: 568cb83e-d79e-4a23-85ec-6e1f6c30cb2f -version: 9 +version: 8 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk, Janantha Marasinghe diff --git a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml index f1360e9e90..e79046f8d0 100644 --- a/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml +++ b/detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml @@ -1,6 +1,6 @@ name: Cisco NVM - Webserver Download From File Sharing Website id: 1984f997-3b49-4d4b-a7e9-dc5dbf88370e -version: 8 +version: 7 creation_date: '2025-07-01' modification_date: '2026-09-22' author: Nasreddine Bencherchali, Splunk