Skip to content

Decrement version on detection that should not have been bumped #4321

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
onurmerdogan merged 3 commits into from
Oct 7, 2026
+14 −14
Merged

Decrement version on detection that should not have been bumped #4321

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c324183
Decrement version on detection that should not have been bumped
pyth0n1c Oct 7, 2026
d339507
another detection that was bumped accidentally
pyth0n1c Oct 7, 2026
52449e2
Push changed to a bunch of files that should not have been bumped
pyth0n1c Oct 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion detections/endpoint/cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: Cisco NVM - Browser Spawned Unix Shell with External Connection
id: 6f2de8d1-9a2d-4c7a-9b8c-3b8a2f7d0e41
version: 2
version: 1
creation_date: '2026-09-02'
modification_date: '2026-09-22'
author: Maria Jose Erquiaga, Splunk
Expand Down
2 changes: 1 addition & 1 deletion detections/endpoint/cisco_nvm___curl_execution_with_insecure_flags.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: Cisco NVM - Curl Execution With Insecure Flags
id: cc695238-3117-4e60-aa83-4beac2a42c69
version: 9
version: 8
creation_date: '2025-07-01'
modification_date: '2026-09-22'
author: Nasreddine Bencherchali, Splunk
Expand Down
2 changes: 1 addition & 1 deletion detections/endpoint/cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI
id: f2a9df84-9b01-4a21-9e3a-7aa1a217f69e
version: 7
version: 6
creation_date: '2025-07-01'
modification_date: '2026-09-22'
author: Nasreddine Bencherchali, Splunk
Expand Down
2 changes: 1 addition & 1 deletion detections/endpoint/cisco_nvm___non_network_binary_making_network_connection.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: Cisco NVM - Non-Network Binary Making Network Connection
id: c6db35af-8a0e-4b61-88ed-738e66f15715
version: 7
version: 6
creation_date: '2025-07-01'
modification_date: '2026-09-22'
author: Nasreddine Bencherchali, Splunk
Expand Down
2 changes: 1 addition & 1 deletion detections/endpoint/cisco_nvm___osascript_network_connection_for_a_long_duration.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: Cisco NVM - Osascript Network Connection for a Long Duration
id: 6bc88a9d-f7de-4257-b526-acf15bc5a517
version: 2
version: 1
creation_date: '2026-09-18'
modification_date: '2026-09-22'
author: Radka Viskova, Splunk
Expand Down
2 changes: 1 addition & 1 deletion detections/endpoint/cisco_nvm___rclone_execution_with_network_activity.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: Cisco NVM - Rclone Execution With Network Activity
id: 719f8c78-b20d-4bb9-8c33-6d1a762e7a9a
version: 8
version: 7
creation_date: '2025-07-01'
modification_date: '2026-09-22'
author: Nasreddine Bencherchali, Splunk
Expand Down
2 changes: 1 addition & 1 deletion detections/endpoint/cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download
id: 18f0d27d-569e-4bc4-96e1-09b214fa73c0
version: 7
version: 6
creation_date: '2025-07-01'
modification_date: '2026-09-22'
author: Nasreddine Bencherchali, Splunk
Expand Down
2 changes: 1 addition & 1 deletion detections/endpoint/cisco_nvm___susp_script_from_archive_triggering_network_activity.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: Cisco NVM - Susp Script From Archive Triggering Network Activity
id: 8b07c2c9-0cde-4c44-9fa6-59dcf2b25777
version: 7
version: 6
creation_date: '2025-07-01'
modification_date: '2026-09-22'
author: Nasreddine Bencherchali, Splunk
Expand Down
2 changes: 1 addition & 1 deletion detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: Cisco NVM - Suspicious Download From File Sharing Website
id: 94ebc001-35e7-4ae8-9b0e-52766b2f99c7
version: 8
version: 7
creation_date: '2025-07-01'
modification_date: '2026-09-22'
author: Nasreddine Bencherchali, Splunk
Expand Down
2 changes: 1 addition & 1 deletion detections/endpoint/cisco_nvm___suspicious_file_download_via_headless_browser.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: Cisco NVM - Suspicious File Download via Headless Browser
id: cd0e816f-f67d-4dbe-a153-480b546e867e
version: 7
version: 6
creation_date: '2025-07-01'
modification_date: '2026-09-22'
author: Nasreddine Bencherchali, Splunk
Expand Down
2 changes: 1 addition & 1 deletion detections/endpoint/cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: Cisco NVM - Suspicious Network Connection From Process With No Args
id: 54fa06c5-96a2-4406-a4a7-44d93ddbd173
version: 7
version: 6
creation_date: '2025-07-01'
modification_date: '2026-09-22'
author: Nasreddine Bencherchali, Splunk
Expand Down
2 changes: 1 addition & 1 deletion detections/endpoint/cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: Cisco NVM - Suspicious Network Connection Initiated via MsXsl
id: 1cbcf75f-0e45-4f29-8c1b-7fcd7e55cc55
version: 7
version: 6
creation_date: '2025-07-01'
modification_date: '2026-09-22'
author: Nasreddine Bencherchali, Splunk
Expand Down
2 changes: 1 addition & 1 deletion detections/endpoint/cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: Cisco NVM - Suspicious Network Connection to IP Lookup Service API
id: 568cb83e-d79e-4a23-85ec-6e1f6c30cb2f
version: 9
version: 8
creation_date: '2025-07-01'
modification_date: '2026-09-22'
author: Nasreddine Bencherchali, Splunk, Janantha Marasinghe
Expand Down
2 changes: 1 addition & 1 deletion detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: Cisco NVM - Webserver Download From File Sharing Website
id: 1984f997-3b49-4d4b-a7e9-dc5dbf88370e
version: 8
version: 7
creation_date: '2025-07-01'
modification_date: '2026-09-22'
author: Nasreddine Bencherchali, Splunk
Expand Down
Loading