[onurmerdogan]

Summary

This PR mainly contains updates to existing network detections, based on the telemetry from recent engagements. List of changes can be found below.

Changes

Lookups

Lookup	Change
remote_access_software	Rebuilt from ~605 to ~2,510 rows. Old columns (remote_domain, remote_utility, remote_utility_fileinfo, remote_appid, isutility, comment_reference, last_update) are replaced by app, match_pattern, domain, file_path, file_name, file_info, category, reference, description. Match types are now WILDCARD on match_pattern, domain, file_path, file_name and file_info. The isutility filter is gone.
filesharing_domains_lookup (new)	About 100 file-sharing and pastebin-style domains, wildcard-matched on domain. Replaces a hard-coded list of 30 URL patterns.

Detections

Remote access software (detect_remote_access_software_usage_*)

• Covers the file, fileinfo, process, registry, DNS, traffic and URL variants.
• Each builds its pre-filter from inputlookup remote_access_software on the relevant column, then enriches matches with lookup ... OUTPUT app as signature, category, reference, description.
• Alert messages now include the matched software name and, where available, the user.

Cisco Secure Firewall

• Remote Access Software Usage Traffic: matches ClientApplication against remote_access_software.match_pattern. No longer uses cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools or its category filter.
• Connection to File Sharing Domain: uses filesharing_domains_lookup instead of an inline url IN (...) list.
• Communication Over Suspicious Ports: replaces the fixed list of 10 ports with a pattern-based check on ports 1025-49150. It flags repeated digits (4444, 55555), ascending digits (1234, 12345) and descending digits (4321).

HTTP POST Request with Encoded Payload (Zeek)

• Now also detects URL, XML, Unicode and Octal encodings, in addition to hex and base64.
• Excludes application/x-www-form-urlencoded and application/ocsp-request bodies and a few mobile-app user agents.
• uri moved from the by clause into values().

[nasbench]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T10:43:38.319407Z	9f40223	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

https://github.com/splunk/security_content/blob/0e928a9e890fd056df0da2d8cf16ace0167c38eb/lookups/csv/remote_access_software.csv#L688
Remove shared GitHub hosts from remote-access indicators

Using github.com as a domain indicator causes every ordinary lookup or web request to GitHub to match the rebuilt lookup. Both detect_remote_access_software_usage_dns.yml and detect_remote_access_software_usage_url.yml now feed the entire domain column into their prefilters, so routine developer traffic will generate remote-access findings attributed arbitrarily to GLPI Agent, Komari, or Nezha; restrict these entries to product-specific hosts or paths rather than the shared GitHub domain.

---

security_content/detections/network/http_post_request_with_encoded_payload.yml

Lines 35 to 36 in 0e928a9

	| eval encoding=ltrim(if(match(post_body, "^(?:\\\\x[0-9a-fA-F]{2}){8,}|(?:%[0-9a-fA-F]{2}){8,}"), "Hexadecimal", ""), " + ")
	| eval encoding=ltrim(if(match(post_body, "^(?:[A-Za-z0-9+\\/]{4}){16,}={0,2}"), encoding." + Base64", encoding), " + ")

Do not anchor encoded-payload matches to the body start

The added ^ changes the detection from finding encoded runs anywhere in post_body to finding them only at byte zero. Common payloads such as JSON ({"payload":"<base64>"}) or any prefixed parameter therefore no longer match even when they contain the same long encoded sequence detected by the previous search; the same anchor is applied to the other encoding variants below, substantially reducing the analytic's intended coverage.

---

security_content/detections/endpoint/detect_remote_access_software_usage_registry.yml

Line 54 in 0e928a9

| rex field=registry_value_data "[\\\b](?<file_name>[^\\\/\'\"]+\.\w{2,5})\b"

Extract bare executable names from registry values

When a Run or service ImagePath value contains a bare executable such as AnyDesk.exe --service, the new prefilter matches it through file_name, but this rex requires a preceding backslash (inside the character class, \b is a backspace rather than a start-of-word assertion). Consequently file_name and signature remain null, so the alert loses attribution and the software-based remote_access_software_usage_exceptions lookup cannot suppress an approved installation; allow the filename to start at the beginning of the value as well as after a path separator.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[nasbench]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9f4022354e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".