v6.8.0

🚀 Key Highlights

🔐 Expanded Active Directory and Windows threat coverage 🔐

Added four analytics for KerberLoss SPN manipulation, ResetNightmare-related UPN changes, and Windows Defender artifacts associated with ShieldCrash. These detections help identify suspicious account changes and exploitation activity.

🪟 Consolidated renamed-binary detection 🪟

Added four lookup-backed analytics covering renamed command interpreters, LOLBAS binaries, popular third-party software, and Python binaries. This replaces multiple separate searches with a smaller set of detections.

☁️ Improved support for current security data sources ☁️

Updated Office 365 message trace analytics to support the Microsoft 365 Graph sourcetype while retaining legacy support. Updates also improve CrowdStrike FDR compatibility and refine Azure AD consent and WMI event subscription detections.

🛠️ Detection quality and content improvements 🛠️

Updated 121 analytics and four macros, and added three lookup sets. Changes span Active Directory, cloud, endpoint, Cisco NVM, and Cisco Secure Firewall content, improving data handling, investigation context, and content maintainability.

New Analytics - [8]

• Windows AD Computer SPN Modified By User Account
• Windows AD SPN Unicode Collision Injection
• Windows AD User Suspicious UPN Change
• Windows Defender Intermediary Artifact Was Observed
• Windows Renamed Command Interpreter was Executed
• Windows Renamed LOLBAS Binary was Executed
• Windows Renamed Popular 3rd Party Software was Executed
• Windows Renamed Python Binary was Executed

Updated Analytics - [121]

• 3CX Supply Chain Attack Network Indicators
• Attacker Tools On Endpoint
• Azure AD OAuth Application Consent Granted By User
• Azure AD Privileged Role Assigned to Service Principal
• Azure AD Privileged Role Assigned
• Azure AD User Consent Blocked for Risky Application
• Circle CI Disable Security Job
• Cisco NVM - Browser Spawned Unix Shell with External Connection
• Cisco NVM - Curl Execution With Insecure Flags
• Cisco NVM - Installation of Typosquatted Python Package
• Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI
• Cisco NVM - Non-Network Binary Making Network Connection
• Cisco NVM - Osascript Network Connection for a Long Duration
• Cisco NVM - Outbound Connection to Suspicious Port
• Cisco NVM - Rclone Execution With Network Activity
• Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download
• Cisco NVM - Susp Script From Archive Triggering Network Activity
• Cisco NVM - Suspicious Download From File Sharing Website
• Cisco NVM - Suspicious File Download via Headless Browser
• Cisco NVM - Suspicious Network Connection From Process With No Args
• Cisco NVM - Suspicious Network Connection Initiated via MsXsl
• Cisco NVM - Suspicious Network Connection to IP Lookup Service API
• Cisco NVM - Webserver Download From File Sharing Website
• Cisco Secure Firewall - Binary File Type Download
• Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint
• Cisco Secure Firewall - File Download Over Uncommon Port
• Cisco Secure Firewall - Intrusion Events by Threat Activity
• Cisco Secure Firewall - Malware File Downloaded
• Cisco Secure Firewall - Remote Access Software Usage Traffic
• Cisco Secure Firewall - Repeated Malware Downloads
• Cloud API Calls From Previously Unseen User Roles
• Cloud Compute Instance Created By Previously Unseen User
• Cloud Compute Instance Created In Previously Unused Region
• Cloud Compute Instance Created With Previously Unseen Image
• Cloud Compute Instance Created With Previously Unseen Instance Type
• Cloud Instance Modified By Previously Unseen User
• Cloud Provisioning Activity From Previously Unseen City
• Cloud Provisioning Activity From Previously Unseen Country
• Cloud Provisioning Activity From Previously Unseen IP Address
• Cloud Provisioning Activity From Previously Unseen Region
• Common Ransomware Extensions
• Detect Remote Access Software Usage DNS
• Detect Remote Access Software Usage FileInfo
• Detect Remote Access Software Usage File
• Detect Remote Access Software Usage Process
• Detect Remote Access Software Usage Registry
• Detect Remote Access Software Usage Traffic
• Detect Remote Access Software Usage URL
• Detect hosts connecting to dynamic domain providers
• First Time Seen Child Process of Zoom
• HTTP C2 Framework User Agent
• HTTP Malware User Agent
• HTTP PUA User Agent
• HTTP RMM User Agent
• HTTP Scripting Tool User Agent
• Kubernetes Nginx Ingress LFI
• LOLBAS Network Connection On Uncommon Port
• MacOS Osascript Executing Interactive Shell
• MacOS Osascript Executing JavaScript Code With ObjC
• O365 BEC Email Hiding Rule Created
• [O365 Email Password and Payroll Compromise Be...

v6.7.0

🚀 Key Highlights

🍎 Expanded macOS AppleScript and osascript coverage 🍎

Added three new macOS analytics that identify osascript executing interactive shells, JavaScript for Automation code using the Objective-C bridge, and long-lived network connections. This improves visibility into script-based execution, remote access, command-and-control activity, and post-exploitation behavior on macOS endpoints.

🪟 Windows ClickFix and LOLBin detection coverage 🪟

Added four new Windows analytics covering remote connections through finger.exe, command execution through for /f loops, JavaScript execution by node.exe from unusual directories, and processes accessing the IronLanguages repository on GitHub. Together, these detections improve visibility into ClickFix-related execution chains, payload retrieval, scripting abuse, and the use of trusted utilities for malicious activity.

🔐 Improved credential-access and process-injection detection 🔐

Updated multiple detections leveraging the process access data source, covering LSASS access and termination, credential dumping, Winlogon token manipulation, Rubeus ticket export activity, handle duplication, and process injection. These changes improve analytic consistency, investigation context, and visibility into credential-access and defense-evasion techniques.

🛠️ Detection quality and metadata improvements 🛠️

Updated multiple analytics across application, endpoint, network, and web content. Changes include improved SPL logic, additional threat objects and references, better event context, and tuning intended to improve detection fidelity and reduce noise. Updates include coverage for ESXi tampering and VM termination, event-log clearing, Kerberos coercion, internal network scanning, and suspicious HTTP activity.

New Analytics - [7]

• Cisco NVM - Osascript Network Connection for a Long Duration
• MacOS Osascript Executing Interactive Shell
• MacOS Osascript Executing JavaScript Code With ObjC
• Windows Finger.exe Connecting to a Remote Host
• Windows For Loop Usage Within Cmd.exe To Execute Commands
• Windows Node.exe Executing JS Script In Immediate Folder
• Windows Process Accessing IronLanguages Repository On GitHub

Updated Analytics - [30]

• Cisco IOS XE WebUI Programmatic Configuration
• Creation of lsass Dump with Taskmgr
• CrushFTP Authentication Bypass Exploitation
• CrushFTP Max Simultaneous Users From IP
• DNS Kerberos Coercion
• Detect Credential Dumping through LSASS access
• ESXi Audit Tampering
• ESXi Bulk VM Termination
• Email files written outside of the Outlook directory
• Internal Horizontal Port Scan NMAP Top 20
• Log4Shell JNDI Payload Injection Attempt
• Log4Shell JNDI Payload Injection with Outbound Connection
• Nginx ConnectWise ScreenConnect Authentication Bypass
• Plain HTTP POST Exfiltrated Data
• Prohibited Network Traffic Allowed
• Rubeus Kerberos Ticket Exports Through Winlogon Access
• Suspicious wevtutil Usage
• Unusually Long Content-Type Length
• Windows Access Token Manipulation Winlogon Duplicate Token Handle
• Windows Access Token Winlogon Duplicate Handle In Uncommon Path
• Windows Eventlog Cleared Via Wevtutil
• Windows Handle Duplication in Known UAC-Bypass Binaries
• Windows Possible Credential Dumping
• Windows Process Injection into Commonly Abused Processes
• Windows Terminating Lsass Process
• Windows Unsecured Outlook Credentials Access In Registry
• Windows Unusual File Creation in Confluence Directory
• Windows Vulnerable Driver Installed
• Windows WMI Impersonate Token
• Windows Wermgr Alternate Data Stream in Temp Dir

Other Updates

A special thanks to @0x4D6174696E from the Security Content community for reporting a bug in on piece of content that improved the quality and reliability of the security content.

Breaking Changes

List of detections scheduled for removal in ESCU version 6.10.0

Following is a list of detections scheduled for removal in ESCU version 6.10.0:

Content	Content Type	Removed in Version	Reason	Replacement Content
MacOS - Re-opened Applications	Detection	6.10.0	Detection deprecated as it is targeting a method of persistence that has been disabled in MacOS for years. As well, as the fact that the detection has been set to experimental since 2020.	None
Windows Process Injection into Notepad	Detection	6.10.0	Detection deprecated as it is already covered by the" Windows Process Injection into Commonly Abused Processes" detection.	Windows Process Injection into Commonly Abused Processes
XMRIG Driver Loaded	Detection	6.10.0	Detection deprecated as it is inaccurate. WinRing0x64.sys is not related to XMRIG. It is a driver that is used to access the hardware ring0.	Windows Vulnerable Driver Installed, Windows Vulnerable Driver Loaded

v6.6.0

🚀 Key Highlights

🌐 Suspicious Network and Shell Activity 🌐

Introduced new analytics for browser-spawned Unix shells with external connections, uncommon and rare network connections from LOLBAS binaries, and suspicious Socat listener and remote TCP activity. This coverage helps defenders identify potential command execution, network tunneling, proxying, and command-and-control behavior originating from browsers or trusted system utilities.

🍎 macOS AppleScript and User Interaction 🍎

Added two macOS analytics covering AppleScript shell execution and compilation, as well as suspicious user prompts displayed through osascript. These detections improve visibility into script-based execution and potentially deceptive user interaction used to facilitate malicious activity on macOS endpoints.

🪟 Windows Account and Browser Activity 🪟

Expanded Windows coverage with detections for changes to built-in account names and execution of content copied from a browser. These analytics help identify account manipulation and suspicious execution workflows that may involve commands or payloads copied from web content.

🧩 SCCM Abuse Detection 🧩

Introduced two analytics focused on suspicious SCCM activity: DLL planting in the SMS Provider directory and abnormal child-process execution spawned by smsexec. This provides stronger visibility into potential abuse of SCCM components for execution, persistence, or lateral movement.

🔧 Cross-Platform Detection Refinements 🔧

Updated 18 analytics across Citrix, Windows, Linux, and macOS environments. The refinements improve coverage and detection fidelity for Citrix ADC exploitation, pipe-based execution, file and process activity, data destruction, Ghostscript exploitation, account creation, data chunking, network discovery, PowerShell, event-log manipulation, user and private-key discovery, credential access, and execution from suspicious paths.

🗂️ Detection and AI Risk Classification 🗂️

Together with NIST AI RMF Control Coverage dashboard, we’ve added the detection_subcategory_map and nist_ai_rmf_subcategories lookups to improve analytic categorization, detection metadata, and alignment with NIST AI Risk Management Framework subcategories.

New Analytics - [12]

• Cisco NVM - Browser Spawned Unix Shell with External Connection
• LOLBAS Network Connection On Uncommon Port
• LOLBAS Rare Network Connection
• Linux Crontab Enumeration
• MacOS AppleScript Shell Execution and Compilation
• MacOS Osascript Displaying Suspicious User Prompt
• Socat Network Listener Binding an Executable
• Socat Remote TCP Connection with Local Echo Disabled
• Windows Builtin Account Name Was Changed
• Windows Content Copied from Browser was Executed
• Windows SCCM Adsource DLL Was Planted In SMS Provider Directory
• Windows SCCM Smsexec Spawned a Suspicious Child Process

Updated Analytics - [18]

• Citrix ADC Exploitation CVE-2023-3519
• File Download or Read to Pipe Execution
• Icacls Deny Command
• Jscript Execution Using Cscript App
• Linux Data Destruction Command
• Linux Ghostscript Exploitation
• MacOS Account Created
• MacOS Data Chunking
• Network Connection Discovery With Arp
• PowerShell 4104 Hunting
• Suspicious wevtutil Usage
• System User Discovery With Whoami
• Windows CAB File on Disk
• Windows Private Keys Discovery
• Windows Process Execution in Temp Dir
• Windows Suspicious Process File Path
• Windows TinyCC Shellcode Execution
• Windows Unusual SysWOW64 Process Run System32 Executable

Other updates

• A new NIST AI RMF Control Coverage dashboard, available in alpha, maps AI-related ESCU detections and activity to the framework's Govern, Map, Measure, and Manage functions. This helps security teams identify coverage gaps and turn technical telemetry into clearer risk and governance insights.
  • Two new lookups detection_subcategory_map, nist_ai_rmf_subcategories were added to support the NIST AI RMF Dashboard.
• A special thanks to @thegreatmhn and @munzzyy from the Security Content community for reporting bugs and proposing fixes that improved the quality and reliability of the security content.

Content Scheduled for Removal in Future Releases

Content	Content Type	Removed in Version	Reason	Replacement Content
LOLBAS With Network Traffic	Detection	6.8.0	Detection deprecated due to high false positive rates from certain LOLBAS binaries with common legitimate network behavior. This broad analytic is being split into more manageable anomaly analytics with separate process groups and common-port tuning.	LOLBAS Network Connection On Uncommon Port, LOLBAS Rare Network Connection
Linux Adding Crontab Using List Parameter	Detection	6.8.0	Detection deprecated as its name and description are not matching the behavior of the search. The search is looking for crontab command with list parameter, not adding a new cron job.	Linux Crontab Enumeration

v6.5.0

🚀 Key Highlights

🐍 Malicious Python Package Installation

Introduced a new analytic story with four detections focused on abuse of the Python package installation lifecycle. New coverage identifies unexpected network connections during package builds, creation of executable .pth configuration files and Python site hooks, and manipulation of the PYTHONPATH environment variable. These analytics help defenders uncover supply-chain compromises that execute code during installation or establish persistence across subsequent Python sessions, improving visibility into threats targeting developer workstations and build environments.

🕵️ Vidar Stealer Detection Coverage

Introduced a new analytic story for the Vidar information stealer, combining a new detection for uncommon processes reading sensitive cloud profile files with existing analytics covering unauthorized browser credential-store access and suspicious process behavior. This coverage helps identify attempts to collect saved credentials, cookies, Azure CLI profile metadata, and other information that could support account takeover, cloud reconnaissance, or data exfiltration, giving defenders an earlier opportunity to contain compromised Windows endpoints.

🪐 RoguePlanet and ShieldBreak Privilege Escalation

Expanded the RoguePlanet analytic story with six new detections targeting Windows Defender race-condition exploitation and related ShieldBreak techniques. The new analytics identify alternate data streams created through local shares, suspicious use of Defender components, threat events referencing kernel object paths, manually staged Windows Error Reports, phantom DLL creation, and Windows Error Reporting processes spawning SYSTEM-integrity children. This provides stronger visibility into Defender scanning abuse, DLL hijacking, and attempts to escalate from a low-privileged context to SYSTEM.

🛡️ EDR Defense Evasion Detection

Added two behavioral analytics for EDRSilencer-style tampering through the Windows Filtering Platform. The detections identify custom outbound filters and filtering rules designed to block security processes from communicating with their management infrastructure, helping defenders recognize attempts to suppress endpoint telemetry or disrupt response capabilities before attackers continue post-compromise activity.

🎯 Cross-Platform Detection Refinements

Updated 46 analytics across Windows, Linux, macOS, ESXi, and AWS Bedrock to improve detection fidelity and behavioral coverage. The refinements strengthen visibility into AI infrastructure abuse, credential access, browser data theft, process injection, persistence, privilege escalation, reconnaissance, security-tool tampering, and destructive activity, helping security teams investigate suspicious behavior across a broader range of endpoint, virtualization, and cloud telemetry.

🗓️ Legacy F5 Detection Retirement

Scheduled the experimental detection for F5 TMUI remote code execution (CVE-2020-5902) for removal in a future release. The analytic targets an older platform version that is no longer supported by F5 and has remained experimental since 2020, allowing the content library to prioritize relevant, supportable detection coverage.

New Analytic Story - [2]

• Malicious Python Package Installation
• Vidar Stealer

Updated Analytic Story - [1]

• RoguePlanet

New Analytics - [13]

• Python Network Traffic During Package Build
• Python PTH File Creation During Package Installation
• Python PYTHONPATH Modification During Package Installation
• Python Site Hooks Creation During Package Installation
• Windows Alternate Data Stream Created Over Local Share
• Windows Cloud Sensitive File Read Access By Uncommon Process
• Windows Defender MpClient.dll Loaded by Non-Defender Process
• Windows Defender Threat Detected on Kernel Object Path
• Windows EDRSilencer Custom Outbound Filter Added
• Windows Error Report Created in ReportQueue Manually
• Windows Filtering Platform Filter Added To Block EDR Process
• Windows Phantom DLL Created on Disk
• Windows Wermgr Spawning System Integrity Process

Updated Analytics - [46]

• AWS Bedrock Claude Cross Region Possible Inference Abuse
• AWS Bedrock Claude Hostile Prompt Sentiment
• AWS Bedrock Claude Possible Prompt Injection
• AWS Bedrock Claude Sensitive Data in Prompts
• AWS Bedrock Claude Unusually Large Prompts
• ESXi Encryption Settings Modified
• Excessive Usage of NSLOOKUP App
• Executables Or Script Creation In Suspicious Path
• Executables Or Script Creation In Temp Path
• Linux Auditd Unix Shell Configuration Modification
• Linux Binary Launched Process with Null Argv
• Linux Malformed Auth Entry
• Linux PF_ALG Registration Outside of Boot Window
• Linux Possible Append Command To Profile Config File
• Linux Suspicious Namespace Creation
• MacOS List Firewall Rules
• Msmpeng Application DLL Side Loading
• Non Chrome Process Accessing Chrome Default Dir
• Non Firefox Process Access Firefox Profile Dir
• Ping Sleep Batch Command
• Windows Access Token Manipulation SeDebugPrivilege
• Windows Admin Password Changed by Non-Admin
• Windows App Layer Protocol Wermgr Connect To NamedPipe
• Windows Cloud Files Filter Log Created by Non-System Process
• Windows Credentials from Password Stores Chrome Extension Access
• Windows Credentials from Password Stores Chrome LocalState Access
• Windows Credentials from Password Stores Chrome Login Data Access
• Windows Disable or Stop Browser Process
• Windows Indicator Removal Via Rmdir
• Windows Modify Registry Configure BitLocker
• Windows Modify Registry Disable RDP
• Windows MsMpEng Writing to System32
• Windows Non-System Process Querying Definition Update
• Windows Powershell Commands from DNS TXT
• Windows Process Injection Remote Thread
• Windows Process Injection Wermgr Child Process
• [Windows Query Registry UnInstall Program List](https://research.splunk.com/endpoint/535fd4fc-...

v6.4.0

🚀 Key Highlights

🐧 Linux Detection Coverage Expansion:

Added broad new Linux behavioral coverage targeting privilege escalation, persistence, execution, defense evasion, reverse shells, container abuse, and suspicious service activity. New analytics identify behaviors including bootloader and system file modification, shared-memory execution, UDEV and XDG persistence, privileged container execution, PostgreSQL and Redis abuse, Ghostscript exploitation, shell history access, and multiple potential privilege-escalation paths, giving defenders stronger visibility into suspicious activity that can blend with legitimate Linux administration.

🪟 Windows Detection Coverage:

Expanded Windows detection coverage with new analytics for network reconnaissance, suspicious PowerShell execution, and abnormal process behavior. New detections identify network sniffing tools, PowerShell commands retrieved through DNS TXT records, directory output piped to Findstr, and suspicious child processes of Consent.exe, helping security teams surface discovery, command execution, defense evasion, and other potentially malicious endpoint activity.

🛠️ Detection Updates & Fixes:

Refined six existing analytics covering administrative SMB shares, high-frequency file copying, network-share discovery, user discovery, and registry-based defense evasion, improving existing detection coverage and fidelity. This release also updates the attacker_tools and malware_user_agents lookups, providing refreshed context to support threat detection and investigation workflows.

New Analytics - [27]

• Linux Binary Executed from Shared Memory Directory
• Linux EFI Bootloader File Deletion
• Linux File Creation In System Generator Directory
• Linux Ghostscript Exploitation
• Linux MOTD Script Added
• Linux Netcat Outbound Connection
• Linux Possible Bootloader Modification
• Linux Possible GSM Privilege Escalation
• Linux Possible Nimbuspwn Privilege Escalation
• Linux Possible Privilege Escalation via PYTHONPATH
• Linux Possible System Binary Backdoor
• Linux Root Execution of id
• Linux Shell History Access Via Command Line Utility
• Linux Shell Pseudo Device Reverse Shell
• Linux Suspicious Child Process of PostgreSQL
• Linux Suspicious Docker Build Command Execution
• Linux Suspicious GCC Invocation Building Init Shared Object
• Linux Suspicious Privileged Container Execution
• Linux Suspicious Redis Activity
• Linux Suspicious Staging of Alternate System Files
• Linux Suspicious XDG Autostart
• Linux UDEV Rule Created
• Linux Usermod Root UID Set
• Windows Dir Piped to Findstr Activity
• Windows Network Sniffing Tool Executed
• Windows Powershell Commands from DNS TXT
• Windows Suspicious Child Process of Consent.EXE

Updated Analytics - [6]

• Executable File Written in Administrative SMB Share
• High Frequency Copy Of Files In Network Share
• Network Share Discovery Via Dir Command
• Windows Disable Shutdown Button Through Registry
• Windows Registry Dotnet ETW Disabled Via ENV Variable
• Windows User Discovery Via Net

Other Updates

• Both the attacker_tools and malware_user_agents lookups have been updated with refreshed content to improve detection and investigation context.
• A special thanks to @munzzyy, @tid3na, and @thegreatmhn from the Security Content community for reporting bugs and proposing fixes that improved the quality and reliability of the security content.

Breaking Changes

• As communicated in ESCU v6.3.0, the Onboarding Assistant beta has now concluded and is no longer available in ESCU as we prepare to bring this capability into Detection Studio for a more fully integrated experience.
• As previously communicated in ESCU v6.2.0, ESCU v6.4.0 removes several detections. See the list of removed detections below for affected detections and recommended replacements. If you are currently using any deprecated detections, review the deprecated analytics in ESCU documentation for guidance on identifying, reviewing, and preserving deprecated detections before upgrading.

Content Removed in Release v6.4.0

Content	Content Type	Reason	Replacement Content
PowerShell - Connect To Internet With Hidden Window	Detection	Detection has been deprecated due to incorrect logic and bad performance.	None
Regsvr32 with Known Silent Switch Cmdline	Detection	Detection has been deprecated since its logic is already covered by another more improved detection.	Regsvr32 Silent and Install Param Dll Loading
Rundll32 CreateRemoteThread In Browser	Detection	Detection has been deprecated. The search is being replaced with a more generic detection that captures the behavior instead of relying on specific source processes.	Windows Uncommon Remote Thread Creation In Browser Process
Splunk App for Lookup File Editing RCE via User XSLT	Detection	Detection has been deprecated because it's too generic and does not provide the ability to detect the payload executed via this exploit.	None
Splunk Code Injection via custom dashboard leading to RCE	Detection	Detection has been deprecated. The affected Splunk software versions (8.1.12, 8.2.9, and 9.0.2) are no longer supported, having reached End of Life (EOL) between 2023 and 2024. Also, the logic is not perfectly capturing the malicious activity.	None
Splunk Enterprise KV Store Incorrect Authorization	Detection	Detection has been deprecated. The affected Splunk software versions (below 9.0.8 and 9.1.3)are no longer supported, having reached End of Life (EOL), and the logic is not accurately detecting the malicious activity.	None
Splunk Information Disclosure on Account Login	Detection	Detection has been deprecated. The logic is not accurately detecting the malicious activity.	None
[Splunk Path Traversal In Splunk App For Lookup File Edit](https://github.com/splunk/security_content/tree/develop/removed/det...

v6.3.0

🚀 Key Highlights

⭐ Starland RAT Campaign (UAT-11795) ⭐

Expanded detection coverage for the Starland RAT campaign attributed to UAT-11795, a financially motivated threat actor leveraging ClickFix social engineering and trojanized installers to deploy Starland RAT, the WLDR Agent PowerShell memory implant, and supporting malware including CastleStealer and Remcos RAT. This release tags a broad set of existing analytics covering PowerShell abuse, malicious script execution, persistence, reconnaissance, suspicious downloads, registry modifications, and Telegram-based C2 communications, improving visibility into the multi-stage infection chain, in-memory execution, credential theft, and resilient command-and-control techniques used throughout the campaign.

👀 Linux Exploitation Detection Expansion 👀

Expanded Linux detection coverage with new analytics focused on local privilege escalation, defense evasion, and kernel-level exploitation techniques, improving visibility into attempts to bypass security controls, abuse elevated execution paths, and exploit low-level system components commonly targeted by advanced adversaries.

New Analytic Story - [1]

• Starland RAT Campaign

New Analytics - [4]

• Linux Apparmor Bypass Via Aaexec
• Linux Auditd Possible Setuid Execve Privesc
• Linux Pedit Offset Out Of Bounds
• Windows AppCertDLL Modification Via Registry

Updated Analytics - [67]

• AWS Bedrock Claude Unusually Large Prompts
• Attacker Tools On Endpoint
• Batch File Write to System32
• Cisco NVM - Curl Execution With Insecure Flags
• Cisco NVM - Installation of Typosquatted Python Package
• Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI
• Cisco NVM - Non-Network Binary Making Network Connection
• Cisco NVM - Outbound Connection to Suspicious Port
• Cisco NVM - Rclone Execution With Network Activity
• Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download
• Cisco NVM - Susp Script From Archive Triggering Network Activity
• Cisco NVM - Suspicious Download From File Sharing Website
• Cisco NVM - Suspicious File Download via Headless Browser
• Cisco NVM - Suspicious Network Connection From Process With No Args
• Cisco NVM - Suspicious Network Connection Initiated via MsXsl
• Cisco NVM - Suspicious Network Connection to IP Lookup Service API
• Cisco NVM - Webserver Download From File Sharing Website
• Common Ransomware Extensions
• Common Ransomware Notes
• Detect HTML Help URL in Command Line
• Detect MSHTA Url in Command Line
• Detect RClone Command-Line Usage
• Domain Controller Discovery with Nltest
• Email files written outside of the Outlook directory
• Executables Or Script Creation In Suspicious Path
• LLM Model File Creation
• Linux Binary Launched Process with Null Argv
• Linux PF_ALG Registration Outside of Boot Window
• Local LLM Framework DNS Query
• Malicious PowerShell Process - Execution Policy Bypass
• PowerShell 4104 Hunting
• Recon AVProduct Through Pwh or WMI
• Registry Keys Used For Persistence
• Set Default PowerShell Execution Policy To Unrestricted or Bypass
• Short Lived Scheduled Task (External Contributor: @AndreiBanaru)
• Suspicious Process Executed From Container File
• Svchost LOLBAS Execution Process Spawn
• Time Provider Persistence Registry
• WMIC XSL Execution via URL
• Windows AppCertDLL Modification Via Command Line
• Windows Boot or Logon Autostart Execution In Startup Folder
• Windows Curl Download to Suspicious Path
• Windows Curl Upload to Remote Destination
• Windows DNS Query Request by Telegram Bot API
• Windows File Download Via CertUtil
• Windows File Download Via PowerShell
• Windows File Without Extension In Critical Folder
• Windows Gather Victim Network Info Through Ip Check Web Services
• Windows HTTP Network Communication From MSIExec
• Windows InstallUtil Remote Network Connection
• Windows InstallUtil URL in Command Line
• Windows Kerberos Local Successful Logon
• Windows Large Number of Computer Service Tickets Requested (External Contributor: @munzzyy)
• Windows Local LLM Framework Execution
• Windows MSI Rollback Script Deleted By Non-Msiexec Process
• Windows MSIExec Remote Download
• Windows Mark Of The Web Bypass
• Windows Mshta Execution In Registry
• Windows PowerShell FakeCAPTCHA Clipboard Execution
• Windows PowerShell ScheduleTask
• Windows Process With NamedPipe CommandLine
• Windows RDP Cache File Deletion
• Windows Rdp AutomaticDestinations Deletion
• Windows Suspicious Defender Update Activity in INetCache
• [Windows Suspicious Process File Path](ht...

v6.2.0

🚀 Key Highlights

🏴 Linux Dirty Frag Privilege Escalation (CVE-2026-43284 & CVE-2026-43500) 🏴

Added a new detection for the Dirty Frag Linux kernel privilege escalation vulnerabilities, identifying the exploit's characteristic high-frequency splice() syscall activity followed by execution of a setuid binary within the same audit session. This analytic provides early visibility into attempts to corrupt the kernel page cache and escalate privileges to root through abuse of the IPsec ESP or RxRPC subsystems.

👻 Phantom Stealer 👻

Expanded detection coverage for this Windows information stealer that targets browser credentials, FTP/SSH clients, cryptocurrency wallets, and other sensitive application data. This release adds a new detection for unauthorized access to WinSCP security configuration folders while tagging and enhancing existing analytics covering browser credential theft, PowerShell abuse, process injection, persistence, suspicious browser behavior, and data exfiltration, improving visibility into credential harvesting and post-compromise activity commonly associated with modern infostealers.

⏫ Sysmon Event ID 8 Detection Improvements ⏫

Refined detection coverage built on Sysmon Event ID 8 (CreateRemoteThread) by aligning the data source with native Sysmon field mappings, updating analytics to use the correct raw field names, and reducing false positives through rule consolidation and deprecation of noisy content. This release also introduces a new detection — Windows Uncommon Remote Thread Creation in Browser Process — strengthening visibility into process injection techniques while improving the accuracy and maintainability of existing CreateRemoteThread analytics.

🪨 AWS Bedrock Claude AI Security Analytics 🪨

Introduced a new analytic story for AWS Bedrock Claude focused on detecting prompt injection, jailbreak attempts, and suspicious AI interactions targeting enterprise generative AI workloads. This release adds analytics to identify cross-region inference abuse, excessive token consumption, high-risk filesystem and execution tool invocation, hostile prompt sentiment, prompt injection attempts, sensitive data exposure in prompts, and unusually large prompt submissions, providing security teams with visibility into attempts to bypass AI safety controls, manipulate model behavior, or misuse Claude-powered applications.

New Analytic Story - [2]

• Phantom Stealer
• Suspicious AWS Bedrock Claude Activities

New Analytics - [10]

• AWS Bedrock Claude Cross Region Possible Inference Abuse
• AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation
• AWS Bedrock Claude Hostile Prompt Sentiment
• AWS Bedrock Claude Possible Prompt Injection
• AWS Bedrock Claude Sensitive Data in Prompts
• AWS Bedrock Claude Unusually Large Prompts
• AWS Bedrock Claude excessive use of tokens
• Linux Dirty Frag Kernel Privilege Escalation
• Windows Uncommon Remote Thread Creation In Browser Process
• Windows WinSCP Configuration Security Access

Updated Analytics - [53]

• Windows EDRSilencer Execution
• PetitPotam Suspicious Kerberos TGT Request

Other Updates

🧱 PowerShell ScriptBlock Analytics Refinement 🧱

Updated the finding messages for detections leveraging the PowerShell ScriptBlock data source to improve readability by omitting oversized ScriptBlockText fields, while also converting these analytics to Anomaly detections and refining their descriptions for clearer triage.

Content Scheduled for Removal in Future Releases

Content	Content Type	Removed in Version	Reason	Replacement Content
PowerShell - Connect To Internet With Hidden Window	Detection	6.4.0	Detection has been deprecated due to incorrect logic and bad performance.	None
Regsvr32 with Known Silent Switch Cmdline	Detection	6.4.0	Detection has been deprecated since its logic is already covered by another more improved detection.	Regsvr32 Silent and Install Param Dll Loading
Rundll32 CreateRemoteThread In Browser	Detection	6.4.0	Detection has been deprecated. The search is being replaced with a more generic detection that captures the behavior instead of relying on specific source processes.	Windows Uncommon Remote Thread Creation In Browser Process
Splunk App for Lookup File Editing RCE via User XSLT	Detection	6.4.0	Detection has been deprecated because it's too generic and does not provide the ability to detect the payload executed via this exploit.	None
Splunk Code Injection via custom dashboard leading to RCE	Detection	6.4.0	Detection has been deprecated. The affected Splunk software versions (8.1.12, 8.2.9, and 9.0.2) are no longer supported, having reached End of Life (EOL) between 2023 and 2024. Also, the logic is not perfectly capturing the malicious activity.	None
Splunk Enterprise KV Store Incorrect Authorization	Detection	6.4.0	Detection has been deprecated. The affected Splunk software versions (below 9.0.8 and 9.1.3)are no longer supported, having reached End of Life (EOL), and the logic is not accurately detecting the malicious activity.	None
Splunk Information Disclosure on Account Login	Detection	6.4.0	Detection has been deprecated. The logic is not accurately detecting the malicious activity.	None
Splunk Path Traversal In Splunk App For Lookup File Edit	Detection	6.4.0	Detection has been deprecated. The logic is not accurately detecting the malicious activity.	None
Splunk RCE PDFgen Render	Detection	6.4.0	Detection has been deprecated. The metadata along with the search are not accurately capturing the malicious activity.	None
Windows Process Injection Of Wermgr to Known Browser	Detection	6.4.0	Detection has been deprecated. The search is being replaced with a more generic detection that captures the behavior instead of relying on specific source processes.	Windows Uncommon Remote Thread Creation In Browser Process
Windows Process Injection With Public Source Path	Detection	6.4.0	Detection has been deprecated. The search is not helpful for the user to implement nor use, as it will generate too many false positives.	None

v6.1.0

🚀 Key Highlights

🔒 Cisco Secure Access Threat Detection 🔒

Introduced new analytics for Cisco Secure Access to identify access to anonymizer and privacy-focused services as well as automated web reconnaissance activity. New detections — Cisco Secure Access Access to Anonymizer Services and Cisco Secure Access Automated Web Reconnaissance via HTTP Access Errors — help uncover attempts to obscure attacker infrastructure, evade attribution, and perform large-scale web application discovery through patterns of abnormal HTTP error responses and suspicious outbound connectivity.

🟦 🔨 BlueHammer & RedSun 🔨 🟦

Added new analytic stories and detections covering the BlueHammer and RedSun exploit families, which abuse Microsoft Defender functionality to achieve privilege escalation and credential access. New analytics detect suspicious Defender engine and signature update activity, non-administrative password changes, abnormal password reset bursts, unauthorized Defender file modifications, and processes interacting with Defender update components, while also introducing support for Windows Security Event ID 4723 (password change attempts) to improve visibility into credential theft and privilege escalation tradecraft associated with these emerging attack techniques.

🔴 Linux Copy Fail Analytics 🔴

Expanded Linux detection coverage for Copy Fail (CVE-2026-31431) and related post-exploitation activity with new analytics targeting malformed authentication entries, PF_ALG registration outside normal boot windows, suspicious namespace creation, and process execution with null argv values—behaviors associated with privilege escalation, stealthy execution, and kernel abuse. This release also introduces support for Linux kern.log telemetry through a new data source, providing deeper visibility into low-level system activity and emerging Linux exploitation techniques.

🧂 Salt Typhoon Tradecraft on Cisco IOS XE🧂

Added a new set of analytics focused on Salt Typhoon-style activity targeting Cisco IOS XE devices, providing coverage for reconnaissance, persistence, defense evasion, and unauthorized remote access techniques observed in network infrastructure compromises. New detections identify behaviors such as Guestshell activation and destruction, log clearing sequences, VTY access control tampering, tunnel interface creation, WebUI abuse, remote access probing, and suspicious platform package shell interactions, helping defenders detect adversaries attempting to establish persistence, evade logging, and manipulate Cisco networking infrastructure.

🛜 Cisco SD-WAN Authentication Analytics 🛜

Added new analytics to identify suspicious authentication patterns in Cisco SD-WAN environments, including multiple source IPs authenticating to vManage via SSH and repeated SSH key-based authentications from a single source, helping detect potential credential sharing, unauthorized administrative access, and distributed brute-force or persistence activity targeting SD-WAN management infrastructure.

💨 TC Windchill Exploitation Detection Coverage 🌬️

Added a new analytic story for PTC Windchill Exploitation along with detections for gateway command execution and GW READY/OK probing activity, providing visibility into exploitation attempts targeting Windchill environments. This release also introduces a new Windchill Log4j data source and supporting macro to help defenders identify reconnaissance, command execution, and post-exploitation behaviors against enterprise product lifecycle management (PLM) infrastructure.

New Analytic Story - [5]

• BlueHammer
• PTC Windchill Exploitation
• RedSun
• RoguePlanet
• Salat Stealer

New Analytics - [34]

• Cisco IOS XE Guestshell Activation and Destroy
• Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal
• Cisco IOS XE Reconnaissance Command Activity
• Cisco IOS XE Remote Access Probe Burst
• Cisco IOS XE Request Platform Package Describe Shell Pattern
• Cisco IOS XE Tunnel Interface Configuration
• Cisco IOS XE VTY Access Class Tampering
• Cisco IOS XE WebUI Login From IOSd Local Port
• Cisco IOS XE WebUI Programmatic Configuration
• Cisco SA - Access to Anonymizer Services
• Cisco SA - Automated Web Reconnaissance via HTTP Access Errors
• Cisco SD-WAN Multiple SSH key Authentication from Same Source
• Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication
• Linux Binary Launched Process with Null Argv
• Linux Malformed Auth Entry
• Linux PF_ALG Registration Outside of Boot Window
• Linux Suspicious Namespace Creation
• PTC Windchill GW READY OK Probe
• PTC Windchill Gateway Command Execution
• Powershell Defender Threat Actions Set to Allow
• Splunk Secure Application Alerts for Runtime Security((Internal Contributor: @bryan-splunk )
• Windows Admin Password Changed by Non-Admin
• Windows Cloud Files Filter Loaded by Uncommon Process
• Windows Cloud Files Filter Log Created by Non-System Process
• Windows FFmpeg Audio and Video Device Discovery
• Windows FFmpeg DirectShow Video Capture
• Windows MsMpEng Writing to System32
• Windows Non-System Process Querying Definition Update
• Windows Suspicious Burst of Password Changes
• Windows Suspicious Child Process of TieringEngineService.exe
• Windows Suspicious Defender Engine or Signature Files Created
• Windows Suspicious Defender Update Activity in INetCache
• Windows VSSVC Process Accessing Defender Engine
• Windows Wermgr Alternate Data Stream in Temp Dir

Other Updates

Fixed several regex related bugs that were reported as Github Issues (External Contributor: @srkyn)

Breaking Changes

As previously communicated in the ESCU v5.26.0 release, several detections have been removed. For a complete list of the detections removed in version v6.1.0, refer to the List of Removed Detections. Users are expected to transition to the recommended replacements where applicable. Additionally, a new set of detections has been deprecated. For details on detections scheduled for removal in ESCU version v6.4.0, see the List of Detections Scheduled for Removal or see the notes below.

Detections Removed in Release v6.1.0

Detection	Reason	Replacement Content
Attempt To Add Certificate To Untrusted Store	Detection is deprecated as the usage of certutil and addstore by itself is not malicious.	None
[CHCP Command Execution](https://github.com/splunk/security_content/blob/develop/removed/detectio...

v6.0.0

🚀 Key Highlights

ESCU 6.0.0 is a major release that includes a number of changes for better alignment with Enterprise Security v8.x+ features.

Please note that all content has been updated in this release, resulting in cleaner, more readable .conf files.

🔍Expanded Finding and Intermediate Finding Support 🔎

Detections that previously created Notable Events, and then Findings with a 0 score “N/A” entity will now create a Finding with an appropriately tagged entity from the search results, with the score that previously would have been used for a risk event/Intermediate Finding for that entity.

Because of the shift to tagging entities to Findings, fewer total Intermediate Findings may be created for some detections, as we won’t be separately creating Intermediate Findings for every entity.

🗓️ Increased Clarity on Content Creation Date vs Modification Date 🗓️

Detections, Analytic Stories, and other things, depending on where you view them now have both creation and modification dates indicating when we first created them and when we’ve last modified them.

🛠️ Repository Tooling Updates 🛠️

ESCU v6.0 marks the transition away from contentctl. We are shifting future investment from contentctl to Detection Studio as we work to bring this functionality into Splunk as an officially supported capability. The contentctl repository will remain publicly available for reference, forking, and customization, but continued use may require customer-managed customization. For more information, see https://github.com/splunk/contentctl/blob/main/README.md

Future Breaking Changes

As previously communicated in ESCU v5.27.0, a number of detections will be removed in v6.1.0. For details on detections scheduled for removal in ESCU version v6.1.0, see the List of Detections Scheduled for Removal.

List of detections scheduled for removal in ESCU version 6.1.0

Deprecated Detection	Replacement Detection
CHCP Command Execution	Not Available
Sc exe Manipulating Windows Services	Not Available
Processes launching netsh	Not Available
Ivanti Sentry Authentication Bypass	Not Available
Attempt To Add Certificate To Untrusted Store	Not Available

List of detections deprecated in ESCU version 6.0.0

Deprecated Detection	Replacement Detection

v5.27.0

🚀 Key Highlights

• 🚨 Linux Copy Fail Privilege Escalation (CVE-2026-31431): Added a new detection: Linux Auditd Copy Fail Privilege Escalation to identify exploitation of the Copy Fail vulnerability, a Linux kernel flaw that enables unprivileged users to perform controlled writes to file page cache and escalate privileges to root. This analytic leverages auditd telemetry to detect suspicious modification patterns targeting setuid binaries, providing early visibility into local privilege escalation attempts across affected Linux systems.

• 🔐 Cisco Secure Access Analytics: Introduced a new analytic story for Cisco Secure Access, leveraging firewall telemetry to detect suspicious access patterns. This release includes updates to existing detections: Large ICMP Traffic, Outbound SMB Traffic, Outbound LDAP Traffic, and Windows RDP Network Brute Force Attempts enabling them to operate with Cisco Secure Access Firewall data, validated through simulated attack scenarios to improve visibility into adversary activity traversing modern cloud-delivered security controls.

• 🪟 Windows Threat Detection Expansion: Significantly expanded coverage across multiple analytic stories with the addition of a broad set of new detections targeting modern Windows attack techniques, including PowerShell abuse, process injection, privilege escalation, registry manipulation, cloud and Azure activity, RMM tool usage, and C2 frameworks such as Cobalt Strike, Metasploit, and custom agents. These analytics enhance visibility into attacker behaviors like defense evasion (EDR bypass, obfuscation, EFI tampering), persistence (scheduled tasks, file association changes, GPO abuse), credential access (LAPS harvesting, keychain-like data access), and lateral movement and exfiltration, while also covering emerging tradecraft such as Cloudflared tunnels, Devtunnels, and supply chain tooling abuse—providing deeper detection across the Windows attack lifecycle.

• ⌨️ VIP Keylogger (.NET Stealer) Detection Coverage: Introduced new analytics to strengthen detection of VIP Keylogger and related .NET-based infostealers by focusing on behavioral indicators of stealthy execution and persistence. New detections: PowerShell Environment Variable Execution, Windows Anomalous Registry Value Length in Environment Key, PowerShell PInvoke Process Injection API Chain, and Windows Proxy Execution of .NET Utilities via Scripts surface patterns such as encoded payload staging in registry keys, script-driven execution of trusted .NET binaries, and in-memory process injection techniques, improving visibility into credential theft operations, obfuscated execution chains, and defense evasion commonly used in modern phishing-delivered stealer campaigns.

New Analytic Story - [2]

• Cisco Secure Access Analytics
• VIP Keylogger

New Analytics - [67]

• Linux Auditd Copy Fail Privilege Escalation
• PowerShell Environment Variable Execution
• PowerShell PInvoke Process Injection API Chain
• Windows .Key File Creation in Root Directory
• Windows Anomalous Registry Value Length in Environment Key
• Windows AppCertDLL Modification Via Command Line
• Windows Azure PowerShell Module Installation Via PowerShell Script
• Windows Azure Storage Utility Execution Via CLI
• Windows Cobalt Strike PowerShell Loader
• Windows Command Obfuscation with Environment Variable Substrings
• Windows Computer Account Changed to Domain Controller
• Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script
• Windows CrowdStrike Agent Registry Key Removal
• Windows Crowdstrike RTR Script Execution
• Windows Default Cobalt Strike PowerShell Beacon
• Windows Devtunnels Execution
• Windows Devtunnels Image Loaded
• Windows Downdate Registry Activity
• Windows EDRSilencer Execution
• Windows EFI Bootloader File Modification
• Windows EFI Volume Mount Attempt Via Mountvol
• Windows Entra User Management Via Azure CLI
• Windows File Association Modification via Ftype
• Windows Filtering Platform Policy Added to Block EDR Process
• Windows Get-Variable.EXE Execution from WindowsApps Folder
• Windows GrimResource - MMC Process Accessing APDS DLL
• Windows Guest Account Enabled Via Net.EXE
• Windows IOBit Unlocker Extension DLL Registration via Regsvr32
• Windows LAPS Password Gathering Via PowerShell Script
• Windows Level RMM PowerShell Script Installer
• Windows Level RMM Watchdog Task Created
• Windows MSI Rollback Script Deleted By Non-Msiexec Process
• Windows Metasploit Confluence Plugin Execution
• Windows Mock Trusted Directory MSC File Creation
• Windows Mustang Panda USB Tool Execution
• Windows Netspy Network Scanner Execution
• Windows Network Connection From Program In Suspect Location
• Windows NorthStar C2 Agent Execution
• Windows OneDrive Share Mounted via Net
• Windows Potato Privilege Escalation Tool Execution
• Windows Potential Cloudflared Network Connection
• Windows Potential Cloudflared Tunnel Execution
• Windows Potential Web Shell Creation For VMware Workspace ONE
• Windows PowGoop Beacon Decoding
• Windows PowerShell Module File Created
• Windows PowerShell Script TabExpansion Direct Call
• Windows Privilege Escalation Attempt Via MSI Rollback
• Windows Process Accessing Windows Recall Directory
• Windows Proxy Execution of .NET Utilities via Scripts
• Windows PuTTY Suite Utility Execution
• Windows RMM Tool Execution
• Windows Remote Image Load
• Windows Scheduled Task Created in a Group Policy Object
• Windows Set Custom DNS ServerLevelPlugin Via Dnscmd
• [Windows Shell or Script Execution From IIS Directory](https...