splunk/security_content v6.2.0

on GitHub

🚀 Key Highlights

🏴 Linux Dirty Frag Privilege Escalation (CVE-2026-43284 & CVE-2026-43500) 🏴

Added a new detection for the Dirty Frag Linux kernel privilege escalation vulnerabilities, identifying the exploit's characteristic high-frequency splice() syscall activity followed by execution of a setuid binary within the same audit session. This analytic provides early visibility into attempts to corrupt the kernel page cache and escalate privileges to root through abuse of the IPsec ESP or RxRPC subsystems.

👻 Phantom Stealer 👻

Expanded detection coverage for this Windows information stealer that targets browser credentials, FTP/SSH clients, cryptocurrency wallets, and other sensitive application data. This release adds a new detection for unauthorized access to WinSCP security configuration folders while tagging and enhancing existing analytics covering browser credential theft, PowerShell abuse, process injection, persistence, suspicious browser behavior, and data exfiltration, improving visibility into credential harvesting and post-compromise activity commonly associated with modern infostealers.

⏫ Sysmon Event ID 8 Detection Improvements ⏫

Refined detection coverage built on Sysmon Event ID 8 (CreateRemoteThread) by aligning the data source with native Sysmon field mappings, updating analytics to use the correct raw field names, and reducing false positives through rule consolidation and deprecation of noisy content. This release also introduces a new detection — Windows Uncommon Remote Thread Creation in Browser Process — strengthening visibility into process injection techniques while improving the accuracy and maintainability of existing CreateRemoteThread analytics.

🪨 AWS Bedrock Claude AI Security Analytics 🪨

Introduced a new analytic story for AWS Bedrock Claude focused on detecting prompt injection, jailbreak attempts, and suspicious AI interactions targeting enterprise generative AI workloads. This release adds analytics to identify cross-region inference abuse, excessive token consumption, high-risk filesystem and execution tool invocation, hostile prompt sentiment, prompt injection attempts, sensitive data exposure in prompts, and unusually large prompt submissions, providing security teams with visibility into attempts to bypass AI safety controls, manipulate model behavior, or misuse Claude-powered applications.

New Analytic Story - [2]

• Phantom Stealer
• Suspicious AWS Bedrock Claude Activities

New Analytics - [10]

• AWS Bedrock Claude Cross Region Possible Inference Abuse
• AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation
• AWS Bedrock Claude Hostile Prompt Sentiment
• AWS Bedrock Claude Possible Prompt Injection
• AWS Bedrock Claude Sensitive Data in Prompts
• AWS Bedrock Claude Unusually Large Prompts
• AWS Bedrock Claude excessive use of tokens
• Linux Dirty Frag Kernel Privilege Escalation
• Windows Uncommon Remote Thread Creation In Browser Process
• Windows WinSCP Configuration Security Access

Updated Analytics - [53]

• Windows EDRSilencer Execution
• PetitPotam Suspicious Kerberos TGT Request

Other Updates

🧱 PowerShell ScriptBlock Analytics Refinement 🧱

Updated the finding messages for detections leveraging the PowerShell ScriptBlock data source to improve readability by omitting oversized ScriptBlockText fields, while also converting these analytics to Anomaly detections and refining their descriptions for clearer triage.

Content Scheduled for Removal in Future Releases