splunk/security_content v6.4.0

on GitHub

🚀 Key Highlights

🐧 Linux Detection Coverage Expansion:

Added broad new Linux behavioral coverage targeting privilege escalation, persistence, execution, defense evasion, reverse shells, container abuse, and suspicious service activity. New analytics identify behaviors including bootloader and system file modification, shared-memory execution, UDEV and XDG persistence, privileged container execution, PostgreSQL and Redis abuse, Ghostscript exploitation, shell history access, and multiple potential privilege-escalation paths, giving defenders stronger visibility into suspicious activity that can blend with legitimate Linux administration.

🪟 Windows Detection Coverage:

Expanded Windows detection coverage with new analytics for network reconnaissance, suspicious PowerShell execution, and abnormal process behavior. New detections identify network sniffing tools, PowerShell commands retrieved through DNS TXT records, directory output piped to Findstr, and suspicious child processes of Consent.exe, helping security teams surface discovery, command execution, defense evasion, and other potentially malicious endpoint activity.

🛠️ Detection Updates & Fixes:

Refined six existing analytics covering administrative SMB shares, high-frequency file copying, network-share discovery, user discovery, and registry-based defense evasion, improving existing detection coverage and fidelity. This release also updates the attacker_tools and malware_user_agents lookups, providing refreshed context to support threat detection and investigation workflows.

New Analytics - [27]

• Linux Binary Executed from Shared Memory Directory
• Linux EFI Bootloader File Deletion
• Linux File Creation In System Generator Directory
• Linux Ghostscript Exploitation
• Linux MOTD Script Added
• Linux Netcat Outbound Connection
• Linux Possible Bootloader Modification
• Linux Possible GSM Privilege Escalation
• Linux Possible Nimbuspwn Privilege Escalation
• Linux Possible Privilege Escalation via PYTHONPATH
• Linux Possible System Binary Backdoor
• Linux Root Execution of id
• Linux Shell History Access Via Command Line Utility
• Linux Shell Pseudo Device Reverse Shell
• Linux Suspicious Child Process of PostgreSQL
• Linux Suspicious Docker Build Command Execution
• Linux Suspicious GCC Invocation Building Init Shared Object
• Linux Suspicious Privileged Container Execution
• Linux Suspicious Redis Activity
• Linux Suspicious Staging of Alternate System Files
• Linux Suspicious XDG Autostart
• Linux UDEV Rule Created
• Linux Usermod Root UID Set
• Windows Dir Piped to Findstr Activity
• Windows Network Sniffing Tool Executed
• Windows Powershell Commands from DNS TXT
• Windows Suspicious Child Process of Consent.EXE

Updated Analytics - [6]

• Executable File Written in Administrative SMB Share
• High Frequency Copy Of Files In Network Share
• Network Share Discovery Via Dir Command
• Windows Disable Shutdown Button Through Registry
• Windows Registry Dotnet ETW Disabled Via ENV Variable
• Windows User Discovery Via Net

Other Updates

• Both the attacker_tools and malware_user_agents lookups have been updated with refreshed content to improve detection and investigation context.
• A special thanks to @munzzyy, @tid3na, and @thegreatmhn from the Security Content community for reporting bugs and proposing fixes that improved the quality and reliability of the security content.

Breaking Changes

• As communicated in ESCU v6.3.0, the Onboarding Assistant beta has now concluded and is no longer available in ESCU as we prepare to bring this capability into Detection Studio for a more fully integrated experience.
• As previously communicated in ESCU v6.2.0, ESCU v6.4.0 removes several detections. See the list of removed detections below for affected detections and recommended replacements. If you are currently using any deprecated detections, review the deprecated analytics in ESCU documentation for guidance on identifying, reviewing, and preserving deprecated detections before upgrading.

Content Removed in Release v6.4.0