🚀 Key Highlights
🛡️ Cisco AI Defense detection coverage 🛡️
Added three detections for allowed sensitive prompts, allowed sensitive responses, and repeated high-risk activity. The release also updates the application-name alert and Cisco AI Defense data source and adds the Abuse of GenAI Systems and Applications analytic story.
📊 Cisco AI Defense Threat Operations dashboard 📊
Introduced a new dashboard in alpha for reviewing runtime activity, enforcement outcomes, risky behavior, sensitive data matches, and activity by application and model.
☁️ Expanded AWS CloudTrail coverage ☁️
Added detections for anomalous Secrets Manager batch retrieval, high-volume CloudWatch Logs reads, and repeated EC2 Instance Connect SSH key uploads. Together, these analytics improve visibility into suspicious secret access, log reads, and key uploads.
🪟 Refined NirSoft utility detections 🪟
Removed overlapping NirSoft analytics and updated the lookup-backed coverage to use current tool descriptions. The changes consolidate detection around the more reliable Windows NirSoft Utilities analytic.
🌐 Improved Cisco Secure Firewall and network detections 🌐
Refreshed remote access software coverage and its lookup, added a lookup for file-sharing domains, and updated suspicious-port detection.
🔎 Added New Coverage for the Zeek data source 🔎
Added detections for encoded HTTP POST payloads, unusual SSH client banners, and unusual HTTP request methods, along with the Zeek HTTP and SSH data sources and macros.
🧪 Improved Atomic Red Team mappings 🧪
Updated atomic_guid values to link detections with relevant Atomic Red Team tests, making it easier to find and run tests that generate corresponding attack data.
🦠 Added coverage for the 2026 Braodo Stealer variant 🦠
Added two analytics and tagged related existing detections to help identify activity associated with the latest Braodo Stealer variant.
🔧 Additional content and quality improvements 🔧
Promoted existing experimental Ollama AI content, updated NIST AI RMF detection mappings, and advanced four M365 Copilot jailbreak analytics to production. It also improved PingID credential-reset correlation, fixed AWS detection issues, retired noisy ICMP coverage based on feedback, corrected data source references, and addressed integration-test and archived add-on issues.
Total New and Updated Content: [358]
New Analytic Story - [1]
Updated Analytic Story - [1]
New Analytics - [15]
- AWS Anomalous Secrets Manager Batch Retrieval
- AWS EC2 Multiple SSH Public Keys Uploaded by a Single Identity
- AWS EC2 Startup Script Modified on Stopped Instance
- AWS IAM Role Created with External Trust
- AWS Repeated CloudWatch Logs Read Operations
- Cisco AI Defense Allowed Sensitive Prompt
- Cisco AI Defense Allowed Sensitive Response
- Cisco AI Defense Repeated High Risk Activity
- HTTP POST Request with Encoded Payload
- Ollama Long-Running Inference Requests
- Ollama Repeated Application Errors
- PowerShell Download from Code Hosting Service
- Unusual HTTP Request Method
- Unusual SSH Client Banner
- Windows Process Outbound Connection To Social Media Domain
Updated Analytics - [334]
- ASL AWS ECR Container Upload Unknown User
- AWS CreateAccessKey
- Access LSASS Memory for Dump Creation
- AdsiSearcher Account Discovery
- BCDEdit Failure Recovery Modification
- BITS Job Persistence
- BITSAdmin Download File
- CertUtil With Decode Argument
- Cisco AI Defense Security Alerts by Application Name
- Cisco Isovalent - Curl Execution With Insecure Flags
- Cisco Secure Firewall - Communication Over Suspicious Ports
- Cisco Secure Firewall - Connection to File Sharing Domain
- Cisco Secure Firewall - Remote Access Software Usage Traffic
- Control Loading from World Writable Directory
- Create or delete windows shares using net exe
- Creation of Shadow Copy with wmic and powershell
- Creation of Shadow Copy
- Creation of lsass Dump with Taskmgr
- Credential Dumping via Copy Command from Shadow Copy
- Credential Dumping via Symlink to Shadow Copy
- DSQuery Domain Discovery
- Delete ShadowCopy With PowerShell
- Deleting Shadow Copies
- Detect Credential Dumping through LSASS access
- Detect HTML Help Spawn Child Process
- Detect HTML Help URL in Command Line
- Detect HTML Help Using InfoTech Storage Handlers
- Detect MSHTA Url in Command Line
- Detect New Local Admin account
- Detect New Open S3 Buckets over AWS CLI
- Detect Path Interception By Creation Of program exe
- Detect PsExec With accepteula Flag
- Detect Regsvr32 Application Control Bypass
- Detect Remote Access Software Usage DNS
- Detect Remote Access Software Usage FileInfo
- Detect Remote Access Software Usage File
- Detect Remote Access Software Usage Process
- Detect Remote Access Software Usage Registry
- Detect Remote Access Software Usage Traffic
- Detect Remote Access Software Usage URL
- Detect Rundll32 Inline HTA Execution
- Detect SharpHound Command-Line Arguments
- Detect SharpHound File Modifications
- Detect SharpHound Usage
- Detect mshta inline hta execution
- Disable ETW Through Registry
- Disable Logs Using WevtUtil
- Disable Registry Tool
- Disable Windows Behavior Monitoring
- Disabling CMD Application
- Disabling Remote User Account Control
- Disabling SystemRestore In Registry
- Domain Group Discovery with Adsisearcher
- Download Files Using Telegram
- Dump LSASS via comsvcs DLL
- Dump LSASS via procdump
- Enable WDigest UseLogonCredential Registry
- Esentutl SAM Copy
- Eventvwr UAC Bypass
- Executables Or Script Creation In Suspicious Path
- Executables Or Script Creation In Temp Path
- FodHelper UAC Bypass
- Get ADDefaultDomainPasswordPolicy with Powershell
- Get ADUser with PowerShell Script Block
- Get ADUser with PowerShell
- Get DomainPolicy with Powershell
- Get DomainUser with PowerShell
- Get WMIObject Group Discovery with Script Block Logging
- Get WMIObject Group Discovery
- Get-DomainTrust with PowerShell
- Get-ForestTrust with PowerShell
- GetAdComputer with PowerShell Script Block
- GetAdGroup with PowerShell Script Block
- GetAdGroup with PowerShell
- GetCurrent User with PowerShell Script Block
- GetCurrent User with PowerShell
- GetDomainController with PowerShell
- GetDomainGroup with PowerShell Script Block
- GetDomainGroup with PowerShell
- GetLocalUser with PowerShell
- GetWmiObject Ds Computer with PowerShell
- Hiding Files And Directories With Attrib exe
- Impacket Lateral Movement WMIExec Commandline Parameters
- Jscript Execution Using Cscript App
- Kerberoasting spn request with RC4 encryption
- Linux Add User Account
- Linux At Application Execution
- Linux Auditd Add User Account
- Linux Auditd Clipboard Data Copy
- Linux Auditd Dd File Overwrite
- Linux Auditd File And Directory Discovery
- Linux Auditd Insert Kernel Module Using Insmod Utility
- Linux Auditd Possible Access To Credential Files
- Linux Auditd Stop Services
- Linux Auditd System Network Configuration Discovery
- Linux Auditd Whoami User Discovery
- Linux Clipboard Data Copy
- Linux Curl Upload File
- Linux DD File Overwrite
- Linux Decode Base64 to Shell
- Linux Docker Root Directory Mount
- Linux Ingress Tool Transfer Hunting
- Linux Ingress Tool Transfer with Curl
- Linux Insert Kernel Module Using Insmod Utility
- Linux Kernel Module Enumeration
- Linux Magic SysRq Key Abuse
- Linux Obfuscated Files or Information Base64 Decode
- Linux SSH Authorized Keys Modification
- Linux System Network Discovery
- Linux System Reboot Via System Request Key
- M365 Copilot Agentic Jailbreak Attack
- M365 Copilot Impersonation Jailbreak Attack
- M365 Copilot Information Extraction Jailbreak Attack
- M365 Copilot Jailbreak Attempts
- MacOS Gatekeeper Bypass
- MacOS Keychains Dumped
- MacOS List Firewall Rules
- MacOS Network Share Discovery
- MacOS Osascript Displaying Suspicious User Prompt
- Malicious PowerShell Process - Encoded Command
- Monitor Registry Keys for Print Monitors
- NLTest Domain Trust Discovery
- Network Share Discovery Via Dir Command
- Non Firefox Process Access Firefox Profile Dir
- Ntdsutil Export NTDS
- Ollama Abnormal Network Connectivity
- Ollama Excessive API Requests
- Ollama Possible API Endpoint Scan Reconnaissance
- Ollama Possible Memory Exhaustion Resource Abuse
- Overwriting Accessibility Binaries
- Ping Sleep Batch Command
- PingID New MFA Method After Credential Reset
- Possible Lateral Movement PowerShell Spawn
- PowerShell Enable PowerShell Remoting
- PowerShell Get LocalGroup Discovery
- PowerShell Invoke CIMMethod CIMSession
- PowerShell Start or Stop Service
- PowerShell Start-BitsTransfer
- Powershell COM Hijacking InprocServer32 Modification
- Powershell Disable Security Monitoring
- Powershell Execute COM Object
- Powershell Get LocalGroup Discovery with Script Block Logging
- Process Execution via WMI
- Registry Keys Used For Persistence
- Registry Keys Used For Privilege Escalation
- Registry Keys for Creating SHIM Databases
- Regsvr32 Silent and Install Param Dll Loading
- Remote Process Instantiation via WMI
- Remote System Discovery with Adsisearcher
- Remote WMI Command Attempt
- Resize ShadowStorage volume
- RunDLL Loading DLL By Ordinal
- Rundll32 Control RunDLL Hunt
- Scheduled Task Deleted Or Created via CMD
- Scheduled Task Initiation on Remote Endpoint
- Schtasks scheduling job on remote system
- ServicePrincipalNames Discovery with SetSPN
- Shim Database File Creation
- Shim Database Installation With Suspicious Parameters
- Short Lived Windows Accounts
- Steal or Forge Authentication Certificates Behavior Identified
- Suspicious Reg exe Process
- Suspicious Rundll32 StartW
- Suspicious microsoft workflow compiler usage
- Suspicious mshta child process
- Suspicious wevtutil Usage
- Svchost LOLBAS Execution Process Spawn
- System Information Discovery Detection
- System Processes Run From Unexpected Locations
- System User Discovery With Query
- USN Journal Deletion
- Unload Sysmon Filter Driver
- User Discovery With Env Vars PowerShell Script Block
- User Discovery With Env Vars PowerShell
- Vbscript Execution Using Wscript App
- WBAdmin Delete System Backups
- WMI Permanent Event Subscription - Sysmon
- WMI Permanent Event Subscription
- WMIC XSL Execution via URL
- Windows AD DSRM Password Reset
- Windows Access Token Manipulation SeDebugPrivilege
- Windows AdFind Exe
- Windows Application Whitelisting Bypass Attempt via Rundll32
- Windows Attempt To Stop Security Service
- Windows Autostart Execution LSASS Driver Registry Modification
- Windows Binary Proxy Execution Mavinject DLL Injection
- Windows Boot or Logon Autostart Execution In Startup Folder
- Windows Cabinet File Extraction Via Expand
- Windows Cloud Files Filter Loaded by Uncommon Process
- Windows Command Shell DCRat ForkBomb Payload
- Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script
- Windows Create Local Account
- Windows Create Local Administrator Account Via Net
- Windows Credential Dumping LSASS Memory Createdump
- Windows Curl Download to Suspicious Path
- Windows Curl Upload to Remote Destination
- Windows DISM Remove Defender
- Windows DLL Search Order Hijacking Hunt with Sysmon
- Windows DNS Query Request To TinyUrl
- Windows DNS Query Request by Telegram Bot API
- Windows Disable Change Password Through Registry
- Windows Disable Lock Workstation Feature Through Registry
- Windows Disable LogOff Button Through Registry
- Windows Disable Notification Center
- Windows Disable Shutdown Button Through Registry
- Windows Disable Windows Event Logging Disable HTTP Logging
- Windows Disable Windows Group Policy Features Through Registry
- Windows DisableAntiSpyware Registry
- Windows DotNet Binary in Non Standard Path
- Windows ESX Admins Group Creation via Net
- Windows Entra User Management Via Azure CLI
- Windows Event Log Cleared
- Windows Event Logging Service Has Shutdown
- Windows Event Triggered Image File Execution Options Injection
- Windows Eventlog Cleared Via Wevtutil
- Windows Export Certificate
- Windows File Download Via CertUtil
- Windows File Download Via PowerShell
- Windows File Share Discovery With Powerview
- Windows Files and Dirs Access Rights Modification Via Icacls
- Windows For Loop Usage Within Cmd.exe To Execute Commands
- Windows Get-Variable.EXE Execution from WindowsApps Folder
- Windows Group Discovery Via Net
- Windows Guest Account Enabled Via Net.EXE
- Windows HTTP Network Communication From MSIExec
- Windows IIS Components Add New Module
- Windows IIS Components New Module Added
- Windows Identify Protocol Handlers
- Windows Impair Defenses Disable Auto Logger Session
- Windows Impair Defenses Disable HVCI
- Windows Indirect Command Execution Via Series Of Forfiles
- Windows Indirect Command Execution Via forfiles
- Windows Indirect Command Execution Via pcalua
- Windows Input Capture Using Credential UI Dll
- Windows InstallUtil Uninstall Option
- Windows InstallUtil in Non Standard Path
- Windows Ldifde Directory Object Behavior
- Windows Linked Policies In ADSI Discovery
- Windows MOF Event Triggered Execution via WMI
- Windows MSIExec DLLRegisterServer
- Windows MSIExec Remote Download
- Windows MSIExec Unregister DLLRegisterServer
- Windows Mimikatz Crypto Export File Extensions
- Windows Modify Registry AuthenticationLevelOverride
- Windows Modify Registry Auto Update Notif
- Windows Modify Registry DisAllow Windows App
- Windows Modify Registry Disable RDP
- Windows Modify Registry Disable Toast Notifications
- Windows Modify Registry Disable Win Defender Raw Write Notif
- Windows Modify Registry Disable WinDefender Notifications
- Windows Modify Registry Disable Windows Security Center Notif
- Windows Modify Registry DisableRemoteDesktopAntiAlias
- Windows Modify Registry DisableSecuritySettings
- Windows Modify Registry Disabling WER Settings
- Windows Modify Registry Do Not Connect To Win Update
- Windows Modify Registry DontShowUI
- Windows Modify Registry EnableLinkedConnections
- Windows Modify Registry LongPathsEnabled
- Windows Modify Registry MaxConnectionPerServer
- Windows Modify Registry No Auto Reboot With Logon User
- Windows Modify Registry No Auto Update
- Windows Modify Registry ProxyEnable
- Windows Modify Registry ProxyServer
- Windows Modify Registry Suppress Win Defender Notif
- Windows Modify Registry Tamper Protection
- Windows Modify Registry on Smart Card Group Policy
- Windows Modify Show Compress Color And Info Tip Registry
- Windows Multiple Users Failed To Authenticate From Host Using NTLM
- Windows Net System Service Discovery
- Windows Network Share Interaction Via Net
- Windows Network Sniffing Tool Executed
- Windows New Custom Security Descriptor Set On EventLog Channel
- Windows New EventLog ChannelAccess Registry Value Set
- Windows Ngrok Reverse Proxy Usage
- Windows NirSoft Tool Bundle File Created
- Windows NirSoft Utilities
- Windows Non-System Account Targeting Lsass
- Windows Non-System Process Querying Definition Update
- Windows Odbcconf Hunting
- Windows Odbcconf Load DLL
- Windows Odbcconf Load Response File
- Windows Outlook WebView Registry Modification
- Windows Parent PID Spoofing with Explorer
- Windows Password Managers Discovery
- Windows Possible Credential Dumping
- Windows PowerShell Disable HTTP Logging
- Windows PowerShell Export Certificate
- Windows PowerShell Export PfxCertificate
- Windows PowerShell Get CIMInstance Remote Computer
- Windows PowerShell IIS Components WebGlobalModule Usage
- Windows PowerShell ScheduleTask
- Windows PowerView Kerberos Service Ticket Request
- Windows Proxy Execution of .NET Utilities via Scripts
- Windows Proxy Via Netsh
- Windows Proxy Via Registry
- Windows Registry BootExecute Modification
- Windows Registry Certificate Added
- Windows Registry Dotnet ETW Disabled Via ENV Variable
- Windows Registry Modification for Safe Mode Persistence
- Windows Remote Create Service
- Windows Root Domain linked policies Discovery
- Windows RunMRU Command Execution
- Windows SQLCMD Execution
- Windows SSH Proxy Command
- Windows ScManager Security Descriptor Tampering Via Sc.EXE
- Windows Scheduled Task Service Spawned Shell
- Windows Sensitive Group Discovery With Net
- Windows Sensitive Registry Hive Dump Via CommandLine
- Windows Service Create with Tscon
- Windows Service Creation Using Registry Entry
- Windows Service Execution RemCom
- Windows Service Stop Attempt
- Windows Snake Malware File Modification Crmlog
- Windows Snake Malware Kernel Driver Comadmin
- Windows Snake Malware Registry Modification wav OpenWithProgIds
- Windows Snake Malware Service Create
- Windows Steal Authentication Certificates CryptoAPI
- Windows Steal Authentication Certificates Export Certificate
- Windows Steal Authentication Certificates Export PfxCertificate
- Windows SubInAcl Execution
- Windows Suspicious React or Next.js Child Process
- Windows System Binary Proxy Execution Compiled HTML File Decompile
- Windows System Network Connections Discovery Netsh
- Windows System Script Proxy Execution Syncappvpublishingserver
- Windows System Time Discovery W32tm Delay
- Windows System User Discovery Via Quser
- Windows Time Based Evasion
- Windows WMI Process Call Create
- Windows WMI Reconnaissance Class Query
- Windows WMIC Shadowcopy Delete
- Windows Wermgr Alternate Data Stream in Temp Dir
- Windows Wmic Systeminfo Discovery
- Wmic Group Discovery
- XSL Script Execution With WMIC
Other Updates
-
A special thanks to @0x4D617469N, @sbaker-gre and @vshcherbakov from the Security Content community for their contributions to this release, helping improve the quality and reliability of ESCU content.
-
Two new macros have been added to support Zeek HTTP and SSH detections.
-
Two new lookups provide reference data for file-sharing domains and NirSoft utilities.
-
Two existing lookups have also been updated: the detection subcategory map to maintain AI RMF mappings, and the remote access software lookup to improve matching across related detections.
Breaking Changes
List of detections scheduled for removal in ESCU version 6.12.0
Following is a list of detections scheduled for removal in ESCU version 6.12.0:
| Content | Content Type | Removed in Version | Reason | Replacement Content |
|---|---|---|---|---|
| Circle CI Disable Security Job | Detection | 6.12.0 | Detection deprecated because the Technology Add-on it uses has been archived, and no replacement TA exists. | None |
| Circle CI Disable Security Step | Detection | 6.12.0 | Detection deprecated because the Technology Add-on it uses has been archived, and no replacement TA exists. | None |
| Detect Large ICMP Traffic | Detection | 6.12.0 | Detection deprecated as it is determined to be very noisy in a production environment. | None |
| Detection of tools built by NirSoft | Detection | 6.12.0 | Detection deprecated due to duplicated content already covered by other detections. | Windows NirSoft Utilities |
| Ollama Abnormal Service Crash Availability Attack | Detection | 6.12.0 | This experimental rule is being deprecated while we enhance Ollama availability detection. Application errors alone do not confirm a service outage, so we are improving the evidence needed to identify service interruptions reliably. | Ollama Repeated Application Errors |
| Ollama Possible Model Exfiltration Data Leakage | Detection | 6.12.0 | This experimental rule is being deprecated while we enhance Ollama exfiltration detection. Access requests and response timing alone do not show what data was returned or transferred, so stronger evidence and correlation are needed. | None |
| Ollama Possible RCE via Model Loading | Detection | 6.12.0 | This experimental rule is being deprecated while we enhance Ollama model-loading detection. Model-loading errors alone do not confirm code execution, so the detection needs stronger evidence of execution. | None |
| Ollama Suspicious Prompt Injection Jailbreak | Detection | 6.12.0 | This experimental rule is being deprecated while we enhance Ollama prompt-injection detection. Long response times do not reveal prompt content or show that safeguards were bypassed, so they are not enough to identify these attacks reliably. | Ollama Long-Running Inference Requests |
| Possible Browser Pass View Parameter | Detection | 6.12.0 | Detection deprecated due to duplicated content already covered by other detections. | Windows NirSoft Utilities |
| Windows NirSoft AdvancedRun | Detection | 6.12.0 | Detection deprecated due to duplicated content already covered by other detections. | Windows NirSoft Utilities |
Platform support notice
ESCU platform support follows the Splunk Software Support Policy. Splunk Enterprise 9.3 and earlier have reached end of support and will be removed from ESCU’s compatibility listings in a future release. Splunk Cloud Platform 10.1 reaches end of support on October 28, 2026. Customers should review the policy and plan upgrades to a supported, compatible platform version.