Releases: splunk/security_content
v1.0.48
RELEASE NOTES
Version 1.0.48 was released on December 20, 2019 and introduced input(pre-filter) and output(post-filter) macros for all new detection searches after v. 1.0.46. These macros let you update a macro definition once and then apply the new definition across all detections that leverage that macro. These changes will be local to your Splunk environment.
New detection searches added to the "Credential Dumping" Analytic Story:
- Access LSASS Memory for Dump Creation
- Create Remote Thread into LSASS
- Detect Credential Dumping through LSASS access
- Unsigned Image Loaded by LSASS
- Attempted Credential Dump From Registry via Reg.exe
- Detect Mimikatz Using Loaded Images
- Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass
- Creation of Shadow Copy with ntdsutil
- Creation of Shadow Copy with vssadmin
- Creation of Shadow Copy with wmic and powershell
- Creation of Shadow Copy with wmicCredential Dumping via Copy Command from Shadowcopy
- Credential Dumping via Symlink to Shadowcopy
Fixed a bug in the security_content_ctime macro, which was not working as expected.
v1.0.47
Enterprise Security Content Updates v 1.0.47 included the following enhancements:
Fixed issues:
- CRL-1700 Remove ES macro dependency by introducing new macros security_content_ctime replacing the ctime macro across all content, and introducing security_content_summariesonly replacing the summariesonly macro across all content.
- Removed runstory macro definition .
- Removed comment macro for empty definition.
v1.0.46
Enterprise Security Content Updates v 1.0.46 included the following enhancements.
Fixed issues:
- CRL-1688 Ensure that ESCU is supported on Splunk Enterprise 8.0
- CRL-1686 Resolve broken hyperlinks in content files
- CRL-1609 Fix for validation check on Feedback Center page
v1.0.45
Enterprise Security Content Updates v 1.0.45 included the following enhancements.
Updated Analytic Stories:
- Added new searches "Abnormally High AWS Instances Launched by User - MLTK detection" and "Abnormally High AWS Instances Terminated by User - MLTK detection" to the "Suspicious AWS EC2 Activities" Analytic Story
- Added new search "Abnormally High AWS Instances Launched by User - MLTK detection" to the "Cloud Cryptomining" Analytic Story
Fixed issues:
- CRL-1493 ESCU Fraud Searches Are Mislabeled
- CRL-1697 Added: Cloud Compute Instance Created With Previously Unseen Image detection to Cloud Cryptomining story