Merge branch 'develop' into secret_blizzard

Author: patel-bhavin

contentctl.yml

@@ -3,7 +3,7 @@ app:
   uid: 3449
   title: ES Content Updates
   appid: DA-ESS-ContentUpdate
-  version: 5.13.0
+  version: 5.14.0
   description: Explore the Analytic Stories included with ES Content Updates.
   prefix: ESCU
   label: ESCU
@@ -44,9 +44,9 @@ apps:
 - uid: 7404
   title: Cisco Security Cloud
   appid: CiscoSecurityCloud
-  version: 3.3.1
+  version: 3.4.0
   description: description of app
-  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-security-cloud_331.tgz
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/cisco-security-cloud_340.tgz
 - uid: 6652
   title: Add-on for Linux Sysmon
   appid: Splunk_TA_linux_sysmon

data_sources/cisco_ai_defense_alerts.yml

@@ -10,5 +10,5 @@ separator: null
 supported_TA:
 - name: Cisco Security Cloud
   url: https://splunkbase.splunk.com/app/7404
-  version: 3.3.1
+  version: 3.4.0
 fields: null

data_sources/cisco_duo_activity.yml

@@ -10,7 +10,7 @@ separator: null
 supported_TA:
 - name: Cisco Security Cloud
   url: https://splunkbase.splunk.com/app/7404
-  version: 3.3.1
+  version: 3.4.0
 fields:
 - access_device.browser
 - access_device.browser_version

data_sources/cisco_duo_administrator.yml

@@ -10,7 +10,7 @@ separator: null
 supported_TA:
 - name: Cisco Security Cloud
   url: https://splunkbase.splunk.com/app/7404
-  version: 3.3.1
+  version: 3.4.0
 fields:
 - action
 - actionlabel

data_sources/cisco_secure_firewall_threat_defense_connection_event.yml

@@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer
 supported_TA:
 - name: Cisco Security Cloud
   url: https://splunkbase.splunk.com/app/7404
-  version: 3.3.1
+  version: 3.4.0
 fields:
 - AC_RuleAction
 - action

data_sources/cisco_secure_firewall_threat_defense_file_event.yml

@@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer
 supported_TA:
 - name: Cisco Security Cloud
   url: https://splunkbase.splunk.com/app/7404
-  version: 3.3.1
+  version: 3.4.0
 fields:
 - app
 - Application

data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml

@@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer
 supported_TA:
 - name: Cisco Security Cloud
   url: https://splunkbase.splunk.com/app/7404
-  version: 3.3.1
+  version: 3.4.0
 fields:
 - Application
 - Classification

detections/cloud/aws_defense_evasion_impair_security_services.yml

@@ -1,13 +1,11 @@
 name: AWS Defense Evasion Impair Security Services
 id: b28c4957-96a6-47e0-a965-6c767aac1458
-version: 8
-date: '2025-05-22'
-author: Bhavin Patel, Gowthamaraj Rajendran, Splunk
+version: 9
+date: '2025-08-26'
+author: Bhavin Patel, Gowthamaraj Rajendran, Splunk, PashFW, Github Community
 status: production
 type: TTP
-description: The following analytic detects attempts to delete critical AWS security
-  service configurations, such as CloudWatch alarms, GuardDuty detectors, and Web
-  Application Firewall rules. It leverages CloudTrail logs to identify specific API
+description: The following analytic detects attempts to impair or disable AWS security services by monitoring specific deletion operations across GuardDuty, AWS WAF (classic and v2), CloudWatch, Route 53, and CloudWatch Logs. These actions include deleting detectors, rule groups, IP sets, web ACLs, logging configurations, alarms, and log streams. Adversaries may perform such operations to evade detection or remove visibility from defenders. By explicitly pairing eventName values with their corresponding eventSource services, this detection reduces noise and ensures that only security-related deletions are flagged. It leverages CloudTrail logs to identify specific API
   calls like "DeleteLogStream" and "DeleteDetector." This activity is significant
   because it indicates potential efforts to disable security monitoring and evade
   detection. If confirmed malicious, this could allow attackers to operate undetected,
@@ -22,14 +20,17 @@ data_source:
 - AWS CloudTrail DeleteRuleGroup
 - AWS CloudTrail DeleteLoggingConfiguration
 - AWS CloudTrail DeleteAlarms
-search: '`cloudtrail` eventName IN ("DeleteLogStream","DeleteDetector","DeleteIPSet","DeleteWebACL","DeleteRule","DeleteRuleGroup","DeleteLoggingConfiguration","DeleteAlarms")
+search: |
+  `cloudtrail`
+  (eventName="DeleteDetector" AND eventSource="guardduty.amazonaws.com") OR (   eventName IN ("DeleteIPSet", "DeleteWebACL", "DeleteRuleGroup", "DeleteRule") AND eventSource IN ("guardduty.amazonaws.com", "wafv2.amazonaws.com", "waf.amazonaws.com") ) OR ( eventName="DeleteLoggingConfiguration" AND eventSource IN ("wafv2.amazonaws.com", "waf.amazonaws.com", "route53.amazonaws.com") )
   | rename user_name as user
   | stats count min(_time) as firstTime max(_time) as lastTime by signature dest user user_agent src vendor_account vendor_region vendor_product
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|  `aws_defense_evasion_impair_security_services_filter`'
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `aws_defense_evasion_impair_security_services_filter`
 how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in
   your AWS Environment.
-known_false_positives: While this search has no known false positives, it is possible
-  that it is a legitimate admin activity. Please consider filtering out these noisy
+known_false_positives: Legitimate administrators may occasionally delete GuardDuty detectors, WAF rule groups, or CloudWatch alarms during environment reconfiguration, migration, or decommissioning activities. In such cases, these events are expected and benign. These should be validated against approved change tickets or deployment pipelines to differentiate malicious activity from normal operations. Please consider filtering out these noisy
   events using userAgent, user_arn field names.
 references:
 - https://docs.aws.amazon.com/cli/latest/reference/guardduty/index.html

detections/cloud/azure_automation_account_created.yml

@@ -1,8 +1,8 @@
 name: Azure Automation Account Created
 id: 860902fd-2e76-46b3-b050-ba548dab576c
-version: 9
-date: '2025-05-02'
-author: Mauricio Velazco, Splunk
+version: 10
+date: '2025-09-03'
+author: Mauricio Velazco, Brian Serocki, Splunk
 status: production
 type: TTP
 description: The following analytic detects the creation of a new Azure Automation
@@ -15,9 +15,9 @@ description: The following analytic detects the creation of a new Azure Automati
   on virtual machines, posing a significant security risk.
 data_source:
 - Azure Audit Create or Update an Azure Automation account
-search: '`azure_audit` operationName.localizedValue="Create or Update an Azure Automation account" status.value=Succeeded 
+search: '`azure_audit` operationName.value="Microsoft.Automation/automationAccounts/write" status.value=Succeeded 
   | dedup object 
-  | rename claims.ipaddr as src, subscriptionId as vendor_account, operationName.localizedValue as signature
+  | rename claims.ipaddr as src, subscriptionId as vendor_account, operationName.value as signature
   | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product object object_path signature
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_automation_account_created_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft

detections/cloud/azure_automation_runbook_created.yml

@@ -1,8 +1,8 @@
 name: Azure Automation Runbook Created
 id: 178d696d-6dc6-4ee8-9d25-93fee34eaf5b
-version: 9
-date: '2025-05-02'
-author: Mauricio Velazco, Splunk
+version: 10
+date: '2025-09-03'
+author: Mauricio Velazco, Brian Serocki, Splunk
 status: production
 type: TTP
 description: The following analytic detects the creation of a new Azure Automation
@@ -15,9 +15,9 @@ description: The following analytic detects the creation of a new Azure Automati
   environment.
 data_source:
 - Azure Audit Create or Update an Azure Automation Runbook
-search: '`azure_audit` operationName.localizedValue="Create or Update an Azure Automation Runbook" object!=AzureAutomationTutorial* status.value=Succeeded 
+search: '`azure_audit` operationName.value="Microsoft.Automation/automationAccounts/runbooks/write" object!=AzureAutomationTutorial* status.value=Succeeded 
   | dedup object 
-  | rename claims.ipaddr as src, subscriptionId as vendor_account, operationName.localizedValue as operationName
+  | rename claims.ipaddr as src, subscriptionId as vendor_account, operationName.value as operationName
   | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product object object_path 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`