Splunk Security Content for Threat Detection & Response: November 2026 Update

Looking for the latest Splunk security content? You’ve come to the right place! This page is updated quarterly with all the latest security content details.

This blog post covers security content developed August – October 2026. Jump straight to the updates below, or read on to learn more about:

• How Splunk develops security content
• The types of content we deliver
• How to access security content

See the latest Splunk Security Content >

Splunk continuously monitors the threat landscape to develop, test, and deliver security content to help identify and respond to vulnerabilities and cyber attacks within your environment.

Types of Security Content

Splunk provides a variety of security content, all of which is designed to help you make the most of your Splunk environment. This includes:

Detections

Splunk’s out-of-the-box detection searches are created to help identify patterns and alert you to threats and anomalous behavior.

Analytic Stories

All detection searches relevant to a particular threat are packaged in the form of analytic stories (also known as use cases).

SOAR Playbook Packs

A collection of pre-built automation playbooks that are designed to help users tackle specific use cases.

How to get Security Content

Take advantage of security content in two ways:

• Enterprise Security Content Update (ESCU) app
• Splunk Security Essentials (SSE) app

Both apps allow you to deploy thousands of out-of-the-box searches to start detecting, investigating, and responding to threats. You can also view the full security content repository by visiting research.splunk.com.

And with that information, we can move onto the latest content. Let's take a look!

Splunk Security Content: August – October 2026

Below you will find a brief table of contents, followed by an overview of the security content developed from August – October 2026.

Table of Contents

Adversary Tradecraft Analytic Stories

• Vidar Stealer
• Malicious Python Package Installation
• Braodo Stealer
• Abuse of GenAI Systems and Applications

Emerging Threats Analytic Stories

• PHP2Shell
• Node2Shell
• RoguePlanet

Overview: Adversary Tradecraft Analytic Stories

The Splunk Threat Research Team (STRT) created several new analytic stories to help identify activity related to various malware threats:

• Vidar Stealer is a commodity infostealer sold as malware-as-a-service (MaaS) on underground forums, capable of harvesting credentials, browser cookies, saved passwords, cryptocurrency wallet data, and cloud profile metadata from infected systems. This analytic story provides detection and investigation content for identifying and responding to threats associated with the Vidar information stealer on Windows endpoints.

• The Malicious Python Package Installation story provides detection coverage for abuse of the Python package installation lifecycle, including install-time code execution, persistence via .pth path configuration files, Python site hooks, and PYTHONPATH environment variable manipulation. Python's popularity, readable syntax, and extensive third-party library ecosystem make it an attractive target for threat actors seeking to compromise developer devices and infrastructure.

• Braodo Stealer analytic story enables teams to detect and investigate unusual activities that may be related to the Braodo Stealer malware, a malicious software designed to steal sensitive information from infected systems. This malware typically targets login credentials, browser history, cookies, and stored passwords.
• With the Abuse of GenAI Systems and Applications story, detect and investigate threats targeting or abusing artificial intelligence systems, services and applications. AI applications can expose sensitive information, invoke connected tools, or process untrusted prompts. Attackers and malicious insiders may try to override model instructions, extract restricted data, misuse AI-enabled tools, or repeatedly probe guardrails. Use this story to investigate AI security events across model providers and application integrations.from Cisco AI Defense.

Overview: Emerging Threats Analytic Stories

The STRT also released multiple analytic stories for emerging threats in the past few months.

• PHP2Shell is associated with remote code execution vulnerabilities in PHP session upload-progress and multipart request handling. This analytic story covers exploitation attempts and post-exploitation activity associated with PHP2Shell (CVE-2026-109618 and CVE-2026-109619).
• Node2Shell (CVE-2026-111497) is a memory corruption vulnerability in the Brotli decoder used by Node.js. Applications that process untrusted Brotli data may be at risk of exploitation, which can result in application crashes or code execution. This analytic story covers exploitation attempts and post-exploitation activity associated with Node2Shell (CVE-2026-111497), an out-of-bounds write in the Brotli decoder used by Node.js.
• And finally, the team release the RoguePlanet analytic story that groups detections that surface alternate data stream abuse, suspicious Defender-adjacent file and module-load activity, Windows Error Reporting abuse, and privilege escalation patterns consistent with RoguePlanet, ShieldBreak, and similar Windows Defender bypass research.

The team also published the following blogs:

• What an Agentic Attack Looks Like in Splunk Attack Range

• Splunking the LLM Gateways. Search Head Meets Prompt Head

• Trusted Agentic SOC: The AI in Security and the Security in AI

• Peeling Back the Layers: Inside Vidar - From Virtualized Code to Stolen Credentials

Previous Security Content Roundups

Looking for previous security content updates? Check out the previous quarters of security content roundups from the Spunk Threat Research Team. Stay tuned to that page and this one — we're updating them every quarter!