Splunk Security Content for Threat Detection & Response: October Recap

In October, the Splunk Threat Research Team (STRT) had 4 releases of new security content via the Enterprise Security Content Update (ESCU) app (v6.8.0, v6.9.0, v6.9.1, and v6.9.2) With these releases, there are 30 new analytics, 1 new analytic story, and 464 updated analytics, now available in Splunk Enterprise Security via the ESCU application update process.

Content highlights include:

• Extensive PHP2Shell Coverage: Developed in coordination with Cisco Talos and the Splunk Threat Research Team’s detection engineers, this content helps customers identify and investigate potential exploitation of CVE-2026-109618 and CVE-2026-109619. Coverage spans network detections using Suricata and Zeek, Snort-rule-based detections developed by Talos, and endpoint analytics that identify suspicious child processes spawned by web and application servers.
• Expanded Active Directory and Windows Threat Coverage: New analytics for KerberLoss SPN manipulation, ResetNightmare-related UPN changes, and Windows Defender artifacts associated with ShieldCrash.
• Consolidated Renamed-Binary Detections: New four lookup-backed analytics covering renamed command interpreters, LOLBAS binaries, popular third-party software, and Python binaries.
• Improved Support for Current Security Data Sources: Updated Office 365 message trace analytics to support the Microsoft 365 Graph sourcetype while retaining legacy support. Updates also improve CrowdStrike FDR compatibility and refine Azure AD consent and WMI event subscription detections.
• Cisco AI Defense Detection Coverage: New detections for allowed sensitive prompts, allowed sensitive responses, and repeated high-risk activity. The release also updates the application-name alert and Cisco AI Defense data source and adds the Abuse of GenAI Systems and Applications analytic story.
• Cisco AI Defense Threat Operations Dashboard: A new dashboard (in alpha) for reviewing runtime activity, enforcement outcomes, risky behavior, sensitive data matches, and activity by application and model.
• Expanded AWS CloudTrail coverage: New detections for anomalous Secrets Manager batch retrieval, high-volume CloudWatch Logs reads, and repeated EC2 Instance Connect SSH key uploads. Together, these analytics improve visibility into suspicious secret access, log reads, and key uploads.
• Improved Cisco Secure Firewall and Network Detections: Refreshed remote access software coverage and its lookup, added a lookup for file-sharing domains, and updated suspicious-port detection.
• Added New Coverage for the Zeek Data Source: Added detections for encoded HTTP POST payloads, unusual SSH client banners, and unusual HTTP request methods, along with the Zeek HTTP and SSH data sources and macros.