Fix Reported Issues - April Batch

contentctl.yml

@@ -123,11 +123,11 @@ apps:
   description: description of app
   hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-stream-wire-data_816.tgz
 - uid: 2757
-  title: Palo Alto Networks Add-on for Splunk
-  appid: PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK
-  version: 8.1.3
+  title: Splunk Add-on for Palo Alto Networks
+  appid: SPLUNK_ADD_ON_FOR_PALO_ALTO_NETWORKS
+  version: 3.0.0
   description: description of app
-  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_813.tgz
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-palo-alto-networks_300.tgz
 - uid: 3865
   title: Zscaler Technical Add-On for Splunk
   appid: Zscaler_CIM

data_sources/palo_alto_network_threat.yml

@@ -1,7 +1,7 @@
 name: Palo Alto Network Threat
 id: 375c2b0e-d216-41ad-9406-200464595209
-version: 2
-date: '2025-01-23'
+version: 3
+date: '2026-03-23'
 author: Patrick Bareiss, Splunk
 description: Logs detected threats identified by Palo Alto Networks devices, including
   details about malware, intrusion attempts, and malicious network activity.
@@ -11,12 +11,12 @@ mitre_components:
 - Network Traffic Flow
 - Application Log Content
 - Host Status
-source: pan:threat
+source: not_applicable
 sourcetype: pan:threat
 supported_TA:
 - name: Palo Alto Networks Add-on
-  url: https://splunkbase.splunk.com/app/2757
-  version: 8.1.3
+  url: https://splunkbase.splunk.com/app/7523
+  version: 3.0.0
 field_mappings:
 - data_model: cim
   data_set: Web

data_sources/palo_alto_network_traffic.yml

@@ -1,7 +1,7 @@
 name: Palo Alto Network Traffic
 id: 182a83bc-c31a-4817-8c7a-263744cec52a
-version: 2
-date: '2025-01-23'
+version: 3
+date: '2026-03-23'
 author: Patrick Bareiss, Splunk
 description: Logs network traffic events captured by Palo Alto Networks devices, including
   details about sessions, protocols, and source and destination IPs.
@@ -11,12 +11,12 @@ mitre_components:
 - Network Connection Creation
 - Response Metadata
 - Application Log Content
-source: screenconnect_palo_traffic
+source: not_applicable
 sourcetype: pan:traffic
 supported_TA:
 - name: Palo Alto Networks Add-on
-  url: https://splunkbase.splunk.com/app/2757
-  version: 8.1.3
+  url: https://splunkbase.splunk.com/app/7523
+  version: 3.0.0
 fields:
 - _time
 - date_hour

data_sources/windows_event_log_security_4756.yml

@@ -0,0 +1,18 @@
+name: Windows Event Log Security 4756
+id: b0093058-0cb6-4c73-a95b-fb0f3541e88c
+version: 1
+date: '2026-03-23'
+author: Nasreddine Bencherchali, Splunk
+description: Data source object for Windows Event Log Security 4754
+source: XmlWinEventLog:Security
+sourcetype: XmlWinEventLog
+separator: EventCode
+supported_TA:
+- name: Splunk Add-on for Microsoft Windows
+  url: https://splunkbase.splunk.com/app/742
+  version: 9.1.2
+fields:
+- _time
+output_fields:
+- dest
+example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-A5BA-3E3B0328C30D}' /> <EventID>4756</EventID> <Version>0</Version> <Level>0</Level> <Task>13826</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime='2019-03-20T17:08:41.465560800Z' /> <EventRecordID>4405437</EventRecordID> <Correlation /> <Execution ProcessID='704' ThreadID='2584' /> <Channel>Security</Channel> <Computer>atc-win-2k16.atc.local</Computer> <Security /> </System><EventData><Data Name='MemberName'>CN=demouser,CN=Users,DC=atc,DC=local</Data> <Data Name='MemberSid'>S-1-5-21-2245550993-2690282630-2861202560-18603</Data> <Data Name='TargetUserName'>Enterprise Admins</Data> <Data Name='TargetDomainName'>ATC</Data> <Data Name='TargetSid'>S-1-5-21-2245550993-2622282683-2531201460-519</Data> <Data Name='SubjectUserSid'>S-1-5-21-2245550993-2622282683-2531201460-500</Data> <Data Name='SubjectUserName'>test_user</Data> <Data Name='SubjectDomainName'>ATC</Data> <Data Name='SubjectLogonId'>0x109a6c</Data> <Data Name='PrivilegeList'>-</Data> </EventData></Event>

detections/application/email_attachments_with_lots_of_spaces.yml

@@ -1,7 +1,7 @@
 name: Email Attachments With Lots Of Spaces
 id: 56e877a6-1455-4479-ada6-0550dc1e22f8
-version: 9
-date: '2026-03-10'
+version: 10
+date: '2026-03-25'
 author: David Dorsey, Splunk
 status: experimental
 type: Anomaly
@@ -35,6 +35,9 @@ tags:
         - Hermetic Wiper
         - Suspicious Emails
     asset_type: Endpoint
+    mitre_attack_id:
+        - T1566.001
+        - T1036.008
     product:
         - Splunk Enterprise
         - Splunk Enterprise Security

detections/application/suspicious_java_classes.yml

@@ -1,24 +1,36 @@
 name: Suspicious Java Classes
 id: 6ed33786-5e87-4f55-b62c-cb5f1168b831
-version: 7
-date: '2026-03-10'
+version: 8
+date: '2026-03-25'
 author: Jose Hernandez, Splunk
 status: experimental
 type: Anomaly
-description: The following analytic identifies suspicious Java classes often used for remote command execution exploits in Java frameworks like Apache Struts. It detects this activity by analyzing HTTP POST requests with specific content patterns using Splunk's `stream_http` data source. This behavior is significant because it may indicate an attempt to exploit vulnerabilities in web applications, potentially leading to unauthorized remote code execution. If confirmed malicious, this activity could allow attackers to execute arbitrary commands on the server, leading to data breaches, system compromise, and further network infiltration.
+description: |-
+    The following analytic identifies suspicious Java classes often used for remote command execution exploits in Java frameworks like Apache Struts.
+    It detects this activity by analyzing HTTP POST requests with specific content patterns using Splunk's `stream_http` data source.
+    This behavior is significant because it may indicate an attempt to exploit vulnerabilities in web applications, potentially leading to unauthorized remote code execution.
+    If confirmed malicious, this activity could allow attackers to execute arbitrary commands on the server, leading to data breaches, system compromise, and further network infiltration.
 data_source: []
 search: |-
-    `stream_http` http_method=POST http_content_length>1
-      | regex form_data="(?i)java\.lang\.(?:runtime
-      | processbuilder)"
-      | rename src_ip as src
-      | stats count earliest(_time) as firstTime, latest(_time) as lastTime, values(url) as uri, values(status) as status, values(http_user_agent) as http_user_agent
-        BY src, dest
-      | `security_content_ctime(firstTime)`
-      | `security_content_ctime(lastTime)`
-      | `suspicious_java_classes_filter`
-how_to_implement: In order to properly run this search, Splunk needs to ingest data from your web-traffic appliances that serve or sit in the path of your Struts application servers. This can be accomplished by indexing data from a web proxy, or by using network traffic-analysis tools, such as Splunk Stream or Bro.
-known_false_positives: There are no known false positives.
+    `stream_http`
+    http_method=POST
+    http_content_length>1
+    | regex form_data="(?i)java\.lang\.(?:runtime|processbuilder)"
+    | rename src_ip as src
+    | stats count earliest(_time) as firstTime
+                  latest(_time) as lastTime
+                  values(url) as uri
+                  values(status) as status
+                  values(http_user_agent) as http_user_agent
+      BY src dest
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `suspicious_java_classes_filter`
+how_to_implement: |-
+    In order to properly run this search, Splunk needs to ingest data from your web-traffic appliances that serve or sit in the path of your Struts application servers.
+    This can be accomplished by indexing data from a web proxy, or by using network traffic-analysis tools, such as Splunk Stream or Bro.
+known_false_positives: |-
+    No false positives have been identified at this time.
 references: []
 rba:
     message: Suspicious Java Classes in HTTP requests involving $src$ and $dest$
@@ -34,6 +46,8 @@ tags:
     analytic_story:
         - Apache Struts Vulnerability
     asset_type: Endpoint
+    mitre_attack_id:
+        - T1190
     product:
         - Splunk Enterprise
         - Splunk Enterprise Security

detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml

@@ -1,17 +1,27 @@
 name: Cloud Compute Instance Created With Previously Unseen Instance Type
 id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda
-version: 8
-date: '2026-03-10'
+version: 9
+date: '2026-03-25'
 author: David Dorsey, Splunk
 status: production
 type: Anomaly
-description: The following analytic detects the creation of EC2 instances with previously unseen instance types. It leverages Splunk's tstats command to analyze data from the Change data model, identifying instance types that have not been previously recorded. This activity is significant for a SOC because it may indicate unauthorized or suspicious activity, such as an attacker attempting to create instances for malicious purposes. If confirmed malicious, this could lead to unauthorized access, data exfiltration, system compromise, or service disruption. Immediate investigation is required to determine the legitimacy of the instance creation.
+description: |-
+    The following analytic detects the creation of EC2 instances with previously unseen instance types.
+    It leverages Splunk's tstats command to analyze data from the Change data model, identifying instance types that have not been previously recorded.
+    This activity is significant for a SOC because it may indicate unauthorized or suspicious activity, such as an attacker attempting to create instances for malicious purposes.
+    If confirmed malicious, this could lead to unauthorized access, data exfiltration, system compromise, or service disruption. Immediate investigation is required to determine the legitimacy of the instance creation.
 data_source:
     - AWS CloudTrail
 search: |-
-    | tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest, count FROM datamodel=Change
-      WHERE All_Changes.action=created
-      BY All_Changes.Instance_Changes.instance_type, All_Changes.user
+    | tstats count earliest(_time) as firstTime
+                   latest(_time) as lastTime
+                   values(All_Changes.object_id) as dest
+    FROM datamodel=Change WHERE
+
+    All_Changes.action=created
+
+    BY All_Changes.Instance_Changes.instance_type All_Changes.user
+
     | `drop_dm_object_name("All_Changes")`
     | `drop_dm_object_name("Instance_Changes")`
     | where instance_type != "unknown"
@@ -23,8 +33,10 @@ search: |-
     | table firstTime, user, dest, count, instance_type
     | `security_content_ctime(firstTime)`
     | `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`
-how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Compute Instance Types - Initial` to build the initial table of instance types observed and times. You must also enable the second baseline search `Previously Seen Cloud Compute Instance Types - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter` macro.
-known_false_positives: It is possible that an admin will create a new system using a new instance type that has never been used before. Verify with the creator that they intended to create the system with the new instance type.
+how_to_implement: |-
+    You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Compute Instance Types - Initial` to build the initial table of instance types observed and times. You must also enable the second baseline search `Previously Seen Cloud Compute Instance Types - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter` macro.
+known_false_positives: |-
+    It is possible that an admin will create a new system using a new instance type that has never been used before. Verify with the creator that they intended to create the system with the new instance type.
 references: []
 drilldown_searches:
     - name: View the detection results for - "$dest$"
@@ -54,6 +66,8 @@ tags:
         - Splunk Enterprise Security
         - Splunk Cloud
     security_domain: threat
+    mitre_attack_id:
+        - T1578.002
     manual_test: This search needs the baseline `Previously Seen Cloud Compute Instance Types - Initial` to be run first.
 tests:
     - name: True Positive Test

detections/endpoint/certutil_exe_certificate_extraction.yml

@@ -1,31 +1,49 @@
 name: Certutil exe certificate extraction
 id: 337a46be-600f-11eb-ae93-0242ac130002
-version: 13
-date: '2026-03-10'
+version: 14
+date: '2026-03-25'
 author: Rod Soto, Splunk
 status: production
 type: TTP
-description: The following analytic identifies the use of certutil.exe with arguments indicating the manipulation or extraction of certificates. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because extracting certificates can allow attackers to sign new authentication tokens, particularly in federated environments like Windows ADFS. If confirmed malicious, this could enable attackers to forge authentication tokens, potentially leading to unauthorized access and privilege escalation within the network.
+description: |-
+    The following analytic identifies the use of certutil.exe with arguments indicating the manipulation or extraction of certificates.
+    It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments.
+    This activity is significant because extracting certificates can allow attackers to sign new authentication tokens, particularly in federated environments like Windows ADFS.
+    If confirmed malicious, this could enable attackers to forge authentication tokens, potentially leading to unauthorized access and privilege escalation within the network.
 data_source:
     - Sysmon EventID 1
     - Windows Event Log Security 4688
     - CrowdStrike ProcessRollup2
 search: |-
-    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
-      WHERE Processes.process_name=certutil.exe Processes.process = "*-exportPFX*"
-      BY Processes.action Processes.dest Processes.original_file_name
-         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
-         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
-         Processes.process Processes.process_exec Processes.process_guid
-         Processes.process_hash Processes.process_id Processes.process_integrity_level
-         Processes.process_name Processes.process_path Processes.user
-         Processes.user_id Processes.vendor_product
+    | tstats `security_content_summariesonly`
+      count min(_time) as firstTime
+            max(_time) as lastTime
+    FROM datamodel=Endpoint.Processes
+    WHERE
+    (
+        Processes.process_name=certutil.exe
+        OR
+        Processes.original_file_name=certutil.exe
+    )
+    Processes.process = "*-exportPFX*"
+
+    BY Processes.action Processes.dest Processes.original_file_name
+       Processes.parent_process Processes.parent_process_exec
+       Processes.parent_process_guid Processes.parent_process_id
+       Processes.parent_process_name Processes.parent_process_path
+       Processes.process Processes.process_exec Processes.process_guid
+       Processes.process_hash Processes.process_id Processes.process_integrity_level
+       Processes.process_name Processes.process_path Processes.user
+       Processes.user_id Processes.vendor_product
+
     | `drop_dm_object_name(Processes)`
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `certutil_exe_certificate_extraction_filter`
-how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services.
+how_to_implement: |-
+    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: |-
+    Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services.
 references:
     - https://blog.sygnia.co/detection-and-hunting-of-golden-saml-attack
     - https://strontic.github.io/xcyclopedia/library/certutil.exe-09A8A29BAA3A451713FD3D07943B4A43.html
@@ -66,6 +84,8 @@ tags:
         - Splunk Enterprise Security
         - Splunk Cloud
     security_domain: endpoint
+    mitre_attack_id:
+        - T1649
 tests:
     - name: True Positive Test
       attack_data: