Add Some Missing Threat Objects & References

detections/application/cisco_ios_xe_webui_programmatic_configuration.yml

@@ -1,13 +1,13 @@
 name: Cisco IOS XE WebUI Programmatic Configuration
 id: f9686576-a23d-4c4d-bfad-a45499dc448a
-version: 1
+version: 2
 creation_date: '2026-05-19'
-modification_date: '2026-05-19'
+modification_date: '2026-09-08'
 author: Nasreddine Bencherchali
 status: production
 type: Anomaly
 description: |
-    This analytic detects Cisco IOS-XE configuration changes performed by the WebUI WSMA process.
+    The following analytic detects Cisco IOS-XE configuration changes performed by the WebUI WSMA process.
 data_source:
     - Cisco IOS Logs
 search: |-
@@ -47,7 +47,8 @@ intermediate_findings:
         - field: user
           type: user
           score: 20
-          message: User $user$ performed Cisco IOS-XE WebUI programmatic configuration on $dest$.
+          message: User [$user$] performed Cisco IOS-XE WebUI programmatic configuration on [$dest$] via [$process$] on [$vty$].
+threat_objects: []
 analytic_story:
     - Salt Typhoon
 asset_type: Network

detections/application/email_files_written_outside_of_the_outlook_directory.yml

@@ -1,8 +1,8 @@
 name: Email files written outside of the Outlook directory
 id: 8d52cf03-ba25-4101-aa78-07994aed4f74
-version: 13
+version: 14
 creation_date: '2020-04-29'
-modification_date: '2026-07-02'
+modification_date: '2026-09-08'
 author: Bhavin Patel, Splunk
 status: production
 type: Anomaly
@@ -55,6 +55,9 @@ intermediate_findings:
           type: system
           score: 20
           message: A new email file [$file_name$] was written to [$file_path$] on endpoint $dest$ by user $user$.
+threat_objects:
+    - field: file_path
+      type: file_path
 analytic_story:
     - Collection and Staging
 asset_type: Endpoint

detections/application/esxi_audit_tampering.yml

@@ -1,17 +1,36 @@
 name: ESXi Audit Tampering
 id: c48a155b-2861-417a-813c-220f5272cf01
-version: 5
+version: 6
 creation_date: '2025-07-11'
-modification_date: '2026-05-13'
+modification_date: '2026-09-08'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: This detection identifies the use of the esxcli system auditrecords commands, which can be used to tamper with logging on an ESXi host. This action may indicate an attempt to evade detection or hinder forensic analysis by preventing the recording of system-level audit events.
+description: |-
+    The following analytic identifies the use of the esxcli system auditrecords commands, which can be used to tamper with logging on an ESXi host.
+    This action may indicate an attempt to evade detection or hinder forensic analysis by preventing the recording of system-level audit events.
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` Message="*esxcli system auditrecords*" Message IN ("*remote*","*local*") NOT Message = "*[shell*" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | rex field=_raw "[\w+]\]: (?<full_command>.*)" | rex field=full_command "\[(?<user>.*)]:\s(?<command>.*)" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_audit_tampering_filter`'
-how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
-known_false_positives: Limited false positives in most environments, however tune as needed.
+search: |-
+    `esxi_syslog`
+    Message="*esxcli system auditrecords*"
+    Message IN ("*remote*","*local*")
+    NOT Message = "*[shell*"
+
+    | rex field=_raw "Z (?<dest>[\w\.]+)\s"
+    | rex field=_raw "[\w+]\]: (?<full_command>.*)"
+    | rex field=full_command "\[(?<user>.*)]:\s(?<command>.*)"
+
+    | stats count min(_time) as firstTime
+                  max(_time) as lastTime
+            by dest user command
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `esxi_audit_tampering_filter`
+how_to_implement: |-
+    This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
+known_false_positives: No false positives have been identified at this time.
 references:
     - https://detect.fyi/detecting-and-responding-to-esxi-compromise-with-splunk-f33998ce7823
 drilldown_searches:
@@ -24,11 +43,14 @@ drilldown_searches:
       earliest_offset: 7d
       latest_offset: "0"
 finding:
-    title: Audit tampering activity on ESXi host $dest$.
+    title: Audit tampering activity via [$command$] on ESXi host [$dest$].
     entity:
         field: dest
         type: system
         score: 50
+threat_objects:
+    - field: command
+      type: command
 analytic_story:
     - ESXi Post Compromise
     - Black Basta Ransomware

detections/application/esxi_bulk_vm_termination.yml

@@ -1,17 +1,49 @@
 name: ESXi Bulk VM Termination
 id: cfe094b4-0737-4a33-9d63-e0562ce2b883
-version: 4
+version: 5
 creation_date: '2025-07-11'
-modification_date: '2026-05-13'
+modification_date: '2026-09-08'
 author: Raven Tait, Splunk
 status: production
 type: TTP
-description: This detection identifies when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads.
+description: |-
+    The following analytic detects when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads.
 data_source:
     - VMWare ESXi Syslog
-search: '`esxi_syslog` | rex field=_raw "\s\[(?<user>[^\]]+)\]:\s(?<shell_command>.+)$" | rex field=_raw "Z (?<dest>[\w\.]+)\s.*:\s(?<esxicli_Command>esxcli\s.+)" | eval command=mvappend(esxicli_Command, shell_Command) | where isnotnull(command) | search (command="pkill -9 vmx-*") OR ( command="*esxcli*" AND command="*--format-param*" AND command="*vm process list*" AND command="*awk*" AND command="*esxcli vm process kill*") | stats min(_time) as firstTime max(_time) as lastTime values(_time) as timeStamp values(command) as commands values(user) as user by dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_bulk_vm_termination_filter`'
-how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
-known_false_positives: Limited false positives in most environments, however tune as needed.
+search: |-
+    `esxi_syslog`
+    Message IN (
+        "*pkill -9 *"
+        "*process kill*"
+    )
+    | rex field=_raw "\s\[(?<user>[^\]]+)\]:\s(?<shell_command>.+)$"
+    | rex field=_raw "Z (?<dest>[\w\.]+)\s.*:\s(?<esxicli_Command>esxcli\s.+)"
+    | eval command=mvappend(esxicli_Command, shell_Command)
+    | where isnotnull(command)
+    | search (command="pkill -9 vmx-*")
+             OR
+             (
+                command="*esxcli*"
+                command="*--format-param*"
+                command="*vm process list*"
+                command="*awk*"
+                command="*esxcli vm process kill*"
+            )
+    | stats min(_time) as firstTime
+            max(_time) as lastTime
+            values(_time) as timeStamp
+            values(command) as commands
+
+      by dest user
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `esxi_bulk_vm_termination_filter`
+how_to_implement: |-
+    This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
+known_false_positives: No false positives have been identified at this time.
+references:
+    - https://www.securityweek.com/microsoft-says-ransomware-gangs-exploiting-just-patched-vmware-esxi-flaw/
 drilldown_searches:
     - name: View the detection results for - "$dest$"
       search: '%original_detection_search% | search  dest = "$dest$"'
@@ -22,11 +54,12 @@ drilldown_searches:
       earliest_offset: 7d
       latest_offset: "0"
 finding:
-    title: Bulk VM termination activity on ESXi host $dest$.
+    title: Bulk VM termination activity on ESXi host [$dest$].
     entity:
         field: dest
         type: system
         score: 50
+threat_objects: []
 analytic_story:
     - ESXi Post Compromise
     - Black Basta Ransomware

detections/endpoint/xmrig_driver_loaded.yml → detections/deprecated/xmrig_driver_loaded.yml

@@ -1,10 +1,10 @@
 name: XMRIG Driver Loaded
 id: 90080fa6-a8df-11eb-91e4-acde48001122
-version: 10
+version: 11
 creation_date: '2021-05-07'
-modification_date: '2026-05-13'
+modification_date: '2026-09-08'
 author: Teoderick Contreras, Splunk
-status: production
+status: deprecated
 type: TTP
 description: The following analytic detects the installation of the XMRIG coinminer driver on a system. It identifies the loading of the `WinRing0x64.sys` driver, commonly associated with XMRIG, by analyzing Sysmon EventCode 6 logs for specific signatures and image loads. This activity is significant because XMRIG is an open-source CPU miner frequently exploited by adversaries to mine cryptocurrency illicitly. If confirmed malicious, this activity could lead to unauthorized resource consumption, degraded system performance, and potential financial loss due to unauthorized cryptocurrency mining.
 data_source:
@@ -49,3 +49,9 @@ tests:
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
       test_type: unit
+deprecation_info:
+    reason: Detection deprecated as it is inacurate. WinRing0x64.sys is not related to XMRIG. It is a driver that is used to access the hardware ring0.
+    removed_in_version: 6.10.0
+    replacement_content:
+        - Windows Vulnerable Driver Installed
+        - Windows Vulnerable Driver Loaded

detections/endpoint/windows_unsecured_outlook_credentials_access_in_registry.yml

@@ -1,15 +1,39 @@
 name: Windows Unsecured Outlook Credentials Access In Registry
 id: 36334123-077d-47a2-b70c-6c7b3cc85049
-version: 14
+version: 15
 creation_date: '2024-02-22'
-modification_date: '2026-06-25'
+modification_date: '2026-09-08'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: The following analytic detects unauthorized access to Outlook credentials stored in the Windows registry. It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles. This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts. If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk.
+description: |-
+    The following analytic detects unauthorized access to Outlook credentials stored in the Windows registry.
+    It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles.
+    This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts.
+    If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk.
 data_source:
     - Windows Event Log Security 4663
-search: '`wineventlog_security` EventCode=4663 object_file_path IN ("*\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676*", "*\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676*") AND process_name != *\\outlook.exe | stats count min(_time) as firstTime max(_time) as lastTime by object_file_name object_file_path process_name process_path  process_id EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_unsecured_outlook_credentials_access_in_registry_filter`'
+search: |-
+    `wineventlog_security`
+    EventCode=4663
+    object_file_path IN (
+        "*\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676*",
+        "*\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676*"
+    )
+    NOT process_name IN (
+            "*\\HxOutlook.exe",
+            "*\\Outlook.exe"
+        )
+
+    | stats count min(_time) as firstTime
+                  max(_time) as lastTime
+
+      by EventCode object_file_name object_file_path
+         process_name process_path process_id dest
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `windows_unsecured_outlook_credentials_access_in_registry_filter`
 how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
 known_false_positives: third party software may access this outlook registry.
 references:
@@ -29,7 +53,10 @@ intermediate_findings:
         - field: dest
           type: system
           score: 20
-          message: A suspicious process $process_name$ accessing outlook credentials registry on $dest$
+          message: A suspicious process [$process_name$] accessing outlook credentials registry [$object_file_path$] on [$dest$].
+threat_objects:
+    - field: process_name
+      type: process_name
 analytic_story:
     - StealC Stealer
     - Snake Keylogger

detections/endpoint/windows_unusual_file_creation_in_confluence_directory.yml

@@ -1,13 +1,13 @@
 name: Windows Unusual File Creation in Confluence Directory
 id: aa9d80d9-ed47-44da-aceb-2909ca4dc19e
-version: 2
+version: 3
 creation_date: '2021-09-02'
-modification_date: '2026-05-13'
+modification_date: '2026-09-08'
 author: Raven Tait, Splunk
 status: production
 type: Anomaly
 description: |-
-    Detects executable file formats being created within the Confluence main directory.
+    The following analytic detects executable file formats being created within the Confluence main directory.
     This can be indicative of exploitation of the Confluence web services to stage malware.
     This won't catch adversaries who modify the output location outside the Confluence directory when exploiting.
 data_source:
@@ -32,16 +32,23 @@ search: |-
         "*.vbs"
     )
 
-    by Filesystem.dest Filesystem.file_create_time Filesystem.process_path
+    by Filesystem.dest Filesystem.file_create_time Filesystem.process_path Filesystem.process_name
        Filesystem.process_guid Filesystem.process_id Filesystem.file_path Filesystem.action
        Filesystem.file_name Filesystem.user Filesystem.vendor_product
 
     | `drop_dm_object_name(Filesystem)`
     | `security_content_ctime(firstTime)`
     | `security_content_ctime(lastTime)`
     | `windows_unusual_file_creation_in_confluence_directory_filter`
-how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
-known_false_positives: Some legitimate administrative or development activities may create executable files in the Confluence directory. Review and filter based on approved maintenance processes.
+how_to_implement: |-
+    The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
+known_false_positives: |-
+    Some legitimate administrative or development activities may create executable files in the Confluence directory.
+    Review and filter based on approved maintenance processes.
+references:
+    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-289a
+    - https://confluence.atlassian.com/security/cve-2023-22515-broken-access-control-vulnerability-in-confluence-data-center-and-server-1295682276.html
+    - https://www.rapid7.com/blog/post/2023/10/04/etr-cve-2023-22515-zero-day-privilege-escalation-in-confluence-server-and-data-center/
 drilldown_searches:
     - earliest_offset: $info_min_time$
       latest_offset: $info_max_time$
@@ -56,7 +63,7 @@ intermediate_findings:
         - field: dest
           type: system
           score: 20
-          message: Executable file created under a Confluence path at $file_path$ on $dest$.
+          message: The process [$process_name$] created an executable file under a Confluence path at [$file_path$] on [$dest$].
 threat_objects:
     - field: file_path
       type: file_path

detections/endpoint/windows_vulnerable_driver_installed.yml

@@ -1,8 +1,8 @@
 name: Windows Vulnerable Driver Installed
 id: 1dda7586-57be-4a1b-8de1-a9ad802b9a7f
-version: 10
+version: 11
 creation_date: '2020-01-19'
-modification_date: '2026-05-13'
+modification_date: '2026-09-08'
 author: Dean Luxton
 status: production
 type: TTP
@@ -38,6 +38,9 @@ finding:
         field: dest
         type: system
         score: 50
+threat_objects:
+    - field: ImagePath
+      type: file_path
 analytic_story:
     - Windows Drivers
     - Void Manticore

detections/endpoint/windows_wermgr_alternate_data_stream_in_temp_dir.yml

@@ -1,8 +1,8 @@
 name: Windows Wermgr Alternate Data Stream in Temp Dir
 id: 65222e9b-9d0b-4bfe-8da1-199b98e1d44a
-version: 1
+version: 2
 creation_date: '2026-06-11'
-modification_date: '2026-06-11'
+modification_date: '2026-09-08'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -47,7 +47,10 @@ intermediate_findings:
         - field: dest
           type: system
           score: 20
-          message: A [$process_name$] created a wermgr.exe alternate stream in the temp directory on $dest$ by $user$
+          message: The process [$process_name$] owned by [$user$] created a Wermgr.exe alternate data stream in [$file_path$] on [$dest$]
+threat_objects:
+    - field: file_path
+      type: file_path
 analytic_story:
     - RoguePlanet
 asset_type: Endpoint

detections/network/dns_kerberos_coercion.yml

@@ -1,8 +1,8 @@
 name: DNS Kerberos Coercion
 id: 8551252d-b5b6-4b6e-8a82-51460aeb29a3
-version: 5
+version: 6
 creation_date: '2025-11-18'
-modification_date: '2026-05-13'
+modification_date: '2026-09-08'
 author: Raven Tait, Splunk
 status: production
 type: TTP
@@ -42,6 +42,9 @@ finding:
         field: src
         type: system
         score: 50
+threat_objects:
+    - field: query
+      type: dns_query
 analytic_story:
     - Compromised Windows Host
     - Suspicious DNS Traffic

detections/network/internal_horizontal_port_scan_nmap_top_20.yml

@@ -1,8 +1,8 @@
 name: Internal Horizontal Port Scan NMAP Top 20
 id: 3141a041-4f57-4277-9faa-9305ca1f8e5b
-version: 12
+version: 13
 creation_date: '2024-07-01'
-modification_date: '2026-05-13'
+modification_date: '2026-09-08'
 author: Dean Luxton
 status: production
 type: TTP
@@ -77,6 +77,9 @@ finding:
         field: src_ip
         type: system
         score: 50
+threat_objects:
+    - field: src_ip
+      type: ip_address
 analytic_story:
     - Network Discovery
     - Cisco Secure Firewall Threat Defense Analytics