Splunk ES Content Update
Overview
Details
Security Content consists of tactics, techniques, and methodologies that help with detection, investigation, and response. Security Content enables security teams to directly operationalize detection searches, investigative searches, and other supporting details. ESCU can generate Notable Events in Splunk Enterprise Security. Security Content also contains easy-to-read background information and guidance, for key context on motivations and risks associated with attack techniques, as well as pragmatic advice on how to combat those techniques.
For more information please visit the Splunk ES Content Update user documentation.
Release Notes
Version 1.0.49
Enterprise Security Content Updates v 1.0.49 was released on January 27, 2020. It includes the following enhancements:
Updated Analytic Stories:
* Updated "Credential Dumping", "Lateral Movement", "Windows Privilege Escalation","DNS Hijack" and "Disabling Security Tools" analytic stories.
* Added a new detection "Unload Sysmon Filter Driver".
Fixed issues:
* CRL-1715 - Updated "First Time Seen Running Windows Service" detection and "Previously Seen Running Windows Services" support search to use field names provided by Splunk Add-on for Microsoft Windows.
* CRL-1716 - Updated Malicious PowerShell Process With Obfuscation Techniques detection to address a false negative.
* CRL-1719 - Fixed URL reference in "Windows Privilege Escalation" analytic story
Full documentation: https://docs.splunk.com/Documentation/ESSOC/1.0.49