Issues

• [BUG]Linux Change File Owner To Root: detection bypass using "chown root: <file>"

  bug
  Bug

  splunk/security_content#4413 · Filter by author thegreatmhn opened on Nov 12, 2026
  4

• 158 endpoint detections are evadable or have logic gaps — most trace to hardcoded process_name instead of the existing process_* macros

  splunk/security_content#4409 · Filter by author Diablo-research opened on Nov 11, 2026

• Detection proposal: VBA Stomping (T1564.007) - EvilClippy execution and vbaProject.bin creation by non-Office process

  splunk/security_content#4405 · Filter by author ali-vrd opened on Nov 10, 2026

• Consider Nizlo indicators in Windows RMM Tool Execution detection

  splunk/security_content#4401 · Filter by author izikipizi opened on Nov 7, 2026

• Improve "Windows AD Privileged Object Access Activity": rename to Privileged Group Enumeration and filter on member/memberOf Properties

  enhancement
  Feature

  splunk/security_content#4400 · Filter by author thegreatmhn opened on Nov 7, 2026

• [BUG] Finding Based Detection - Possible timezone issue in detection_time_range_lookup

  bug
  Bug

  splunk/security_content#4399 · Filter by author ProfessorBrausewein opened on Nov 5, 2026

• Detection proposal: Sysinternals ADExplorer Active Directory snapshots

  enhancement
  Feature

  splunk/security_content#4393 · Filter by author Diablo-research opened on Nov 3, 2026
  3

• Detection proposal: Chromium remote debugging used for cookie theft

  enhancement
  Feature

  splunk/security_content#4389 · Filter by author Diablo-research opened on Nov 2, 2026
  1

• [BUG] Windows DisableAntiSpyware Registry" overlaps with and is weaker than "Disable Defender AntiVirus Registry

  bug
  Bug

  splunk/security_content#4388 · Filter by author thegreatmhn opened on Nov 2, 2026 · v6.11.0
  1

• Detection proposal: dMSA (BadSuccessor) abuse via predecessor link without superseded-account link

  enhancement
  Feature

  splunk/security_content#4384 · Filter by author Diablo-research opened on Nov 1, 2026
  1

• Detection proposal: WinGet Configuration (winget configure) abuse

  enhancement
  Feature

  splunk/security_content#4383 · Filter by author Diablo-research opened on Nov 1, 2026
  1

• Detection proposal: Windows ssh-keygen loading an unsigned PKCS#11 provider DLL

  enhancement
  Feature

  splunk/security_content#4382 · Filter by author Diablo-research opened on Nov 1, 2026
  1

• Splunk Add-on for Sysmon for Linux is archived on Splunkbase

  splunk/security_content#4306 · Filter by author github-actions opened on Oct 1, 2026
  1

  

• feat: Dual-signal SnortML (GID 411) + signature/EVE corroboration analytics for Cisco Secure Firewall

  splunk/security_content#4220 · Filter by author AAH20 opened on Aug 16, 2026
  2

• Suggested Enhancement for Detection: Windows AD Short Lived Domain Account ServicePrincipalName

  enhancement
  Feature

  splunk/security_content#3941 · Filter by author Jannik1228 opened on Mar 6, 2026
  

• Suggested Enhancement for ESCU Detection: Internal Horizontal Port Scan NMAP Top 20

  enhancement
  Feature

  splunk/security_content#3604 · Filter by author thegreatmhn opened on Jul 12, 2025
  3

• [BUG] ESCU CS fields LogonType and TargetUserName

  bug
  Bug

  splunk/security_content#2869 · Filter by author cp-sn opened on Oct 2, 2023
  3