[P4T12ICK]

Details

Sigma rules added or modified in splunk/security_content_sigma (PR #56) were converted to ESCU detections with sigmactl convert --target security_content.

• Source: https://github.com/splunk/security_content_sigma/pull/56
• Workflow run: https://github.com/splunk/security_content_sigma/actions/runs/42784321869

Each converted file replaces detections/<same relative path>. Review the diff for fields sigmactl rewrote.

Added Sigma rules

None.

Modified Sigma rules

rules/endpoint/add_defaultuser_and_password_in_registry.yml
rules/endpoint/excessive_attempt_to_disable_services.yml
rules/endpoint/impacket_lateral_movement_smbexec_commandline_parameters.yml
rules/endpoint/web_servers_executing_suspicious_processes.yml

Renamed Sigma rules

None.

Deleted Sigma rules

Matching detections were left in place. Remove them in this pull request if that is intended.

Deleted paths

None.

Checklist

• CI/CD jobs passed
• Validated SPL logic
• Validated tags, description, and how to implement
• Verified references match analytic