What's new

New finding-based detections: In Splunk Enterprise Security 8.4 and higher, ESCU introduces finding-based detections, which is a new analytic type that automatically groups and correlates high volumes of related findings and intermediate findings at the entity level. This reduces alert noise and helps analysts quickly focus on users or hosts most likely to represent real threats.

GNU Telnetd CVE-2026-24061 authentication bypass: Introduced a new analytic story covering CVE-2026-24061, a critical authentication bypass vulnerability in GNU InetUtils telnetd that allows unauthenticated attackers to establish a Telnet session as root. This flaw abuses an un-sanitized, attacker-controlled user environment variable that is passed to the login process, enabling direct privilege escalation without valid credentials. Added a new detection called Linux Telnet Authentication Bypass to identify exploitation attempts targeting legacy Unix/Linux systems, embedded devices, network appliances, and operational technology environments where Telnet remains in use.

Windows Chromium browser hijacking enhancements: Expanded browser hijacking coverage with new endpoint detections targeting suspicious Chromium-based browser execution patterns on Windows. Added analytics to identify browsers launched with abnormally small window sizes, disabled popup blocking, disabled logging, suppressed extensions, and headless execution — behaviors commonly associated with ad fraud, credential harvesting, session hijacking, and stealthy user interaction abuse. These detections improve visibility into malicious browser manipulation used by infostealers, loaders, and post-exploitation frameworks.

Expanded threat actor and malware coverage (VoidLink, Storm-0501, StealC): Tagged a broad set of existing analytics and improved detection coverage for several high-impact threats. Added comprehensive coverage for VoidLink, a cloud-native Linux malware framework leveraging a modular C2 architecture, rootkit functionality, and advanced evasion techniques to target containerized and cloud environments. Additionally, enhanced analytic stories and tagging for Storm-0501 ransomware activity and the StealC stealer, improving visibility into ransomware execution chains, credential theft, downloader behavior, and post-compromise persistence across Windows and Linux environments.