What's new
-
ESCU version 6.10.0 was released on November 4, 2026.
Key highlights
ESCU version 6.10.0
ESCU v6.10.0 delivers expanded PHP2Shell and Node2Shell coverage for web-application exploitation, new Linux auditd analytics, Azure AD identity-abuse detections, new Windows execution and persistence coverage, and refinements to existing C2, tunneling, and remote-management analytics. By connecting suspicious web requests to related server crashes, process changes, and spawned shells, these detections help security teams assess whether an exploit attempt may have progressed to code execution and prioritize the applications and hosts that need investigation. The Azure AD, Linux, and Windows additions give investigators more ways to uncover unauthorized access, attacker tooling, and persistence beyond the initial alert. Improvements to C2, tunneling, and remote-management analytics can reduce false leads, helping analysts focus on activity backed by stronger evidence. For detection engineers tracking newly disclosed threats, enabling the relevant ESCU analytics provides a practical way to look for related activity as soon as the required telemetry is available, without building every search from scratch.Here's a summary of the latest updates:
-
PHP2Shell Detection Coverage Expansion (CVE-2026-109618, CVE-2026-109619): Expanded the PHP2Shell analytic story with new Linux auditd analytics for inline PHP code execution and web or application servers spawning shells. A new analytic correlates Apache segmentation-fault errors with multipart POST requests handled by the same worker process. This links crafted-request crashes to the requests that caused them. Refinements to the PHP memory exhaustion and serialized PHP upload-filename analytics improve entity mapping and accuracy. Together they connect request-level exploitation attempts to the crashes and shell activity that can follow.
-
Node2Shell Detection Coverage (CVE-2026-111497): Introduced a new analytic story for Node2Shell, an out-of-bounds write in the Node.js Brotli decoder. New auditd analytics identify Linux processes that change their image under the same PID and bursts of service crashes and restarts. The updated large HTTP POST analytic now also surfaces requests that trigger server errors. Together these give defenders web and endpoint signals to investigate suspected exploitation and command execution.
-
Linux Auditd Behavioral Coverage: Added new analytics for raw socket creation from user-writable paths and compiled C source written to temporary directories. These improve visibility into post-exploitation tooling and staging on Linux hosts.
-
Azure AD Identity Abuse Coverage: Added new analytics for federated identity credentials added to service principals, guest users changed to members, suspicious device registrations, and Temporary Access Pass creation. These help defenders spot persistence and unauthorized access paths in Azure AD tenants.
-
Windows Execution and Persistence Detections: Introduced detections for scheduled task XML built through console echo commands, user-profile binaries terminating processes via taskkill, and Chromium sessions restored with the crash bubble suppressed. These improve visibility into defense evasion, persistence, and suspicious execution on Windows endpoints.
-
Refined Analytics for Fidelity and Coverage: Updated existing analytics for HTTP C2 user agents, React and Next.js child processes, ngrok reverse proxy usage (fixing a duplicate pattern), non-shell command-line tool execution, and Windows Remote Management spawned processes. The changes improve detection fidelity and broaden coverage of web exploitation, tunneling, and remote execution activity.
New analytic stories
New analytics
Updated analytics
Other updates
-
A special thanks to @descambiado, @mvanhorn, @jakeenea51 and @thegreatmhn from the Security Content community for their contributions to this release, helping improve the quality and reliability of ESCU content.
-
Fields and example logs were updated for 188 different data sources.
List of detections removed or scheduled for removal
Following is a list of detections removed from ESCU version 6.10.0:
| Detection | Reason for deprecation | Replacement detection |
|---|---|---|
| Deprecated because the broad parent-child logic generated substantial legitimate printer, driver, and print-management activity and did not directly detect the exploitation behavior associated with its CVE reference. | ||
| Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. | ||
| Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons. | ||
| Detection deprecated due to duplicated content already covered by other detections. | ||
| This experimental rule is being deprecated while we enhance Ollama availability detection. Application errors alone do not confirm a service outage, so we are improving the evidence needed to identify service interruptions reliably. | ||
| Detection deprecated due to having a duplicated content with another detection. Renaming of all command interpreter binaries are covered in a single detection instead of having their separate searches, for performance related reasons. | ||
| Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons. | ||
| Detection deprecated due to having a duplicated content with another detection. Renaming of all popular 3rd party software binaries are covered in a single detection instead of having their separate searches, for performance related reasons. | ||
| This rule uses only Sysmon EventID 20, which records creation of a WMI event consumer but does not confirm that a filter is bound to it. The Sysmon permanent subscription detection covers the binding with EventID 21. | ||
| Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. | ||
| Detection deprecated as it is targeting a method of persistence that has been disabled in MacOS for years. As well, as the fact that the detection has been set to experimental since 2020. | None | |
| Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. | ||
| Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. | ||
| This rule is deprecated in its current form because EventID 5860 identifies temporary subscriptions rather than permanent persistence, and the broad match with exact query-string exceptions does not reliably distinguish malicious use from legitimate software. | ||
| Detection deprecated due to renaming of its newer version. | ||
| Detection deprecated as it is already covered by the" Windows Process Injection into Commonly Abused Processes" detection. | ||
| Detection deprecated due to having a duplicated content with another detection. Renaming of all LOLBAS binaries are covered in a single detection instead of having their separate searches, for performance related reasons. | ||
| Detection deprecated due to having a duplicated content with another detection. Renaming of all command interpreter binaries are covered in a single detection instead of having their separate searches, for performance related reasons. | ||
| Detection deprecated as it is inaccurate. WinRing0x64.sys is not related to XMRIG. It is a driver that is used to access the hardware ring0. | , |
Following is a list of detections scheduled for removal from ESCU version 6.12.0:
| Deprecated Detection | Reason for deprecation | Replacement detection |
|---|---|---|
| Detection deprecated because the Technology Add-on it uses has been archived, and no replacement TA exists. | ||
| Detection deprecated because the Technology Add-on it uses has been archived, and no replacement TA exists. | ||
| Detection deprecated as it is determined to be very noisy in a production environment. | ||
| Detection deprecated due to duplicated content already covered by other detections. | ||
| This experimental rule is being deprecated while we enhance Ollama availability detection. Application errors alone do not confirm a service outage, so we are improving the evidence needed to identify service interruptions reliably. | ||
| This experimental rule is being deprecated while we enhance Ollama exfiltration detection. Access requests and response timing alone do not show what data was returned or transferred, so stronger evidence and correlation are needed. | ||
| This experimental rule is being deprecated while we enhance Ollama model-loading detection. Model-loading errors alone do not confirm code execution, so the detection needs stronger evidence of execution. | ||
| This experimental rule is being deprecated while we enhance Ollama prompt-injection detection. Long response times do not reveal prompt content or show that safeguards were bypassed, so they are not enough to identify these attacks reliably. | ||
| Detection deprecated due to duplicated content already covered by other detections. | ||
| Detection deprecated because its parent and child process selection is covered by the expanded Windows Remote Management Execute Shell detection. The non shell processes were not transferred to the new detection due to scope considerations, and the fact that this detection was experimental, so any claims made by it were not validated via testing. | ||
| Detection deprecated due to duplicated content already covered by other detections. |
Third party copyright credits
Some of the components included in Splunk Security Content are licensed under free or open source licenses. We wish to thank the contributors to those projects.
A complete listing of third-party software information for Splunk Security Content is available as a PDF file for download: Splunk Security Content third-party software credits.