Skip to content

Bump contentctl.yml and build.yml to 6.1.0 #4113

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
patel-bhavin wants to merge 3 commits into
base: develop
Choose a base branch
from
+16 −16
Open

Bump contentctl.yml and build.yml to 6.1.0 #4113

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6f32b55
chore: bump contentctl.yml and build.yml to 6.1.0
Jun 1, 2026
7b88a59
move to removed
patel-bhavin Jun 3, 2026
a51fd18
status is removed
patel-bhavin Jun 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ author: Splunk Threat Research Team
author_email: research@splunk.com
content_prefix: ESCU
label: ES Content Updates
app_version: 6.0.0
app_version: 6.1.0
description: Explore the Analytic Stories included with ES Content Updates.
id: DA-ESS-ContentUpdate
external_app_content:
Expand Down
2 changes: 1 addition & 1 deletion contentctl.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ app:
uid: 3449
title: ES Content Updates
appid: DA-ESS-ContentUpdate
version: 6.0.0
version: 6.1.0
description: Explore the Analytic Stories included with ES Content Updates.
prefix: ESCU
label: ESCU
Expand Down
4 changes: 2 additions & 2 deletions ...to_add_certificate_to_untrusted_store.yml → ...to_add_certificate_to_untrusted_store.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@ name: Attempt To Add Certificate To Untrusted Store
id: 6bc5243e-ef36-45dc-9b12-f4a6be131159
version: 20
creation_date: '2020-04-29'
modification_date: '2026-05-13'
modification_date: '2026-06-03'
author: Patrick Bareiss, Rico Valdez, Splunk
status: deprecated
status: removed
deprecation_info:
reason: Detection is deprecated as the usage of certutil and addstore by itself is not malicious.
removed_in_version: 6.1.0
Expand Down
6 changes: 3 additions & 3 deletions ...ons/deprecated/chcp_command_execution.yml → ...ved/detections/chcp_command_execution.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
name: CHCP Command Execution
id: 21d236ec-eec1-11eb-b23e-acde48001122
version: 13
version: 14
creation_date: '2021-08-05'
modification_date: '2026-05-13'
modification_date: '2026-06-03'
author: Teoderick Contreras, Splunk
status: deprecated
status: removed
deprecation_info:
reason: Detection is deprecated as the usage of chcp.com by itself is not malicious.
removed_in_version: 6.1.0
Expand Down
6 changes: 3 additions & 3 deletions ...d/ivanti_sentry_authentication_bypass.yml → ...s/ivanti_sentry_authentication_bypass.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
name: Ivanti Sentry Authentication Bypass
id: b8e0d1cf-e6a8-4d46-a5ae-aebe18ead8f8
version: 9
version: 10
creation_date: '2023-08-24'
modification_date: '2026-05-13'
modification_date: '2026-06-03'
author: Michael Haag, Splunk
status: deprecated
status: removed
deprecation_info:
reason: Detection is deprecated since it is not specific enough to identify the intended malicious activity and might produce false positives.
removed_in_version: 6.1.0
Expand Down
6 changes: 3 additions & 3 deletions .../deprecated/processes_launching_netsh.yml → .../detections/processes_launching_netsh.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
name: Processes launching netsh
id: b89919ed-fe5f-492c-b139-95dbb162040e
version: 16
version: 17
creation_date: '2020-04-29'
modification_date: '2026-05-13'
modification_date: '2026-06-03'
author: Michael Haag, Josef Kuepker, Splunk
status: deprecated
status: removed
deprecation_info:
reason: Detection is deprecated as the usage of netsh.exe by itself is often used for legitimate purposes.
removed_in_version: 6.1.0
Expand Down
6 changes: 3 additions & 3 deletions .../sc_exe_manipulating_windows_services.yml → .../sc_exe_manipulating_windows_services.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
name: Sc exe Manipulating Windows Services
id: f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d
version: 16
version: 17
creation_date: '2020-04-29'
modification_date: '2026-05-13'
modification_date: '2026-06-03'
author: Rico Valdez, Splunk
status: deprecated
status: removed
deprecation_info:
reason: Detection is deprecated as the usage of sc.exe by itself is often used for legitimate purposes.
removed_in_version: 6.1.0
Expand Down
Loading