crowdstrike-falcon-queries

crowdstrike-falcon-queries A collection of Splunk's Search Processing Language SPL for Threat Hunting with CrowdStrike Falcon Developed and maintained by Intelligent Response team, i-secure co., Ltd. crowdstrike-falcon-queries Execution of Renamed Executables List of Living Off The Land Binaries...

CVE-2022-38691_38692

CVE-2022-38691/38692 persistently boot FDL1/SPL without signature NOTE: first remove sign check of Boot Chain images in FDL1/SPL ​ fdl1 use genfdl1-dl sourcecode ​ spl android 9/10, use genspl-unlock-legacy sourcecode ​ spl android 11+, use genspl-unlock sourcecode ​ windows prebuilt tools can be...

Detection-Rules

APT29 Detection Engineering Production-ready Sigma detection rules developed from analysis of 196,071 Sysmon events in the MITRE ATT&CK Evaluations APT29 dataset. Overview This repository contains validated detection rules for adversary behaviors observed during APT29 simulation. Each rule was...

patch-CVE-2026-28001

Patch: CVE-2026-28001 Vulnerability Details CVE : CVE-2026-28001 Product : Splunk Enterprise Description : Remote code execution in SPL parsing Severity : Critical Patch Status: DEPLOYED Field| Value ---|--- Patch Date| 2026-07-22 Status| deployed Deployed To| Production Validated By| SecOps Team...

CVE-2026-76279

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the runcollect capability could use the collect Search Processing Language SPL command to write events to internal indexes outside the index access configured for the role. The vulnerability is...

EUVD-2026-94631

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the runcollect capability could use the collect Search Processing Language SPL command to write events to internal indexes outside the index access configured for the role. The vulnerability is...

PT-2026-107695

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15 Description An issue exists where a user with the run collect capabili...

PT-2026-85504

Grav before 2.0.19 affected versions = 2.0.17 contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; t...

EUVD-2026-62952

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mcinvestigationread capability could inject Search Processing Language SPL through Analyst Queue search filters, allowing for access to all relevant data and system integrity...

EUVD-2026-62906

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language SPL in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the SPL when that user...

EUVD-2026-62907

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store risky Search Processing Language SPL commands in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the commands when that user...

EUVD-2026-62914

In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into running arbitrary Search Processing Language SPL commands using the permissions of the authenticated user through a crafted Splunk Web link. The SPL commands could access...

EUVD-2026-62904

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject arbitrary Search Processing Language SPL commands through the geostats command. The injected SPL runs with the permissions of another authenticated use...

EUVD-2026-62896

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject Search Processing Language SPL into saved-search dispatch requests. This could allow for unauthorized access to all relevant data and affect system...

EUVD-2026-62894

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick a user who holds the "admin" Splunk role into opening a crafted link to Monitoring Console. When that user opens the link, Splunk Enterprise runs attacker-controlled Search Processing...

EUVD-2026-62897

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Analytics Workspace. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language S...

EUVD-2026-62899

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action containing attacker-controlled Search Processing Language SPL. When another authenticated user selects the action from Event Actions and...

EUVD-2026-62893

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language SPL in a dashboard. When another authenticated user exports the dashboard as a Portable Document Format PDF file, Splunk...

EUVD-2026-63130

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could bypass Search Processing Language SPL safeguards for risky commands through the Job Details dashboard. The injected SPL could run using the permissions of an...

EUVD-2026-63134

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, an unauthenticated user could trick a user who holds the "admin" or "scadmin" Splunk roles into opening a crafted Splunk Web Uniform Resource Locator URL. T...