Splunk Security Content for Threat Detection & Response: July Recap

In July, the Splunk Threat Research Team (STRT) had 2 releases of new security content via the Enterprise Security Content Update (ESCU) app (v6.2.0 and v6.3.0.) With this release, there are 3 analytic stories and 14 new analytics now available in Splunk Enterprise Security via the ESCU application update process.

• Starland RAT Campaign (UAT-11795): Expanded detection coverage for the Starland RAT campaign attributed to UAT-11795, a financially motivated threat actor leveraging ClickFix social engineering and trojanized installers to deploy Starland RAT, the WLDR Agent PowerShell memory implant, and supporting malware including CastleStealer and Remcos RAT.

• Linux Exploitation Detection Expansion: Expanded Linux detection coverage with new analytics focused on local privilege escalation, defense evasion, and kernel-level exploitation techniques, improving visibility into attempts to bypass security controls, abuse elevated execution paths, and exploit low-level system components commonly targeted by advanced adversaries.

• Linux Dirty Frag Kernel Privilege Escalation: (CVE-2026-43284 & CVE-2026-43500): New detection for the Dirty Frag Linux kernel privilege escalation vulnerabilities, identifying the exploit's characteristic high-frequency splice() syscall activity followed by execution of a setuid binary within the same audit session. This analytic provides early visibility into attempts to corrupt the kernel page cache and escalate privileges to root through abuse of the IPsec ESP or RxRPC subsystems.

• Phantom Stealer: Expanded detection coverage for the Windows information stealer that targets browser credentials, FTP/SSH clients, cryptocurrency wallets, and other sensitive application data. This release adds a new detection for unauthorized access to WinSCP security configuration folders while tagging and enhancing existing analytics covering browser credential theft, PowerShell abuse, process injection, persistence, suspicious browser behavior, and data exfiltration, improving visibility into credential harvesting and post-compromise activity commonly associated with modern infostealers.

• Sysmon Event ID 8 Detection Improvements: Refined detection coverage built on Sysmon Event ID 8 (CreateRemoteThread) by aligning the data source with native Sysmon field mappings, updating analytics to use the correct raw field names, and reducing false positives through rule consolidation and deprecation of noisy content. This release also introduces a new detection — Windows Uncommon Remote Thread Creation in Browser Process — strengthening visibility into process injection techniques while improving the accuracy and maintainability of existing CreateRemoteThread analytics.

• AWS Bedrock Claude AI Security Analytics: A new analytic story for AWS Bedrock Claude focused on detecting prompt injection, jailbreak attempts, and suspicious AI interactions targeting enterprise generative AI workloads. This release adds analytics to identify cross-region inference abuse, excessive token consumption, high-risk filesystem and execution tool invocation, hostile prompt sentiment, prompt injection attempts, sensitive data exposure in prompts, and unusually large prompt submissions, providing security teams with visibility into attempts to bypass AI safety controls, manipulate model behavior, or misuse Claude-powered applications.