Skip to content

Bump to contentctl 1.1.0 to facilitate testing #4224

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
pyth0n1c wants to merge 2 commits into
base: develop
Choose a base branch
from
+3 −3
Draft

Bump to contentctl 1.1.0 to facilitate testing #4224

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
61d4c53
Bump to contentctl 1.1.0 to facilitate testing
pyth0n1c Aug 17, 2026
752f8f2
bump one of the detection files so that unit testing will fire
pyth0n1c Aug 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions detections/endpoint/7zip_commandline_to_smb_share_path.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
name: 7zip CommandLine To SMB Share Path
id: 01d29b48-ff6f-11eb-b81e-acde48001123
version: 10
version: 11
creation_date: '2021-08-17'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of 7z or 7za processes with command lines pointing to SMB network shares. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it may indicate an attempt to archive and exfiltrate sensitive files to a network share, a technique observed in CONTI LEAK tools. If confirmed malicious, this behavior could lead to data exfiltration, compromising sensitive information and potentially aiding further attacks.
description: DO NOT MERGE, THIS DETECTION HAS ONLY BEEN UPDATED FOR THE SAKE OF TESTING THE UNIT TESTING WORKFLOW. The following analytic detects the execution of 7z or 7za processes with command lines pointing to SMB network shares. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it may indicate an attempt to archive and exfiltrate sensitive files to a network share, a technique observed in CONTI LEAK tools. If confirmed malicious, this behavior could lead to data exfiltration, compromising sensitive information and potentially aiding further attacks.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
Expand Down
2 changes: 1 addition & 1 deletion requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
contentctl-ng==1.0.2
contentctl-ng==1.1.0
Loading