Sync Sigma detections from security_content_sigma PR #38

[P4T12ICK]

Details

Sigma rules added or modified in splunk/security_content_sigma (PR #38) were converted to ESCU detections with sigmaspl convert --output-format security_content.

• Source: https://github.com/splunk/security_content_sigma/pull/38
• Workflow run: https://github.com/splunk/security_content_sigma/actions/runs/37602892322

Each converted file replaces detections/<same relative path>. Review the diff for fields sigmaspl rewrote.

Added Sigma rules

None.

Modified Sigma rules

rules/endpoint/bitsadmin_download_file.yml

Renamed Sigma rules

None.

Deleted Sigma rules

Matching detections were left in place. Remove them in this pull request if that is intended.

Deleted paths

None.

Checklist

• CI/CD jobs passed
• Validated SPL logic
• Validated tags, description, and how to implement
• Verified references match analytic