Loading story…
Red Siege introduces the fundamentals of using Splunk Attack Range to streamline threat detection processes. The article outlines how security teams can leverage this tool to simulate attacks and validate detection capabilities. This approach supports improved incident response and security posture.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security professionals and red teamers are increasingly leveraging open-source intelligence (OSINT) techniques and specialized search engines to uncover sensitive information and map attack surfaces. Guides and cheat-sheets detail how to use Google Dorking, Shodan, FOFA, and other platforms to identify exposed admin panels, misconfigured servers, open directories, and vulnerable systems. These resources emphasize the importance of crafting precise queries, combining results from multiple engines, and understanding the methodologies behind effective reconnaissance. Practical examples and best practices are provided to help both attackers and defenders identify and remediate high-value exposures before adversaries can exploit them. The focus on automation and methodology is evident, with discussions on integrating tools for JavaScript enumeration and using curated dork lists to streamline the discovery process. Defensive recommendations highlight the need for organizations to proactively search for their own exposures and implement controls to prevent unintended data leaks. By mastering these OSINT techniques, security teams can better understand their digital footprint and reduce the risk of compromise from publicly accessible information.
Jul 12, 2026
Splunk has disclosed six critical security vulnerabilities affecting both Splunk Enterprise and Splunk Cloud Platform, exposing organizations to significant risks. The vulnerabilities include multiple cross-site scripting (XSS) flaws, an unauthenticated server-side request forgery (SSRF) vulnerability, and other weaknesses in Splunk’s web components. Two of the most notable XSS vulnerabilities are CVE-2025-20367, a reflected XSS in the /app/search/table endpoint, and CVE-2025-20368, a stored XSS in the Saved Search and Job Inspector features. Both XSS flaws can be exploited by low-privileged users to execute malicious JavaScript in the browsers of other users, potentially compromising user sessions and exposing sensitive data. The SSRF vulnerability, CVE-2025-20371, is particularly severe as it allows unauthenticated attackers to coerce Splunk into making REST API calls on behalf of authenticated high-privilege users, which could lead to further compromise of internal systems. These vulnerabilities affect multiple versions of Splunk Enterprise, specifically those below 10.0.1, 9.4.4, 9.3.6, and 9.2.8, as well as various versions of Splunk Cloud Platform. Successful exploitation of these flaws could allow attackers to gain unauthorized access, escalate privileges, and perform actions on behalf of legitimate users. Splunk has released patches addressing all six vulnerabilities and urges administrators to update their deployments immediately to mitigate the risks. The vulnerabilities highlight the importance of regular security assessments and prompt patch management in enterprise environments. Organizations using affected Splunk versions are advised to review their access logs for signs of exploitation and to apply the security updates without delay. The disclosure underscores the potential impact of web-based vulnerabilities in widely used security and analytics platforms. Security teams should also consider reviewing user permissions and monitoring for unusual activity in Splunk environments. The coordinated disclosure and rapid patching demonstrate the ongoing efforts by vendors and the security community to address critical flaws. These vulnerabilities, if left unpatched, could be leveraged in targeted attacks against organizations relying on Splunk for security monitoring and data analytics. The incident serves as a reminder of the evolving threat landscape and the need for vigilance in securing enterprise software. Splunk’s response includes detailed advisories and guidance for affected customers. The company has not reported any active exploitation in the wild at the time of disclosure, but the technical details provided could accelerate attempts by threat actors to develop exploits. Organizations are encouraged to stay informed about security advisories and to implement layered defenses to reduce the risk of compromise.
Jun 29, 2026
Detection engineering communities have released a series of updates and insights aimed at improving threat detection capabilities across multiple platforms. Notable highlights include the integration of chaos engineering principles into incident response playbooks, the use of AI to generate and translate detection rules, and the expansion of community-driven detection content for PowerShell execution, lateral movement, and service installations. These efforts are designed to help security teams stay ahead of evolving attacker techniques and streamline the process of operationalizing threat intelligence. In parallel, major detection rule repositories such as Sigma, Splunk, and YARA have seen significant activity, with dozens of new and updated rules targeting recent exploits and vulnerabilities. Key updates include new Sigma rules for Commvault RCE and GoAnywhere MFT attacks, Splunk content for Oracle E-Business Suite exploitation, and YARA rules for WSUS RCE and WinRAR path traversal. Cloud detection coverage has also been enhanced, with new rules for AWS and Azure environments, and credential dumping detections have been refined to monitor additional processes and command-line flags. These developments collectively strengthen the detection engineering landscape and provide security teams with actionable tools to address current threats.
Jun 29, 2026