CVE-2026-47301 - #4236
Conversation
Detections for coverage of CVE-2026-47301
onurmerdogan
left a comment
onurmerdogan
left a comment
There was a problem hiding this comment.
Thanks a lot Raven, looks great, just a few suggestions from my side.
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 15511d14c4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | rex field=_raw "TargetSid\">(?<target_sid>[^<]+)" | ||
| | rex field=_raw "NewTargetUserName\">(?<new_name>[^<]+)" | ||
| | rex field=_raw "OldTargetUserName\">(?<old_name>[^<]+)" | ||
| | rex field=_raw "SubjectLogonId\">(?<logon_id>[^<]+)" |
There was a problem hiding this comment.
For 4781 events formatted like the repository's Windows Event Log Security 4781 example, XML attributes use single quotes (for example, <Data Name='TargetSid'>), while all four expressions here require a double quote before >. Consequently the rex commands leave these fields null, and the subsequent where match(target_sid, ...) removes every event. Use the fields already extracted by the Windows TA or make these expressions accept either XML quote style.
Useful? React with 👍 / 👎.
3 participants
Detections for coverage of CVE-2026-47301
Details
New Detections:
Windows Builtin Account Name Change
Windows Suspicious Child Process of smsexec
Windows Suspicious SCCM Adsource DLL
Updated Detections:
Windows CAB File on Disk