Splunk ESCU 6.6.0 adds 12 behavioral analytics and updates 18
ESCU 6.6.0 was released on 2026-09-10 with 12 new behavioral analytics and 18 updated ones, across Linux, macOS and Windows. The new detections cover browser-launched shell execution, LOLBAS network activity, Linux crontab enumeration, macOS AppleScript prompts and Socat listeners (Splunk release notes, read 2026-11-03).
ESCU is the content Splunk ships separately from Enterprise Security and builds with contentctl. A numbered release is something a team can pin, diff and test before it goes live, which is the version discipline this site scores under rule versioning.
Source: help.splunk.com read 2026-11-04
What it changes for a buyer
A Splunk team should review the 18 updated analytics against the rules it has tuned, because an update can overwrite a local change.
All notes are in the changelog. Spotted something wrong? See corrections.