- deprecated_name: ASL AWS Excessive Security Scanning deprecated_id: ff2bfdbc-65b7-4434-8f08-d55761d1d446 replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: AWS Cloud Provisioning From Previously Unseen Region deprecated_id: 7971d3df-da82-4648-a6e5-b5637bea5253 replacement_name: Cloud Provisioning Activity From Previously Unseen Region replacement_id: 5aba1860-9617-4af9-b19d-aecac16fe4f2 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: First time seen command line argument deprecated_id: a1b6e73f-98d5-470f-99ac-77aacd578473 replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Windows connhost exe started forcefully deprecated_id: c114aaca-68ee-41c2-ad8c-32bf21db8769 replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Detect Mimikatz Using Loaded Images deprecated_id: 29e307ba-40af-4ab2-91b2-3c6b392bbba0 replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Kubernetes Azure detect sensitive role access deprecated_id: f27349e5-1641-4f6a-9e68-30402be0ad4c replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Web Fraud - Anomalous User Clickspeed deprecated_id: 31337bbb-bc22-4752-b599-ef192df2dc7a replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: EC2 Instance Started With Previously Unseen Instance Type deprecated_id: 65541c80-03c7-4e05-83c8-1dcd57a2e1ad replacement_name: Cloud Compute Instance Created With Previously Unseen Instance Type replacement_id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: EC2 Instance Started With Previously Unseen AMI deprecated_id: 347ec301-601b-48b9-81aa-9ddf9c829dd3 replacement_name: Cloud Compute Instance Created With Previously Unseen Image replacement_id: bc24922d-987c-4645-b288-f8c73ec194c4 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Domain Group Discovery With Net deprecated_id: f2f14ac7-fa81-471a-80d5-7eb65c3c7349 replacement_name: Windows Group Discovery Via Net replacement_id: c5c8e0f3-147a-43da-bf04-4cfaec27dc44 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Kubernetes AWS detect sensitive role access deprecated_id: b6013a7b-85e0-4a45-b051-10b252d69569 replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Winword Spawning Windows Script Host deprecated_id: 637e1b5c-9be1-11eb-9c32-acde48001122 replacement_name: Windows Office Product Spawned Uncommon Process replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: 'The following analytics was deprecated in favour of a more generic approach. Where instead of creating specific analytic for every potentially suspicious child of an office product. We group them by threat level. This would ease management and false positives tuning.' - deprecated_name: Winword Spawning PowerShell deprecated_id: b2c950b8-9be2-11eb-8658-acde48001122 replacement_name: Windows Office Product Spawned Uncommon Process replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Attempted Credential Dump From Registry via Reg exe deprecated_id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911 replacement_name: Windows Sensitive Registry Hive Dump Via CommandLine replacement_id: 8bbb7d58-b360-11eb-ba21-acde48001122 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: This analytic had some overlap with another one, hence the deprecation. It was replaced by 8bbb7d58-b360-11eb-ba21-acde48001122 / Windows Sensitive Registry Hive Dump Via CommandLine - deprecated_name: Detect processes used for System Network Configuration Discovery deprecated_id: a51bfe1a-94f0-48cc-b1e4-16ae10145893 replacement_name: Potential System Network Configuration Discovery Activity replacement_id: 3f0b95e3-3195-46ac-bea3-84fb59e7fac5 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Execution of File With Spaces Before Extension deprecated_id: ab0353e6-a956-420b-b724-a8b4846d5d5a replacement_name: Execution of File with Multiple Extensions replacement_id: b06a555e-dce0-417d-a2eb-28a5d8d66ef7 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Updated to a new detection name - deprecated_name: EC2 Instance Started In Previously Unseen Region deprecated_id: ada0f478-84a8-4641-a3f3-d82362d6fd75 replacement_name: Cloud Compute Instance Created In Previously Unused Region replacement_id: fa4089e2-50e3-40f7-8469-d2cc1564ca59 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Office Document Spawned Child Process To Download deprecated_id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3 replacement_name: Windows Office Product Spawned Child Process For Download replacement_id: f02b64b8-cbea-4f75-bf77-7a05111566b1 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Detect new API calls from user roles deprecated_id: 22773e84-bac0-4595-b086-20d3f335b4f1 replacement_name: Cloud API Calls From Previously Unseen User Roles replacement_id: 2181ad1f-1e73-4d0c-9780-e8880482a08f date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Cmdline Tool Not Executed In CMD Shell deprecated_id: 6c3f7dd8-153c-11ec-ac2d-acde48001122 replacement_name: Windows Cmdline Tool Execution From Non-Shell Process replacement_id: 2afa393f-b88d-41b7-9793-623c93a2dfde date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Linux Auditd Find Private Keys deprecated_id: 80bb9988-190b-4ee0-a3c3-509545a8f678 replacement_name: Linux Auditd Private Keys and Certificate Enumeration replacement_id: 892eb674-3344-4143-8e52-4775b1daf3f1 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Detect AWS API Activities From Unapproved Accounts deprecated_id: ada0f478-84a8-4641-a3f1-d82362d4bd55 replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Monitor DNS For Brand Abuse deprecated_id: 24dd17b1-e2fb-4c31-878c-d4f746595bfa replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Kubernetes GCP detect sensitive object access deprecated_id: bdb6d596-86a0-4aba-8369-418ae8b9963a replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Kubernetes Azure scan fingerprint deprecated_id: c5e5bd5c-1013-4841-8b23-e7b3253c840a replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: ASL AWS Password Policy Changes deprecated_id: 5ade5937-11a2-4363-ba6b-39a3ee8d5b1a replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: O365 Suspicious Admin Email Forwarding deprecated_id: 7f398cfb-918d-41f4-8db8-2e2474e02c28 replacement_name: O365 Mailbox Email Forwarding Enabled replacement_id: 0b6bc75c-05d1-4101-9fc3-97e706168f24 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: AWS Cloud Provisioning From Previously Unseen City deprecated_id: 344a1778-0b25-490c-adb1-de8beddf59cd replacement_name: Cloud Provisioning Activity From Previously Unseen City replacement_id: e7ecc5e0-88df-48b9-91af-51104c68f02f date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Kubernetes AWS detect service accounts forbidden failure access deprecated_id: a6959c57-fa8f-4277-bb86-7c32fba579d5 replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Osquery pack - ColdRoot detection deprecated_id: a6fffe5e-05c3-4c04-badc-887607fbb8dc replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Windows Modify Registry Reg Restore deprecated_id: d0072bd2-6d73-4c1b-bc77-ded6d2da3a4e replacement_name: Windows Registry Entries Restored Via Reg replacement_id: a17af481-e2ad-494c-9da6-afb4d243a019 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Kubernetes GCP detect most active service accounts by pod deprecated_id: 7f5c2779-88a0-4824-9caa-0f606c8f260f replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Scheduled tasks used in BadRabbit ransomware deprecated_id: 1297fb80-f42a-4b4a-9c8b-78c066437cf6 replacement_name: Scheduled Task Deleted Or Created via CMD replacement_id: d5af132c-7c17-439c-9d31-13d55340f36c date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Updated to a new detection name - deprecated_name: Suspicious Rundll32 Rename deprecated_id: 7360137f-abad-473e-8189-acbdaa34d114 replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Remote System Discovery with Net deprecated_id: 9df16706-04a2-41e2-bbfe-9b38b34409d3 replacement_name: Windows Network Share Interaction With Net replacement_id: 4dc3951f-b3f8-4f46-b412-76a483f72277 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: "This analytic was focusing on 2 separate and unrelated type of threats\ \ or actions. It was split into other analytics, namely:\r\n\r\nWindows Network\ \ Share Interaction With Net / 4dc3951f-b3f8-4f46-b412-76a483f72277\r\nWindows\ \ Sensitive Group Discovery With Net / a23a0e20-0b1b-4a07-82e5-ec5f70811e7a" - deprecated_name: Remote System Discovery with Net deprecated_id: 9df16706-04a2-41e2-bbfe-9b38b34409d3 replacement_name: Windows Sensitive Group Discovery With Net replacement_id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: DNS Query Requests Resolved by Unauthorized DNS Servers deprecated_id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f6 replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Suspicious Changes to File Associations deprecated_id: 1b989a0e-0129-4446-a695-f193a5b746fc replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: GCP Detect high risk permissions by resource and account deprecated_id: 2e70ef35-2187-431f-aedc-4503dc9b06ba replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Office Product Writing cab or inf deprecated_id: f48cd1d4-125a-11ec-a447-acde48001122 replacement_name: Windows Office Product Dropped Cab or Inf File replacement_id: dbdd251e-dd45-4ec9-a555-f5e151391746 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Identify New User Accounts deprecated_id: 475b9e27-17e4-46e2-b7e2-648221be3b89 replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Office Product Spawn CMD Process deprecated_id: b8b19420-e892-11eb-9244-acde48001122 replacement_name: Windows Office Product Spawned Uncommon Process replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Windows DLL Search Order Hijacking Hunt deprecated_id: 79c7d0fc-60c7-41be-a616-ccda752efe89 replacement_name: Windows DLL Search Order Hijacking Hunt with Sysmon replacement_id: 79c7d1fc-64c7-91be-a616-ccda752efe81 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: ASL AWS CreateAccessKey deprecated_id: ccb3e4af-23d6-407f-9842-a26212816c9e replacement_name: ASL AWS Create Access Key replacement_id: 81a9f2fe-1697-473c-af1d-086b0d8b63c8 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Okta ThreatInsight Login Failure with High Unknown users deprecated_id: 632663b0-4562-4aad-abe9-9f621a049738 replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Detect Spike in Security Group Activity deprecated_id: ada0f478-84a8-4641-a3f1-e32372d4bd53 replacement_name: Abnormally High Number Of Cloud Security Group API Calls replacement_id: d4dfb7f3-7a37-498a-b5df-f19334e871af date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Office Product Spawning BITSAdmin deprecated_id: e8c591f4-a6d7-11eb-8cf7-acde48001122 replacement_name: Windows Office Product Spawned Uncommon Process replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Create local admin accounts using net exe deprecated_id: b89919ed-fe5f-492c-b139-151bb162040e replacement_name: Windows Create Local Administrator Account Via Net replacement_id: 2c568c34-bb57-4b43-9d75-19c605b98e70 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Abnormally High AWS Instances Terminated by User - MLTK deprecated_id: 1c02b86a-cd85-473e-a50b-014a9ac8fe3e replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Windows Office Product Spawning MSDT deprecated_id: 127eba64-c981-40bf-8589-1830638864a7 replacement_name: Windows Office Product Spawned MSDT replacement_id: a3148fad-3734-4b7f-9a71-62f08d39fab1 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Detect Spike in AWS API Activity deprecated_id: ada0f478-84a8-4641-a3f1-d32362d4bd55 replacement_name: '' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Office Product Spawning Windows Script Host deprecated_id: b3628a5b-8d02-42fa-a891-eebf2351cbe1 replacement_name: Windows Office Product Spawned Uncommon Process replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Prohibited Software On Endpoint deprecated_id: a51bfe1a-94f0-48cc-b4e4-b6ae50145893 replacement_name: Attacker Tools On Endpoint replacement_id: a51bfe1a-94f0-48cc-b4e4-16a110145893 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: AWS Cloud Provisioning From Previously Unseen Country deprecated_id: ceb8d3d8-06cb-49eb-beaf-829526e33ff0 replacement_name: Cloud Provisioning Activity From Previously Unseen Country replacement_id: 94994255-3acf-4213-9b3f-0494df03bb31 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Detect Critical Alerts from Security Tools deprecated_id: 483e8a68-f2f7-45be-8fc9-bf725f0e22fd replacement_name: Microsoft Defender ATP Alerts replacement_id: 38f034ed-1598-46c8-95e8-14edf05fdf5d date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: As discussed internally, this analytic was too generic for an analyst to do anything with it. It was deprecated in favor of the more specific approach provided by analytics such as Microsoft Defender ATP Alerts and Microsoft Defender Incident Alerts. Going forward analytics from leveraging alerts from vendors will have their specific analytics. - deprecated_name: Detect Critical Alerts from Security Tools deprecated_id: 483e8a68-f2f7-45be-8fc9-bf725f0e22fd replacement_name: Microsoft Defender Incident Alerts replacement_id: 13435b55-afd8-46d4-9045-7d5457f430a5 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Excel Spawning PowerShell deprecated_id: 42d40a22-9be3-11eb-8f08-acde48001122 replacement_name: Windows Office Product Spawned Uncommon Process replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Office Application Spawn rundll32 process deprecated_id: 958751e4-9c5f-11eb-b103-acde48001122 replacement_name: Windows Office Product Spawned Uncommon Process replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Excessive Usage Of Net App deprecated_id: 45e52536-ae42-11eb-b5c6-acde48001122 replacement_name: Windows Excessive Usage Of Net App replacement_id: 355ba810-0a20-4215-8485-9ce3f87f2e38 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Elevated Group Discovery With Net deprecated_id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a replacement_name: Windows Sensitive Group Discovery With Net replacement_id: d9eb7cda-5622-4722-bc88-7f2442f4b5af date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Local Account Discovery with Net deprecated_id: 5d0d4830-0133-11ec-bae3-acde48001122 replacement_name: Windows User Discovery Via Net replacement_id: 7742987e-88c1-476b-a626-a869e088ab72 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Windows Command Shell Fetch Env Variables deprecated_id: 048839e4-1eaa-43ff-8a22-86d17f6fcc13 replacement_name: Windows List ENV Variables Via SET Command From Uncommon Parent replacement_id: aec157f4-8783-4584-aca6-754c4dc7fba9 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Suspicious Email - UBA Anomaly deprecated_id: 56e877a6-1455-4479-ad16-0550dc1e33f8 replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Detect web traffic to dynamic domain providers deprecated_id: 134da869-e264-4a8f-8d7e-fcd01c18f301 replacement_name: Detect hosts connecting to dynamic domain providers replacement_id: a1e761ac-1344-4dbd-88b2-3f34c912d359 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Updated to use a different log source - deprecated_name: Okta Failed SSO Attempts deprecated_id: 371a6545-2618-4032-ad84-93386b8698c5 replacement_name: Okta Unauthorized Access to Application replacement_id: 5f661629-9750-4cb9-897c-1f05d6db8727 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Kubernetes AWS detect RBAC authorization by account deprecated_id: de7264ed-3ed9-4fef-bb01-6eefc87cefe8 replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Kubernetes Azure detect service accounts forbidden failure access deprecated_id: 019690d7-420f-4da0-b320-f27b09961514 replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Remote Registry Key modifications deprecated_id: c9f4b923-f8af-4155-b697-1354f5dcbc5e replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: O365 Suspicious User Email Forwarding deprecated_id: f8dfe015-dbb3-4569-ba75-b13787e06aa4 replacement_name: O365 Mailbox Email Forwarding Enabled replacement_id: 0b6bc75c-05d1-4101-9fc3-97e706168f24 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Office Product Spawning MSHTA deprecated_id: 6078fa20-a6d2-11eb-b662-acde48001122 replacement_name: Windows Office Product Spawned Uncommon Process replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Kubernetes AWS detect most active service accounts by pod deprecated_id: 5b30b25d-7d32-42d8-95ca-64dfcd9076e6 replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Correlation by Repository and Risk deprecated_id: 8da9fdd9-6a1b-4ae0-8a34-8c25e6be9687 replacement_name: Risk Rule for Dev Sec Ops by Repository replacement_id: 161bc0ca-4651-4c13-9c27-27770660cf67 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the datamodel - deprecated_name: Kubernetes Azure detect RBAC authorization by account deprecated_id: 47af7d20-0607-4079-97d7-7a29af58b54e replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Clients Connecting to Multiple DNS Servers deprecated_id: 74ec6f18-604b-4202-a567-86b2066be3ce replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Excessive Service Stop Attempt deprecated_id: ae8d3f4a-acd7-11eb-8846-acde48001122 replacement_name: Windows Excessive Service Stop Attempt replacement_id: 8f3a614f-6b98-4f7d-82dd-d0df38452a8b date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Multiple Okta Users With Invalid Credentials From The Same IP deprecated_id: 19cba45f-cad3-4032-8911-0c09e0444552 replacement_name: Okta Multiple Users Failing To Authenticate From Ip replacement_id: de365ffa-42f5-46b5-b43f-fa72290b8218 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Suspicious writes to System Volume Information deprecated_id: cd6297cd-2bdd-4aa1-84aa-5d2f84228fac replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Detect new user AWS Console Login deprecated_id: ada0f478-84a8-4641-a3f3-d82362dffd75 replacement_name: Detect AWS Console Login by New User replacement_id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Domain Account Discovery With Net App deprecated_id: 98f6a534-04c2-11ec-96b2-acde48001122 replacement_name: Windows User Discovery Via Net replacement_id: 5d0d4830-0133-11ec-bae3-acde48001122 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: 'This analytic was a TTP that looked only for commands that tries to query info about the users via net user /do. This had a couple of issues, such as triggering on creation of users via the /add flag etc.. It was deprecated in favor of a more tighter approach in 5d0d4830-0133-11ec-bae3-acde48001122' - deprecated_name: Detection of DNS Tunnels deprecated_id: 104658f4-afdc-499f-9719-17a43f9826f4 replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Detect DNS requests to Phishing Sites leveraging EvilGinx2 deprecated_id: 24dd17b1-e2fb-4c31-878c-d4f226595bfa replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Office Document Creating Schedule Task deprecated_id: cc8b7b74-9d0f-11eb-8342-acde48001122 replacement_name: Windows Office Product Loading Taskschd DLL replacement_id: d7297cfa-1f04-4714-bfbe-3679e0666959 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Okta Account Locked Out deprecated_id: d650c0ae-bdc5-400e-9f0f-f7aa0a010ef1 replacement_name: Okta Multiple Accounts Locked Out replacement_id: a511426e-184f-4de6-8711-cfd2af29d1e1 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Unsuccessful Netbackup backups deprecated_id: a34aae96-ccf8-4aaa-952c-3ea21444444f replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Detect Mimikatz Via PowerShell And EventCode 4703 deprecated_id: 98917be2-bfc8-475a-8618-a9bb06575188 replacement_name: Detect Mimikatz With PowerShell Script Block Logging replacement_id: 8148c29c-c952-11eb-9255-acde48001122 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Updated to a new detection name - deprecated_name: Winword Spawning Cmd deprecated_id: 6fcbaedc-a37b-11eb-956b-acde48001122 replacement_name: Windows Office Product Spawned Uncommon Process replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: GCP Kubernetes cluster scan detection deprecated_id: db5957ec-0144-4c56-b512-9dccbe7a2d26 replacement_name: Kubernetes Scanning by Unauthenticated IP Address replacement_id: f9cadf4e-df22-4f4e-a08f-9d3344c2165d date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Kubernetes GCP detect suspicious kubectl calls deprecated_id: a5bed417-070a-41f2-a1e4-82b6aa281557 replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: gcp detect oauth token abuse deprecated_id: a7e9f7bb-8901-4ad0-8d88-0a4ab07b1972 replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Correlation by User and Risk deprecated_id: 610e12dc-b6fa-4541-825e-4a0b3b6f6773 replacement_name: Risk Rule for Dev Sec Ops by Repository replacement_id: 161bc0ca-4651-4c13-9c27-27770660cf67 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the datamodel - deprecated_name: Processes created by netsh deprecated_id: b89919ed-fe5f-492c-b139-95dbb162041e replacement_name: Processes launching netsh replacement_id: b89919ed-fe5f-492c-b139-95dbb162040e date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Updated to a new detection name - deprecated_name: Office Product Spawning Wmic deprecated_id: ffc236d6-a6c9-11eb-95f1-acde48001122 replacement_name: Windows Office Product Spawned Uncommon Process replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Extraction of Registry Hives deprecated_id: 8bbb7d58-b360-11eb-ba21-acde48001122 replacement_name: Windows Sensitive Registry Hive Dump Via CommandLine replacement_id: 5aaff29d-0cce-405b-9ee8-5d06b49d045e date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Attempt To Stop Security Service deprecated_id: c8e349c6-b97c-486e-8949-bd7bcd1f3910 replacement_name: Windows Attempt To Stop Security Service replacement_id: 9ed27cea-4e27-4eff-b2c6-aac9e78a7517 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Windows MSIExec With Network Connections deprecated_id: 827409a1-5393-4d8d-8da4-bbb297c262a7 replacement_name: Windows HTTP Network Communication From MSIExec replacement_id: b0fd38c7-f71a-43a2-870e-f3ca06bcdd99 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Windows Query Registry Reg Save deprecated_id: cbee60c1-b776-456f-83c2-faa56bdbe6c6 replacement_name: Windows Registry Entries Exported Via Reg replacement_id: 466379bc-0f47-476c-8202-16ef38112e0d date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Cloud Network Access Control List Deleted deprecated_id: 021abc51-1862-41dd-ad43-43c739c0a983 replacement_name: AWS Network Access Control List Deleted replacement_id: ada0f478-84a8-4641-a3f1-d82362d6fd75 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: O365 Suspicious Rights Delegation deprecated_id: b25d2973-303e-47c8-bacd-52b61604c6a7 replacement_name: O365 Elevated Mailbox Permission Assigned replacement_id: 2246c142-a678-45f8-8546-aaed7e0efd30 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Abnormally High AWS Instances Launched by User - MLTK deprecated_id: dec41ad5-d579-42cb-b4c6-f5dbb778bbe5 replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Reg exe used to hide files directories via registry keys deprecated_id: 61a7d1e6-f5d4-41d9-a9be-39a1ffe69459 replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Detect Long DNS TXT Record Response deprecated_id: 05437c07-62f5-452e-afdc-04dd44815bb9 replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Password Policy Discovery with Net deprecated_id: 09336538-065a-11ec-8665-acde48001122 replacement_name: Windows Password Policy Discovery with Net replacement_id: e52f7865-be78-46bf-b7ed-150fbe447613 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: AWS Cloud Provisioning From Previously Unseen IP Address deprecated_id: 42e15012-ac14-4801-94f4-f1acbe64880b replacement_name: Cloud Provisioning Activity From Previously Unseen IP Address replacement_id: f86a8ec9-b042-45eb-92f4-e9ed1d781078 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Network Connection Discovery With Net deprecated_id: 640337e5-6e41-4b7f-af06-9d9eab5e1e2d replacement_name: Windows Network Connection Discovery Via Net replacement_id: 86a5b949-679b-4197-8d4c-9c180a818c45 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Kubernetes Azure detect suspicious kubectl calls deprecated_id: 4b6d1ba8-0000-4cec-87e6-6cbbd71651b5 replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Kubernetes GCP detect sensitive role access deprecated_id: a46923f6-36b9-4806-a681-31f314907c30 replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Detect Webshell Exploit Behavior deprecated_id: 22597426-6dbd-49bd-bcdc-4ec19857192f replacement_name: Windows Suspicious Child Process Spawned From WebServer replacement_id: 2d4470ef-7158-4b47-b68b-1f7f16382156 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: DNS record changed deprecated_id: 44d3a43e-dcd5-49f7-8356-5209bb369065 replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Unsigned Image Loaded by LSASS deprecated_id: 56ef054c-76ef-45f9-af4a-a634695dcd65 replacement_name: '' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Detect USB device insertion deprecated_id: 104658f4-afdc-499f-9719-17a43f9826f5 replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Windows Network Share Interaction With Net deprecated_id: 4dc3951f-b3f8-4f46-b412-76a483f72277 replacement_name: Windows Network Share Interaction Via Net replacement_id: e51fbdb0-0be0-474f-92ea-d289f71a695e date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Account Discovery With Net App deprecated_id: 339805ce-ac30-11eb-b87d-acde48001122 replacement_name: Windows Excessive Usage Of Net App replacement_id: 45e52536-ae42-11eb-b5c6-acde48001122 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: This analytic was a TTP that focused on unrelated things and called account discovery. Since there were other detection that overlapped with it. I choose to deprecate it, and replace it with an updated version of 339805ce-ac30-11eb-b87d-acde48001122 / Windows Excessive Usage Of Net App. - deprecated_name: Change Default File Association deprecated_id: 462d17d8-1f71-11ec-ad07-acde48001122 replacement_name: Windows New Default File Association Value Set replacement_id: 7d1f031f-f1c9-43be-8b0b-c4e3e8a8928a date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Windows Lateral Tool Transfer RemCom deprecated_id: e373a840-5bdc-47ef-b2fd-9cc7aaf387f0 replacement_name: Windows Service Execution RemCom replacement_id: 7e3d68db-ea4d-419b-adbd-e14a525ecf09 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Updated to a new detection name - deprecated_name: Office Document Executing Macro Code deprecated_id: b12c89bc-9d06-11eb-a592-acde48001122 replacement_name: Windows Office Product Loading VBE7 DLL replacement_id: 7cfec906-2697-43f7-898b-83634a051d9a date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Okta Account Lockout Events deprecated_id: 62b70968-a0a5-4724-8ac4-67871e6f544d replacement_name: Okta Multiple Accounts Locked Out replacement_id: a511426e-184f-4de6-8711-cfd2af29d1e1 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Abnormally High AWS Instances Launched by User deprecated_id: 2a9b80d3-6340-4345-b5ad-290bf5d0dac4 replacement_name: Abnormally High Number Of Cloud Instances Launched replacement_id: f2361e9f-3928-496c-a556-120cd4223a65 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: EC2 Instance Modified With Previously Unseen User deprecated_id: 56f91724-cf3f-4666-84e1-e3712fb41e76 replacement_name: Cloud API Calls From Previously Unseen User Roles replacement_id: 2181ad1f-1e73-4d0c-9780-e8880482a08f date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Windows Valid Account With Never Expires Password deprecated_id: 73a931db-1830-48b3-8296-cd9cfa09c3c8 replacement_name: Windows Set Account Password Policy To Unlimited Via Net replacement_id: 11f93009-8083-43fd-82a7-821fcbdc8342 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Windows hosts file modification deprecated_id: 06a6fc63-a72d-41dc-8736-7e3dd9612116 replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: MSHTML Module Load in Office Product deprecated_id: 5f1c168e-118b-11ec-84ff-acde48001122 replacement_name: Windows Office Product Loaded MSHTML Module replacement_id: 4cc015c9-687c-40d2-adcc-46350f66e10c date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Abnormally High AWS Instances Terminated by User deprecated_id: 8d301246-fccf-45e2-a8e7-3655fd14379c replacement_name: Abnormally High Number Of Cloud Instances Destroyed replacement_id: ef629fc9-1583-4590-b62a-f2247fbf7bbf date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Web Fraud - Account Harvesting deprecated_id: bf1d7b5c-df2f-4249-a401-c09fdc221ddf replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Office Spawning Control deprecated_id: 053e027c-10c7-11ec-8437-acde48001122 replacement_name: Windows Office Product Spawned Control replacement_id: 081c485d-ac8d-4bee-ad4c-525772fead4d date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Detect Activity Related to Pass the Hash Attacks deprecated_id: f5939373-8054-40ad-8c64-cec478a22a4b replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Deleting Of Net Users deprecated_id: 1c8c6f66-acce-11eb-aafb-acde48001122 replacement_name: Windows User Deletion Via Net replacement_id: b0b6fd2c-8953-4d1b-8f7b-56075ea6ab3e date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Suspicious File Write deprecated_id: 57f76b8a-32f0-42ed-b358-d9fa3ca7bac8 replacement_name: '' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: AWS EKS Kubernetes cluster sensitive object access deprecated_id: 7f227943-2196-4d4d-8d6a-ac8cb308e61c replacement_name: Kubernetes Abuse of Secret by Unusual Location replacement_id: 40a064c1-4ec1-4381-9e35-61192ba8ef82 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Spectre and Meltdown Vulnerable Systems deprecated_id: 354be8e0-32cd-4da0-8c47-796de13b60ea replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: EC2 Instance Started With Previously Unseen User deprecated_id: 22773e84-bac0-4595-b086-20d3f735b4f1 replacement_name: Cloud Compute Instance Created By Previously Unseen User replacement_id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Office Product Spawning CertUtil deprecated_id: 6925fe72-a6d5-11eb-9e17-acde48001122 replacement_name: Windows Office Product Spawned Uncommon Process replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Kubernetes GCP detect RBAC authorizations by account deprecated_id: 99487de3-7192-4b41-939d-fbe9acfb1340 replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Office Application Drop Executable deprecated_id: 73ce70c4-146d-11ec-9184-acde48001122 replacement_name: Windows Office Product Dropped Uncommon File replacement_id: 7ac0fced-9eae-4381-a748-90dcd1aa9393 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Kubernetes Azure active service accounts by pod namespace deprecated_id: 55a2264a-b7f0-45e5-addd-1e5ab3415c72 replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Kubernetes Azure pod scan fingerprint deprecated_id: 86aad3e0-732f-4f66-bbbc-70df448e461d replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Detect Spike in Network ACL Activity deprecated_id: ada0f478-84a8-4641-a1f1-e32372d4bd53 replacement_name: Abnormally High Number Of Cloud Infrastructure API Calls replacement_id: 0840ddf1-8c89-46ff-b730-c8d6722478c0 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Suspicious Powershell Command-Line Arguments deprecated_id: 2cdb91d2-542c-497f-b252-be495e71f38c replacement_name: Malicious PowerShell Process - Encoded Command replacement_id: c4db14d9-7909-48b4-a054-aa14d89dbb19 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Office Application Spawn Regsvr32 process deprecated_id: 2d9fc90c-f11f-11eb-9300-acde48001122 replacement_name: Windows Office Product Spawned Uncommon Process replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Detect API activity from users without MFA deprecated_id: 4d46e8bd-4072-48e4-92db-0325889ef894 replacement_name: AWS Successful Single-Factor Authentication replacement_id: a520b1fe-cc9e-4f56-b762-18354594c52f date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Kubernetes Azure detect sensitive object access deprecated_id: 1bba382b-07fd-4ffa-b390-8002739b76e8 replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Web Fraud - Password Sharing Across Accounts deprecated_id: 31337a1a-53b9-4e05-96e9-55c934cb71d3 replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Disabling Net User Account deprecated_id: c0325326-acd6-11eb-98c2-acde48001122 replacement_name: Windows User Disabled Via Net replacement_id: b0359e05-c87b-4354-83d8-aee0d890243f date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: GCP Detect accounts with high risk roles by project deprecated_id: 27af8c15-38b0-4408-b339-920170724adb replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Kubernetes GCP detect service accounts forbidden failure access deprecated_id: 7094808d-432a-48e7-bb3c-77e96c894f3b replacement_name: '- ' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Extended Period Without Successful Netbackup Backups deprecated_id: a34aae96-ccf8-4aef-952c-3ea214444440 replacement_name: '-' replacement_id: '' date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Office Product Spawning Rundll32 with no DLL deprecated_id: c661f6be-a38c-11eb-be57-acde48001122 replacement_name: Windows Office Product Spawned Rundll32 With No DLL replacement_id: f28e787e-69ca-480e-9f98-ab970e6d4bcc date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Renamed and updated logic - deprecated_name: Okta ThreatInsight Suspected PasswordSpray Attack deprecated_id: 25dbad05-6682-4dd5-9ce9-8adecf0d9ae2 replacement_name: Okta ThreatInsight Threat Detected replacement_id: 140504ae-5fe2-4d65-b2bc-a211813fbca6 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update - deprecated_name: Net Localgroup Discovery deprecated_id: 54f5201e-155b-11ec-a6e2-acde48001122 replacement_name: Windows Group Discovery Via Net replacement_id: c5c8e0f3-147a-43da-bf04-4cfaec27dc44 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Both of these analytics were deprecated in favor of c5c8e0f3-147a-43da-bf04-4cfaec27dc44 / Windows Group Discovery Via Net - deprecated_name: Uncommon Processes On Endpoint deprecated_id: 29ccce64-a10c-4389-a45f-337cb29ba1f7 replacement_name: Attacker Tools On Endpoint replacement_id: a51bfe1a-94f0-48cc-b4e4-16a110145893 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: '' - deprecated_name: Dump LSASS via procdump Rename deprecated_id: 21276daa-663d-11eb-ae93-0242ac130002 replacement_name: Dump LSASS via procdump replacement_id: 3742ebfe-64c2-11eb-ae93-0242ac130002 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Updated to a new detection name - deprecated_name: Okta Two or More Rejected Okta Pushes deprecated_id: d93f785e-4c2c-4262-b8c7-12b77a13fd39 replacement_name: Okta Multiple Failed MFA Requests For User replacement_id: 826dbaae-a1e6-4c8c-b384-d16898956e73 date: '2025-01-28' escu_version: 5.0.0 migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics reason: Detections updated to use the new search logic and field names due to the TA update