admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
deprecated_mapping
splunk-security_content/deprecated/deprecated_detection_mapping.yml
T
research-bot f2247bc251 adding a file
2025-01-28 10:42:27 -08:00

1261 lines
58 KiB
YAML
Raw Permalink Blame History

- deprecated_name: ASL AWS Excessive Security Scanning
deprecated_id: ff2bfdbc-65b7-4434-8f08-d55761d1d446
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: AWS Cloud Provisioning From Previously Unseen Region
deprecated_id: 7971d3df-da82-4648-a6e5-b5637bea5253
replacement_name: Cloud Provisioning Activity From Previously Unseen Region
replacement_id: 5aba1860-9617-4af9-b19d-aecac16fe4f2
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: First time seen command line argument
deprecated_id: a1b6e73f-98d5-470f-99ac-77aacd578473
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Windows connhost exe started forcefully
deprecated_id: c114aaca-68ee-41c2-ad8c-32bf21db8769
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Detect Mimikatz Using Loaded Images
deprecated_id: 29e307ba-40af-4ab2-91b2-3c6b392bbba0
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Kubernetes Azure detect sensitive role access
deprecated_id: f27349e5-1641-4f6a-9e68-30402be0ad4c
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Web Fraud - Anomalous User Clickspeed
deprecated_id: 31337bbb-bc22-4752-b599-ef192df2dc7a
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: EC2 Instance Started With Previously Unseen Instance Type
deprecated_id: 65541c80-03c7-4e05-83c8-1dcd57a2e1ad
replacement_name: Cloud Compute Instance Created With Previously Unseen Instance
Type
replacement_id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: EC2 Instance Started With Previously Unseen AMI
deprecated_id: 347ec301-601b-48b9-81aa-9ddf9c829dd3
replacement_name: Cloud Compute Instance Created With Previously Unseen Image
replacement_id: bc24922d-987c-4645-b288-f8c73ec194c4
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Domain Group Discovery With Net
deprecated_id: f2f14ac7-fa81-471a-80d5-7eb65c3c7349
replacement_name: Windows Group Discovery Via Net
replacement_id: c5c8e0f3-147a-43da-bf04-4cfaec27dc44
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Kubernetes AWS detect sensitive role access
deprecated_id: b6013a7b-85e0-4a45-b051-10b252d69569
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Winword Spawning Windows Script Host
deprecated_id: 637e1b5c-9be1-11eb-9c32-acde48001122
replacement_name: Windows Office Product Spawned Uncommon Process
replacement_id: 55d8741c-fa32-4692-8109-410304961eb8
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: 'The following analytics was deprecated in favour of a more generic approach.
Where instead of creating specific analytic for every potentially suspicious child
of an office product. We group them by threat level.
This would ease management and false positives tuning.'
- deprecated_name: Winword Spawning PowerShell
deprecated_id: b2c950b8-9be2-11eb-8658-acde48001122
replacement_name: Windows Office Product Spawned Uncommon Process
replacement_id: 55d8741c-fa32-4692-8109-410304961eb8
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Attempted Credential Dump From Registry via Reg exe
deprecated_id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911
replacement_name: Windows Sensitive Registry Hive Dump Via CommandLine
replacement_id: 8bbb7d58-b360-11eb-ba21-acde48001122
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: This analytic had some overlap with another one, hence the deprecation.
It was replaced by 8bbb7d58-b360-11eb-ba21-acde48001122 / Windows Sensitive Registry
Hive Dump Via CommandLine
- deprecated_name: Detect processes used for System Network Configuration Discovery
deprecated_id: a51bfe1a-94f0-48cc-b1e4-16ae10145893
replacement_name: Potential System Network Configuration Discovery Activity
replacement_id: 3f0b95e3-3195-46ac-bea3-84fb59e7fac5
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Execution of File With Spaces Before Extension
deprecated_id: ab0353e6-a956-420b-b724-a8b4846d5d5a
replacement_name: Execution of File with Multiple Extensions
replacement_id: b06a555e-dce0-417d-a2eb-28a5d8d66ef7
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Updated to a new detection name
- deprecated_name: EC2 Instance Started In Previously Unseen Region
deprecated_id: ada0f478-84a8-4641-a3f3-d82362d6fd75
replacement_name: Cloud Compute Instance Created In Previously Unused Region
replacement_id: fa4089e2-50e3-40f7-8469-d2cc1564ca59
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Office Document Spawned Child Process To Download
deprecated_id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3
replacement_name: Windows Office Product Spawned Child Process For Download
replacement_id: f02b64b8-cbea-4f75-bf77-7a05111566b1
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Detect new API calls from user roles
deprecated_id: 22773e84-bac0-4595-b086-20d3f335b4f1
replacement_name: Cloud API Calls From Previously Unseen User Roles
replacement_id: 2181ad1f-1e73-4d0c-9780-e8880482a08f
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Cmdline Tool Not Executed In CMD Shell
deprecated_id: 6c3f7dd8-153c-11ec-ac2d-acde48001122
replacement_name: Windows Cmdline Tool Execution From Non-Shell Process
replacement_id: 2afa393f-b88d-41b7-9793-623c93a2dfde
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Linux Auditd Find Private Keys
deprecated_id: 80bb9988-190b-4ee0-a3c3-509545a8f678
replacement_name: Linux Auditd Private Keys and Certificate Enumeration
replacement_id: 892eb674-3344-4143-8e52-4775b1daf3f1
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Detect AWS API Activities From Unapproved Accounts
deprecated_id: ada0f478-84a8-4641-a3f1-d82362d4bd55
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Monitor DNS For Brand Abuse
deprecated_id: 24dd17b1-e2fb-4c31-878c-d4f746595bfa
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Kubernetes GCP detect sensitive object access
deprecated_id: bdb6d596-86a0-4aba-8369-418ae8b9963a
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Kubernetes Azure scan fingerprint
deprecated_id: c5e5bd5c-1013-4841-8b23-e7b3253c840a
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: ASL AWS Password Policy Changes
deprecated_id: 5ade5937-11a2-4363-ba6b-39a3ee8d5b1a
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: O365 Suspicious Admin Email Forwarding
deprecated_id: 7f398cfb-918d-41f4-8db8-2e2474e02c28
replacement_name: O365 Mailbox Email Forwarding Enabled
replacement_id: 0b6bc75c-05d1-4101-9fc3-97e706168f24
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: AWS Cloud Provisioning From Previously Unseen City
deprecated_id: 344a1778-0b25-490c-adb1-de8beddf59cd
replacement_name: Cloud Provisioning Activity From Previously Unseen City
replacement_id: e7ecc5e0-88df-48b9-91af-51104c68f02f
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Kubernetes AWS detect service accounts forbidden failure access
deprecated_id: a6959c57-fa8f-4277-bb86-7c32fba579d5
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Osquery pack - ColdRoot detection
deprecated_id: a6fffe5e-05c3-4c04-badc-887607fbb8dc
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Windows Modify Registry Reg Restore
deprecated_id: d0072bd2-6d73-4c1b-bc77-ded6d2da3a4e
replacement_name: Windows Registry Entries Restored Via Reg
replacement_id: a17af481-e2ad-494c-9da6-afb4d243a019
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Kubernetes GCP detect most active service accounts by pod
deprecated_id: 7f5c2779-88a0-4824-9caa-0f606c8f260f
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Scheduled tasks used in BadRabbit ransomware
deprecated_id: 1297fb80-f42a-4b4a-9c8b-78c066437cf6
replacement_name: Scheduled Task Deleted Or Created via CMD
replacement_id: d5af132c-7c17-439c-9d31-13d55340f36c
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Updated to a new detection name
- deprecated_name: Suspicious Rundll32 Rename
deprecated_id: 7360137f-abad-473e-8189-acbdaa34d114
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Remote System Discovery with Net
deprecated_id: 9df16706-04a2-41e2-bbfe-9b38b34409d3
replacement_name: Windows Network Share Interaction With Net
replacement_id: 4dc3951f-b3f8-4f46-b412-76a483f72277
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: "This analytic was focusing on 2 separate and unrelated type of threats\
\ or actions. It was split into other analytics, namely:\r\n\r\nWindows Network\
\ Share Interaction With Net / 4dc3951f-b3f8-4f46-b412-76a483f72277\r\nWindows\
\ Sensitive Group Discovery With Net / a23a0e20-0b1b-4a07-82e5-ec5f70811e7a"
- deprecated_name: Remote System Discovery with Net
deprecated_id: 9df16706-04a2-41e2-bbfe-9b38b34409d3
replacement_name: Windows Sensitive Group Discovery With Net
replacement_id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: DNS Query Requests Resolved by Unauthorized DNS Servers
deprecated_id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f6
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Suspicious Changes to File Associations
deprecated_id: 1b989a0e-0129-4446-a695-f193a5b746fc
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: GCP Detect high risk permissions by resource and account
deprecated_id: 2e70ef35-2187-431f-aedc-4503dc9b06ba
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Office Product Writing cab or inf
deprecated_id: f48cd1d4-125a-11ec-a447-acde48001122
replacement_name: Windows Office Product Dropped Cab or Inf File
replacement_id: dbdd251e-dd45-4ec9-a555-f5e151391746
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Identify New User Accounts
deprecated_id: 475b9e27-17e4-46e2-b7e2-648221be3b89
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Office Product Spawn CMD Process
deprecated_id: b8b19420-e892-11eb-9244-acde48001122
replacement_name: Windows Office Product Spawned Uncommon Process
replacement_id: 55d8741c-fa32-4692-8109-410304961eb8
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Windows DLL Search Order Hijacking Hunt
deprecated_id: 79c7d0fc-60c7-41be-a616-ccda752efe89
replacement_name: Windows DLL Search Order Hijacking Hunt with Sysmon
replacement_id: 79c7d1fc-64c7-91be-a616-ccda752efe81
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: ASL AWS CreateAccessKey
deprecated_id: ccb3e4af-23d6-407f-9842-a26212816c9e
replacement_name: ASL AWS Create Access Key
replacement_id: 81a9f2fe-1697-473c-af1d-086b0d8b63c8
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Okta ThreatInsight Login Failure with High Unknown users
deprecated_id: 632663b0-4562-4aad-abe9-9f621a049738
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Detect Spike in Security Group Activity
deprecated_id: ada0f478-84a8-4641-a3f1-e32372d4bd53
replacement_name: Abnormally High Number Of Cloud Security Group API Calls
replacement_id: d4dfb7f3-7a37-498a-b5df-f19334e871af
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Office Product Spawning BITSAdmin
deprecated_id: e8c591f4-a6d7-11eb-8cf7-acde48001122
replacement_name: Windows Office Product Spawned Uncommon Process
replacement_id: 55d8741c-fa32-4692-8109-410304961eb8
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Create local admin accounts using net exe
deprecated_id: b89919ed-fe5f-492c-b139-151bb162040e
replacement_name: Windows Create Local Administrator Account Via Net
replacement_id: 2c568c34-bb57-4b43-9d75-19c605b98e70
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Abnormally High AWS Instances Terminated by User - MLTK
deprecated_id: 1c02b86a-cd85-473e-a50b-014a9ac8fe3e
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Windows Office Product Spawning MSDT
deprecated_id: 127eba64-c981-40bf-8589-1830638864a7
replacement_name: Windows Office Product Spawned MSDT
replacement_id: a3148fad-3734-4b7f-9a71-62f08d39fab1
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Detect Spike in AWS API Activity
deprecated_id: ada0f478-84a8-4641-a3f1-d32362d4bd55
replacement_name: ''
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Office Product Spawning Windows Script Host
deprecated_id: b3628a5b-8d02-42fa-a891-eebf2351cbe1
replacement_name: Windows Office Product Spawned Uncommon Process
replacement_id: 55d8741c-fa32-4692-8109-410304961eb8
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Prohibited Software On Endpoint
deprecated_id: a51bfe1a-94f0-48cc-b4e4-b6ae50145893
replacement_name: Attacker Tools On Endpoint
replacement_id: a51bfe1a-94f0-48cc-b4e4-16a110145893
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: AWS Cloud Provisioning From Previously Unseen Country
deprecated_id: ceb8d3d8-06cb-49eb-beaf-829526e33ff0
replacement_name: Cloud Provisioning Activity From Previously Unseen Country
replacement_id: 94994255-3acf-4213-9b3f-0494df03bb31
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Detect Critical Alerts from Security Tools
deprecated_id: 483e8a68-f2f7-45be-8fc9-bf725f0e22fd
replacement_name: Microsoft Defender ATP Alerts
replacement_id: 38f034ed-1598-46c8-95e8-14edf05fdf5d
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: As discussed internally, this analytic was too generic for an analyst to
do anything with it. It was deprecated in favor of the more specific approach
provided by analytics such as Microsoft Defender ATP Alerts and Microsoft Defender
Incident Alerts. Going forward analytics from leveraging alerts from vendors will
have their specific analytics.
- deprecated_name: Detect Critical Alerts from Security Tools
deprecated_id: 483e8a68-f2f7-45be-8fc9-bf725f0e22fd
replacement_name: Microsoft Defender Incident Alerts
replacement_id: 13435b55-afd8-46d4-9045-7d5457f430a5
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Excel Spawning PowerShell
deprecated_id: 42d40a22-9be3-11eb-8f08-acde48001122
replacement_name: Windows Office Product Spawned Uncommon Process
replacement_id: 55d8741c-fa32-4692-8109-410304961eb8
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Office Application Spawn rundll32 process
deprecated_id: 958751e4-9c5f-11eb-b103-acde48001122
replacement_name: Windows Office Product Spawned Uncommon Process
replacement_id: 55d8741c-fa32-4692-8109-410304961eb8
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Excessive Usage Of Net App
deprecated_id: 45e52536-ae42-11eb-b5c6-acde48001122
replacement_name: Windows Excessive Usage Of Net App
replacement_id: 355ba810-0a20-4215-8485-9ce3f87f2e38
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Elevated Group Discovery With Net
deprecated_id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a
replacement_name: Windows Sensitive Group Discovery With Net
replacement_id: d9eb7cda-5622-4722-bc88-7f2442f4b5af
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Local Account Discovery with Net
deprecated_id: 5d0d4830-0133-11ec-bae3-acde48001122
replacement_name: Windows User Discovery Via Net
replacement_id: 7742987e-88c1-476b-a626-a869e088ab72
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Windows Command Shell Fetch Env Variables
deprecated_id: 048839e4-1eaa-43ff-8a22-86d17f6fcc13
replacement_name: Windows List ENV Variables Via SET Command From Uncommon Parent
replacement_id: aec157f4-8783-4584-aca6-754c4dc7fba9
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Suspicious Email - UBA Anomaly
deprecated_id: 56e877a6-1455-4479-ad16-0550dc1e33f8
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Detect web traffic to dynamic domain providers
deprecated_id: 134da869-e264-4a8f-8d7e-fcd01c18f301
replacement_name: Detect hosts connecting to dynamic domain providers
replacement_id: a1e761ac-1344-4dbd-88b2-3f34c912d359
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Updated to use a different log source
- deprecated_name: Okta Failed SSO Attempts
deprecated_id: 371a6545-2618-4032-ad84-93386b8698c5
replacement_name: Okta Unauthorized Access to Application
replacement_id: 5f661629-9750-4cb9-897c-1f05d6db8727
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Kubernetes AWS detect RBAC authorization by account
deprecated_id: de7264ed-3ed9-4fef-bb01-6eefc87cefe8
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Kubernetes Azure detect service accounts forbidden failure access
deprecated_id: 019690d7-420f-4da0-b320-f27b09961514
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Remote Registry Key modifications
deprecated_id: c9f4b923-f8af-4155-b697-1354f5dcbc5e
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: O365 Suspicious User Email Forwarding
deprecated_id: f8dfe015-dbb3-4569-ba75-b13787e06aa4
replacement_name: O365 Mailbox Email Forwarding Enabled
replacement_id: 0b6bc75c-05d1-4101-9fc3-97e706168f24
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Office Product Spawning MSHTA
deprecated_id: 6078fa20-a6d2-11eb-b662-acde48001122
replacement_name: Windows Office Product Spawned Uncommon Process
replacement_id: 55d8741c-fa32-4692-8109-410304961eb8
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Kubernetes AWS detect most active service accounts by pod
deprecated_id: 5b30b25d-7d32-42d8-95ca-64dfcd9076e6
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Correlation by Repository and Risk
deprecated_id: 8da9fdd9-6a1b-4ae0-8a34-8c25e6be9687
replacement_name: Risk Rule for Dev Sec Ops by Repository
replacement_id: 161bc0ca-4651-4c13-9c27-27770660cf67
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the datamodel
- deprecated_name: Kubernetes Azure detect RBAC authorization by account
deprecated_id: 47af7d20-0607-4079-97d7-7a29af58b54e
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Clients Connecting to Multiple DNS Servers
deprecated_id: 74ec6f18-604b-4202-a567-86b2066be3ce
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Excessive Service Stop Attempt
deprecated_id: ae8d3f4a-acd7-11eb-8846-acde48001122
replacement_name: Windows Excessive Service Stop Attempt
replacement_id: 8f3a614f-6b98-4f7d-82dd-d0df38452a8b
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Multiple Okta Users With Invalid Credentials From The Same IP
deprecated_id: 19cba45f-cad3-4032-8911-0c09e0444552
replacement_name: Okta Multiple Users Failing To Authenticate From Ip
replacement_id: de365ffa-42f5-46b5-b43f-fa72290b8218
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Suspicious writes to System Volume Information
deprecated_id: cd6297cd-2bdd-4aa1-84aa-5d2f84228fac
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Detect new user AWS Console Login
deprecated_id: ada0f478-84a8-4641-a3f3-d82362dffd75
replacement_name: Detect AWS Console Login by New User
replacement_id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Domain Account Discovery With Net App
deprecated_id: 98f6a534-04c2-11ec-96b2-acde48001122
replacement_name: Windows User Discovery Via Net
replacement_id: 5d0d4830-0133-11ec-bae3-acde48001122
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: 'This analytic was a TTP that looked only for commands that tries to query
info about the users via net user /do. This had a couple of issues, such as triggering
on creation of users via the /add flag etc..
It was deprecated in favor of a more tighter approach in 5d0d4830-0133-11ec-bae3-acde48001122'
- deprecated_name: Detection of DNS Tunnels
deprecated_id: 104658f4-afdc-499f-9719-17a43f9826f4
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Detect DNS requests to Phishing Sites leveraging EvilGinx2
deprecated_id: 24dd17b1-e2fb-4c31-878c-d4f226595bfa
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Office Document Creating Schedule Task
deprecated_id: cc8b7b74-9d0f-11eb-8342-acde48001122
replacement_name: Windows Office Product Loading Taskschd DLL
replacement_id: d7297cfa-1f04-4714-bfbe-3679e0666959
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Okta Account Locked Out
deprecated_id: d650c0ae-bdc5-400e-9f0f-f7aa0a010ef1
replacement_name: Okta Multiple Accounts Locked Out
replacement_id: a511426e-184f-4de6-8711-cfd2af29d1e1
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Unsuccessful Netbackup backups
deprecated_id: a34aae96-ccf8-4aaa-952c-3ea21444444f
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Detect Mimikatz Via PowerShell And EventCode 4703
deprecated_id: 98917be2-bfc8-475a-8618-a9bb06575188
replacement_name: Detect Mimikatz With PowerShell Script Block Logging
replacement_id: 8148c29c-c952-11eb-9255-acde48001122
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Updated to a new detection name
- deprecated_name: Winword Spawning Cmd
deprecated_id: 6fcbaedc-a37b-11eb-956b-acde48001122
replacement_name: Windows Office Product Spawned Uncommon Process
replacement_id: 55d8741c-fa32-4692-8109-410304961eb8
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: GCP Kubernetes cluster scan detection
deprecated_id: db5957ec-0144-4c56-b512-9dccbe7a2d26
replacement_name: Kubernetes Scanning by Unauthenticated IP Address
replacement_id: f9cadf4e-df22-4f4e-a08f-9d3344c2165d
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Kubernetes GCP detect suspicious kubectl calls
deprecated_id: a5bed417-070a-41f2-a1e4-82b6aa281557
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: gcp detect oauth token abuse
deprecated_id: a7e9f7bb-8901-4ad0-8d88-0a4ab07b1972
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Correlation by User and Risk
deprecated_id: 610e12dc-b6fa-4541-825e-4a0b3b6f6773
replacement_name: Risk Rule for Dev Sec Ops by Repository
replacement_id: 161bc0ca-4651-4c13-9c27-27770660cf67
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the datamodel
- deprecated_name: Processes created by netsh
deprecated_id: b89919ed-fe5f-492c-b139-95dbb162041e
replacement_name: Processes launching netsh
replacement_id: b89919ed-fe5f-492c-b139-95dbb162040e
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Updated to a new detection name
- deprecated_name: Office Product Spawning Wmic
deprecated_id: ffc236d6-a6c9-11eb-95f1-acde48001122
replacement_name: Windows Office Product Spawned Uncommon Process
replacement_id: 55d8741c-fa32-4692-8109-410304961eb8
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Extraction of Registry Hives
deprecated_id: 8bbb7d58-b360-11eb-ba21-acde48001122
replacement_name: Windows Sensitive Registry Hive Dump Via CommandLine
replacement_id: 5aaff29d-0cce-405b-9ee8-5d06b49d045e
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Attempt To Stop Security Service
deprecated_id: c8e349c6-b97c-486e-8949-bd7bcd1f3910
replacement_name: Windows Attempt To Stop Security Service
replacement_id: 9ed27cea-4e27-4eff-b2c6-aac9e78a7517
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Windows MSIExec With Network Connections
deprecated_id: 827409a1-5393-4d8d-8da4-bbb297c262a7
replacement_name: Windows HTTP Network Communication From MSIExec
replacement_id: b0fd38c7-f71a-43a2-870e-f3ca06bcdd99
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Windows Query Registry Reg Save
deprecated_id: cbee60c1-b776-456f-83c2-faa56bdbe6c6
replacement_name: Windows Registry Entries Exported Via Reg
replacement_id: 466379bc-0f47-476c-8202-16ef38112e0d
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Cloud Network Access Control List Deleted
deprecated_id: 021abc51-1862-41dd-ad43-43c739c0a983
replacement_name: AWS Network Access Control List Deleted
replacement_id: ada0f478-84a8-4641-a3f1-d82362d6fd75
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: O365 Suspicious Rights Delegation
deprecated_id: b25d2973-303e-47c8-bacd-52b61604c6a7
replacement_name: O365 Elevated Mailbox Permission Assigned
replacement_id: 2246c142-a678-45f8-8546-aaed7e0efd30
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Abnormally High AWS Instances Launched by User - MLTK
deprecated_id: dec41ad5-d579-42cb-b4c6-f5dbb778bbe5
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Reg exe used to hide files directories via registry keys
deprecated_id: 61a7d1e6-f5d4-41d9-a9be-39a1ffe69459
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Detect Long DNS TXT Record Response
deprecated_id: 05437c07-62f5-452e-afdc-04dd44815bb9
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Password Policy Discovery with Net
deprecated_id: 09336538-065a-11ec-8665-acde48001122
replacement_name: Windows Password Policy Discovery with Net
replacement_id: e52f7865-be78-46bf-b7ed-150fbe447613
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: AWS Cloud Provisioning From Previously Unseen IP Address
deprecated_id: 42e15012-ac14-4801-94f4-f1acbe64880b
replacement_name: Cloud Provisioning Activity From Previously Unseen IP Address
replacement_id: f86a8ec9-b042-45eb-92f4-e9ed1d781078
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Network Connection Discovery With Net
deprecated_id: 640337e5-6e41-4b7f-af06-9d9eab5e1e2d
replacement_name: Windows Network Connection Discovery Via Net
replacement_id: 86a5b949-679b-4197-8d4c-9c180a818c45
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Kubernetes Azure detect suspicious kubectl calls
deprecated_id: 4b6d1ba8-0000-4cec-87e6-6cbbd71651b5
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Kubernetes GCP detect sensitive role access
deprecated_id: a46923f6-36b9-4806-a681-31f314907c30
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Detect Webshell Exploit Behavior
deprecated_id: 22597426-6dbd-49bd-bcdc-4ec19857192f
replacement_name: Windows Suspicious Child Process Spawned From WebServer
replacement_id: 2d4470ef-7158-4b47-b68b-1f7f16382156
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: DNS record changed
deprecated_id: 44d3a43e-dcd5-49f7-8356-5209bb369065
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Unsigned Image Loaded by LSASS
deprecated_id: 56ef054c-76ef-45f9-af4a-a634695dcd65
replacement_name: ''
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Detect USB device insertion
deprecated_id: 104658f4-afdc-499f-9719-17a43f9826f5
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Windows Network Share Interaction With Net
deprecated_id: 4dc3951f-b3f8-4f46-b412-76a483f72277
replacement_name: Windows Network Share Interaction Via Net
replacement_id: e51fbdb0-0be0-474f-92ea-d289f71a695e
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Account Discovery With Net App
deprecated_id: 339805ce-ac30-11eb-b87d-acde48001122
replacement_name: Windows Excessive Usage Of Net App
replacement_id: 45e52536-ae42-11eb-b5c6-acde48001122
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: This analytic was a TTP that focused on unrelated things and called account
discovery. Since there were other detection that overlapped with it. I choose
to deprecate it, and replace it with an updated version of 339805ce-ac30-11eb-b87d-acde48001122
/ Windows Excessive Usage Of Net App.
- deprecated_name: Change Default File Association
deprecated_id: 462d17d8-1f71-11ec-ad07-acde48001122
replacement_name: Windows New Default File Association Value Set
replacement_id: 7d1f031f-f1c9-43be-8b0b-c4e3e8a8928a
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Windows Lateral Tool Transfer RemCom
deprecated_id: e373a840-5bdc-47ef-b2fd-9cc7aaf387f0
replacement_name: Windows Service Execution RemCom
replacement_id: 7e3d68db-ea4d-419b-adbd-e14a525ecf09
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Updated to a new detection name
- deprecated_name: Office Document Executing Macro Code
deprecated_id: b12c89bc-9d06-11eb-a592-acde48001122
replacement_name: Windows Office Product Loading VBE7 DLL
replacement_id: 7cfec906-2697-43f7-898b-83634a051d9a
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Okta Account Lockout Events
deprecated_id: 62b70968-a0a5-4724-8ac4-67871e6f544d
replacement_name: Okta Multiple Accounts Locked Out
replacement_id: a511426e-184f-4de6-8711-cfd2af29d1e1
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Abnormally High AWS Instances Launched by User
deprecated_id: 2a9b80d3-6340-4345-b5ad-290bf5d0dac4
replacement_name: Abnormally High Number Of Cloud Instances Launched
replacement_id: f2361e9f-3928-496c-a556-120cd4223a65
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: EC2 Instance Modified With Previously Unseen User
deprecated_id: 56f91724-cf3f-4666-84e1-e3712fb41e76
replacement_name: Cloud API Calls From Previously Unseen User Roles
replacement_id: 2181ad1f-1e73-4d0c-9780-e8880482a08f
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Windows Valid Account With Never Expires Password
deprecated_id: 73a931db-1830-48b3-8296-cd9cfa09c3c8
replacement_name: Windows Set Account Password Policy To Unlimited Via Net
replacement_id: 11f93009-8083-43fd-82a7-821fcbdc8342
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Windows hosts file modification
deprecated_id: 06a6fc63-a72d-41dc-8736-7e3dd9612116
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: MSHTML Module Load in Office Product
deprecated_id: 5f1c168e-118b-11ec-84ff-acde48001122
replacement_name: Windows Office Product Loaded MSHTML Module
replacement_id: 4cc015c9-687c-40d2-adcc-46350f66e10c
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Abnormally High AWS Instances Terminated by User
deprecated_id: 8d301246-fccf-45e2-a8e7-3655fd14379c
replacement_name: Abnormally High Number Of Cloud Instances Destroyed
replacement_id: ef629fc9-1583-4590-b62a-f2247fbf7bbf
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Web Fraud - Account Harvesting
deprecated_id: bf1d7b5c-df2f-4249-a401-c09fdc221ddf
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Office Spawning Control
deprecated_id: 053e027c-10c7-11ec-8437-acde48001122
replacement_name: Windows Office Product Spawned Control
replacement_id: 081c485d-ac8d-4bee-ad4c-525772fead4d
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Detect Activity Related to Pass the Hash Attacks
deprecated_id: f5939373-8054-40ad-8c64-cec478a22a4b
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Deleting Of Net Users
deprecated_id: 1c8c6f66-acce-11eb-aafb-acde48001122
replacement_name: Windows User Deletion Via Net
replacement_id: b0b6fd2c-8953-4d1b-8f7b-56075ea6ab3e
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Suspicious File Write
deprecated_id: 57f76b8a-32f0-42ed-b358-d9fa3ca7bac8
replacement_name: ''
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: AWS EKS Kubernetes cluster sensitive object access
deprecated_id: 7f227943-2196-4d4d-8d6a-ac8cb308e61c
replacement_name: Kubernetes Abuse of Secret by Unusual Location
replacement_id: 40a064c1-4ec1-4381-9e35-61192ba8ef82
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Spectre and Meltdown Vulnerable Systems
deprecated_id: 354be8e0-32cd-4da0-8c47-796de13b60ea
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: EC2 Instance Started With Previously Unseen User
deprecated_id: 22773e84-bac0-4595-b086-20d3f735b4f1
replacement_name: Cloud Compute Instance Created By Previously Unseen User
replacement_id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Office Product Spawning CertUtil
deprecated_id: 6925fe72-a6d5-11eb-9e17-acde48001122
replacement_name: Windows Office Product Spawned Uncommon Process
replacement_id: 55d8741c-fa32-4692-8109-410304961eb8
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Kubernetes GCP detect RBAC authorizations by account
deprecated_id: 99487de3-7192-4b41-939d-fbe9acfb1340
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Office Application Drop Executable
deprecated_id: 73ce70c4-146d-11ec-9184-acde48001122
replacement_name: Windows Office Product Dropped Uncommon File
replacement_id: 7ac0fced-9eae-4381-a748-90dcd1aa9393
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Kubernetes Azure active service accounts by pod namespace
deprecated_id: 55a2264a-b7f0-45e5-addd-1e5ab3415c72
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Kubernetes Azure pod scan fingerprint
deprecated_id: 86aad3e0-732f-4f66-bbbc-70df448e461d
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Detect Spike in Network ACL Activity
deprecated_id: ada0f478-84a8-4641-a1f1-e32372d4bd53
replacement_name: Abnormally High Number Of Cloud Infrastructure API Calls
replacement_id: 0840ddf1-8c89-46ff-b730-c8d6722478c0
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Suspicious Powershell Command-Line Arguments
deprecated_id: 2cdb91d2-542c-497f-b252-be495e71f38c
replacement_name: Malicious PowerShell Process - Encoded Command
replacement_id: c4db14d9-7909-48b4-a054-aa14d89dbb19
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Office Application Spawn Regsvr32 process
deprecated_id: 2d9fc90c-f11f-11eb-9300-acde48001122
replacement_name: Windows Office Product Spawned Uncommon Process
replacement_id: 55d8741c-fa32-4692-8109-410304961eb8
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Detect API activity from users without MFA
deprecated_id: 4d46e8bd-4072-48e4-92db-0325889ef894
replacement_name: AWS Successful Single-Factor Authentication
replacement_id: a520b1fe-cc9e-4f56-b762-18354594c52f
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Kubernetes Azure detect sensitive object access
deprecated_id: 1bba382b-07fd-4ffa-b390-8002739b76e8
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Web Fraud - Password Sharing Across Accounts
deprecated_id: 31337a1a-53b9-4e05-96e9-55c934cb71d3
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Disabling Net User Account
deprecated_id: c0325326-acd6-11eb-98c2-acde48001122
replacement_name: Windows User Disabled Via Net
replacement_id: b0359e05-c87b-4354-83d8-aee0d890243f
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: GCP Detect accounts with high risk roles by project
deprecated_id: 27af8c15-38b0-4408-b339-920170724adb
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Kubernetes GCP detect service accounts forbidden failure access
deprecated_id: 7094808d-432a-48e7-bb3c-77e96c894f3b
replacement_name: '- '
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Extended Period Without Successful Netbackup Backups
deprecated_id: a34aae96-ccf8-4aef-952c-3ea214444440
replacement_name: '-'
replacement_id: ''
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Office Product Spawning Rundll32 with no DLL
deprecated_id: c661f6be-a38c-11eb-be57-acde48001122
replacement_name: Windows Office Product Spawned Rundll32 With No DLL
replacement_id: f28e787e-69ca-480e-9f98-ab970e6d4bcc
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Renamed and updated logic
- deprecated_name: Okta ThreatInsight Suspected PasswordSpray Attack
deprecated_id: 25dbad05-6682-4dd5-9ce9-8adecf0d9ae2
replacement_name: Okta ThreatInsight Threat Detected
replacement_id: 140504ae-5fe2-4d65-b2bc-a211813fbca6
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
- deprecated_name: Net Localgroup Discovery
deprecated_id: 54f5201e-155b-11ec-a6e2-acde48001122
replacement_name: Windows Group Discovery Via Net
replacement_id: c5c8e0f3-147a-43da-bf04-4cfaec27dc44
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Both of these analytics were deprecated in favor of c5c8e0f3-147a-43da-bf04-4cfaec27dc44
/ Windows Group Discovery Via Net
- deprecated_name: Uncommon Processes On Endpoint
deprecated_id: 29ccce64-a10c-4389-a45f-337cb29ba1f7
replacement_name: Attacker Tools On Endpoint
replacement_id: a51bfe1a-94f0-48cc-b4e4-16a110145893
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: ''
- deprecated_name: Dump LSASS via procdump Rename
deprecated_id: 21276daa-663d-11eb-ae93-0242ac130002
replacement_name: Dump LSASS via procdump
replacement_id: 3742ebfe-64c2-11eb-ae93-0242ac130002
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Updated to a new detection name
- deprecated_name: Okta Two or More Rejected Okta Pushes
deprecated_id: d93f785e-4c2c-4262-b8c7-12b77a13fd39
replacement_name: Okta Multiple Failed MFA Requests For User
replacement_id: 826dbaae-a1e6-4c8c-b384-d16898956e73
date: '2025-01-28'
escu_version: 5.0.0
migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics
reason: Detections updated to use the new search logic and field names due to the
TA update
Reference in New Issue View Git Blame Copy Permalink