diff --git a/deprecated/deprecated_detection_mapping.yml b/deprecated/deprecated_detection_mapping.yml new file mode 100644 index 0000000000..ca0e64dcb3 --- /dev/null +++ b/deprecated/deprecated_detection_mapping.yml @@ -0,0 +1,1260 @@ +- deprecated_name: ASL AWS Excessive Security Scanning + deprecated_id: ff2bfdbc-65b7-4434-8f08-d55761d1d446 + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: AWS Cloud Provisioning From Previously Unseen Region + deprecated_id: 7971d3df-da82-4648-a6e5-b5637bea5253 + replacement_name: Cloud Provisioning Activity From Previously Unseen Region + replacement_id: 5aba1860-9617-4af9-b19d-aecac16fe4f2 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: First time seen command line argument + deprecated_id: a1b6e73f-98d5-470f-99ac-77aacd578473 + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Windows connhost exe started forcefully + deprecated_id: c114aaca-68ee-41c2-ad8c-32bf21db8769 + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Detect Mimikatz Using Loaded Images + deprecated_id: 29e307ba-40af-4ab2-91b2-3c6b392bbba0 + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Kubernetes Azure detect sensitive role access + deprecated_id: f27349e5-1641-4f6a-9e68-30402be0ad4c + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Web Fraud - Anomalous User Clickspeed + deprecated_id: 31337bbb-bc22-4752-b599-ef192df2dc7a + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: EC2 Instance Started With Previously Unseen Instance Type + deprecated_id: 65541c80-03c7-4e05-83c8-1dcd57a2e1ad + replacement_name: Cloud Compute Instance Created With Previously Unseen Instance + Type + replacement_id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: EC2 Instance Started With Previously Unseen AMI + deprecated_id: 347ec301-601b-48b9-81aa-9ddf9c829dd3 + replacement_name: Cloud Compute Instance Created With Previously Unseen Image + replacement_id: bc24922d-987c-4645-b288-f8c73ec194c4 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Domain Group Discovery With Net + deprecated_id: f2f14ac7-fa81-471a-80d5-7eb65c3c7349 + replacement_name: Windows Group Discovery Via Net + replacement_id: c5c8e0f3-147a-43da-bf04-4cfaec27dc44 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Kubernetes AWS detect sensitive role access + deprecated_id: b6013a7b-85e0-4a45-b051-10b252d69569 + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Winword Spawning Windows Script Host + deprecated_id: 637e1b5c-9be1-11eb-9c32-acde48001122 + replacement_name: Windows Office Product Spawned Uncommon Process + replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: 'The following analytics was deprecated in favour of a more generic approach. + Where instead of creating specific analytic for every potentially suspicious child + of an office product. We group them by threat level. + + This would ease management and false positives tuning.' +- deprecated_name: Winword Spawning PowerShell + deprecated_id: b2c950b8-9be2-11eb-8658-acde48001122 + replacement_name: Windows Office Product Spawned Uncommon Process + replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Attempted Credential Dump From Registry via Reg exe + deprecated_id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911 + replacement_name: Windows Sensitive Registry Hive Dump Via CommandLine + replacement_id: 8bbb7d58-b360-11eb-ba21-acde48001122 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: This analytic had some overlap with another one, hence the deprecation. + It was replaced by 8bbb7d58-b360-11eb-ba21-acde48001122 / Windows Sensitive Registry + Hive Dump Via CommandLine +- deprecated_name: Detect processes used for System Network Configuration Discovery + deprecated_id: a51bfe1a-94f0-48cc-b1e4-16ae10145893 + replacement_name: Potential System Network Configuration Discovery Activity + replacement_id: 3f0b95e3-3195-46ac-bea3-84fb59e7fac5 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Execution of File With Spaces Before Extension + deprecated_id: ab0353e6-a956-420b-b724-a8b4846d5d5a + replacement_name: Execution of File with Multiple Extensions + replacement_id: b06a555e-dce0-417d-a2eb-28a5d8d66ef7 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Updated to a new detection name +- deprecated_name: EC2 Instance Started In Previously Unseen Region + deprecated_id: ada0f478-84a8-4641-a3f3-d82362d6fd75 + replacement_name: Cloud Compute Instance Created In Previously Unused Region + replacement_id: fa4089e2-50e3-40f7-8469-d2cc1564ca59 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Office Document Spawned Child Process To Download + deprecated_id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3 + replacement_name: Windows Office Product Spawned Child Process For Download + replacement_id: f02b64b8-cbea-4f75-bf77-7a05111566b1 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Detect new API calls from user roles + deprecated_id: 22773e84-bac0-4595-b086-20d3f335b4f1 + replacement_name: Cloud API Calls From Previously Unseen User Roles + replacement_id: 2181ad1f-1e73-4d0c-9780-e8880482a08f + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Cmdline Tool Not Executed In CMD Shell + deprecated_id: 6c3f7dd8-153c-11ec-ac2d-acde48001122 + replacement_name: Windows Cmdline Tool Execution From Non-Shell Process + replacement_id: 2afa393f-b88d-41b7-9793-623c93a2dfde + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Linux Auditd Find Private Keys + deprecated_id: 80bb9988-190b-4ee0-a3c3-509545a8f678 + replacement_name: Linux Auditd Private Keys and Certificate Enumeration + replacement_id: 892eb674-3344-4143-8e52-4775b1daf3f1 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Detect AWS API Activities From Unapproved Accounts + deprecated_id: ada0f478-84a8-4641-a3f1-d82362d4bd55 + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Monitor DNS For Brand Abuse + deprecated_id: 24dd17b1-e2fb-4c31-878c-d4f746595bfa + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Kubernetes GCP detect sensitive object access + deprecated_id: bdb6d596-86a0-4aba-8369-418ae8b9963a + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Kubernetes Azure scan fingerprint + deprecated_id: c5e5bd5c-1013-4841-8b23-e7b3253c840a + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: ASL AWS Password Policy Changes + deprecated_id: 5ade5937-11a2-4363-ba6b-39a3ee8d5b1a + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: O365 Suspicious Admin Email Forwarding + deprecated_id: 7f398cfb-918d-41f4-8db8-2e2474e02c28 + replacement_name: O365 Mailbox Email Forwarding Enabled + replacement_id: 0b6bc75c-05d1-4101-9fc3-97e706168f24 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: AWS Cloud Provisioning From Previously Unseen City + deprecated_id: 344a1778-0b25-490c-adb1-de8beddf59cd + replacement_name: Cloud Provisioning Activity From Previously Unseen City + replacement_id: e7ecc5e0-88df-48b9-91af-51104c68f02f + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Kubernetes AWS detect service accounts forbidden failure access + deprecated_id: a6959c57-fa8f-4277-bb86-7c32fba579d5 + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Osquery pack - ColdRoot detection + deprecated_id: a6fffe5e-05c3-4c04-badc-887607fbb8dc + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Windows Modify Registry Reg Restore + deprecated_id: d0072bd2-6d73-4c1b-bc77-ded6d2da3a4e + replacement_name: Windows Registry Entries Restored Via Reg + replacement_id: a17af481-e2ad-494c-9da6-afb4d243a019 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Kubernetes GCP detect most active service accounts by pod + deprecated_id: 7f5c2779-88a0-4824-9caa-0f606c8f260f + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Scheduled tasks used in BadRabbit ransomware + deprecated_id: 1297fb80-f42a-4b4a-9c8b-78c066437cf6 + replacement_name: Scheduled Task Deleted Or Created via CMD + replacement_id: d5af132c-7c17-439c-9d31-13d55340f36c + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Updated to a new detection name +- deprecated_name: Suspicious Rundll32 Rename + deprecated_id: 7360137f-abad-473e-8189-acbdaa34d114 + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Remote System Discovery with Net + deprecated_id: 9df16706-04a2-41e2-bbfe-9b38b34409d3 + replacement_name: Windows Network Share Interaction With Net + replacement_id: 4dc3951f-b3f8-4f46-b412-76a483f72277 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: "This analytic was focusing on 2 separate and unrelated type of threats\ + \ or actions. It was split into other analytics, namely:\r\n\r\nWindows Network\ + \ Share Interaction With Net / 4dc3951f-b3f8-4f46-b412-76a483f72277\r\nWindows\ + \ Sensitive Group Discovery With Net / a23a0e20-0b1b-4a07-82e5-ec5f70811e7a" +- deprecated_name: Remote System Discovery with Net + deprecated_id: 9df16706-04a2-41e2-bbfe-9b38b34409d3 + replacement_name: Windows Sensitive Group Discovery With Net + replacement_id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: DNS Query Requests Resolved by Unauthorized DNS Servers + deprecated_id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f6 + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Suspicious Changes to File Associations + deprecated_id: 1b989a0e-0129-4446-a695-f193a5b746fc + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: GCP Detect high risk permissions by resource and account + deprecated_id: 2e70ef35-2187-431f-aedc-4503dc9b06ba + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Office Product Writing cab or inf + deprecated_id: f48cd1d4-125a-11ec-a447-acde48001122 + replacement_name: Windows Office Product Dropped Cab or Inf File + replacement_id: dbdd251e-dd45-4ec9-a555-f5e151391746 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Identify New User Accounts + deprecated_id: 475b9e27-17e4-46e2-b7e2-648221be3b89 + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Office Product Spawn CMD Process + deprecated_id: b8b19420-e892-11eb-9244-acde48001122 + replacement_name: Windows Office Product Spawned Uncommon Process + replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Windows DLL Search Order Hijacking Hunt + deprecated_id: 79c7d0fc-60c7-41be-a616-ccda752efe89 + replacement_name: Windows DLL Search Order Hijacking Hunt with Sysmon + replacement_id: 79c7d1fc-64c7-91be-a616-ccda752efe81 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: ASL AWS CreateAccessKey + deprecated_id: ccb3e4af-23d6-407f-9842-a26212816c9e + replacement_name: ASL AWS Create Access Key + replacement_id: 81a9f2fe-1697-473c-af1d-086b0d8b63c8 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Okta ThreatInsight Login Failure with High Unknown users + deprecated_id: 632663b0-4562-4aad-abe9-9f621a049738 + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Detect Spike in Security Group Activity + deprecated_id: ada0f478-84a8-4641-a3f1-e32372d4bd53 + replacement_name: Abnormally High Number Of Cloud Security Group API Calls + replacement_id: d4dfb7f3-7a37-498a-b5df-f19334e871af + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Office Product Spawning BITSAdmin + deprecated_id: e8c591f4-a6d7-11eb-8cf7-acde48001122 + replacement_name: Windows Office Product Spawned Uncommon Process + replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Create local admin accounts using net exe + deprecated_id: b89919ed-fe5f-492c-b139-151bb162040e + replacement_name: Windows Create Local Administrator Account Via Net + replacement_id: 2c568c34-bb57-4b43-9d75-19c605b98e70 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Abnormally High AWS Instances Terminated by User - MLTK + deprecated_id: 1c02b86a-cd85-473e-a50b-014a9ac8fe3e + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Windows Office Product Spawning MSDT + deprecated_id: 127eba64-c981-40bf-8589-1830638864a7 + replacement_name: Windows Office Product Spawned MSDT + replacement_id: a3148fad-3734-4b7f-9a71-62f08d39fab1 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Detect Spike in AWS API Activity + deprecated_id: ada0f478-84a8-4641-a3f1-d32362d4bd55 + replacement_name: '' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Office Product Spawning Windows Script Host + deprecated_id: b3628a5b-8d02-42fa-a891-eebf2351cbe1 + replacement_name: Windows Office Product Spawned Uncommon Process + replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Prohibited Software On Endpoint + deprecated_id: a51bfe1a-94f0-48cc-b4e4-b6ae50145893 + replacement_name: Attacker Tools On Endpoint + replacement_id: a51bfe1a-94f0-48cc-b4e4-16a110145893 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: AWS Cloud Provisioning From Previously Unseen Country + deprecated_id: ceb8d3d8-06cb-49eb-beaf-829526e33ff0 + replacement_name: Cloud Provisioning Activity From Previously Unseen Country + replacement_id: 94994255-3acf-4213-9b3f-0494df03bb31 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Detect Critical Alerts from Security Tools + deprecated_id: 483e8a68-f2f7-45be-8fc9-bf725f0e22fd + replacement_name: Microsoft Defender ATP Alerts + replacement_id: 38f034ed-1598-46c8-95e8-14edf05fdf5d + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: As discussed internally, this analytic was too generic for an analyst to + do anything with it. It was deprecated in favor of the more specific approach + provided by analytics such as Microsoft Defender ATP Alerts and Microsoft Defender + Incident Alerts. Going forward analytics from leveraging alerts from vendors will + have their specific analytics. +- deprecated_name: Detect Critical Alerts from Security Tools + deprecated_id: 483e8a68-f2f7-45be-8fc9-bf725f0e22fd + replacement_name: Microsoft Defender Incident Alerts + replacement_id: 13435b55-afd8-46d4-9045-7d5457f430a5 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Excel Spawning PowerShell + deprecated_id: 42d40a22-9be3-11eb-8f08-acde48001122 + replacement_name: Windows Office Product Spawned Uncommon Process + replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Office Application Spawn rundll32 process + deprecated_id: 958751e4-9c5f-11eb-b103-acde48001122 + replacement_name: Windows Office Product Spawned Uncommon Process + replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Excessive Usage Of Net App + deprecated_id: 45e52536-ae42-11eb-b5c6-acde48001122 + replacement_name: Windows Excessive Usage Of Net App + replacement_id: 355ba810-0a20-4215-8485-9ce3f87f2e38 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Elevated Group Discovery With Net + deprecated_id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a + replacement_name: Windows Sensitive Group Discovery With Net + replacement_id: d9eb7cda-5622-4722-bc88-7f2442f4b5af + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Local Account Discovery with Net + deprecated_id: 5d0d4830-0133-11ec-bae3-acde48001122 + replacement_name: Windows User Discovery Via Net + replacement_id: 7742987e-88c1-476b-a626-a869e088ab72 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Windows Command Shell Fetch Env Variables + deprecated_id: 048839e4-1eaa-43ff-8a22-86d17f6fcc13 + replacement_name: Windows List ENV Variables Via SET Command From Uncommon Parent + replacement_id: aec157f4-8783-4584-aca6-754c4dc7fba9 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Suspicious Email - UBA Anomaly + deprecated_id: 56e877a6-1455-4479-ad16-0550dc1e33f8 + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Detect web traffic to dynamic domain providers + deprecated_id: 134da869-e264-4a8f-8d7e-fcd01c18f301 + replacement_name: Detect hosts connecting to dynamic domain providers + replacement_id: a1e761ac-1344-4dbd-88b2-3f34c912d359 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Updated to use a different log source +- deprecated_name: Okta Failed SSO Attempts + deprecated_id: 371a6545-2618-4032-ad84-93386b8698c5 + replacement_name: Okta Unauthorized Access to Application + replacement_id: 5f661629-9750-4cb9-897c-1f05d6db8727 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Kubernetes AWS detect RBAC authorization by account + deprecated_id: de7264ed-3ed9-4fef-bb01-6eefc87cefe8 + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Kubernetes Azure detect service accounts forbidden failure access + deprecated_id: 019690d7-420f-4da0-b320-f27b09961514 + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Remote Registry Key modifications + deprecated_id: c9f4b923-f8af-4155-b697-1354f5dcbc5e + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: O365 Suspicious User Email Forwarding + deprecated_id: f8dfe015-dbb3-4569-ba75-b13787e06aa4 + replacement_name: O365 Mailbox Email Forwarding Enabled + replacement_id: 0b6bc75c-05d1-4101-9fc3-97e706168f24 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Office Product Spawning MSHTA + deprecated_id: 6078fa20-a6d2-11eb-b662-acde48001122 + replacement_name: Windows Office Product Spawned Uncommon Process + replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Kubernetes AWS detect most active service accounts by pod + deprecated_id: 5b30b25d-7d32-42d8-95ca-64dfcd9076e6 + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Correlation by Repository and Risk + deprecated_id: 8da9fdd9-6a1b-4ae0-8a34-8c25e6be9687 + replacement_name: Risk Rule for Dev Sec Ops by Repository + replacement_id: 161bc0ca-4651-4c13-9c27-27770660cf67 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the datamodel +- deprecated_name: Kubernetes Azure detect RBAC authorization by account + deprecated_id: 47af7d20-0607-4079-97d7-7a29af58b54e + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Clients Connecting to Multiple DNS Servers + deprecated_id: 74ec6f18-604b-4202-a567-86b2066be3ce + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Excessive Service Stop Attempt + deprecated_id: ae8d3f4a-acd7-11eb-8846-acde48001122 + replacement_name: Windows Excessive Service Stop Attempt + replacement_id: 8f3a614f-6b98-4f7d-82dd-d0df38452a8b + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Multiple Okta Users With Invalid Credentials From The Same IP + deprecated_id: 19cba45f-cad3-4032-8911-0c09e0444552 + replacement_name: Okta Multiple Users Failing To Authenticate From Ip + replacement_id: de365ffa-42f5-46b5-b43f-fa72290b8218 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Suspicious writes to System Volume Information + deprecated_id: cd6297cd-2bdd-4aa1-84aa-5d2f84228fac + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Detect new user AWS Console Login + deprecated_id: ada0f478-84a8-4641-a3f3-d82362dffd75 + replacement_name: Detect AWS Console Login by New User + replacement_id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Domain Account Discovery With Net App + deprecated_id: 98f6a534-04c2-11ec-96b2-acde48001122 + replacement_name: Windows User Discovery Via Net + replacement_id: 5d0d4830-0133-11ec-bae3-acde48001122 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: 'This analytic was a TTP that looked only for commands that tries to query + info about the users via net user /do. This had a couple of issues, such as triggering + on creation of users via the /add flag etc.. + + It was deprecated in favor of a more tighter approach in 5d0d4830-0133-11ec-bae3-acde48001122' +- deprecated_name: Detection of DNS Tunnels + deprecated_id: 104658f4-afdc-499f-9719-17a43f9826f4 + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Detect DNS requests to Phishing Sites leveraging EvilGinx2 + deprecated_id: 24dd17b1-e2fb-4c31-878c-d4f226595bfa + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Office Document Creating Schedule Task + deprecated_id: cc8b7b74-9d0f-11eb-8342-acde48001122 + replacement_name: Windows Office Product Loading Taskschd DLL + replacement_id: d7297cfa-1f04-4714-bfbe-3679e0666959 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Okta Account Locked Out + deprecated_id: d650c0ae-bdc5-400e-9f0f-f7aa0a010ef1 + replacement_name: Okta Multiple Accounts Locked Out + replacement_id: a511426e-184f-4de6-8711-cfd2af29d1e1 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Unsuccessful Netbackup backups + deprecated_id: a34aae96-ccf8-4aaa-952c-3ea21444444f + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Detect Mimikatz Via PowerShell And EventCode 4703 + deprecated_id: 98917be2-bfc8-475a-8618-a9bb06575188 + replacement_name: Detect Mimikatz With PowerShell Script Block Logging + replacement_id: 8148c29c-c952-11eb-9255-acde48001122 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Updated to a new detection name +- deprecated_name: Winword Spawning Cmd + deprecated_id: 6fcbaedc-a37b-11eb-956b-acde48001122 + replacement_name: Windows Office Product Spawned Uncommon Process + replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: GCP Kubernetes cluster scan detection + deprecated_id: db5957ec-0144-4c56-b512-9dccbe7a2d26 + replacement_name: Kubernetes Scanning by Unauthenticated IP Address + replacement_id: f9cadf4e-df22-4f4e-a08f-9d3344c2165d + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Kubernetes GCP detect suspicious kubectl calls + deprecated_id: a5bed417-070a-41f2-a1e4-82b6aa281557 + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: gcp detect oauth token abuse + deprecated_id: a7e9f7bb-8901-4ad0-8d88-0a4ab07b1972 + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Correlation by User and Risk + deprecated_id: 610e12dc-b6fa-4541-825e-4a0b3b6f6773 + replacement_name: Risk Rule for Dev Sec Ops by Repository + replacement_id: 161bc0ca-4651-4c13-9c27-27770660cf67 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the datamodel +- deprecated_name: Processes created by netsh + deprecated_id: b89919ed-fe5f-492c-b139-95dbb162041e + replacement_name: Processes launching netsh + replacement_id: b89919ed-fe5f-492c-b139-95dbb162040e + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Updated to a new detection name +- deprecated_name: Office Product Spawning Wmic + deprecated_id: ffc236d6-a6c9-11eb-95f1-acde48001122 + replacement_name: Windows Office Product Spawned Uncommon Process + replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Extraction of Registry Hives + deprecated_id: 8bbb7d58-b360-11eb-ba21-acde48001122 + replacement_name: Windows Sensitive Registry Hive Dump Via CommandLine + replacement_id: 5aaff29d-0cce-405b-9ee8-5d06b49d045e + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Attempt To Stop Security Service + deprecated_id: c8e349c6-b97c-486e-8949-bd7bcd1f3910 + replacement_name: Windows Attempt To Stop Security Service + replacement_id: 9ed27cea-4e27-4eff-b2c6-aac9e78a7517 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Windows MSIExec With Network Connections + deprecated_id: 827409a1-5393-4d8d-8da4-bbb297c262a7 + replacement_name: Windows HTTP Network Communication From MSIExec + replacement_id: b0fd38c7-f71a-43a2-870e-f3ca06bcdd99 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Windows Query Registry Reg Save + deprecated_id: cbee60c1-b776-456f-83c2-faa56bdbe6c6 + replacement_name: Windows Registry Entries Exported Via Reg + replacement_id: 466379bc-0f47-476c-8202-16ef38112e0d + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Cloud Network Access Control List Deleted + deprecated_id: 021abc51-1862-41dd-ad43-43c739c0a983 + replacement_name: AWS Network Access Control List Deleted + replacement_id: ada0f478-84a8-4641-a3f1-d82362d6fd75 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: O365 Suspicious Rights Delegation + deprecated_id: b25d2973-303e-47c8-bacd-52b61604c6a7 + replacement_name: O365 Elevated Mailbox Permission Assigned + replacement_id: 2246c142-a678-45f8-8546-aaed7e0efd30 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Abnormally High AWS Instances Launched by User - MLTK + deprecated_id: dec41ad5-d579-42cb-b4c6-f5dbb778bbe5 + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Reg exe used to hide files directories via registry keys + deprecated_id: 61a7d1e6-f5d4-41d9-a9be-39a1ffe69459 + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Detect Long DNS TXT Record Response + deprecated_id: 05437c07-62f5-452e-afdc-04dd44815bb9 + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Password Policy Discovery with Net + deprecated_id: 09336538-065a-11ec-8665-acde48001122 + replacement_name: Windows Password Policy Discovery with Net + replacement_id: e52f7865-be78-46bf-b7ed-150fbe447613 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: AWS Cloud Provisioning From Previously Unseen IP Address + deprecated_id: 42e15012-ac14-4801-94f4-f1acbe64880b + replacement_name: Cloud Provisioning Activity From Previously Unseen IP Address + replacement_id: f86a8ec9-b042-45eb-92f4-e9ed1d781078 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Network Connection Discovery With Net + deprecated_id: 640337e5-6e41-4b7f-af06-9d9eab5e1e2d + replacement_name: Windows Network Connection Discovery Via Net + replacement_id: 86a5b949-679b-4197-8d4c-9c180a818c45 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Kubernetes Azure detect suspicious kubectl calls + deprecated_id: 4b6d1ba8-0000-4cec-87e6-6cbbd71651b5 + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Kubernetes GCP detect sensitive role access + deprecated_id: a46923f6-36b9-4806-a681-31f314907c30 + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Detect Webshell Exploit Behavior + deprecated_id: 22597426-6dbd-49bd-bcdc-4ec19857192f + replacement_name: Windows Suspicious Child Process Spawned From WebServer + replacement_id: 2d4470ef-7158-4b47-b68b-1f7f16382156 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: DNS record changed + deprecated_id: 44d3a43e-dcd5-49f7-8356-5209bb369065 + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Unsigned Image Loaded by LSASS + deprecated_id: 56ef054c-76ef-45f9-af4a-a634695dcd65 + replacement_name: '' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Detect USB device insertion + deprecated_id: 104658f4-afdc-499f-9719-17a43f9826f5 + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Windows Network Share Interaction With Net + deprecated_id: 4dc3951f-b3f8-4f46-b412-76a483f72277 + replacement_name: Windows Network Share Interaction Via Net + replacement_id: e51fbdb0-0be0-474f-92ea-d289f71a695e + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Account Discovery With Net App + deprecated_id: 339805ce-ac30-11eb-b87d-acde48001122 + replacement_name: Windows Excessive Usage Of Net App + replacement_id: 45e52536-ae42-11eb-b5c6-acde48001122 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: This analytic was a TTP that focused on unrelated things and called account + discovery. Since there were other detection that overlapped with it. I choose + to deprecate it, and replace it with an updated version of 339805ce-ac30-11eb-b87d-acde48001122 + / Windows Excessive Usage Of Net App. +- deprecated_name: Change Default File Association + deprecated_id: 462d17d8-1f71-11ec-ad07-acde48001122 + replacement_name: Windows New Default File Association Value Set + replacement_id: 7d1f031f-f1c9-43be-8b0b-c4e3e8a8928a + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Windows Lateral Tool Transfer RemCom + deprecated_id: e373a840-5bdc-47ef-b2fd-9cc7aaf387f0 + replacement_name: Windows Service Execution RemCom + replacement_id: 7e3d68db-ea4d-419b-adbd-e14a525ecf09 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Updated to a new detection name +- deprecated_name: Office Document Executing Macro Code + deprecated_id: b12c89bc-9d06-11eb-a592-acde48001122 + replacement_name: Windows Office Product Loading VBE7 DLL + replacement_id: 7cfec906-2697-43f7-898b-83634a051d9a + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Okta Account Lockout Events + deprecated_id: 62b70968-a0a5-4724-8ac4-67871e6f544d + replacement_name: Okta Multiple Accounts Locked Out + replacement_id: a511426e-184f-4de6-8711-cfd2af29d1e1 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Abnormally High AWS Instances Launched by User + deprecated_id: 2a9b80d3-6340-4345-b5ad-290bf5d0dac4 + replacement_name: Abnormally High Number Of Cloud Instances Launched + replacement_id: f2361e9f-3928-496c-a556-120cd4223a65 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: EC2 Instance Modified With Previously Unseen User + deprecated_id: 56f91724-cf3f-4666-84e1-e3712fb41e76 + replacement_name: Cloud API Calls From Previously Unseen User Roles + replacement_id: 2181ad1f-1e73-4d0c-9780-e8880482a08f + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Windows Valid Account With Never Expires Password + deprecated_id: 73a931db-1830-48b3-8296-cd9cfa09c3c8 + replacement_name: Windows Set Account Password Policy To Unlimited Via Net + replacement_id: 11f93009-8083-43fd-82a7-821fcbdc8342 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Windows hosts file modification + deprecated_id: 06a6fc63-a72d-41dc-8736-7e3dd9612116 + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: MSHTML Module Load in Office Product + deprecated_id: 5f1c168e-118b-11ec-84ff-acde48001122 + replacement_name: Windows Office Product Loaded MSHTML Module + replacement_id: 4cc015c9-687c-40d2-adcc-46350f66e10c + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Abnormally High AWS Instances Terminated by User + deprecated_id: 8d301246-fccf-45e2-a8e7-3655fd14379c + replacement_name: Abnormally High Number Of Cloud Instances Destroyed + replacement_id: ef629fc9-1583-4590-b62a-f2247fbf7bbf + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Web Fraud - Account Harvesting + deprecated_id: bf1d7b5c-df2f-4249-a401-c09fdc221ddf + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Office Spawning Control + deprecated_id: 053e027c-10c7-11ec-8437-acde48001122 + replacement_name: Windows Office Product Spawned Control + replacement_id: 081c485d-ac8d-4bee-ad4c-525772fead4d + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Detect Activity Related to Pass the Hash Attacks + deprecated_id: f5939373-8054-40ad-8c64-cec478a22a4b + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Deleting Of Net Users + deprecated_id: 1c8c6f66-acce-11eb-aafb-acde48001122 + replacement_name: Windows User Deletion Via Net + replacement_id: b0b6fd2c-8953-4d1b-8f7b-56075ea6ab3e + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Suspicious File Write + deprecated_id: 57f76b8a-32f0-42ed-b358-d9fa3ca7bac8 + replacement_name: '' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: AWS EKS Kubernetes cluster sensitive object access + deprecated_id: 7f227943-2196-4d4d-8d6a-ac8cb308e61c + replacement_name: Kubernetes Abuse of Secret by Unusual Location + replacement_id: 40a064c1-4ec1-4381-9e35-61192ba8ef82 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Spectre and Meltdown Vulnerable Systems + deprecated_id: 354be8e0-32cd-4da0-8c47-796de13b60ea + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: EC2 Instance Started With Previously Unseen User + deprecated_id: 22773e84-bac0-4595-b086-20d3f735b4f1 + replacement_name: Cloud Compute Instance Created By Previously Unseen User + replacement_id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Office Product Spawning CertUtil + deprecated_id: 6925fe72-a6d5-11eb-9e17-acde48001122 + replacement_name: Windows Office Product Spawned Uncommon Process + replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Kubernetes GCP detect RBAC authorizations by account + deprecated_id: 99487de3-7192-4b41-939d-fbe9acfb1340 + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Office Application Drop Executable + deprecated_id: 73ce70c4-146d-11ec-9184-acde48001122 + replacement_name: Windows Office Product Dropped Uncommon File + replacement_id: 7ac0fced-9eae-4381-a748-90dcd1aa9393 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Kubernetes Azure active service accounts by pod namespace + deprecated_id: 55a2264a-b7f0-45e5-addd-1e5ab3415c72 + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Kubernetes Azure pod scan fingerprint + deprecated_id: 86aad3e0-732f-4f66-bbbc-70df448e461d + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Detect Spike in Network ACL Activity + deprecated_id: ada0f478-84a8-4641-a1f1-e32372d4bd53 + replacement_name: Abnormally High Number Of Cloud Infrastructure API Calls + replacement_id: 0840ddf1-8c89-46ff-b730-c8d6722478c0 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Suspicious Powershell Command-Line Arguments + deprecated_id: 2cdb91d2-542c-497f-b252-be495e71f38c + replacement_name: Malicious PowerShell Process - Encoded Command + replacement_id: c4db14d9-7909-48b4-a054-aa14d89dbb19 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Office Application Spawn Regsvr32 process + deprecated_id: 2d9fc90c-f11f-11eb-9300-acde48001122 + replacement_name: Windows Office Product Spawned Uncommon Process + replacement_id: 55d8741c-fa32-4692-8109-410304961eb8 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Detect API activity from users without MFA + deprecated_id: 4d46e8bd-4072-48e4-92db-0325889ef894 + replacement_name: AWS Successful Single-Factor Authentication + replacement_id: a520b1fe-cc9e-4f56-b762-18354594c52f + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Kubernetes Azure detect sensitive object access + deprecated_id: 1bba382b-07fd-4ffa-b390-8002739b76e8 + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Web Fraud - Password Sharing Across Accounts + deprecated_id: 31337a1a-53b9-4e05-96e9-55c934cb71d3 + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Disabling Net User Account + deprecated_id: c0325326-acd6-11eb-98c2-acde48001122 + replacement_name: Windows User Disabled Via Net + replacement_id: b0359e05-c87b-4354-83d8-aee0d890243f + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: GCP Detect accounts with high risk roles by project + deprecated_id: 27af8c15-38b0-4408-b339-920170724adb + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Kubernetes GCP detect service accounts forbidden failure access + deprecated_id: 7094808d-432a-48e7-bb3c-77e96c894f3b + replacement_name: '- ' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Extended Period Without Successful Netbackup Backups + deprecated_id: a34aae96-ccf8-4aef-952c-3ea214444440 + replacement_name: '-' + replacement_id: '' + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Office Product Spawning Rundll32 with no DLL + deprecated_id: c661f6be-a38c-11eb-be57-acde48001122 + replacement_name: Windows Office Product Spawned Rundll32 With No DLL + replacement_id: f28e787e-69ca-480e-9f98-ab970e6d4bcc + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Renamed and updated logic +- deprecated_name: Okta ThreatInsight Suspected PasswordSpray Attack + deprecated_id: 25dbad05-6682-4dd5-9ce9-8adecf0d9ae2 + replacement_name: Okta ThreatInsight Threat Detected + replacement_id: 140504ae-5fe2-4d65-b2bc-a211813fbca6 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update +- deprecated_name: Net Localgroup Discovery + deprecated_id: 54f5201e-155b-11ec-a6e2-acde48001122 + replacement_name: Windows Group Discovery Via Net + replacement_id: c5c8e0f3-147a-43da-bf04-4cfaec27dc44 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Both of these analytics were deprecated in favor of c5c8e0f3-147a-43da-bf04-4cfaec27dc44 + / Windows Group Discovery Via Net +- deprecated_name: Uncommon Processes On Endpoint + deprecated_id: 29ccce64-a10c-4389-a45f-337cb29ba1f7 + replacement_name: Attacker Tools On Endpoint + replacement_id: a51bfe1a-94f0-48cc-b4e4-16a110145893 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: '' +- deprecated_name: Dump LSASS via procdump Rename + deprecated_id: 21276daa-663d-11eb-ae93-0242ac130002 + replacement_name: Dump LSASS via procdump + replacement_id: 3742ebfe-64c2-11eb-ae93-0242ac130002 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Updated to a new detection name +- deprecated_name: Okta Two or More Rejected Okta Pushes + deprecated_id: d93f785e-4c2c-4262-b8c7-12b77a13fd39 + replacement_name: Okta Multiple Failed MFA Requests For User + replacement_id: 826dbaae-a1e6-4c8c-b384-d16898956e73 + date: '2025-01-28' + escu_version: 5.0.0 + migration_guide: https://docs.splunk.com/Documentation/ESCU/5.0.0/user/DeprecatedAnalytics + reason: Detections updated to use the new search logic and field names due to the + TA update