diff --git a/deprecated/deprecated_detection_mapping.yml b/deprecated/deprecated_detection_mapping.yml new file mode 100644 index 0000000000..c104358a54 --- /dev/null +++ b/deprecated/deprecated_detection_mapping.yml @@ -0,0 +1,967 @@ +detections: + - deprecated_content: ASL AWS Excessive Security Scanning + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: AWS Cloud Provisioning From Previously Unseen Region + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Provisioning Activity From Previously Unseen Region + - deprecated_content: First time seen command line argument + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Windows connhost exe started forcefully + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Detect Mimikatz Using Loaded Images + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Kubernetes Azure detect sensitive role access + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Web Fraud - Anomalous User Clickspeed + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: EC2 Instance Started With Previously Unseen Instance Type + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Compute Instance Created With Previously Unseen Instance Type + - deprecated_content: EC2 Instance Started With Previously Unseen AMI + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Compute Instance Created With Previously Unseen Image + - deprecated_content: Domain Group Discovery With Net + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Group Discovery Via Net + - deprecated_content: Kubernetes AWS detect sensitive role access + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Winword Spawning Windows Script Host + deprecated_in_version: 5.2.0 + reason: "The following analytics was deprecated in favour of a more generic approach. + Where instead of creating specific analytic for every potentially suspicious child + of an office product. We group them by threat level.\nThis would ease management + and false positives tuning." + replacement_content: + - Windows Office Product Spawned Uncommon Process + - deprecated_content: Winword Spawning PowerShell + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - deprecated_content: Attempted Credential Dump From Registry via Reg exe + deprecated_in_version: 5.2.0 + reason: This analytic had some overlap with another one, hence the deprecation. + It was replaced by 8bbb7d58-b360-11eb-ba21-acde48001122 / Windows Sensitive Registry + Hive Dump Via CommandLine + replacement_content: + - Windows Sensitive Registry Hive Dump Via CommandLine + - deprecated_content: Detect processes used for System Network Configuration Discovery + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Potential System Network Configuration Discovery Activity + - deprecated_content: Execution of File With Spaces Before Extension + deprecated_in_version: 5.2.0 + reason: Updated to a new detection name + replacement_content: + - Execution of File with Multiple Extensions + - deprecated_content: EC2 Instance Started In Previously Unseen Region + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Compute Instance Created In Previously Unused Region + - deprecated_content: Office Document Spawned Child Process To Download + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Spawned Child Process For Download + - deprecated_content: Detect new API calls from user roles + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud API Calls From Previously Unseen User Roles + - deprecated_content: Cmdline Tool Not Executed In CMD Shell + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Cmdline Tool Execution From Non-Shell Process + - deprecated_content: Linux Auditd Find Private Keys + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Linux Auditd Private Keys and Certificate Enumeration + - deprecated_content: Detect AWS API Activities From Unapproved Accounts + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Monitor DNS For Brand Abuse + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Kubernetes GCP detect sensitive object access + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Kubernetes Azure scan fingerprint + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: ASL AWS Password Policy Changes + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: O365 Suspicious Admin Email Forwarding + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - O365 Mailbox Email Forwarding Enabled + - deprecated_content: AWS Cloud Provisioning From Previously Unseen City + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Provisioning Activity From Previously Unseen City + - deprecated_content: Kubernetes AWS detect service accounts forbidden failure access + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Osquery pack - ColdRoot detection + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Windows Modify Registry Reg Restore + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Registry Entries Restored Via Reg + - deprecated_content: Kubernetes GCP detect most active service accounts by pod + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Scheduled tasks used in BadRabbit ransomware + deprecated_in_version: 5.2.0 + reason: Updated to a new detection name + replacement_content: + - Scheduled Task Deleted Or Created via CMD + - deprecated_content: Suspicious Rundll32 Rename + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Remote System Discovery with Net + deprecated_in_version: 5.2.0 + reason: "This analytic was focusing on 2 separate and unrelated type of threats + or actions. It was split into other analytics, namely:\r\n\r\nWindows Network + Share Interaction With Net / 4dc3951f-b3f8-4f46-b412-76a483f72277\r\nWindows Sensitive + Group Discovery With Net / a23a0e20-0b1b-4a07-82e5-ec5f70811e7a" + replacement_content: + - Windows Network Share Interaction With Net + - deprecated_content: Remote System Discovery with Net + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Sensitive Group Discovery With Net + - deprecated_content: DNS Query Requests Resolved by Unauthorized DNS Servers + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Suspicious Changes to File Associations + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: GCP Detect high risk permissions by resource and account + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Office Product Writing cab or inf + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Dropped Cab or Inf File + - deprecated_content: Identify New User Accounts + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Office Product Spawn CMD Process + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - deprecated_content: Windows DLL Search Order Hijacking Hunt + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Windows DLL Search Order Hijacking Hunt with Sysmon + - deprecated_content: ASL AWS CreateAccessKey + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - ASL AWS Create Access Key + - deprecated_content: Okta ThreatInsight Login Failure with High Unknown users + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Detect Spike in Security Group Activity + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Abnormally High Number Of Cloud Security Group API Calls + - deprecated_content: Office Product Spawning BITSAdmin + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - deprecated_content: Create local admin accounts using net exe + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Create Local Administrator Account Via Net + - deprecated_content: Abnormally High AWS Instances Terminated by User - MLTK + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Windows Office Product Spawning MSDT + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Spawned MSDT + - deprecated_content: Detect Spike in AWS API Activity + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Office Product Spawning Windows Script Host + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - deprecated_content: Prohibited Software On Endpoint + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Attacker Tools On Endpoint + - deprecated_content: AWS Cloud Provisioning From Previously Unseen Country + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Provisioning Activity From Previously Unseen Country + - deprecated_content: Detect Critical Alerts from Security Tools + deprecated_in_version: 5.2.0 + reason: As discussed internally, this analytic was too generic for an analyst to + do anything with it. It was deprecated in favor of the more specific approach + provided by analytics such as Microsoft Defender ATP Alerts and Microsoft Defender + Incident Alerts. Going forward analytics from leveraging alerts from vendors will + have their specific analytics. + replacement_content: + - Microsoft Defender ATP Alerts + - deprecated_content: Detect Critical Alerts from Security Tools + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Microsoft Defender Incident Alerts + - deprecated_content: Excel Spawning PowerShell + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - deprecated_content: Office Application Spawn rundll32 process + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - deprecated_content: Excessive Usage Of Net App + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Excessive Usage Of Net App + - deprecated_content: Elevated Group Discovery With Net + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Sensitive Group Discovery With Net + - deprecated_content: Local Account Discovery with Net + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows User Discovery Via Net + - deprecated_content: Windows Command Shell Fetch Env Variables + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows List ENV Variables Via SET Command From Uncommon Parent + - deprecated_content: Suspicious Email - UBA Anomaly + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Detect web traffic to dynamic domain providers + deprecated_in_version: 5.2.0 + reason: Updated to use a different log source + replacement_content: + - Detect hosts connecting to dynamic domain providers + - deprecated_content: Okta Failed SSO Attempts + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Okta Unauthorized Access to Application + - deprecated_content: Kubernetes AWS detect RBAC authorization by account + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Kubernetes Azure detect service accounts forbidden failure access + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Remote Registry Key modifications + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: O365 Suspicious User Email Forwarding + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - O365 Mailbox Email Forwarding Enabled + - deprecated_content: Office Product Spawning MSHTA + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - deprecated_content: Kubernetes AWS detect most active service accounts by pod + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Correlation by Repository and Risk + deprecated_in_version: 5.2.0 + reason: Detections updated to use the datamodel + replacement_content: + - Risk Rule for Dev Sec Ops by Repository + - deprecated_content: Kubernetes Azure detect RBAC authorization by account + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Clients Connecting to Multiple DNS Servers + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Excessive Service Stop Attempt + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Excessive Service Stop Attempt + - deprecated_content: Multiple Okta Users With Invalid Credentials From The Same IP + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Okta Multiple Users Failing To Authenticate From Ip + - deprecated_content: Suspicious writes to System Volume Information + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Detect new user AWS Console Login + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Detect AWS Console Login by New User + - deprecated_content: Domain Account Discovery With Net App + deprecated_in_version: 5.2.0 + reason: "This analytic was a TTP that looked only for commands that tries to query + info about the users via net user /do. This had a couple of issues, such as triggering + on creation of users via the /add flag etc..\nIt was deprecated in favor of a + more tighter approach in 5d0d4830-0133-11ec-bae3-acde48001122" + replacement_content: + - Windows User Discovery Via Net + - deprecated_content: Detection of DNS Tunnels + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Detect DNS requests to Phishing Sites leveraging EvilGinx2 + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Office Document Creating Schedule Task + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Loading Taskschd DLL + - deprecated_content: Okta Account Locked Out + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Okta Multiple Accounts Locked Out + - deprecated_content: Unsuccessful Netbackup backups + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Detect Mimikatz Via PowerShell And EventCode 4703 + deprecated_in_version: 5.2.0 + reason: Updated to a new detection name + replacement_content: + - Detect Mimikatz With PowerShell Script Block Logging + - deprecated_content: Winword Spawning Cmd + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - deprecated_content: GCP Kubernetes cluster scan detection + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Kubernetes Scanning by Unauthenticated IP Address + - deprecated_content: Kubernetes GCP detect suspicious kubectl calls + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: gcp detect oauth token abuse + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Correlation by User and Risk + deprecated_in_version: 5.2.0 + reason: Detections updated to use the datamodel + replacement_content: + - Risk Rule for Dev Sec Ops by Repository + - deprecated_content: Processes created by netsh + deprecated_in_version: 5.2.0 + reason: Updated to a new detection name + replacement_content: + - Processes launching netsh + - deprecated_content: Office Product Spawning Wmic + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - deprecated_content: Extraction of Registry Hives + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Sensitive Registry Hive Dump Via CommandLine + - deprecated_content: Attempt To Stop Security Service + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Attempt To Stop Security Service + - deprecated_content: Windows MSIExec With Network Connections + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows HTTP Network Communication From MSIExec + - deprecated_content: Windows Query Registry Reg Save + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Registry Entries Exported Via Reg + - deprecated_content: Cloud Network Access Control List Deleted + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - AWS Network Access Control List Deleted + - deprecated_content: O365 Suspicious Rights Delegation + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - O365 Elevated Mailbox Permission Assigned + - deprecated_content: Abnormally High AWS Instances Launched by User - MLTK + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Reg exe used to hide files directories via registry keys + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Detect Long DNS TXT Record Response + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Password Policy Discovery with Net + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Password Policy Discovery with Net + - deprecated_content: AWS Cloud Provisioning From Previously Unseen IP Address + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Provisioning Activity From Previously Unseen IP Address + - deprecated_content: Network Connection Discovery With Net + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Network Connection Discovery Via Net + - deprecated_content: Kubernetes Azure detect suspicious kubectl calls + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Kubernetes GCP detect sensitive role access + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Detect Webshell Exploit Behavior + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Suspicious Child Process Spawned From WebServer + - deprecated_content: DNS record changed + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Unsigned Image Loaded by LSASS + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Detect USB device insertion + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Windows Network Share Interaction With Net + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Network Share Interaction Via Net + - deprecated_content: Account Discovery With Net App + deprecated_in_version: 5.2.0 + reason: This analytic was a TTP that focused on unrelated things and called account + discovery. Since there were other detection that overlapped with it. I choose + to deprecate it, and replace it with an updated version of 339805ce-ac30-11eb-b87d-acde48001122 + / Windows Excessive Usage Of Net App. + replacement_content: + - Windows Excessive Usage Of Net App + - deprecated_content: Change Default File Association + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows New Default File Association Value Set + - deprecated_content: Windows Lateral Tool Transfer RemCom + deprecated_in_version: 5.2.0 + reason: Updated to a new detection name + replacement_content: + - Windows Service Execution RemCom + - deprecated_content: Office Document Executing Macro Code + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Loading VBE7 DLL + - deprecated_content: Okta Account Lockout Events + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Okta Multiple Accounts Locked Out + - deprecated_content: Abnormally High AWS Instances Launched by User + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Abnormally High Number Of Cloud Instances Launched + - deprecated_content: EC2 Instance Modified With Previously Unseen User + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud API Calls From Previously Unseen User Roles + - deprecated_content: Windows Valid Account With Never Expires Password + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Set Account Password Policy To Unlimited Via Net + - deprecated_content: Windows hosts file modification + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: MSHTML Module Load in Office Product + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Loaded MSHTML Module + - deprecated_content: Abnormally High AWS Instances Terminated by User + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Abnormally High Number Of Cloud Instances Destroyed + - deprecated_content: Web Fraud - Account Harvesting + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Office Spawning Control + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Spawned Control + - deprecated_content: Detect Activity Related to Pass the Hash Attacks + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Deleting Of Net Users + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows User Deletion Via Net + - deprecated_content: Suspicious File Write + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: AWS EKS Kubernetes cluster sensitive object access + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Kubernetes Abuse of Secret by Unusual Location + - deprecated_content: Spectre and Meltdown Vulnerable Systems + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: EC2 Instance Started With Previously Unseen User + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Compute Instance Created By Previously Unseen User + - deprecated_content: Office Product Spawning CertUtil + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - deprecated_content: Kubernetes GCP detect RBAC authorizations by account + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Office Application Drop Executable + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Dropped Uncommon File + - deprecated_content: Kubernetes Azure active service accounts by pod namespace + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Kubernetes Azure pod scan fingerprint + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Detect Spike in Network ACL Activity + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Abnormally High Number Of Cloud Infrastructure API Calls + - deprecated_content: Suspicious Powershell Command-Line Arguments + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Malicious PowerShell Process - Encoded Command + - deprecated_content: Office Application Spawn Regsvr32 process + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - deprecated_content: Detect API activity from users without MFA + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - AWS Successful Single-Factor Authentication + - deprecated_content: Kubernetes Azure detect sensitive object access + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Web Fraud - Password Sharing Across Accounts + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Disabling Net User Account + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows User Disabled Via Net + - deprecated_content: GCP Detect accounts with high risk roles by project + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Kubernetes GCP detect service accounts forbidden failure access + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Extended Period Without Successful Netbackup Backups + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Office Product Spawning Rundll32 with no DLL + deprecated_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Spawned Rundll32 With No DLL + - deprecated_content: Okta ThreatInsight Suspected PasswordSpray Attack + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Okta ThreatInsight Threat Detected + - deprecated_content: Net Localgroup Discovery + deprecated_in_version: 5.2.0 + reason: Both of these analytics were deprecated in favor of c5c8e0f3-147a-43da-bf04-4cfaec27dc44 + / Windows Group Discovery Via Net + replacement_content: + - Windows Group Discovery Via Net + - deprecated_content: Uncommon Processes On Endpoint + deprecated_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Attacker Tools On Endpoint + - deprecated_content: Dump LSASS via procdump Rename + deprecated_in_version: 5.2.0 + reason: Updated to a new detection name + replacement_content: + - Dump LSASS via procdump + - deprecated_content: Okta Two or More Rejected Okta Pushes + deprecated_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Okta Multiple Failed MFA Requests For User + - deprecated_content: Excel Spawning Windows Script Host + deprecated_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: GitHub Actions Disable Security Workflow + deprecated_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Github Commit Changes In Master + deprecated_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Github Commit In Develop + deprecated_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: GitHub Dependabot Alert + deprecated_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: GitHub Pull Request from Unknown User + deprecated_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Known Services Killed by Ransomware + deprecated_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Remote Desktop Network Bruteforce + deprecated_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Suspicious Driver Loaded Path + deprecated_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Suspicious Event Log Service Behavior + deprecated_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Suspicious Process File Path + deprecated_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Windows Service Stop Via Net and SC Application + deprecated_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity +baselines: + - deprecated_content: Add Prohibited Processes to Enterprise Security + deprecated_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - deprecated_content: Baseline of API Calls per User ARN + deprecated_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - deprecated_content: Baseline of Excessive AWS Instances Launched by User - MLTK + deprecated_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - deprecated_content: Baseline of Excessive AWS Instances Terminated by User - MLTK + deprecated_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - deprecated_content: Previously seen API call per user roles in CloudTrail + deprecated_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - deprecated_content: Previously Seen AWS Provisioning Activity Sources + deprecated_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - deprecated_content: Previously Seen EC2 AMIs + deprecated_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - deprecated_content: Previously Seen EC2 Instance Types + deprecated_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - deprecated_content: Previously Seen EC2 Launches By User + deprecated_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - deprecated_content: Previously seen users in CloudTrail + deprecated_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - deprecated_content: Update previously seen users in CloudTrail + deprecated_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' +investigations: + - deprecated_content: All backup logs for host + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Amazon EKS Kubernetes activity by src ip + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: AWS Investigate Security Hub alerts by dest + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: AWS Investigate User Activities By AccessKeyId + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: AWS Investigate User Activities By ARN + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: AWS Network ACL Details from ID + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: AWS Network Interface details via resourceId + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: AWS S3 Bucket details via bucketName + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: GCP Kubernetes activity by src ip + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get All AWS Activity From City + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get All AWS Activity From Country + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get All AWS Activity From IP Address + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get All AWS Activity From Region + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get Backup Logs For Endpoint + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get Certificate logs for a domain + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get DNS Server History for a host + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get DNS traffic ratio + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get EC2 Instance Details by instanceId + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get EC2 Launch Details + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get Email Info + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get Emails From Specific Sender + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get First Occurrence and Last Occurrence of a MAC Address + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get History Of Email Sources + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get Logon Rights Modifications For Endpoint + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get Logon Rights Modifications For User + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get Notable History + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get Outbound Emails to Hidden Cobra Threat Actors + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get Parent Process Info + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get Process File Activity + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get Process Info + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get Process Information For Port Activity + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get Process Responsible For The DNS Traffic + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get Sysmon WMI Activity for Host + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Get Web Session Information via session id + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Investigate AWS activities via region name + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Investigate AWS User Activities by user field + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Investigate Failed Logins for Multiple Destinations + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Investigate Network Traffic From src ip + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Investigate Okta Activity by app + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Investigate Okta Activity by IP Address + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Investigate Pass the Hash Attempts + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Investigate Pass the Ticket Attempts + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Investigate Previous Unseen User + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Investigate Successful Remote Desktop Authentications + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Investigate Suspicious Strings in HTTP Header + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Investigate User Activities In Okta + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - deprecated_content: Investigate Web POSTs From src + deprecated_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' +stories: + - deprecated_content: AWS Cryptomining + deprecated_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Cloud Cryptomining + - deprecated_content: AWS Suspicious Provisioning Activities + deprecated_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Suspicious Cloud Provisioning Activities + - deprecated_content: Common Phishing Frameworks + deprecated_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Container Implantation Monitoring and Investigation + deprecated_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Kubernetes Security + - deprecated_content: Host Redirection + deprecated_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Kubernetes Sensitive Role Activity + deprecated_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Kubernetes Security + - deprecated_content: Lateral Movement + deprecated_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Compromised User Account + - deprecated_content: Monitor Backup Solution + deprecated_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Monitor for Unauthorized Software + deprecated_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Office 365 Detections + deprecated_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Office 365 Account Takeover + - deprecated_content: Spectre And Meltdown Vulnerabilities + deprecated_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Suspicious AWS EC2 Activities + deprecated_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Suspicious Cloud Instance Activities + - deprecated_content: Unusual AWS EC2 Modifications + deprecated_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Suspicious Cloud Instance Activities + - deprecated_content: Web Fraud Detection + deprecated_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + - deprecated_content: Nexus APT Threat Activity + deprecated_in_version: 5.4.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - China-Nexus Threat Activity \ No newline at end of file diff --git a/lookups/deprecation_info.csv b/lookups/deprecation_info.csv new file mode 100644 index 0000000000..ca41e89981 --- /dev/null +++ b/lookups/deprecation_info.csv @@ -0,0 +1,195 @@ +Name,Content Type,Deprecated in Version,Reason,Migration Guide,Replacement Content +ESCU - ASL AWS Excessive Security Scanning - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/5aba1860-9617-4af9-b19d-aecac16fe4f2 +ESCU - First time seen command line argument - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Windows connhost exe started forcefully - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Detect Mimikatz Using Loaded Images - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Kubernetes Azure detect sensitive role access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Web Fraud - Anomalous User Clickspeed - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/c6ddbf53-9715-49f3-bb4c-fb2e8a309cda +ESCU - EC2 Instance Started With Previously Unseen AMI - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/bc24922d-987c-4645-b288-f8c73ec194c4 +ESCU - Domain Group Discovery With Net - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/c5c8e0f3-147a-43da-bf04-4cfaec27dc44 +ESCU - Kubernetes AWS detect sensitive role access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Winword Spawning Windows Script Host - Rule,Detection,5.2.0,"The following analytics was deprecated in favour of a more generic approach. Where instead of creating specific analytic for every potentially suspicious child of an office product. We group them by threat level. +This would ease management and false positives tuning.",https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Winword Spawning PowerShell - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Attempted Credential Dump From Registry via Reg exe - Rule,Detection,5.2.0,"This analytic had some overlap with another one, hence the deprecation. It was replaced by 8bbb7d58-b360-11eb-ba21-acde48001122 / Windows Sensitive Registry Hive Dump Via CommandLine",https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/5aaff29d-0cce-405b-9ee8-5d06b49d045e +ESCU - Detect processes used for System Network Configuration Discovery - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/3f0b95e3-3195-46ac-bea3-84fb59e7fac5 +ESCU - Execution of File With Spaces Before Extension - Rule,Detection,5.2.0,Updated to a new detection name,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/b06a555e-dce0-417d-a2eb-28a5d8d66ef7 +ESCU - EC2 Instance Started In Previously Unseen Region - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/fa4089e2-50e3-40f7-8469-d2cc1564ca59 +ESCU - Office Document Spawned Child Process To Download - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/f02b64b8-cbea-4f75-bf77-7a05111566b1 +ESCU - Detect new API calls from user roles - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/2181ad1f-1e73-4d0c-9780-e8880482a08f +ESCU - Cmdline Tool Not Executed In CMD Shell - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/2afa393f-b88d-41b7-9793-623c93a2dfde +ESCU - Linux Auditd Find Private Keys - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/892eb674-3344-4143-8e52-4775b1daf3f1 +ESCU - Detect AWS API Activities From Unapproved Accounts - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Monitor DNS For Brand Abuse - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Kubernetes GCP detect sensitive object access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Kubernetes Azure scan fingerprint - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - ASL AWS Password Policy Changes - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - O365 Suspicious Admin Email Forwarding - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/0b6bc75c-05d1-4101-9fc3-97e706168f24 +ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/e7ecc5e0-88df-48b9-91af-51104c68f02f +ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Osquery pack - ColdRoot detection - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Windows Modify Registry Reg Restore - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/a17af481-e2ad-494c-9da6-afb4d243a019 +ESCU - Kubernetes GCP detect most active service accounts by pod - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Scheduled tasks used in BadRabbit ransomware - Rule,Detection,5.2.0,Updated to a new detection name,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/d5af132c-7c17-439c-9d31-13d55340f36c +ESCU - Suspicious Rundll32 Rename - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Remote System Discovery with Net - Rule,Detection,5.2.0,"This analytic was focusing on 2 separate and unrelated type of threats or actions. It was split into other analytics, namely: + +Windows Network Share Interaction With Net / 4dc3951f-b3f8-4f46-b412-76a483f72277 +Windows Sensitive Group Discovery With Net / a23a0e20-0b1b-4a07-82e5-ec5f70811e7a",https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/4dc3951f-b3f8-4f46-b412-76a483f72277 +ESCU - Remote System Discovery with Net - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/d9eb7cda-5622-4722-bc88-7f2442f4b5af +ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Suspicious Changes to File Associations - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - GCP Detect high risk permissions by resource and account - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Office Product Writing cab or inf - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/dbdd251e-dd45-4ec9-a555-f5e151391746 +ESCU - Identify New User Accounts - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Office Product Spawn CMD Process - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Windows DLL Search Order Hijacking Hunt - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/79c7d1fc-64c7-91be-a616-ccda752efe81 +ESCU - ASL AWS CreateAccessKey - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/81a9f2fe-1697-473c-af1d-086b0d8b63c8 +ESCU - Okta ThreatInsight Login Failure with High Unknown users - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Detect Spike in Security Group Activity - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/d4dfb7f3-7a37-498a-b5df-f19334e871af +ESCU - Office Product Spawning BITSAdmin - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Create local admin accounts using net exe - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/2c568c34-bb57-4b43-9d75-19c605b98e70 +ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Windows Office Product Spawning MSDT - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/a3148fad-3734-4b7f-9a71-62f08d39fab1 +ESCU - Detect Spike in AWS API Activity - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Office Product Spawning Windows Script Host - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Prohibited Software On Endpoint - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/a51bfe1a-94f0-48cc-b4e4-16a110145893 +ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/94994255-3acf-4213-9b3f-0494df03bb31 +ESCU - Detect Critical Alerts from Security Tools - Rule,Detection,5.2.0,"As discussed internally, this analytic was too generic for an analyst to do anything with it. It was deprecated in favor of the more specific approach provided by analytics such as Microsoft Defender ATP Alerts and Microsoft Defender Incident Alerts. Going forward analytics from leveraging alerts from vendors will have their specific analytics.",https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/38f034ed-1598-46c8-95e8-14edf05fdf5d +ESCU - Detect Critical Alerts from Security Tools - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/13435b55-afd8-46d4-9045-7d5457f430a5 +ESCU - Excel Spawning PowerShell - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Office Application Spawn rundll32 process - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Excessive Usage Of Net App - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/355ba810-0a20-4215-8485-9ce3f87f2e38 +ESCU - Elevated Group Discovery With Net - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/d9eb7cda-5622-4722-bc88-7f2442f4b5af +ESCU - Local Account Discovery with Net - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/7742987e-88c1-476b-a626-a869e088ab72 +ESCU - Windows Command Shell Fetch Env Variables - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/aec157f4-8783-4584-aca6-754c4dc7fba9 +ESCU - Suspicious Email - UBA Anomaly - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Detect web traffic to dynamic domain providers - Rule,Detection,5.2.0,Updated to use a different log source,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/a1e761ac-1344-4dbd-88b2-3f34c912d359 +ESCU - Okta Failed SSO Attempts - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/5f661629-9750-4cb9-897c-1f05d6db8727 +ESCU - Kubernetes AWS detect RBAC authorization by account - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Remote Registry Key modifications - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - O365 Suspicious User Email Forwarding - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/0b6bc75c-05d1-4101-9fc3-97e706168f24 +ESCU - Office Product Spawning MSHTA - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Kubernetes AWS detect most active service accounts by pod - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Correlation by Repository and Risk - Rule,Detection,5.2.0,Detections updated to use the datamodel,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/161bc0ca-4651-4c13-9c27-27770660cf67 +ESCU - Kubernetes Azure detect RBAC authorization by account - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Clients Connecting to Multiple DNS Servers - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Excessive Service Stop Attempt - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/8f3a614f-6b98-4f7d-82dd-d0df38452a8b +ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/de365ffa-42f5-46b5-b43f-fa72290b8218 +ESCU - Suspicious writes to System Volume Information - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Detect new user AWS Console Login - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/bc91a8cd-35e7-4bb2-6140-e756cc46fd71 +ESCU - Domain Account Discovery With Net App - Rule,Detection,5.2.0,"This analytic was a TTP that looked only for commands that tries to query info about the users via net user /do. This had a couple of issues, such as triggering on creation of users via the /add flag etc.. +It was deprecated in favor of a more tighter approach in 5d0d4830-0133-11ec-bae3-acde48001122",https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/7742987e-88c1-476b-a626-a869e088ab72 +ESCU - Detection of DNS Tunnels - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Office Document Creating Schedule Task - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/d7297cfa-1f04-4714-bfbe-3679e0666959 +ESCU - Okta Account Locked Out - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/a511426e-184f-4de6-8711-cfd2af29d1e1 +ESCU - Unsuccessful Netbackup backups - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule,Detection,5.2.0,Updated to a new detection name,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/8148c29c-c952-11eb-9255-acde48001122 +ESCU - Winword Spawning Cmd - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - GCP Kubernetes cluster scan detection - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/f9cadf4e-df22-4f4e-a08f-9d3344c2165d +ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - gcp detect oauth token abuse - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Correlation by User and Risk - Rule,Detection,5.2.0,Detections updated to use the datamodel,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/161bc0ca-4651-4c13-9c27-27770660cf67 +ESCU - Processes created by netsh - Rule,Detection,5.2.0,Updated to a new detection name,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/b89919ed-fe5f-492c-b139-95dbb162040e +ESCU - Office Product Spawning Wmic - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Extraction of Registry Hives - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/5aaff29d-0cce-405b-9ee8-5d06b49d045e +ESCU - Attempt To Stop Security Service - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/9ed27cea-4e27-4eff-b2c6-aac9e78a7517 +ESCU - Windows MSIExec With Network Connections - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/b0fd38c7-f71a-43a2-870e-f3ca06bcdd99 +ESCU - Windows Query Registry Reg Save - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/466379bc-0f47-476c-8202-16ef38112e0d +ESCU - Cloud Network Access Control List Deleted - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/ada0f478-84a8-4641-a3f1-d82362d6fd75 +ESCU - O365 Suspicious Rights Delegation - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/2246c142-a678-45f8-8546-aaed7e0efd30 +ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Reg exe used to hide files directories via registry keys - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Detect Long DNS TXT Record Response - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Password Policy Discovery with Net - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/e52f7865-be78-46bf-b7ed-150fbe447613 +ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/f86a8ec9-b042-45eb-92f4-e9ed1d781078 +ESCU - Network Connection Discovery With Net - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/86a5b949-679b-4197-8d4c-9c180a818c45 +ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Kubernetes GCP detect sensitive role access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Detect Webshell Exploit Behavior - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/2d4470ef-7158-4b47-b68b-1f7f16382156 +ESCU - DNS record changed - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Unsigned Image Loaded by LSASS - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Detect USB device insertion - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Windows Network Share Interaction With Net - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/e51fbdb0-0be0-474f-92ea-d289f71a695e +ESCU - Account Discovery With Net App - Rule,Detection,5.2.0,"This analytic was a TTP that focused on unrelated things and called account discovery. Since there were other detection that overlapped with it. I choose to deprecate it, and replace it with an updated version of 339805ce-ac30-11eb-b87d-acde48001122 / Windows Excessive Usage Of Net App.",https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/355ba810-0a20-4215-8485-9ce3f87f2e38 +ESCU - Change Default File Association - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/7d1f031f-f1c9-43be-8b0b-c4e3e8a8928a +ESCU - Windows Lateral Tool Transfer RemCom - Rule,Detection,5.2.0,Updated to a new detection name,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/7e3d68db-ea4d-419b-adbd-e14a525ecf09 +ESCU - Office Document Executing Macro Code - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/7cfec906-2697-43f7-898b-83634a051d9a +ESCU - Okta Account Lockout Events - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/a511426e-184f-4de6-8711-cfd2af29d1e1 +ESCU - Abnormally High AWS Instances Launched by User - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/f2361e9f-3928-496c-a556-120cd4223a65 +ESCU - EC2 Instance Modified With Previously Unseen User - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/2181ad1f-1e73-4d0c-9780-e8880482a08f +ESCU - Windows Valid Account With Never Expires Password - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/11f93009-8083-43fd-82a7-821fcbdc8342 +ESCU - Windows hosts file modification - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - MSHTML Module Load in Office Product - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/4cc015c9-687c-40d2-adcc-46350f66e10c +ESCU - Abnormally High AWS Instances Terminated by User - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/ef629fc9-1583-4590-b62a-f2247fbf7bbf +ESCU - Web Fraud - Account Harvesting - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Office Spawning Control - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/081c485d-ac8d-4bee-ad4c-525772fead4d +ESCU - Detect Activity Related to Pass the Hash Attacks - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Deleting Of Net Users - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/b0b6fd2c-8953-4d1b-8f7b-56075ea6ab3e +ESCU - Suspicious File Write - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/40a064c1-4ec1-4381-9e35-61192ba8ef82 +ESCU - Spectre and Meltdown Vulnerable Systems - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - EC2 Instance Started With Previously Unseen User - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/37a0ec8d-827e-4d6d-8025-cedf31f3a149 +ESCU - Office Product Spawning CertUtil - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Office Application Drop Executable - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/7ac0fced-9eae-4381-a748-90dcd1aa9393 +ESCU - Kubernetes Azure active service accounts by pod namespace - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Kubernetes Azure pod scan fingerprint - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Detect Spike in Network ACL Activity - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/0840ddf1-8c89-46ff-b730-c8d6722478c0 +ESCU - Suspicious Powershell Command-Line Arguments - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/c4db14d9-7909-48b4-a054-aa14d89dbb19 +ESCU - Office Application Spawn Regsvr32 process - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Detect API activity from users without MFA - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/a520b1fe-cc9e-4f56-b762-18354594c52f +ESCU - Kubernetes Azure detect sensitive object access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Web Fraud - Password Sharing Across Accounts - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Disabling Net User Account - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/b0359e05-c87b-4354-83d8-aee0d890243f +ESCU - GCP Detect accounts with high risk roles by project - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Extended Period Without Successful Netbackup Backups - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Office Product Spawning Rundll32 with no DLL - Rule,Detection,5.2.0,Renamed and updated logic,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/f28e787e-69ca-480e-9f98-ab970e6d4bcc +ESCU - Okta ThreatInsight Suspected PasswordSpray Attack - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/140504ae-5fe2-4d65-b2bc-a211813fbca6 +ESCU - Net Localgroup Discovery - Rule,Detection,5.2.0,Both of these analytics were deprecated in favor of c5c8e0f3-147a-43da-bf04-4cfaec27dc44 / Windows Group Discovery Via Net,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/c5c8e0f3-147a-43da-bf04-4cfaec27dc44 +ESCU - Uncommon Processes On Endpoint - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/a51bfe1a-94f0-48cc-b4e4-16a110145893 +ESCU - Dump LSASS via procdump Rename - Rule,Detection,5.2.0,Updated to a new detection name,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/3742ebfe-64c2-11eb-ae93-0242ac130002 +ESCU - Okta Two or More Rejected Okta Pushes - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,https://research.splunk.com/migration_guide/,https://research.splunk.com/detections/826dbaae-a1e6-4c8c-b384-d16898956e73 +ESCU - Excel Spawning Windows Script Host - Rule,Detection,5.3.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - GitHub Actions Disable Security Workflow - Rule,Detection,5.3.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Github Commit Changes In Master - Rule,Detection,5.3.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Github Commit In Develop - Rule,Detection,5.3.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - GitHub Dependabot Alert - Rule,Detection,5.3.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - GitHub Pull Request from Unknown User - Rule,Detection,5.3.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Known Services Killed by Ransomware - Rule,Detection,5.3.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Remote Desktop Network Bruteforce - Rule,Detection,5.3.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Suspicious Driver Loaded Path - Rule,Detection,5.3.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Suspicious Event Log Service Behavior - Rule,Detection,5.3.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Suspicious Process File Path - Rule,Detection,5.3.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Windows Service Stop Via Net and SC Application - Rule,Detection,5.3.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +ESCU - Add Prohibited Processes to Enterprise Security,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",https://research.splunk.com/migration_guide/, +ESCU - Baseline of API Calls per User ARN,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",https://research.splunk.com/migration_guide/, +ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",https://research.splunk.com/migration_guide/, +ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",https://research.splunk.com/migration_guide/, +ESCU - Previously seen API call per user roles in CloudTrail,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",https://research.splunk.com/migration_guide/, +ESCU - Previously Seen AWS Provisioning Activity Sources,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",https://research.splunk.com/migration_guide/, +ESCU - Previously Seen EC2 AMIs,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",https://research.splunk.com/migration_guide/, +ESCU - Previously Seen EC2 Instance Types,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",https://research.splunk.com/migration_guide/, +ESCU - Previously Seen EC2 Launches By User,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",https://research.splunk.com/migration_guide/, +ESCU - Previously seen users in CloudTrail,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",https://research.splunk.com/migration_guide/, +ESCU - Update previously seen users in CloudTrail,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",https://research.splunk.com/migration_guide/, +AWS Cryptomining,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +AWS Suspicious Provisioning Activities,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +Common Phishing Frameworks,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +Container Implantation Monitoring and Investigation,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +Host Redirection,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +Kubernetes Sensitive Role Activity,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +Lateral Movement,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +Monitor Backup Solution,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +Monitor for Unauthorized Software,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +Office 365 Detections,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +Spectre And Meltdown Vulnerabilities,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +Suspicious AWS EC2 Activities,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +Unusual AWS EC2 Modifications,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +Web Fraud Detection,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, +Nexus APT Threat Activity,Story,5.4.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,https://research.splunk.com/migration_guide/, diff --git a/lookups/deprecation_info.yml b/lookups/deprecation_info.yml new file mode 100644 index 0000000000..dab74f8b34 --- /dev/null +++ b/lookups/deprecation_info.yml @@ -0,0 +1,9 @@ +name: deprecation_info +date: 2025-03-14 +version: 1 +id: d83dad4f-7bce-4979-bf07-a88c610da5f6 +author: Splunk Threat Research Team +lookup_type: csv +default_match: false +description: A lookup file for deprecation information +min_matches: 1