diff --git a/baselines/deprecated/.gitkeep b/baselines/deprecated/.gitkeep new file mode 100644 index 0000000000..e69de29bb2 diff --git a/baselines/previously_seen_aws_cross_account_activity___initial.yml b/baselines/deprecated/previously_seen_aws_cross_account_activity___initial.yml similarity index 98% rename from baselines/previously_seen_aws_cross_account_activity___initial.yml rename to baselines/deprecated/previously_seen_aws_cross_account_activity___initial.yml index 6fad8d0f18..3cc411008a 100644 --- a/baselines/previously_seen_aws_cross_account_activity___initial.yml +++ b/baselines/deprecated/previously_seen_aws_cross_account_activity___initial.yml @@ -4,7 +4,7 @@ version: 1 date: '2020-08-15' author: Rico Valdez, Splunk type: Baseline -status: production +status: deprecated description: This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. diff --git a/baselines/previously_seen_aws_cross_account_activity___update.yml b/baselines/deprecated/previously_seen_aws_cross_account_activity___update.yml similarity index 98% rename from baselines/previously_seen_aws_cross_account_activity___update.yml rename to baselines/deprecated/previously_seen_aws_cross_account_activity___update.yml index 9cb9c956b9..bc8eee0872 100644 --- a/baselines/previously_seen_aws_cross_account_activity___update.yml +++ b/baselines/deprecated/previously_seen_aws_cross_account_activity___update.yml @@ -4,7 +4,7 @@ version: 1 date: '2020-08-15' author: Rico Valdez, Splunk type: Baseline -status: production +status: deprecated description: This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. diff --git a/contentctl.yml b/contentctl.yml index 0fcd575b4a..0fec06f9bf 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 5.1.1 + version: 5.2.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU diff --git a/detections/deprecated/.gitkeep b/detections/deprecated/.gitkeep new file mode 100644 index 0000000000..e69de29bb2 diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index a983aeb31d..b4a9c676c9 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -1,7 +1,7 @@ name: Attacker Tools On Endpoint id: a51bfe1a-94f0-48cc-b4e4-16a110145893 -version: 8 -date: '2025-02-10' +version: 9 +date: '2025-02-27' author: Bhavin Patel, Splunk status: production type: TTP @@ -66,7 +66,6 @@ rba: tags: analytic_story: - XMRig - - Monitor for Unauthorized Software - Unusual Processes - SamSam Ransomware - CISA AA22-264A diff --git a/lookups/deprecation_info.csv b/lookups/deprecation_info.csv new file mode 100644 index 0000000000..743562a38e --- /dev/null +++ b/lookups/deprecation_info.csv @@ -0,0 +1,207 @@ +Name,Content Type,Removed in Version,Reason,Replacement Content,Replacement Content Link +ESCU - Previously Seen AWS Cross Account Activity - Initial,Baseline,5.4.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Previously Seen AWS Cross Account Activity - Update,Baseline,5.4.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - AWS SAML Access by Provider User and Principal - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - GitHub Actions Disable Security Workflow - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - GitHub Dependabot Alert - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - GitHub Pull Request from Unknown User - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Github Commit Changes In Master - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Github Commit In Develop - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Known Services Killed by Ransomware - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Remote Desktop Network Bruteforce - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Suspicious Driver Loaded Path - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Suspicious Event Log Service Behavior - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Suspicious Process File Path - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - aws detect attach to role policy - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - aws detect permanent key creation - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - aws detect role creation - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - aws detect sts assume role abuse - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - aws detect sts get session token abuse - Rule,Detection,5.4.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +Nexus APT Threat Activity,Story,5.4.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,China-Nexus Threat Activity,https://research.splunk.com/stories/china_nexus_threat_activity +ESCU - Add Prohibited Processes to Enterprise Security,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Baseline of API Calls per User ARN,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Monitor Successful Backups,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Monitor Unsuccessful Backups,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Previously Seen AWS Provisioning Activity Sources,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Previously Seen AWS Regions,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Previously Seen EC2 AMIs,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Previously Seen EC2 Instance Types,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Previously Seen EC2 Launches By User,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Previously Seen EC2 Modifications By User,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Previously seen API call per user roles in CloudTrail,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Previously seen users in CloudTrail,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Systems Ready for Spectre-Meltdown Windows Patch,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - Update previously seen users in CloudTrail,Baseline,5.2.0,"All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.",No Replacement Content Available,No Content Link Available +ESCU - ASL AWS CreateAccessKey - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - ASL AWS Create Access Key - Rule,https://research.splunk.com/cloud/81a9f2fe-1697-473c-af1d-086b0d8b63c8 +ESCU - ASL AWS Excessive Security Scanning - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - ASL AWS Password Policy Changes - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule,https://research.splunk.com/cloud/e7ecc5e0-88df-48b9-91af-51104c68f02f +ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule,https://research.splunk.com/cloud/94994255-3acf-4213-9b3f-0494df03bb31 +ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule,https://research.splunk.com/cloud/f86a8ec9-b042-45eb-92f4-e9ed1d781078 +ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule,https://research.splunk.com/cloud/5aba1860-9617-4af9-b19d-aecac16fe4f2 +ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Kubernetes Abuse of Secret by Unusual Location - Rule,https://research.splunk.com/cloud/40a064c1-4ec1-4381-9e35-61192ba8ef82 +ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Abnormally High AWS Instances Launched by User - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Abnormally High Number Of Cloud Instances Launched - Rule,https://research.splunk.com/cloud/f2361e9f-3928-496c-a556-120cd4223a65 +ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Abnormally High AWS Instances Terminated by User - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule,https://research.splunk.com/cloud/ef629fc9-1583-4590-b62a-f2247fbf7bbf +ESCU - Account Discovery With Net App - Rule,Detection,5.2.0,"This analytic was a TTP that focused on unrelated things and called account discovery. Since there were other detection that overlapped with it. I choose to deprecate it, and replace it with an updated version of 339805ce-ac30-11eb-b87d-acde48001122 / Windows Excessive Usage Of Net App.",ESCU - Windows Excessive Usage Of Net App - Rule,https://research.splunk.com/endpoint/355ba810-0a20-4215-8485-9ce3f87f2e38 +ESCU - Attempt To Stop Security Service - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Attempt To Stop Security Service - Rule,https://research.splunk.com/endpoint/9ed27cea-4e27-4eff-b2c6-aac9e78a7517 +ESCU - Attempted Credential Dump From Registry via Reg exe - Rule,Detection,5.2.0,"This analytic had some overlap with another one, hence the deprecation. It was replaced by 8bbb7d58-b360-11eb-ba21-acde48001122 / Windows Sensitive Registry Hive Dump Via CommandLine",ESCU - Windows Sensitive Registry Hive Dump Via CommandLine - Rule,https://research.splunk.com/endpoint/5aaff29d-0cce-405b-9ee8-5d06b49d045e +ESCU - Change Default File Association - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows New Default File Association Value Set - Rule,https://research.splunk.com/endpoint/7d1f031f-f1c9-43be-8b0b-c4e3e8a8928a +ESCU - Clients Connecting to Multiple DNS Servers - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Cloud Network Access Control List Deleted - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - AWS Network Access Control List Deleted - Rule,https://research.splunk.com/cloud/ada0f478-84a8-4641-a3f1-d82362d6fd75 +ESCU - Cmdline Tool Not Executed In CMD Shell - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Cmdline Tool Execution From Non-Shell Process - Rule,https://research.splunk.com/endpoint/2afa393f-b88d-41b7-9793-623c93a2dfde +ESCU - Correlation by Repository and Risk - Rule,Detection,5.2.0,Detections updated to use the datamodel,ESCU - Risk Rule for Dev Sec Ops by Repository - Rule,https://research.splunk.com/cloud/161bc0ca-4651-4c13-9c27-27770660cf67 +ESCU - Correlation by User and Risk - Rule,Detection,5.2.0,Detections updated to use the datamodel,ESCU - Risk Rule for Dev Sec Ops by Repository - Rule,https://research.splunk.com/cloud/161bc0ca-4651-4c13-9c27-27770660cf67 +ESCU - Create local admin accounts using net exe - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Create Local Administrator Account Via Net - Rule,https://research.splunk.com/endpoint/2c568c34-bb57-4b43-9d75-19c605b98e70 +ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - DNS record changed - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Deleting Of Net Users - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows User Deletion Via Net - Rule,https://research.splunk.com/endpoint/b0b6fd2c-8953-4d1b-8f7b-56075ea6ab3e +ESCU - Detect API activity from users without MFA - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - AWS Successful Single-Factor Authentication - Rule,https://research.splunk.com/cloud/a520b1fe-cc9e-4f56-b762-18354594c52f +ESCU - Detect AWS API Activities From Unapproved Accounts - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Detect Activity Related to Pass the Hash Attacks - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Detect Critical Alerts from Security Tools - Rule,Detection,5.2.0,"As discussed internally, this analytic was too generic for an analyst to do anything with it. It was deprecated in favor of the more specific approach provided by analytics such as Microsoft Defender ATP Alerts and Microsoft Defender Incident Alerts. Going forward analytics from leveraging alerts from vendors will have their specific analytics.",ESCU - Microsoft Defender ATP Alerts - Rule,https://research.splunk.com/endpoint/38f034ed-1598-46c8-95e8-14edf05fdf5d +ESCU - Detect Critical Alerts from Security Tools - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Microsoft Defender Incident Alerts - Rule,https://research.splunk.com/endpoint/13435b55-afd8-46d4-9045-7d5457f430a5 +ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Detect Long DNS TXT Record Response - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Detect Mimikatz Using Loaded Images - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule,Detection,5.2.0,Updated to a new detection name,ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule,https://research.splunk.com/endpoint/8148c29c-c952-11eb-9255-acde48001122 +ESCU - Detect Spike in AWS API Activity - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Detect Spike in Network ACL Activity - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule,https://research.splunk.com/cloud/0840ddf1-8c89-46ff-b730-c8d6722478c0 +ESCU - Detect Spike in Security Group Activity - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule,https://research.splunk.com/cloud/d4dfb7f3-7a37-498a-b5df-f19334e871af +ESCU - Detect USB device insertion - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Detect Webshell Exploit Behavior - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Suspicious Child Process Spawned From WebServer - Rule,https://research.splunk.com/endpoint/2d4470ef-7158-4b47-b68b-1f7f16382156 +ESCU - Detect new API calls from user roles - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Cloud API Calls From Previously Unseen User Roles - Rule,https://research.splunk.com/cloud/2181ad1f-1e73-4d0c-9780-e8880482a08f +ESCU - Detect new user AWS Console Login - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Detect AWS Console Login by New User - Rule,https://research.splunk.com/cloud/bc91a8cd-35e7-4bb2-6140-e756cc46fd71 +ESCU - Detect processes used for System Network Configuration Discovery - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Potential System Network Configuration Discovery Activity - Rule,https://research.splunk.com/endpoint/3f0b95e3-3195-46ac-bea3-84fb59e7fac5 +ESCU - Detect web traffic to dynamic domain providers - Rule,Detection,5.2.0,Updated to use a different log source,ESCU - Detect hosts connecting to dynamic domain providers - Rule,https://research.splunk.com/network/a1e761ac-1344-4dbd-88b2-3f34c912d359 +ESCU - Detection of DNS Tunnels - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Disabling Net User Account - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows User Disabled Via Net - Rule,https://research.splunk.com/endpoint/b0359e05-c87b-4354-83d8-aee0d890243f +ESCU - Domain Account Discovery With Net App - Rule,Detection,5.2.0,"This analytic was a TTP that looked only for commands that tries to query info about the users via net user /do. This had a couple of issues, such as triggering on creation of users via the /add flag etc.. +It was deprecated in favor of a more tighter approach in 5d0d4830-0133-11ec-bae3-acde48001122",ESCU - Windows User Discovery Via Net - Rule,https://research.splunk.com/endpoint/7742987e-88c1-476b-a626-a869e088ab72 +ESCU - Domain Group Discovery With Net - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Group Discovery Via Net - Rule,https://research.splunk.com/endpoint/c5c8e0f3-147a-43da-bf04-4cfaec27dc44 +ESCU - Dump LSASS via procdump Rename - Rule,Detection,5.2.0,Updated to a new detection name,ESCU - Dump LSASS via procdump - Rule,https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002 +ESCU - EC2 Instance Modified With Previously Unseen User - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Cloud API Calls From Previously Unseen User Roles - Rule,https://research.splunk.com/cloud/2181ad1f-1e73-4d0c-9780-e8880482a08f +ESCU - EC2 Instance Started In Previously Unseen Region - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule,https://research.splunk.com/cloud/fa4089e2-50e3-40f7-8469-d2cc1564ca59 +ESCU - EC2 Instance Started With Previously Unseen AMI - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule,https://research.splunk.com/cloud/bc24922d-987c-4645-b288-f8c73ec194c4 +ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule,https://research.splunk.com/cloud/c6ddbf53-9715-49f3-bb4c-fb2e8a309cda +ESCU - EC2 Instance Started With Previously Unseen User - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule,https://research.splunk.com/cloud/37a0ec8d-827e-4d6d-8025-cedf31f3a149 +ESCU - Elevated Group Discovery With Net - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Sensitive Group Discovery With Net - Rule,https://research.splunk.com/endpoint/d9eb7cda-5622-4722-bc88-7f2442f4b5af +ESCU - Excel Spawning PowerShell - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Excel Spawning Windows Script Host - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Excessive Service Stop Attempt - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Excessive Service Stop Attempt - Rule,https://research.splunk.com/endpoint/8f3a614f-6b98-4f7d-82dd-d0df38452a8b +ESCU - Excessive Usage Of Net App - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Excessive Usage Of Net App - Rule,https://research.splunk.com/endpoint/355ba810-0a20-4215-8485-9ce3f87f2e38 +ESCU - Execution of File With Spaces Before Extension - Rule,Detection,5.2.0,Updated to a new detection name,ESCU - Execution of File with Multiple Extensions - Rule,https://research.splunk.com/endpoint/b06a555e-dce0-417d-a2eb-28a5d8d66ef7 +ESCU - Extended Period Without Successful Netbackup Backups - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Extraction of Registry Hives - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Sensitive Registry Hive Dump Via CommandLine - Rule,https://research.splunk.com/endpoint/5aaff29d-0cce-405b-9ee8-5d06b49d045e +ESCU - First time seen command line argument - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - GCP Detect accounts with high risk roles by project - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - GCP Detect high risk permissions by resource and account - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - GCP Kubernetes cluster scan detection - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Kubernetes Scanning by Unauthenticated IP Address - Rule,https://research.splunk.com/cloud/f9cadf4e-df22-4f4e-a08f-9d3344c2165d +ESCU - Identify New User Accounts - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes AWS detect RBAC authorization by account - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes AWS detect most active service accounts by pod - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes AWS detect sensitive role access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes Azure active service accounts by pod namespace - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes Azure detect RBAC authorization by account - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes Azure detect sensitive object access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes Azure detect sensitive role access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes Azure pod scan fingerprint - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes Azure scan fingerprint - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes GCP detect most active service accounts by pod - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes GCP detect sensitive object access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes GCP detect sensitive role access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Linux Auditd Find Private Keys - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Linux Auditd Private Keys and Certificate Enumeration - Rule,https://research.splunk.com/endpoint/892eb674-3344-4143-8e52-4775b1daf3f1 +ESCU - Local Account Discovery with Net - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows User Discovery Via Net - Rule,https://research.splunk.com/endpoint/7742987e-88c1-476b-a626-a869e088ab72 +ESCU - MSHTML Module Load in Office Product - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Office Product Loaded MSHTML Module - Rule,https://research.splunk.com/endpoint/4cc015c9-687c-40d2-adcc-46350f66e10c +ESCU - Monitor DNS For Brand Abuse - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Okta Multiple Users Failing To Authenticate From Ip - Rule,https://research.splunk.com/application/de365ffa-42f5-46b5-b43f-fa72290b8218 +ESCU - Net Localgroup Discovery - Rule,Detection,5.2.0,Both of these analytics were deprecated in favor of c5c8e0f3-147a-43da-bf04-4cfaec27dc44 / Windows Group Discovery Via Net,ESCU - Windows Group Discovery Via Net - Rule,https://research.splunk.com/endpoint/c5c8e0f3-147a-43da-bf04-4cfaec27dc44 +ESCU - Network Connection Discovery With Net - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Network Connection Discovery Via Net - Rule,https://research.splunk.com/endpoint/86a5b949-679b-4197-8d4c-9c180a818c45 +ESCU - O365 Suspicious Admin Email Forwarding - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - O365 Mailbox Email Forwarding Enabled - Rule,https://research.splunk.com/cloud/0b6bc75c-05d1-4101-9fc3-97e706168f24 +ESCU - O365 Suspicious Rights Delegation - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - O365 Elevated Mailbox Permission Assigned - Rule,https://research.splunk.com/cloud/2246c142-a678-45f8-8546-aaed7e0efd30 +ESCU - O365 Suspicious User Email Forwarding - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - O365 Mailbox Email Forwarding Enabled - Rule,https://research.splunk.com/cloud/0b6bc75c-05d1-4101-9fc3-97e706168f24 +ESCU - Office Application Drop Executable - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Office Product Dropped Uncommon File - Rule,https://research.splunk.com/endpoint/7ac0fced-9eae-4381-a748-90dcd1aa9393 +ESCU - Office Application Spawn Regsvr32 process - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Office Application Spawn rundll32 process - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Office Document Creating Schedule Task - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Office Product Loading Taskschd DLL - Rule,https://research.splunk.com/endpoint/d7297cfa-1f04-4714-bfbe-3679e0666959 +ESCU - Office Document Executing Macro Code - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Office Product Loading VBE7 DLL - Rule,https://research.splunk.com/endpoint/7cfec906-2697-43f7-898b-83634a051d9a +ESCU - Office Document Spawned Child Process To Download - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Office Product Spawned Child Process For Download - Rule,https://research.splunk.com/endpoint/f02b64b8-cbea-4f75-bf77-7a05111566b1 +ESCU - Office Product Spawn CMD Process - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Office Product Spawning BITSAdmin - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Office Product Spawning CertUtil - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Office Product Spawning MSHTA - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Office Product Spawning Rundll32 with no DLL - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Office Product Spawned Rundll32 With No DLL - Rule,https://research.splunk.com/endpoint/f28e787e-69ca-480e-9f98-ab970e6d4bcc +ESCU - Office Product Spawning Windows Script Host - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Office Product Spawning Wmic - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Office Product Writing cab or inf - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Office Product Dropped Cab or Inf File - Rule,https://research.splunk.com/endpoint/dbdd251e-dd45-4ec9-a555-f5e151391746 +ESCU - Office Spawning Control - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Office Product Spawned Control - Rule,https://research.splunk.com/endpoint/081c485d-ac8d-4bee-ad4c-525772fead4d +ESCU - Okta Account Locked Out - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Okta Multiple Accounts Locked Out - Rule,https://research.splunk.com/application/a511426e-184f-4de6-8711-cfd2af29d1e1 +ESCU - Okta Account Lockout Events - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Okta Multiple Accounts Locked Out - Rule,https://research.splunk.com/application/a511426e-184f-4de6-8711-cfd2af29d1e1 +ESCU - Okta Failed SSO Attempts - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Okta Unauthorized Access to Application - Rule,https://research.splunk.com/application/5f661629-9750-4cb9-897c-1f05d6db8727 +ESCU - Okta ThreatInsight Login Failure with High Unknown users - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Okta ThreatInsight Suspected PasswordSpray Attack - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Okta ThreatInsight Threat Detected - Rule,https://research.splunk.com/application/140504ae-5fe2-4d65-b2bc-a211813fbca6 +ESCU - Okta Two or More Rejected Okta Pushes - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Okta Multiple Failed MFA Requests For User - Rule,https://research.splunk.com/application/826dbaae-a1e6-4c8c-b384-d16898956e73 +ESCU - Open Redirect in Splunk Web - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Osquery pack - ColdRoot detection - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Password Policy Discovery with Net - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Password Policy Discovery with Net - Rule,https://research.splunk.com/endpoint/e52f7865-be78-46bf-b7ed-150fbe447613 +ESCU - Processes created by netsh - Rule,Detection,5.2.0,Updated to a new detection name,ESCU - Processes launching netsh - Rule,https://research.splunk.com/endpoint/b89919ed-fe5f-492c-b139-95dbb162040e +ESCU - Prohibited Software On Endpoint - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Attacker Tools On Endpoint - Rule,https://research.splunk.com/endpoint/a51bfe1a-94f0-48cc-b4e4-16a110145893 +ESCU - Reg exe used to hide files directories via registry keys - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Remote Registry Key modifications - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Remote System Discovery with Net - Rule,Detection,5.2.0,This analytic was focusing on 2 separate and unrelated type of threats or actions. PLease use the replacement content,ESCU - Windows Sensitive Group Discovery With Net - Rule,https://research.splunk.com/endpoint/d9eb7cda-5622-4722-bc88-7f2442f4b5af +ESCU - Scheduled tasks used in BadRabbit ransomware - Rule,Detection,5.2.0,Updated to a new detection name,ESCU - Scheduled Task Deleted Or Created via CMD - Rule,https://research.splunk.com/endpoint/d5af132c-7c17-439c-9d31-13d55340f36c +ESCU - Spectre and Meltdown Vulnerable Systems - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Splunk Enterprise Information Disclosure - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Suspicious Changes to File Associations - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Suspicious Email - UBA Anomaly - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Suspicious File Write - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Suspicious Powershell Command-Line Arguments - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Malicious PowerShell Process - Encoded Command - Rule,https://research.splunk.com/endpoint/c4db14d9-7909-48b4-a054-aa14d89dbb19 +ESCU - Suspicious Rundll32 Rename - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Suspicious writes to System Volume Information - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Uncommon Processes On Endpoint - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Attacker Tools On Endpoint - Rule,https://research.splunk.com/endpoint/a51bfe1a-94f0-48cc-b4e4-16a110145893 +ESCU - Unsigned Image Loaded by LSASS - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Unsuccessful Netbackup backups - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Web Fraud - Account Harvesting - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Web Fraud - Anomalous User Clickspeed - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Web Fraud - Password Sharing Across Accounts - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Windows Command Shell Fetch Env Variables - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows List ENV Variables Via SET Command From Uncommon Parent - Rule,https://research.splunk.com/endpoint/aec157f4-8783-4584-aca6-754c4dc7fba9 +ESCU - Windows DLL Search Order Hijacking Hunt - Rule,Detection,5.2.0,Detections updated to use the new search logic and field names due to the TA update,ESCU - Windows DLL Search Order Hijacking Hunt with Sysmon - Rule,https://research.splunk.com/endpoint/79c7d1fc-64c7-91be-a616-ccda752efe81 +ESCU - Windows Lateral Tool Transfer RemCom - Rule,Detection,5.2.0,Updated to a new detection name,ESCU - Windows Service Execution RemCom - Rule,https://research.splunk.com/endpoint/7e3d68db-ea4d-419b-adbd-e14a525ecf09 +ESCU - Windows MSIExec With Network Connections - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows HTTP Network Communication From MSIExec - Rule,https://research.splunk.com/endpoint/b0fd38c7-f71a-43a2-870e-f3ca06bcdd99 +ESCU - Windows Modify Registry Reg Restore - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Registry Entries Restored Via Reg - Rule,https://research.splunk.com/endpoint/a17af481-e2ad-494c-9da6-afb4d243a019 +ESCU - Windows Network Share Interaction With Net - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Network Share Interaction Via Net - Rule,https://research.splunk.com/endpoint/e51fbdb0-0be0-474f-92ea-d289f71a695e +ESCU - Windows Office Product Spawning MSDT - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Office Product Spawned MSDT - Rule,https://research.splunk.com/endpoint/a3148fad-3734-4b7f-9a71-62f08d39fab1 +ESCU - Windows Query Registry Reg Save - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Registry Entries Exported Via Reg - Rule,https://research.splunk.com/endpoint/466379bc-0f47-476c-8202-16ef38112e0d +ESCU - Windows Service Stop Via Net and SC Application - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Windows Valid Account With Never Expires Password - Rule,Detection,5.2.0,Renamed and updated logic,ESCU - Windows Set Account Password Policy To Unlimited Via Net - Rule,https://research.splunk.com/endpoint/11f93009-8083-43fd-82a7-821fcbdc8342 +ESCU - Windows connhost exe started forcefully - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Windows hosts file modification - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +ESCU - Winword Spawning Cmd - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Winword Spawning PowerShell - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - Winword Spawning Windows Script Host - Rule,Detection,5.2.0,"The following analytics was deprecated in favour of a more generic approach. Where instead of creating specific analytic for every potentially suspicious child of an office product. We group them by threat level. +This would ease management and false positives tuning.",ESCU - Windows Office Product Spawned Uncommon Process - Rule,https://research.splunk.com/endpoint/55d8741c-fa32-4692-8109-410304961eb8 +ESCU - gcp detect oauth token abuse - Rule,Detection,5.2.0,Detection deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +AWS Cryptomining,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,Cloud Cryptomining,https://research.splunk.com/stories/cloud_cryptomining +AWS Suspicious Provisioning Activities,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,Suspicious Cloud Provisioning Activities,https://research.splunk.com/stories/suspicious_cloud_provisioning_activities +Common Phishing Frameworks,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +Container Implantation Monitoring and Investigation,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,Kubernetes Security,https://research.splunk.com/stories/kubernetes_security +Host Redirection,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +Kubernetes Sensitive Role Activity,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,Kubernetes Security,https://research.splunk.com/stories/kubernetes_security +Lateral Movement,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,Compromised User Account,https://research.splunk.com/stories/compromised_user_account +Monitor Backup Solution,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +Monitor for Unauthorized Software,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +Office 365 Detections,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,Office 365 Account Takeover,https://research.splunk.com/stories/office_365_account_takeover +Spectre And Meltdown Vulnerabilities,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available +Suspicious AWS EC2 Activities,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,Suspicious Cloud Instance Activities,https://research.splunk.com/stories/suspicious_cloud_instance_activities +Unusual AWS EC2 Modifications,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,Suspicious Cloud Instance Activities,https://research.splunk.com/stories/suspicious_cloud_instance_activities +Web Fraud Detection,Story,5.2.0,Analytic Story deprecated as it no longer effectively identifies the intended malicious activity,No Replacement Content Available,No Content Link Available diff --git a/lookups/deprecation_info.yml b/lookups/deprecation_info.yml new file mode 100644 index 0000000000..dab74f8b34 --- /dev/null +++ b/lookups/deprecation_info.yml @@ -0,0 +1,9 @@ +name: deprecation_info +date: 2025-03-14 +version: 1 +id: d83dad4f-7bce-4979-bf07-a88c610da5f6 +author: Splunk Threat Research Team +lookup_type: csv +default_match: false +description: A lookup file for deprecation information +min_matches: 1 diff --git a/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml b/removed/baselines/add_prohibited_processes_to_enterprise_security.yml similarity index 98% rename from baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml rename to removed/baselines/add_prohibited_processes_to_enterprise_security.yml index 607a5f9829..571031fc48 100644 --- a/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml +++ b/removed/baselines/add_prohibited_processes_to_enterprise_security.yml @@ -4,7 +4,7 @@ version: 1 date: '2017-09-15' author: David Dorsey, Splunk type: Baseline -status: deprecated +status: removed description: This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints. diff --git a/baselines/deprecated/baseline_of_api_calls_per_user_arn.yml b/removed/baselines/baseline_of_api_calls_per_user_arn.yml similarity index 98% rename from baselines/deprecated/baseline_of_api_calls_per_user_arn.yml rename to removed/baselines/baseline_of_api_calls_per_user_arn.yml index 461b657a67..2673563607 100644 --- a/baselines/deprecated/baseline_of_api_calls_per_user_arn.yml +++ b/removed/baselines/baseline_of_api_calls_per_user_arn.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-04-09' author: David Dorsey, Splunk type: Baseline -status: deprecated +status: removed description: This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow diff --git a/baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml b/removed/baselines/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml similarity index 99% rename from baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml rename to removed/baselines/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml index ade1932593..f239369ff1 100644 --- a/baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml +++ b/removed/baselines/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml @@ -4,7 +4,7 @@ version: 1 date: '2019-11-14' author: Jason Brewer, Splunk type: Baseline -status: deprecated +status: removed description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is diff --git a/baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml b/removed/baselines/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml similarity index 99% rename from baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml rename to removed/baselines/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml index a6d890da08..66859b3998 100644 --- a/baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml +++ b/removed/baselines/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml @@ -4,7 +4,7 @@ version: 1 date: '2019-11-14' author: Jason Brewer, Splunk type: Baseline -status: deprecated +status: removed description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search diff --git a/baselines/monitor_successful_backups.yml b/removed/baselines/monitor_successful_backups.yml similarity index 94% rename from baselines/monitor_successful_backups.yml rename to removed/baselines/monitor_successful_backups.yml index fe0c140a5a..ab88e7b269 100644 --- a/baselines/monitor_successful_backups.yml +++ b/removed/baselines/monitor_successful_backups.yml @@ -1,10 +1,10 @@ name: Monitor Successful Backups id: b4d0dfb2-2195-4f6e-93a3-48468ed9734e -version: 1 -date: '2017-09-12' +version: 2 +date: '2025-02-27' author: David Dorsey, Splunk type: Baseline -status: production +status: removed description: This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. diff --git a/baselines/monitor_unsuccessful_backups.yml b/removed/baselines/monitor_unsuccessful_backups.yml similarity index 94% rename from baselines/monitor_unsuccessful_backups.yml rename to removed/baselines/monitor_unsuccessful_backups.yml index 83195cbae0..19c0d4ca73 100644 --- a/baselines/monitor_unsuccessful_backups.yml +++ b/removed/baselines/monitor_unsuccessful_backups.yml @@ -1,10 +1,10 @@ name: Monitor Unsuccessful Backups id: b2178fed-592f-492b-b851-74161678aa56 -version: 1 -date: '2017-09-12' +version: 2 +date: '2025-02-27' author: David Dorsey, Splunk type: Baseline -status: production +status: removed description: This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. diff --git a/baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml b/removed/baselines/previously_seen_api_call_per_user_roles_in_cloudtrail.yml similarity index 98% rename from baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml rename to removed/baselines/previously_seen_api_call_per_user_roles_in_cloudtrail.yml index 71a860c70b..8725c77478 100644 --- a/baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml +++ b/removed/baselines/previously_seen_api_call_per_user_roles_in_cloudtrail.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-04-16' author: Bhavin Patel, Splunk type: Baseline -status: deprecated +status: removed description: This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user diff --git a/baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml b/removed/baselines/previously_seen_aws_provisioning_activity_sources.yml similarity index 98% rename from baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml rename to removed/baselines/previously_seen_aws_provisioning_activity_sources.yml index b0c5e90290..96f8dccd31 100644 --- a/baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml +++ b/removed/baselines/previously_seen_aws_provisioning_activity_sources.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-03-16' author: David Dorsey, Splunk type: Baseline -status: deprecated +status: removed description: This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. diff --git a/baselines/previously_seen_aws_regions.yml b/removed/baselines/previously_seen_aws_regions.yml similarity index 95% rename from baselines/previously_seen_aws_regions.yml rename to removed/baselines/previously_seen_aws_regions.yml index da7bd98582..c64933b437 100644 --- a/baselines/previously_seen_aws_regions.yml +++ b/removed/baselines/previously_seen_aws_regions.yml @@ -1,10 +1,10 @@ name: Previously Seen AWS Regions id: fc0edc95-ff2b-48b0-9f6f-63da3789fd63 -version: 1 -date: '2018-01-08' +version: 2 +date: '2025-02-27' author: Bhavin Patel, Splunk type: Baseline -status: production +status: removed description: This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last diff --git a/baselines/deprecated/previously_seen_ec2_amis.yml b/removed/baselines/previously_seen_ec2_amis.yml similarity index 98% rename from baselines/deprecated/previously_seen_ec2_amis.yml rename to removed/baselines/previously_seen_ec2_amis.yml index 1550cdf588..bc7c7ec00e 100644 --- a/baselines/deprecated/previously_seen_ec2_amis.yml +++ b/removed/baselines/previously_seen_ec2_amis.yml @@ -4,7 +4,7 @@ version: 2 date: '2025-01-16' author: David Dorsey, Splunk type: Baseline -status: deprecated +status: removed description: This search builds a table of previously seen AMIs used to launch EC2 instances search: '`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instancesSet.items{}.imageId diff --git a/baselines/deprecated/previously_seen_ec2_instance_types.yml b/removed/baselines/previously_seen_ec2_instance_types.yml similarity index 98% rename from baselines/deprecated/previously_seen_ec2_instance_types.yml rename to removed/baselines/previously_seen_ec2_instance_types.yml index cfff4e6d58..4c1f2fa439 100644 --- a/baselines/deprecated/previously_seen_ec2_instance_types.yml +++ b/removed/baselines/previously_seen_ec2_instance_types.yml @@ -4,7 +4,7 @@ version: 2 date: '2025-01-16' author: David Dorsey, Splunk type: Baseline -status: deprecated +status: removed description: This search builds a table of previously seen EC2 instance types search: '`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instanceType as instanceType | fillnull value="m1.small" instanceType | stats earliest(_time) diff --git a/baselines/deprecated/previously_seen_ec2_launches_by_user.yml b/removed/baselines/previously_seen_ec2_launches_by_user.yml similarity index 98% rename from baselines/deprecated/previously_seen_ec2_launches_by_user.yml rename to removed/baselines/previously_seen_ec2_launches_by_user.yml index d1aa8e8045..d90c9b44cc 100644 --- a/baselines/deprecated/previously_seen_ec2_launches_by_user.yml +++ b/removed/baselines/previously_seen_ec2_launches_by_user.yml @@ -4,7 +4,7 @@ version: 2 date: '2025-01-16' author: David Dorsey, Splunk type: Baseline -status: deprecated +status: removed description: This search builds a table of previously seen ARNs that have launched a EC2 instance. search: '`cloudtrail` eventName=RunInstances errorCode=success | rename userIdentity.arn diff --git a/baselines/previously_seen_ec2_modifications_by_user.yml b/removed/baselines/previously_seen_ec2_modifications_by_user.yml similarity index 95% rename from baselines/previously_seen_ec2_modifications_by_user.yml rename to removed/baselines/previously_seen_ec2_modifications_by_user.yml index fdf51c1460..09a26dca86 100644 --- a/baselines/previously_seen_ec2_modifications_by_user.yml +++ b/removed/baselines/previously_seen_ec2_modifications_by_user.yml @@ -1,10 +1,10 @@ name: Previously Seen EC2 Modifications By User id: 4d69091b-d975-4267-85df-888bd41034eb -version: 1 -date: '2018-04-05' +version: 2 +date: '2025-02-27' author: David Dorsey, Splunk type: Baseline -status: production +status: removed description: This search builds a table of previously seen ARNs that have launched a EC2 instance. search: '`cloudtrail` `ec2_modification_api_calls` errorCode=success | spath output=arn diff --git a/baselines/deprecated/previously_seen_users_in_cloudtrail.yml b/removed/baselines/previously_seen_users_in_cloudtrail.yml similarity index 98% rename from baselines/deprecated/previously_seen_users_in_cloudtrail.yml rename to removed/baselines/previously_seen_users_in_cloudtrail.yml index f8e40480d7..2e3a762c8d 100644 --- a/baselines/deprecated/previously_seen_users_in_cloudtrail.yml +++ b/removed/baselines/previously_seen_users_in_cloudtrail.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-04-30' author: Jason Brewer, Splunk type: Baseline -status: deprecated +status: removed description: This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 diff --git a/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml b/removed/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml similarity index 96% rename from baselines/systems_ready_for_spectre_meltdown_windows_patch.yml rename to removed/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml index 7b26e9e44d..54085fb1b2 100644 --- a/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml +++ b/removed/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml @@ -1,10 +1,10 @@ name: Systems Ready for Spectre-Meltdown Windows Patch id: fc0edc95-ff2b-48b0-9f6f-63da3789fd61 -version: 1 -date: '2018-01-08' +version: 2 +date: '2025-02-27' author: David Dorsey, Splunk type: Baseline -status: production +status: removed description: Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this diff --git a/baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml b/removed/baselines/update_previously_seen_users_in_cloudtrail.yml similarity index 98% rename from baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml rename to removed/baselines/update_previously_seen_users_in_cloudtrail.yml index 063ad93dcc..b12c1c002f 100644 --- a/baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml +++ b/removed/baselines/update_previously_seen_users_in_cloudtrail.yml @@ -4,7 +4,7 @@ version: 2 date: '2025-01-16' author: Jason Brewer, Splunk type: Baseline -status: deprecated +status: removed description: This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. diff --git a/removed/deprecation_mapping.YML b/removed/deprecation_mapping.YML new file mode 100644 index 0000000000..73220d59fb --- /dev/null +++ b/removed/deprecation_mapping.YML @@ -0,0 +1,1008 @@ +detections: + - content: Open Redirect in Splunk Web + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Splunk Enterprise Information Disclosure + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: ASL AWS Excessive Security Scanning + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: AWS Cloud Provisioning From Previously Unseen Region + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Provisioning Activity From Previously Unseen Region + - content: First time seen command line argument + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Windows connhost exe started forcefully + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Detect Mimikatz Using Loaded Images + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Kubernetes Azure detect sensitive role access + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Web Fraud - Anomalous User Clickspeed + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: EC2 Instance Started With Previously Unseen Instance Type + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Compute Instance Created With Previously Unseen Instance Type + - content: EC2 Instance Started With Previously Unseen AMI + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Compute Instance Created With Previously Unseen Image + - content: Domain Group Discovery With Net + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Group Discovery Via Net + - content: Kubernetes AWS detect sensitive role access + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Winword Spawning Windows Script Host + removed_in_version: 5.2.0 + reason: "The following analytics was deprecated in favour of a more generic approach. + Where instead of creating specific analytic for every potentially suspicious child + of an office product. We group them by threat level.\nThis would ease management + and false positives tuning." + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Winword Spawning PowerShell + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Attempted Credential Dump From Registry via Reg exe + removed_in_version: 5.2.0 + reason: This analytic had some overlap with another one, hence the deprecation. + It was replaced by 8bbb7d58-b360-11eb-ba21-acde48001122 / Windows Sensitive Registry + Hive Dump Via CommandLine + replacement_content: + - Windows Sensitive Registry Hive Dump Via CommandLine + - content: Detect processes used for System Network Configuration Discovery + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Potential System Network Configuration Discovery Activity + - content: Execution of File With Spaces Before Extension + removed_in_version: 5.2.0 + reason: Updated to a new detection name + replacement_content: + - Execution of File with Multiple Extensions + - content: EC2 Instance Started In Previously Unseen Region + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Compute Instance Created In Previously Unused Region + - content: Office Document Spawned Child Process To Download + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Spawned Child Process For Download + - content: Detect new API calls from user roles + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud API Calls From Previously Unseen User Roles + - content: Cmdline Tool Not Executed In CMD Shell + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Cmdline Tool Execution From Non-Shell Process + - content: Linux Auditd Find Private Keys + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Linux Auditd Private Keys and Certificate Enumeration + - content: Detect AWS API Activities From Unapproved Accounts + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Monitor DNS For Brand Abuse + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Kubernetes GCP detect sensitive object access + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Kubernetes Azure scan fingerprint + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: ASL AWS Password Policy Changes + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: O365 Suspicious Admin Email Forwarding + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - O365 Mailbox Email Forwarding Enabled + - content: AWS Cloud Provisioning From Previously Unseen City + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Provisioning Activity From Previously Unseen City + - content: Kubernetes AWS detect service accounts forbidden failure access + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Osquery pack - ColdRoot detection + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Windows Modify Registry Reg Restore + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Registry Entries Restored Via Reg + - content: Kubernetes GCP detect most active service accounts by pod + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Scheduled tasks used in BadRabbit ransomware + removed_in_version: 5.2.0 + reason: Updated to a new detection name + replacement_content: + - Scheduled Task Deleted Or Created via CMD + - content: Suspicious Rundll32 Rename + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Remote System Discovery with Net + removed_in_version: 5.2.0 + reason: "This analytic was focusing on 2 separate and unrelated type of threats + or actions. PLease use the replacement content" + replacement_content: + - Windows Sensitive Group Discovery With Net + - content: DNS Query Requests Resolved by Unauthorized DNS Servers + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Suspicious Changes to File Associations + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: GCP Detect high risk permissions by resource and account + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Office Product Writing cab or inf + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Dropped Cab or Inf File + - content: Identify New User Accounts + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Office Product Spawn CMD Process + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Windows DLL Search Order Hijacking Hunt + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Windows DLL Search Order Hijacking Hunt with Sysmon + - content: ASL AWS CreateAccessKey + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - ASL AWS Create Access Key + - content: Okta ThreatInsight Login Failure with High Unknown users + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Detect Spike in Security Group Activity + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Abnormally High Number Of Cloud Security Group API Calls + - content: Office Product Spawning BITSAdmin + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Create local admin accounts using net exe + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Create Local Administrator Account Via Net + - content: Abnormally High AWS Instances Terminated by User - MLTK + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Windows Office Product Spawning MSDT + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Spawned MSDT + - content: Detect Spike in AWS API Activity + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Office Product Spawning Windows Script Host + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Prohibited Software On Endpoint + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Attacker Tools On Endpoint + - content: AWS Cloud Provisioning From Previously Unseen Country + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Provisioning Activity From Previously Unseen Country + - content: Detect Critical Alerts from Security Tools + removed_in_version: 5.2.0 + reason: As discussed internally, this analytic was too generic for an analyst to + do anything with it. It was deprecated in favor of the more specific approach + provided by analytics such as Microsoft Defender ATP Alerts and Microsoft Defender + Incident Alerts. Going forward analytics from leveraging alerts from vendors will + have their specific analytics. + replacement_content: + - Microsoft Defender ATP Alerts + - content: Detect Critical Alerts from Security Tools + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Microsoft Defender Incident Alerts + - content: Excel Spawning PowerShell + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Office Application Spawn rundll32 process + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Excessive Usage Of Net App + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Excessive Usage Of Net App + - content: Elevated Group Discovery With Net + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Sensitive Group Discovery With Net + - content: Local Account Discovery with Net + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows User Discovery Via Net + - content: Windows Command Shell Fetch Env Variables + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows List ENV Variables Via SET Command From Uncommon Parent + - content: Suspicious Email - UBA Anomaly + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Detect web traffic to dynamic domain providers + removed_in_version: 5.2.0 + reason: Updated to use a different log source + replacement_content: + - Detect hosts connecting to dynamic domain providers + - content: Okta Failed SSO Attempts + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Okta Unauthorized Access to Application + - content: Kubernetes AWS detect RBAC authorization by account + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Kubernetes Azure detect service accounts forbidden failure access + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Remote Registry Key modifications + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: O365 Suspicious User Email Forwarding + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - O365 Mailbox Email Forwarding Enabled + - content: Office Product Spawning MSHTA + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Kubernetes AWS detect most active service accounts by pod + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Correlation by Repository and Risk + removed_in_version: 5.2.0 + reason: Detections updated to use the datamodel + replacement_content: + - Risk Rule for Dev Sec Ops by Repository + - content: Kubernetes Azure detect RBAC authorization by account + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Clients Connecting to Multiple DNS Servers + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Excessive Service Stop Attempt + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Excessive Service Stop Attempt + - content: Multiple Okta Users With Invalid Credentials From The Same IP + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Okta Multiple Users Failing To Authenticate From Ip + - content: Suspicious writes to System Volume Information + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Detect new user AWS Console Login + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Detect AWS Console Login by New User + - content: Domain Account Discovery With Net App + removed_in_version: 5.2.0 + reason: "This analytic was a TTP that looked only for commands that tries to query + info about the users via net user /do. This had a couple of issues, such as triggering + on creation of users via the /add flag etc..\nIt was deprecated in favor of a + more tighter approach in 5d0d4830-0133-11ec-bae3-acde48001122" + replacement_content: + - Windows User Discovery Via Net + - content: Detection of DNS Tunnels + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Detect DNS requests to Phishing Sites leveraging EvilGinx2 + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Office Document Creating Schedule Task + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Loading Taskschd DLL + - content: Okta Account Locked Out + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Okta Multiple Accounts Locked Out + - content: Unsuccessful Netbackup backups + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Detect Mimikatz Via PowerShell And EventCode 4703 + removed_in_version: 5.2.0 + reason: Updated to a new detection name + replacement_content: + - Detect Mimikatz With PowerShell Script Block Logging + - content: Winword Spawning Cmd + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: GCP Kubernetes cluster scan detection + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Kubernetes Scanning by Unauthenticated IP Address + - content: Kubernetes GCP detect suspicious kubectl calls + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: gcp detect oauth token abuse + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Correlation by User and Risk + removed_in_version: 5.2.0 + reason: Detections updated to use the datamodel + replacement_content: + - Risk Rule for Dev Sec Ops by Repository + - content: Processes created by netsh + removed_in_version: 5.2.0 + reason: Updated to a new detection name + replacement_content: + - Processes launching netsh + - content: Office Product Spawning Wmic + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Extraction of Registry Hives + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Sensitive Registry Hive Dump Via CommandLine + - content: Attempt To Stop Security Service + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Attempt To Stop Security Service + - content: Windows MSIExec With Network Connections + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows HTTP Network Communication From MSIExec + - content: Windows Query Registry Reg Save + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Registry Entries Exported Via Reg + - content: Cloud Network Access Control List Deleted + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - AWS Network Access Control List Deleted + - content: O365 Suspicious Rights Delegation + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - O365 Elevated Mailbox Permission Assigned + - content: Abnormally High AWS Instances Launched by User - MLTK + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Reg exe used to hide files directories via registry keys + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Detect Long DNS TXT Record Response + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Password Policy Discovery with Net + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Password Policy Discovery with Net + - content: AWS Cloud Provisioning From Previously Unseen IP Address + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Provisioning Activity From Previously Unseen IP Address + - content: Network Connection Discovery With Net + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Network Connection Discovery Via Net + - content: Kubernetes Azure detect suspicious kubectl calls + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Kubernetes GCP detect sensitive role access + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Detect Webshell Exploit Behavior + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Suspicious Child Process Spawned From WebServer + - content: DNS record changed + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Unsigned Image Loaded by LSASS + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Detect USB device insertion + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Windows Network Share Interaction With Net + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Network Share Interaction Via Net + - content: Account Discovery With Net App + removed_in_version: 5.2.0 + reason: This analytic was a TTP that focused on unrelated things and called account + discovery. Since there were other detection that overlapped with it. I choose + to deprecate it, and replace it with an updated version of 339805ce-ac30-11eb-b87d-acde48001122 + / Windows Excessive Usage Of Net App. + replacement_content: + - Windows Excessive Usage Of Net App + - content: Change Default File Association + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows New Default File Association Value Set + - content: Windows Lateral Tool Transfer RemCom + removed_in_version: 5.2.0 + reason: Updated to a new detection name + replacement_content: + - Windows Service Execution RemCom + - content: Office Document Executing Macro Code + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Loading VBE7 DLL + - content: Okta Account Lockout Events + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Okta Multiple Accounts Locked Out + - content: Abnormally High AWS Instances Launched by User + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Abnormally High Number Of Cloud Instances Launched + - content: EC2 Instance Modified With Previously Unseen User + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud API Calls From Previously Unseen User Roles + - content: Windows Valid Account With Never Expires Password + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Set Account Password Policy To Unlimited Via Net + - content: Windows hosts file modification + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: MSHTML Module Load in Office Product + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Loaded MSHTML Module + - content: Abnormally High AWS Instances Terminated by User + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Abnormally High Number Of Cloud Instances Destroyed + - content: Web Fraud - Account Harvesting + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Office Spawning Control + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Spawned Control + - content: Detect Activity Related to Pass the Hash Attacks + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Deleting Of Net Users + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows User Deletion Via Net + - content: Suspicious File Write + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: AWS EKS Kubernetes cluster sensitive object access + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Kubernetes Abuse of Secret by Unusual Location + - content: Spectre and Meltdown Vulnerable Systems + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: EC2 Instance Started With Previously Unseen User + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Cloud Compute Instance Created By Previously Unseen User + - content: Office Product Spawning CertUtil + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Kubernetes GCP detect RBAC authorizations by account + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Office Application Drop Executable + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Dropped Uncommon File + - content: Kubernetes Azure active service accounts by pod namespace + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Kubernetes Azure pod scan fingerprint + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Detect Spike in Network ACL Activity + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Abnormally High Number Of Cloud Infrastructure API Calls + - content: Suspicious Powershell Command-Line Arguments + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Malicious PowerShell Process - Encoded Command + - content: Office Application Spawn Regsvr32 process + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Windows Office Product Spawned Uncommon Process + - content: Detect API activity from users without MFA + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - AWS Successful Single-Factor Authentication + - content: Kubernetes Azure detect sensitive object access + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Web Fraud - Password Sharing Across Accounts + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Disabling Net User Account + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows User Disabled Via Net + - content: GCP Detect accounts with high risk roles by project + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Kubernetes GCP detect service accounts forbidden failure access + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Extended Period Without Successful Netbackup Backups + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Office Product Spawning Rundll32 with no DLL + removed_in_version: 5.2.0 + reason: Renamed and updated logic + replacement_content: + - Windows Office Product Spawned Rundll32 With No DLL + - content: Okta ThreatInsight Suspected PasswordSpray Attack + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Okta ThreatInsight Threat Detected + - content: Net Localgroup Discovery + removed_in_version: 5.2.0 + reason: Both of these analytics were deprecated in favor of c5c8e0f3-147a-43da-bf04-4cfaec27dc44 + / Windows Group Discovery Via Net + replacement_content: + - Windows Group Discovery Via Net + - content: Uncommon Processes On Endpoint + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Attacker Tools On Endpoint + - content: Dump LSASS via procdump Rename + removed_in_version: 5.2.0 + reason: Updated to a new detection name + replacement_content: + - Dump LSASS via procdump + - content: Okta Two or More Rejected Okta Pushes + removed_in_version: 5.2.0 + reason: Detections updated to use the new search logic and field names due to the + TA update + replacement_content: + - Okta Multiple Failed MFA Requests For User + - content: Windows Service Stop Via Net and SC Application + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Excel Spawning Windows Script Host + removed_in_version: 5.2.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: GitHub Actions Disable Security Workflow + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Github Commit Changes In Master + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Github Commit In Develop + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: GitHub Dependabot Alert + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: GitHub Pull Request from Unknown User + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Known Services Killed by Ransomware + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Remote Desktop Network Bruteforce + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Suspicious Driver Loaded Path + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Suspicious Event Log Service Behavior + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: Suspicious Process File Path + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: AWS Cross Account Activity From Previously Unseen Account + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: aws detect attach to role policy + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: aws detect permanent key creation + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: aws detect role creation + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: aws detect sts assume role abuse + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: aws detect sts get session token abuse + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity + - content: AWS SAML Access by Provider User and Principal + removed_in_version: 5.4.0 + reason: Detection deprecated as it no longer effectively identifies the intended malicious activity +baselines: + - content: Add Prohibited Processes to Enterprise Security + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Baseline of API Calls per User ARN + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Baseline of Excessive AWS Instances Launched by User - MLTK + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Baseline of Excessive AWS Instances Terminated by User - MLTK + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Previously seen API call per user roles in CloudTrail + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Previously Seen AWS Provisioning Activity Sources + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Previously Seen EC2 AMIs + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Previously Seen EC2 Instance Types + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Previously Seen EC2 Launches By User + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Previously seen users in CloudTrail + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Update previously seen users in CloudTrail + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Monitor Successful Backups + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Monitor Unsuccessful Backups + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Previously Seen AWS Regions + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Previously Seen EC2 Modifications By User + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Systems Ready for Spectre-Meltdown Windows Patch + removed_in_version: 5.2.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Previously Seen AWS Cross Account Activity - Initial + removed_in_version: 5.4.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' + - content: Previously Seen AWS Cross Account Activity - Update + removed_in_version: 5.4.0 + reason: 'All detection(s) which leverage this baseline have been deprecated. As such, this baseline has been deprecated as well.' +investigations: + - content: All backup logs for host + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Amazon EKS Kubernetes activity by src ip + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: AWS Investigate Security Hub alerts by dest + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: AWS Investigate User Activities By AccessKeyId + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: AWS Investigate User Activities By ARN + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: AWS Network ACL Details from ID + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: AWS Network Interface details via resourceId + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: AWS S3 Bucket details via bucketName + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: GCP Kubernetes activity by src ip + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get All AWS Activity From City + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get All AWS Activity From Country + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get All AWS Activity From IP Address + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get All AWS Activity From Region + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Backup Logs For Endpoint + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Certificate logs for a domain + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get DNS Server History for a host + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get DNS traffic ratio + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get EC2 Instance Details by instanceId + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get EC2 Launch Details + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Email Info + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Emails From Specific Sender + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get First Occurrence and Last Occurrence of a MAC Address + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get History Of Email Sources + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Logon Rights Modifications For Endpoint + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Logon Rights Modifications For User + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Notable History + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Outbound Emails to Hidden Cobra Threat Actors + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Parent Process Info + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Process File Activity + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Process Info + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Process Information For Port Activity + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Process Responsible For The DNS Traffic + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Sysmon WMI Activity for Host + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Get Web Session Information via session id + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate AWS activities via region name + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate AWS User Activities by user field + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate Failed Logins for Multiple Destinations + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate Network Traffic From src ip + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate Okta Activity by app + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate Okta Activity by IP Address + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate Pass the Hash Attempts + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate Pass the Ticket Attempts + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate Previous Unseen User + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate Successful Remote Desktop Authentications + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate Suspicious Strings in HTTP Header + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate User Activities In Okta + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' + - content: Investigate Web POSTs From src + removed_in_version: 5.2.0 + reason: 'As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.' +stories: + - content: AWS Cryptomining + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Cloud Cryptomining + - content: AWS Suspicious Provisioning Activities + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Suspicious Cloud Provisioning Activities + - content: Common Phishing Frameworks + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + - content: Container Implantation Monitoring and Investigation + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Kubernetes Security + - content: Host Redirection + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + - content: Kubernetes Sensitive Role Activity + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Kubernetes Security + - content: Lateral Movement + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Compromised User Account + - content: Monitor Backup Solution + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + - content: Monitor for Unauthorized Software + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + - content: Office 365 Detections + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Office 365 Account Takeover + - content: Spectre And Meltdown Vulnerabilities + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + - content: Suspicious AWS EC2 Activities + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Suspicious Cloud Instance Activities + - content: Unusual AWS EC2 Modifications + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - Suspicious Cloud Instance Activities + - content: Web Fraud Detection + removed_in_version: 5.2.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + - content: Nexus APT Threat Activity + removed_in_version: 5.4.0 + reason: Analytic Story deprecated as it no longer effectively identifies the intended malicious activity + replacement_content: + - China-Nexus Threat Activity \ No newline at end of file diff --git a/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml b/removed/detections/abnormally_high_aws_instances_launched_by_user.yml similarity index 99% rename from detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml rename to removed/detections/abnormally_high_aws_instances_launched_by_user.yml index e46dec6369..595bc299da 100644 --- a/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml +++ b/removed/detections/abnormally_high_aws_instances_launched_by_user.yml @@ -3,7 +3,7 @@ id: 2a9b80d3-6340-4345-b5ad-290bf5d0dac4 version: 5 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have diff --git a/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml b/removed/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml similarity index 98% rename from detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml rename to removed/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml index 9acc4411b2..d70e23808e 100644 --- a/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml +++ b/removed/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml @@ -3,7 +3,7 @@ id: dec41ad5-d579-42cb-b4c6-f5dbb778bbe5 version: 5 date: '2024-11-14' author: Jason Brewer, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have diff --git a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml b/removed/detections/abnormally_high_aws_instances_terminated_by_user.yml similarity index 99% rename from detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml rename to removed/detections/abnormally_high_aws_instances_terminated_by_user.yml index ae3c15024b..7ce46aff25 100644 --- a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml +++ b/removed/detections/abnormally_high_aws_instances_terminated_by_user.yml @@ -3,7 +3,7 @@ id: 8d301246-fccf-45e2-a8e7-3655fd14379c version: 5 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for AWS CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. diff --git a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml b/removed/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml similarity index 98% rename from detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml rename to removed/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml index 04f88a704a..4581feda8f 100644 --- a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml +++ b/removed/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml @@ -3,7 +3,7 @@ id: 1c02b86a-cd85-473e-a50b-014a9ac8fe3e version: 5 date: '2024-11-14' author: Jason Brewer, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for AWS CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and diff --git a/detections/deprecated/account_discovery_with_net_app.yml b/removed/detections/account_discovery_with_net_app.yml similarity index 99% rename from detections/deprecated/account_discovery_with_net_app.yml rename to removed/detections/account_discovery_with_net_app.yml index 074b4fba7a..ddb1846f2e 100644 --- a/detections/deprecated/account_discovery_with_net_app.yml +++ b/removed/detections/account_discovery_with_net_app.yml @@ -3,7 +3,7 @@ id: 339805ce-ac30-11eb-b87d-acde48001122 version: 9 date: '2025-02-10' author: Teoderick Contreras, Splunk, TheLawsOfChaos, Github Community -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of the more generic "45e52536-ae42-11eb-b5c6-acde48001122". The following analytic detects potential diff --git a/detections/deprecated/asl_aws_createaccesskey.yml b/removed/detections/asl_aws_createaccesskey.yml similarity index 99% rename from detections/deprecated/asl_aws_createaccesskey.yml rename to removed/detections/asl_aws_createaccesskey.yml index e7588388f6..a4fe172ca3 100644 --- a/detections/deprecated/asl_aws_createaccesskey.yml +++ b/removed/detections/asl_aws_createaccesskey.yml @@ -3,7 +3,7 @@ id: ccb3e4af-23d6-407f-9842-a26212816c9e version: 3 date: '2024-11-14' author: Patrick Bareiss, Splunk -status: deprecated +status: removed type: Hunting description: This detection rule monitors for the creation of AWS Identity and Access Management (IAM) access keys. An IAM access key consists of an access key ID and diff --git a/detections/deprecated/asl_aws_excessive_security_scanning.yml b/removed/detections/asl_aws_excessive_security_scanning.yml similarity index 99% rename from detections/deprecated/asl_aws_excessive_security_scanning.yml rename to removed/detections/asl_aws_excessive_security_scanning.yml index 0ee3a463e3..6f8c8c2cf2 100644 --- a/detections/deprecated/asl_aws_excessive_security_scanning.yml +++ b/removed/detections/asl_aws_excessive_security_scanning.yml @@ -3,7 +3,7 @@ id: ff2bfdbc-65b7-4434-8f08-d55761d1d446 version: 4 date: '2024-11-14' author: Patrick Bareiss, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this diff --git a/detections/deprecated/asl_aws_password_policy_changes.yml b/removed/detections/asl_aws_password_policy_changes.yml similarity index 99% rename from detections/deprecated/asl_aws_password_policy_changes.yml rename to removed/detections/asl_aws_password_policy_changes.yml index d791f17208..faa1c0ef93 100644 --- a/detections/deprecated/asl_aws_password_policy_changes.yml +++ b/removed/detections/asl_aws_password_policy_changes.yml @@ -3,7 +3,7 @@ id: 5ade5937-11a2-4363-ba6b-39a3ee8d5b1a version: 3 date: '2024-11-14' author: Patrick Bareiss, Splunk -status: deprecated +status: removed type: Hunting description: This search looks for AWS CloudTrail events from Amazon Security Lake where a user is making successful API calls to view/update/delete the existing password diff --git a/detections/deprecated/attempt_to_stop_security_service.yml b/removed/detections/attempt_to_stop_security_service.yml similarity index 99% rename from detections/deprecated/attempt_to_stop_security_service.yml rename to removed/detections/attempt_to_stop_security_service.yml index 1964d9b110..0fca86d98e 100644 --- a/detections/deprecated/attempt_to_stop_security_service.yml +++ b/removed/detections/attempt_to_stop_security_service.yml @@ -3,7 +3,7 @@ id: c8e349c6-b97c-486e-8949-bd7bcd1f3910 version: 11 date: '2025-02-10' author: Rico Valdez, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects attempts to stop security-related services on an endpoint, which may indicate malicious diff --git a/detections/deprecated/attempted_credential_dump_from_registry_via_reg_exe.yml b/removed/detections/attempted_credential_dump_from_registry_via_reg_exe.yml similarity index 99% rename from detections/deprecated/attempted_credential_dump_from_registry_via_reg_exe.yml rename to removed/detections/attempted_credential_dump_from_registry_via_reg_exe.yml index 65c188a991..5dfdbf1e49 100644 --- a/detections/deprecated/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/removed/detections/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -3,7 +3,7 @@ id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911 version: 14 date: '2025-02-10' author: Patrick Bareiss, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of "8bbb7d58-b360-11eb-ba21-acde48001122". The following analytic detects the execution of reg.exe with parameters that export diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml b/removed/detections/aws_cloud_provisioning_from_previously_unseen_city.yml similarity index 99% rename from detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml rename to removed/detections/aws_cloud_provisioning_from_previously_unseen_city.yml index 91a576d2f0..93e513cc2c 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml +++ b/removed/detections/aws_cloud_provisioning_from_previously_unseen_city.yml @@ -3,7 +3,7 @@ id: 344a1778-0b25-490c-adb1-de8beddf59cd version: 5 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml b/removed/detections/aws_cloud_provisioning_from_previously_unseen_country.yml similarity index 99% rename from detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml rename to removed/detections/aws_cloud_provisioning_from_previously_unseen_country.yml index 986a31d1f0..5c7257858e 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml +++ b/removed/detections/aws_cloud_provisioning_from_previously_unseen_country.yml @@ -3,7 +3,7 @@ id: ceb8d3d8-06cb-49eb-beaf-829526e33ff0 version: 5 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml b/removed/detections/aws_cloud_provisioning_from_previously_unseen_ip_address.yml similarity index 99% rename from detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml rename to removed/detections/aws_cloud_provisioning_from_previously_unseen_ip_address.yml index 5568175da0..13a7f90294 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/removed/detections/aws_cloud_provisioning_from_previously_unseen_ip_address.yml @@ -3,7 +3,7 @@ id: 42e15012-ac14-4801-94f4-f1acbe64880b version: 5 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml b/removed/detections/aws_cloud_provisioning_from_previously_unseen_region.yml similarity index 99% rename from detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml rename to removed/detections/aws_cloud_provisioning_from_previously_unseen_region.yml index 5efa68a449..039f1cd76c 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml +++ b/removed/detections/aws_cloud_provisioning_from_previously_unseen_region.yml @@ -3,7 +3,7 @@ id: 7971d3df-da82-4648-a6e5-b5637bea5253 version: 4 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for AWS provisioning activities from previously unseen regions. Region in this context is similar to a state in the United States. Provisioning diff --git a/detections/deprecated/aws_eks_kubernetes_cluster_sensitive_object_access.yml b/removed/detections/aws_eks_kubernetes_cluster_sensitive_object_access.yml similarity index 98% rename from detections/deprecated/aws_eks_kubernetes_cluster_sensitive_object_access.yml rename to removed/detections/aws_eks_kubernetes_cluster_sensitive_object_access.yml index 866bca7809..c337fae5d0 100644 --- a/detections/deprecated/aws_eks_kubernetes_cluster_sensitive_object_access.yml +++ b/removed/detections/aws_eks_kubernetes_cluster_sensitive_object_access.yml @@ -3,7 +3,7 @@ id: 7f227943-2196-4d4d-8d6a-ac8cb308e61c version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets diff --git a/detections/deprecated/change_default_file_association.yml b/removed/detections/change_default_file_association.yml similarity index 99% rename from detections/deprecated/change_default_file_association.yml rename to removed/detections/change_default_file_association.yml index e5e583848a..3025b5adeb 100644 --- a/detections/deprecated/change_default_file_association.yml +++ b/removed/detections/change_default_file_association.yml @@ -3,7 +3,7 @@ id: 462d17d8-1f71-11ec-ad07-acde48001122 version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects suspicious registry modifications that change the default file association to execute diff --git a/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml b/removed/detections/clients_connecting_to_multiple_dns_servers.yml similarity index 99% rename from detections/deprecated/clients_connecting_to_multiple_dns_servers.yml rename to removed/detections/clients_connecting_to_multiple_dns_servers.yml index eb01c32ea2..d5371b4c99 100644 --- a/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml +++ b/removed/detections/clients_connecting_to_multiple_dns_servers.yml @@ -3,7 +3,7 @@ id: 74ec6f18-604b-4202-a567-86b2066be3ce version: 6 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: TTP description: This search allows you to identify the endpoints that have connected to more than five DNS servers and made DNS Queries over the time frame of the search. diff --git a/detections/deprecated/cloud_network_access_control_list_deleted.yml b/removed/detections/cloud_network_access_control_list_deleted.yml similarity index 98% rename from detections/deprecated/cloud_network_access_control_list_deleted.yml rename to removed/detections/cloud_network_access_control_list_deleted.yml index 8a9036b76a..bb84da3f50 100644 --- a/detections/deprecated/cloud_network_access_control_list_deleted.yml +++ b/removed/detections/cloud_network_access_control_list_deleted.yml @@ -3,7 +3,7 @@ id: 021abc51-1862-41dd-ad43-43c739c0a983 version: 4 date: '2024-11-14' author: Peter Gael, Splunk -status: deprecated +status: removed type: Anomaly description: Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker diff --git a/detections/deprecated/cmdline_tool_not_executed_in_cmd_shell.yml b/removed/detections/cmdline_tool_not_executed_in_cmd_shell.yml similarity index 99% rename from detections/deprecated/cmdline_tool_not_executed_in_cmd_shell.yml rename to removed/detections/cmdline_tool_not_executed_in_cmd_shell.yml index 74087020ed..772d5444d8 100644 --- a/detections/deprecated/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/removed/detections/cmdline_tool_not_executed_in_cmd_shell.yml @@ -3,7 +3,7 @@ id: 6c3f7dd8-153c-11ec-ac2d-acde48001122 version: 9 date: '2025-02-10' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, or similar tools are executed by a non-standard parent process, excluding CMD, PowerShell, diff --git a/detections/deprecated/correlation_by_repository_and_risk.yml b/removed/detections/correlation_by_repository_and_risk.yml similarity index 99% rename from detections/deprecated/correlation_by_repository_and_risk.yml rename to removed/detections/correlation_by_repository_and_risk.yml index 681f046bf4..a3e5fea3e7 100644 --- a/detections/deprecated/correlation_by_repository_and_risk.yml +++ b/removed/detections/correlation_by_repository_and_risk.yml @@ -3,7 +3,7 @@ id: 8da9fdd9-6a1b-4ae0-8a34-8c25e6be9687 version: 4 date: '2025-02-10' author: Patrick Bareiss, Splunk -status: deprecated +status: removed type: Correlation description: |- This search has been deprecated and updated with Risk Rule for Dev Sec Ops by Repository detection. The following analytic detects by correlating repository and risk score to identify patterns and trends in the data based on the level of risk associated. The analytic adds any null values and calculates the sum of the risk scores for each detection. Then, the analytic captures the source and user information for each detection and sorts the results in ascending order based on the risk score. Finally, the analytic filters the detections with a risk score below 80 and focuses only on high-risk detections.This detection is important because it provides valuable insights into the distribution of high-risk activities across different repositories. It also identifies the most vulnerable repositories that are frequently targeted by potential threats. Additionally, it proactively detects and responds to potential threats, thereby minimizing the impact of attacks and safeguarding critical assets. Finally, it provides a comprehensive view of the risk landscape and helps to make informed decisions to protect the organization's data and infrastructure. False positives might occur so it is important to identify the impact of the attack and prioritize response and mitigation efforts. diff --git a/detections/deprecated/correlation_by_user_and_risk.yml b/removed/detections/correlation_by_user_and_risk.yml similarity index 98% rename from detections/deprecated/correlation_by_user_and_risk.yml rename to removed/detections/correlation_by_user_and_risk.yml index d121453be9..95a4e50e10 100644 --- a/detections/deprecated/correlation_by_user_and_risk.yml +++ b/removed/detections/correlation_by_user_and_risk.yml @@ -3,7 +3,7 @@ id: 610e12dc-b6fa-4541-825e-4a0b3b6f6773 version: 4 date: '2025-02-10' author: Patrick Bareiss, Splunk -status: deprecated +status: removed type: Correlation description: |- The following analytic detects the correlation between the user and risk score and identifies users with a high risk score that pose a significant security risk such as unauthorized access attempts, suspicious behavior, or potential insider threats. Next, the analytic calculates the sum of the risk scores and groups the results by user, the corresponding signals, and the repository. The results are sorted in descending order based on the risk score and filtered to include records with a risk score greater than 80. Finally, the results are passed through a correlation filter specific to the user and risk. This detection is important because it identifies users who have a high risk score and helps to prioritize investigations and allocate resources. False positives might occur but the impact of such an attack can vary depending on the specific scenario such as data exfiltration, system compromise, or the disruption of critical services. Please investigate this notable event. diff --git a/detections/deprecated/create_local_admin_accounts_using_net_exe.yml b/removed/detections/create_local_admin_accounts_using_net_exe.yml similarity index 99% rename from detections/deprecated/create_local_admin_accounts_using_net_exe.yml rename to removed/detections/create_local_admin_accounts_using_net_exe.yml index 05bd612ba3..5534cdc2d0 100644 --- a/detections/deprecated/create_local_admin_accounts_using_net_exe.yml +++ b/removed/detections/create_local_admin_accounts_using_net_exe.yml @@ -3,7 +3,7 @@ id: b89919ed-fe5f-492c-b139-151bb162040e version: 17 date: '2025-02-10' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects the creation of local administrator accounts using the net.exe command. It leverages diff --git a/detections/deprecated/deleting_of_net_users.yml b/removed/detections/deleting_of_net_users.yml similarity index 99% rename from detections/deprecated/deleting_of_net_users.yml rename to removed/detections/deleting_of_net_users.yml index 379264584f..48c661fd73 100644 --- a/detections/deprecated/deleting_of_net_users.yml +++ b/removed/detections/deleting_of_net_users.yml @@ -3,7 +3,7 @@ id: 1c8c6f66-acce-11eb-aafb-acde48001122 version: 8 date: '2025-01-24' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects the use of net.exe or net1.exe command-line diff --git a/detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml b/removed/detections/detect_activity_related_to_pass_the_hash_attacks.yml similarity index 99% rename from detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml rename to removed/detections/detect_activity_related_to_pass_the_hash_attacks.yml index 9b6c9aec2c..c57b95da42 100644 --- a/detections/deprecated/detect_activity_related_to_pass_the_hash_attacks.yml +++ b/removed/detections/detect_activity_related_to_pass_the_hash_attacks.yml @@ -3,7 +3,7 @@ id: f5939373-8054-40ad-8c64-cec478a22a4b version: 10 date: '2025-02-10' author: Bhavin Patel, Patrick Bareiss, Splunk -status: deprecated +status: removed type: Hunting description: This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts at using the Pass-the-Hash technique. diff --git a/detections/deprecated/detect_api_activity_from_users_without_mfa.yml b/removed/detections/detect_api_activity_from_users_without_mfa.yml similarity index 99% rename from detections/deprecated/detect_api_activity_from_users_without_mfa.yml rename to removed/detections/detect_api_activity_from_users_without_mfa.yml index e0ad2efcfc..f7da7f035d 100644 --- a/detections/deprecated/detect_api_activity_from_users_without_mfa.yml +++ b/removed/detections/detect_api_activity_from_users_without_mfa.yml @@ -3,7 +3,7 @@ id: 4d46e8bd-4072-48e4-92db-0325889ef894 version: 4 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Hunting description: This search looks for AWS CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. diff --git a/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml b/removed/detections/detect_aws_api_activities_from_unapproved_accounts.yml similarity index 99% rename from detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml rename to removed/detections/detect_aws_api_activities_from_unapproved_accounts.yml index 23e833aac1..98b40ed434 100644 --- a/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml +++ b/removed/detections/detect_aws_api_activities_from_unapproved_accounts.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a3f1-d82362d4bd55 version: 5 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Hunting description: This search looks for successful AWS CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns diff --git a/detections/deprecated/detect_critical_alerts_from_security_tools.yml b/removed/detections/detect_critical_alerts_from_security_tools.yml similarity index 99% rename from detections/deprecated/detect_critical_alerts_from_security_tools.yml rename to removed/detections/detect_critical_alerts_from_security_tools.yml index 79ba56809d..a1bdeec87e 100644 --- a/detections/deprecated/detect_critical_alerts_from_security_tools.yml +++ b/removed/detections/detect_critical_alerts_from_security_tools.yml @@ -3,7 +3,7 @@ id: 483e8a68-f2f7-45be-8fc9-bf725f0e22fd version: 2 date: '2025-01-13' author: Gowthamaraj Rajendran, Patrick Bareiss, Bhavin Patel, Bryan Pluta, Splunk -status: deprecated +status: removed type: TTP data_source: - Windows Defender Alerts diff --git a/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml b/removed/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml similarity index 99% rename from detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml rename to removed/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml index 2d4975f3ec..05a6f77ef4 100644 --- a/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml +++ b/removed/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml @@ -3,7 +3,7 @@ id: 24dd17b1-e2fb-4c31-878c-d4f226595bfa version: 5 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: This search looks for DNS requests for phishing domains that are leveraging EvilGinx tools to mimic websites. diff --git a/detections/deprecated/detect_long_dns_txt_record_response.yml b/removed/detections/detect_long_dns_txt_record_response.yml similarity index 99% rename from detections/deprecated/detect_long_dns_txt_record_response.yml rename to removed/detections/detect_long_dns_txt_record_response.yml index 57a2fb80be..1329c3bf26 100644 --- a/detections/deprecated/detect_long_dns_txt_record_response.yml +++ b/removed/detections/detect_long_dns_txt_record_response.yml @@ -3,7 +3,7 @@ id: 05437c07-62f5-452e-afdc-04dd44815bb9 version: 5 date: '2024-11-14' author: Rico Valdez, Splunk -status: deprecated +status: removed type: TTP description: This search is used to detect attempts to use DNS tunneling, by calculating the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission diff --git a/detections/deprecated/detect_mimikatz_using_loaded_images.yml b/removed/detections/detect_mimikatz_using_loaded_images.yml similarity index 99% rename from detections/deprecated/detect_mimikatz_using_loaded_images.yml rename to removed/detections/detect_mimikatz_using_loaded_images.yml index 75e66c0061..6fbe7ff5e7 100644 --- a/detections/deprecated/detect_mimikatz_using_loaded_images.yml +++ b/removed/detections/detect_mimikatz_using_loaded_images.yml @@ -3,7 +3,7 @@ id: 29e307ba-40af-4ab2-91b2-3c6b392bbba0 version: 4 date: '2025-02-10' author: Patrick Bareiss, Splunk -status: deprecated +status: removed type: TTP description: This search looks for reading loaded Images unique to credential dumping with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon diff --git a/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml b/removed/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml similarity index 99% rename from detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml rename to removed/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml index aa9cabe8d3..a97cc408bb 100644 --- a/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml +++ b/removed/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml @@ -3,7 +3,7 @@ id: 98917be2-bfc8-475a-8618-a9bb06575188 version: 5 date: '2024-11-14' author: Rico Valdez, Splunk -status: deprecated +status: removed type: TTP description: This search looks for PowerShell requesting privileges consistent with credential dumping. Deprecated, looks like things changed from a logging perspective. diff --git a/detections/deprecated/detect_new_api_calls_from_user_roles.yml b/removed/detections/detect_new_api_calls_from_user_roles.yml similarity index 99% rename from detections/deprecated/detect_new_api_calls_from_user_roles.yml rename to removed/detections/detect_new_api_calls_from_user_roles.yml index 5ed0943c52..6875898fc1 100644 --- a/detections/deprecated/detect_new_api_calls_from_user_roles.yml +++ b/removed/detections/detect_new_api_calls_from_user_roles.yml @@ -3,7 +3,7 @@ id: 22773e84-bac0-4595-b086-20d3f335b4f1 version: 4 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Anomaly description: This search detects new API calls that have either never been seen before or that have not been seen in the previous hour, where the identity type is `AssumedRole`. diff --git a/detections/deprecated/detect_new_user_aws_console_login.yml b/removed/detections/detect_new_user_aws_console_login.yml similarity index 99% rename from detections/deprecated/detect_new_user_aws_console_login.yml rename to removed/detections/detect_new_user_aws_console_login.yml index 1713d3b52d..75f7756e52 100644 --- a/detections/deprecated/detect_new_user_aws_console_login.yml +++ b/removed/detections/detect_new_user_aws_console_login.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a3f3-d82362dffd75 version: 5 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Hunting description: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup diff --git a/detections/deprecated/detect_processes_used_for_system_network_configuration_discovery.yml b/removed/detections/detect_processes_used_for_system_network_configuration_discovery.yml similarity index 99% rename from detections/deprecated/detect_processes_used_for_system_network_configuration_discovery.yml rename to removed/detections/detect_processes_used_for_system_network_configuration_discovery.yml index d0851935d2..e46c595fe9 100644 --- a/detections/deprecated/detect_processes_used_for_system_network_configuration_discovery.yml +++ b/removed/detections/detect_processes_used_for_system_network_configuration_discovery.yml @@ -3,7 +3,7 @@ id: a51bfe1a-94f0-48cc-b1e4-16ae10145893 version: 8 date: '2025-01-24' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic identifies the rapid execution of processes used diff --git a/detections/deprecated/detect_spike_in_aws_api_activity.yml b/removed/detections/detect_spike_in_aws_api_activity.yml similarity index 99% rename from detections/deprecated/detect_spike_in_aws_api_activity.yml rename to removed/detections/detect_spike_in_aws_api_activity.yml index 5a7efe7007..97feb48d8b 100644 --- a/detections/deprecated/detect_spike_in_aws_api_activity.yml +++ b/removed/detections/detect_spike_in_aws_api_activity.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a3f1-d32362d4bd55 version: 5 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: This search will detect users creating spikes of API activity in your AWS environment. It will also update the cache file that factors in the latest diff --git a/detections/deprecated/detect_spike_in_network_acl_activity.yml b/removed/detections/detect_spike_in_network_acl_activity.yml similarity index 99% rename from detections/deprecated/detect_spike_in_network_acl_activity.yml rename to removed/detections/detect_spike_in_network_acl_activity.yml index a7e693bf9e..fa43ca2e7d 100644 --- a/detections/deprecated/detect_spike_in_network_acl_activity.yml +++ b/removed/detections/detect_spike_in_network_acl_activity.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a1f1-e32372d4bd53 version: 4 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Anomaly description: This search will detect users creating spikes in API activity related to network access-control lists (ACLs)in your AWS environment. This search is deprecated diff --git a/detections/deprecated/detect_spike_in_security_group_activity.yml b/removed/detections/detect_spike_in_security_group_activity.yml similarity index 99% rename from detections/deprecated/detect_spike_in_security_group_activity.yml rename to removed/detections/detect_spike_in_security_group_activity.yml index de1cad3b6d..a6c75ede25 100644 --- a/detections/deprecated/detect_spike_in_security_group_activity.yml +++ b/removed/detections/detect_spike_in_security_group_activity.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a3f1-e32372d4bd53 version: 4 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Anomaly description: This search will detect users creating spikes in API activity related to security groups in your AWS environment. It will also update the cache file diff --git a/detections/deprecated/detect_usb_device_insertion.yml b/removed/detections/detect_usb_device_insertion.yml similarity index 99% rename from detections/deprecated/detect_usb_device_insertion.yml rename to removed/detections/detect_usb_device_insertion.yml index 2d6dd088f5..98ea80b3e0 100644 --- a/detections/deprecated/detect_usb_device_insertion.yml +++ b/removed/detections/detect_usb_device_insertion.yml @@ -3,7 +3,7 @@ id: 104658f4-afdc-499f-9719-17a43f9826f5 version: 4 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: The search is used to detect hosts that generate Windows Event ID 4663 for successful attempts to write to or read from a removable storage and Event ID diff --git a/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml b/removed/detections/detect_web_traffic_to_dynamic_domain_providers.yml similarity index 99% rename from detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml rename to removed/detections/detect_web_traffic_to_dynamic_domain_providers.yml index deadd5d14b..7b61741b56 100644 --- a/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml +++ b/removed/detections/detect_web_traffic_to_dynamic_domain_providers.yml @@ -3,7 +3,7 @@ id: 134da869-e264-4a8f-8d7e-fcd01c18f301 version: 6 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: This search looks for web connections to dynamic DNS providers. data_source: [] diff --git a/detections/deprecated/detect_webshell_exploit_behavior.yml b/removed/detections/detect_webshell_exploit_behavior.yml similarity index 99% rename from detections/deprecated/detect_webshell_exploit_behavior.yml rename to removed/detections/detect_webshell_exploit_behavior.yml index a460946a1a..679f7cfd64 100644 --- a/detections/deprecated/detect_webshell_exploit_behavior.yml +++ b/removed/detections/detect_webshell_exploit_behavior.yml @@ -3,7 +3,7 @@ id: 22597426-6dbd-49bd-bcdc-4ec19857192f version: 8 date: '2025-02-10' author: Steven Dick -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic identifies the execution of suspicious processes typically associated with webshell activity diff --git a/detections/deprecated/detection_of_dns_tunnels.yml b/removed/detections/detection_of_dns_tunnels.yml similarity index 99% rename from detections/deprecated/detection_of_dns_tunnels.yml rename to removed/detections/detection_of_dns_tunnels.yml index e903bf4d9a..cabfa19b64 100644 --- a/detections/deprecated/detection_of_dns_tunnels.yml +++ b/removed/detections/detection_of_dns_tunnels.yml @@ -3,7 +3,7 @@ id: 104658f4-afdc-499f-9719-17a43f9826f4 version: 5 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: "This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential diff --git a/detections/deprecated/disabling_net_user_account.yml b/removed/detections/disabling_net_user_account.yml similarity index 99% rename from detections/deprecated/disabling_net_user_account.yml rename to removed/detections/disabling_net_user_account.yml index 409e89854a..56936042e3 100644 --- a/detections/deprecated/disabling_net_user_account.yml +++ b/removed/detections/disabling_net_user_account.yml @@ -3,7 +3,7 @@ id: c0325326-acd6-11eb-98c2-acde48001122 version: 8 date: '2025-01-24' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects the use of the `net.exe` utility to disable diff --git a/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml b/removed/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml similarity index 98% rename from detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml rename to removed/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml index b52f87457a..680f232852 100644 --- a/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml +++ b/removed/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml @@ -3,7 +3,7 @@ id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f6 version: 6 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: This search will detect DNS requests resolved by unauthorized DNS servers. Legitimate DNS servers should be identified in the Enterprise Security Assets and diff --git a/detections/deprecated/dns_record_changed.yml b/removed/detections/dns_record_changed.yml similarity index 99% rename from detections/deprecated/dns_record_changed.yml rename to removed/detections/dns_record_changed.yml index 1da12999ba..d620468bcf 100644 --- a/detections/deprecated/dns_record_changed.yml +++ b/removed/detections/dns_record_changed.yml @@ -3,7 +3,7 @@ id: 44d3a43e-dcd5-49f7-8356-5209bb369065 version: 6 date: '2024-11-14' author: Jose Hernandez, Splunk -status: deprecated +status: removed type: TTP description: The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the diff --git a/detections/deprecated/domain_account_discovery_with_net_app.yml b/removed/detections/domain_account_discovery_with_net_app.yml similarity index 99% rename from detections/deprecated/domain_account_discovery_with_net_app.yml rename to removed/detections/domain_account_discovery_with_net_app.yml index a1518a4c1f..98dfe89c93 100644 --- a/detections/deprecated/domain_account_discovery_with_net_app.yml +++ b/removed/detections/domain_account_discovery_with_net_app.yml @@ -3,7 +3,7 @@ id: 98f6a534-04c2-11ec-96b2-acde48001122 version: 6 date: '2025-02-10' author: Teoderick Contreras, Mauricio Velazco, Splunk -status: deprecated +status: removed type: TTP description: This following analytic has been deprecated in favour of the generic version "5d0d4830-0133-11ec-bae3-acde48001122". The following analytic detects the diff --git a/detections/deprecated/domain_group_discovery_with_net.yml b/removed/detections/domain_group_discovery_with_net.yml similarity index 99% rename from detections/deprecated/domain_group_discovery_with_net.yml rename to removed/detections/domain_group_discovery_with_net.yml index 928dec10e8..cdb1b85e11 100644 --- a/detections/deprecated/domain_group_discovery_with_net.yml +++ b/removed/detections/domain_group_discovery_with_net.yml @@ -3,7 +3,7 @@ id: f2f14ac7-fa81-471a-80d5-7eb65c3c7349 version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk -status: deprecated +status: removed type: Hunting description: This search has been deprecated in favour of the more generic analytic "c5c8e0f3-147a-43da-bf04-4cfaec27dc44". The following analytic identifies the execution diff --git a/detections/deprecated/dump_lsass_via_procdump_rename.yml b/removed/detections/dump_lsass_via_procdump_rename.yml similarity index 99% rename from detections/deprecated/dump_lsass_via_procdump_rename.yml rename to removed/detections/dump_lsass_via_procdump_rename.yml index db67928fa4..646606d2fa 100644 --- a/detections/deprecated/dump_lsass_via_procdump_rename.yml +++ b/removed/detections/dump_lsass_via_procdump_rename.yml @@ -3,7 +3,7 @@ id: 21276daa-663d-11eb-ae93-0242ac130002 version: 4 date: '2024-11-14' author: Michael Haag, Splunk -status: deprecated +status: removed type: Hunting description: "Detect a renamed instance of procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and diff --git a/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml b/removed/detections/ec2_instance_modified_with_previously_unseen_user.yml similarity index 99% rename from detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml rename to removed/detections/ec2_instance_modified_with_previously_unseen_user.yml index c0dddee3ca..c41e9ef0f2 100644 --- a/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml +++ b/removed/detections/ec2_instance_modified_with_previously_unseen_user.yml @@ -3,7 +3,7 @@ id: 56f91724-cf3f-4666-84e1-e3712fb41e76 version: 6 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for EC2 instances being modified by users who have not previously modified them. This search is deprecated and have been translated diff --git a/detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml b/removed/detections/ec2_instance_started_in_previously_unseen_region.yml similarity index 98% rename from detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml rename to removed/detections/ec2_instance_started_in_previously_unseen_region.yml index 0d7e62b234..0ddc56e39b 100644 --- a/detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml +++ b/removed/detections/ec2_instance_started_in_previously_unseen_region.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a3f3-d82362d6fd75 version: 4 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Hunting description: This search looks for AWS CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml b/removed/detections/ec2_instance_started_with_previously_unseen_ami.yml similarity index 99% rename from detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml rename to removed/detections/ec2_instance_started_with_previously_unseen_ami.yml index 80a929eefb..a801015f2d 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml +++ b/removed/detections/ec2_instance_started_with_previously_unseen_ami.yml @@ -3,7 +3,7 @@ id: 347ec301-601b-48b9-81aa-9ddf9c829dd3 version: 5 date: '2025-01-16' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for EC2 instances being created with previously unseen AMIs. This search is deprecated and have been translated to use the latest Change diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml b/removed/detections/ec2_instance_started_with_previously_unseen_instance_type.yml similarity index 99% rename from detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml rename to removed/detections/ec2_instance_started_with_previously_unseen_instance_type.yml index e1a95404a0..1f549688bd 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml +++ b/removed/detections/ec2_instance_started_with_previously_unseen_instance_type.yml @@ -3,7 +3,7 @@ id: 65541c80-03c7-4e05-83c8-1dcd57a2e1ad version: 6 date: '2025-01-16' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for EC2 instances being created with previously unseen instance types. This search is deprecated and have been translated to use the latest diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml b/removed/detections/ec2_instance_started_with_previously_unseen_user.yml similarity index 99% rename from detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml rename to removed/detections/ec2_instance_started_with_previously_unseen_user.yml index d43786da55..e2b75f6b5d 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml +++ b/removed/detections/ec2_instance_started_with_previously_unseen_user.yml @@ -3,7 +3,7 @@ id: 22773e84-bac0-4595-b086-20d3f735b4f1 version: 6 date: '2025-01-16' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: This search looks for EC2 instances being created by users who have not created them before. This search is deprecated and have been translated to use the diff --git a/detections/deprecated/elevated_group_discovery_with_net.yml b/removed/detections/elevated_group_discovery_with_net.yml similarity index 99% rename from detections/deprecated/elevated_group_discovery_with_net.yml rename to removed/detections/elevated_group_discovery_with_net.yml index a941649159..d2239f33b0 100644 --- a/detections/deprecated/elevated_group_discovery_with_net.yml +++ b/removed/detections/elevated_group_discovery_with_net.yml @@ -3,7 +3,7 @@ id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments used to query diff --git a/detections/deprecated/excel_spawning_powershell.yml b/removed/detections/excel_spawning_powershell.yml similarity index 99% rename from detections/deprecated/excel_spawning_powershell.yml rename to removed/detections/excel_spawning_powershell.yml index 764de86234..10332d5d80 100644 --- a/detections/deprecated/excel_spawning_powershell.yml +++ b/removed/detections/excel_spawning_powershell.yml @@ -3,7 +3,7 @@ id: 42d40a22-9be3-11eb-8f08-acde48001122 version: 9 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/excel_spawning_windows_script_host.yml b/removed/detections/excel_spawning_windows_script_host.yml similarity index 99% rename from detections/deprecated/excel_spawning_windows_script_host.yml rename to removed/detections/excel_spawning_windows_script_host.yml index 40deb89c49..404e72e788 100644 --- a/detections/deprecated/excel_spawning_windows_script_host.yml +++ b/removed/detections/excel_spawning_windows_script_host.yml @@ -3,7 +3,7 @@ id: 57fe880a-9be3-11eb-9bf3-acde48001122 version: 10 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach. The following analytic identifies instances where Microsoft Excel spawns diff --git a/detections/deprecated/excessive_service_stop_attempt.yml b/removed/detections/excessive_service_stop_attempt.yml similarity index 99% rename from detections/deprecated/excessive_service_stop_attempt.yml rename to removed/detections/excessive_service_stop_attempt.yml index 3e27dc456b..c1d3ad9f3c 100644 --- a/detections/deprecated/excessive_service_stop_attempt.yml +++ b/removed/detections/excessive_service_stop_attempt.yml @@ -3,7 +3,7 @@ id: ae8d3f4a-acd7-11eb-8846-acde48001122 version: 7 date: '2025-01-24' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: Anomaly description: The following analytic has been deprecated. The following analytic detects multiple attempts to stop or delete services diff --git a/detections/deprecated/excessive_usage_of_net_app.yml b/removed/detections/excessive_usage_of_net_app.yml similarity index 99% rename from detections/deprecated/excessive_usage_of_net_app.yml rename to removed/detections/excessive_usage_of_net_app.yml index 1b3556f57b..c993f62522 100644 --- a/detections/deprecated/excessive_usage_of_net_app.yml +++ b/removed/detections/excessive_usage_of_net_app.yml @@ -3,7 +3,7 @@ id: 45e52536-ae42-11eb-b5c6-acde48001122 version: 7 date: '2025-01-24' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: Anomaly description: The following analytic has been deprecated. The following analytic detects excessive usage of `net.exe` or `net1.exe` diff --git a/detections/deprecated/execution_of_file_with_spaces_before_extension.yml b/removed/detections/execution_of_file_with_spaces_before_extension.yml similarity index 99% rename from detections/deprecated/execution_of_file_with_spaces_before_extension.yml rename to removed/detections/execution_of_file_with_spaces_before_extension.yml index 6e453a7f03..ef42aea3b4 100644 --- a/detections/deprecated/execution_of_file_with_spaces_before_extension.yml +++ b/removed/detections/execution_of_file_with_spaces_before_extension.yml @@ -3,7 +3,7 @@ id: ab0353e6-a956-420b-b724-a8b4846d5d5a version: 6 date: '2024-11-14' author: Rico Valdez, Splunk -status: deprecated +status: removed type: TTP description: This search looks for processes launched from files with at least five spaces in the name before the extension. This is typically done to obfuscate the diff --git a/detections/deprecated/extended_period_without_successful_netbackup_backups.yml b/removed/detections/extended_period_without_successful_netbackup_backups.yml similarity index 98% rename from detections/deprecated/extended_period_without_successful_netbackup_backups.yml rename to removed/detections/extended_period_without_successful_netbackup_backups.yml index c72e3977a2..fa3e78bc00 100644 --- a/detections/deprecated/extended_period_without_successful_netbackup_backups.yml +++ b/removed/detections/extended_period_without_successful_netbackup_backups.yml @@ -3,7 +3,7 @@ id: a34aae96-ccf8-4aef-952c-3ea214444440 version: 4 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: Hunting description: This search returns a list of hosts that have not successfully completed a backup in over a week. Deprecated because it's a infrastructure monitoring. diff --git a/detections/deprecated/extraction_of_registry_hives.yml b/removed/detections/extraction_of_registry_hives.yml similarity index 99% rename from detections/deprecated/extraction_of_registry_hives.yml rename to removed/detections/extraction_of_registry_hives.yml index ceb5264fa6..ed19f50850 100644 --- a/detections/deprecated/extraction_of_registry_hives.yml +++ b/removed/detections/extraction_of_registry_hives.yml @@ -3,7 +3,7 @@ id: 8bbb7d58-b360-11eb-ba21-acde48001122 version: 8 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects the use of `reg.exe` to export Windows Registry hives, which may contain sensitive diff --git a/detections/deprecated/first_time_seen_command_line_argument.yml b/removed/detections/first_time_seen_command_line_argument.yml similarity index 99% rename from detections/deprecated/first_time_seen_command_line_argument.yml rename to removed/detections/first_time_seen_command_line_argument.yml index 5df827cada..b11889326f 100644 --- a/detections/deprecated/first_time_seen_command_line_argument.yml +++ b/removed/detections/first_time_seen_command_line_argument.yml @@ -3,7 +3,7 @@ id: a1b6e73f-98d5-470f-99ac-77aacd578473 version: 8 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Hunting description: This search looks for command-line arguments that use a `/c` parameter to execute a command that has not previously been seen. diff --git a/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml b/removed/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml similarity index 98% rename from detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml rename to removed/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml index 10a412fbc9..e1ff155ab4 100644 --- a/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml +++ b/removed/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml @@ -3,7 +3,7 @@ id: 27af8c15-38b0-4408-b339-920170724adb version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides detection of accounts with high risk roles by projects. Compromised accounts with high risk roles can move laterally or even scalate privileges diff --git a/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml b/removed/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml similarity index 98% rename from detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml rename to removed/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml index 1291444493..4082bc1b56 100644 --- a/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml +++ b/removed/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml @@ -3,7 +3,7 @@ id: 2e70ef35-2187-431f-aedc-4503dc9b06ba version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides detection of high risk permissions by resource and accounts. These are permissions that can allow attackers with compromised accounts diff --git a/detections/deprecated/gcp_detect_oauth_token_abuse.yml b/removed/detections/gcp_detect_oauth_token_abuse.yml similarity index 98% rename from detections/deprecated/gcp_detect_oauth_token_abuse.yml rename to removed/detections/gcp_detect_oauth_token_abuse.yml index 25144dd436..16b1471ac1 100644 --- a/detections/deprecated/gcp_detect_oauth_token_abuse.yml +++ b/removed/detections/gcp_detect_oauth_token_abuse.yml @@ -3,7 +3,7 @@ id: a7e9f7bb-8901-4ad0-8d88-0a4ab07b1972 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides detection of possible GCP Oauth token abuse. GCP Oauth token without time limit can be exfiltrated and reused for keeping access diff --git a/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml b/removed/detections/gcp_kubernetes_cluster_scan_detection.yml similarity index 99% rename from detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml rename to removed/detections/gcp_kubernetes_cluster_scan_detection.yml index f8fabad5ff..414be67679 100644 --- a/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml +++ b/removed/detections/gcp_kubernetes_cluster_scan_detection.yml @@ -3,7 +3,7 @@ id: db5957ec-0144-4c56-b512-9dccbe7a2d26 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: TTP description: This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster diff --git a/detections/deprecated/identify_new_user_accounts.yml b/removed/detections/identify_new_user_accounts.yml similarity index 98% rename from detections/deprecated/identify_new_user_accounts.yml rename to removed/detections/identify_new_user_accounts.yml index 55b528d72a..89e8250b82 100644 --- a/detections/deprecated/identify_new_user_accounts.yml +++ b/removed/detections/identify_new_user_accounts.yml @@ -3,7 +3,7 @@ id: 475b9e27-17e4-46e2-b7e2-648221be3b89 version: 4 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Hunting description: This detection search will help profile user accounts in your environment by identifying newly created accounts that have been added to your network in the diff --git a/detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml b/removed/detections/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml similarity index 98% rename from detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml rename to removed/detections/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml index 8aed9288a5..20458780df 100644 --- a/detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml +++ b/removed/detections/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml @@ -3,7 +3,7 @@ id: 5b30b25d-7d32-42d8-95ca-64dfcd9076e6 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes service accounts,accessing pods by IP address, verb and decision diff --git a/detections/deprecated/kubernetes_aws_detect_rbac_authorization_by_account.yml b/removed/detections/kubernetes_aws_detect_rbac_authorization_by_account.yml similarity index 98% rename from detections/deprecated/kubernetes_aws_detect_rbac_authorization_by_account.yml rename to removed/detections/kubernetes_aws_detect_rbac_authorization_by_account.yml index 6d04bf8d94..5f424be025 100644 --- a/detections/deprecated/kubernetes_aws_detect_rbac_authorization_by_account.yml +++ b/removed/detections/kubernetes_aws_detect_rbac_authorization_by_account.yml @@ -3,7 +3,7 @@ id: de7264ed-3ed9-4fef-bb01-6eefc87cefe8 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding top to see both extremes of RBAC diff --git a/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml b/removed/detections/kubernetes_aws_detect_sensitive_role_access.yml similarity index 98% rename from detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml rename to removed/detections/kubernetes_aws_detect_sensitive_role_access.yml index bb7b707a96..ed19c6d3f0 100644 --- a/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml +++ b/removed/detections/kubernetes_aws_detect_sensitive_role_access.yml @@ -3,7 +3,7 @@ id: b6013a7b-85e0-4a45-b051-10b252d69569 version: 5 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets diff --git a/detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml b/removed/detections/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml similarity index 98% rename from detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml rename to removed/detections/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml index 17722e0587..9dd04f706e 100644 --- a/detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml +++ b/removed/detections/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml @@ -3,7 +3,7 @@ id: a6959c57-fa8f-4277-bb86-7c32fba579d5 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes service accounts with failure or forbidden access status, this search can be extended by using top or diff --git a/detections/deprecated/kubernetes_azure_active_service_accounts_by_pod_namespace.yml b/removed/detections/kubernetes_azure_active_service_accounts_by_pod_namespace.yml similarity index 98% rename from detections/deprecated/kubernetes_azure_active_service_accounts_by_pod_namespace.yml rename to removed/detections/kubernetes_azure_active_service_accounts_by_pod_namespace.yml index ef9d02ecbe..900b6fd517 100644 --- a/detections/deprecated/kubernetes_azure_active_service_accounts_by_pod_namespace.yml +++ b/removed/detections/kubernetes_azure_active_service_accounts_by_pod_namespace.yml @@ -3,7 +3,7 @@ id: 55a2264a-b7f0-45e5-addd-1e5ab3415c72 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb diff --git a/detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml b/removed/detections/kubernetes_azure_detect_rbac_authorization_by_account.yml similarity index 98% rename from detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml rename to removed/detections/kubernetes_azure_detect_rbac_authorization_by_account.yml index 0adc47769d..a40aa3b80e 100644 --- a/detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml +++ b/removed/detections/kubernetes_azure_detect_rbac_authorization_by_account.yml @@ -3,7 +3,7 @@ id: 47af7d20-0607-4079-97d7-7a29af58b54e version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding rare or top to see both extremes diff --git a/detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml b/removed/detections/kubernetes_azure_detect_sensitive_object_access.yml similarity index 98% rename from detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml rename to removed/detections/kubernetes_azure_detect_sensitive_object_access.yml index 8ae1ee647e..d06b658319 100644 --- a/detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml +++ b/removed/detections/kubernetes_azure_detect_sensitive_object_access.yml @@ -3,7 +3,7 @@ id: 1bba382b-07fd-4ffa-b390-8002739b76e8 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets diff --git a/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml b/removed/detections/kubernetes_azure_detect_sensitive_role_access.yml similarity index 98% rename from detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml rename to removed/detections/kubernetes_azure_detect_sensitive_role_access.yml index 9993a0a115..a42d6e5acd 100644 --- a/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml +++ b/removed/detections/kubernetes_azure_detect_sensitive_role_access.yml @@ -3,7 +3,7 @@ id: f27349e5-1641-4f6a-9e68-30402be0ad4c version: 5 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets diff --git a/detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml b/removed/detections/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml similarity index 98% rename from detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml rename to removed/detections/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml index ccbf5daf0c..502f1644b6 100644 --- a/detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml +++ b/removed/detections/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml @@ -3,7 +3,7 @@ id: 019690d7-420f-4da0-b320-f27b09961514 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes service accounts with failure or forbidden access status diff --git a/detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml b/removed/detections/kubernetes_azure_detect_suspicious_kubectl_calls.yml similarity index 98% rename from detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml rename to removed/detections/kubernetes_azure_detect_suspicious_kubectl_calls.yml index ef3fed2b2d..f213575ef1 100644 --- a/detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml +++ b/removed/detections/kubernetes_azure_detect_suspicious_kubectl_calls.yml @@ -3,7 +3,7 @@ id: 4b6d1ba8-0000-4cec-87e6-6cbbd71651b5 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on rare Kubectl calls with IP, verb namespace and object access context diff --git a/detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml b/removed/detections/kubernetes_azure_pod_scan_fingerprint.yml similarity index 98% rename from detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml rename to removed/detections/kubernetes_azure_pod_scan_fingerprint.yml index 1b1378b2f7..715ad90996 100644 --- a/detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml +++ b/removed/detections/kubernetes_azure_pod_scan_fingerprint.yml @@ -3,7 +3,7 @@ id: 86aad3e0-732f-4f66-bbbc-70df448e461d version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster pod diff --git a/detections/deprecated/kubernetes_azure_scan_fingerprint.yml b/removed/detections/kubernetes_azure_scan_fingerprint.yml similarity index 98% rename from detections/deprecated/kubernetes_azure_scan_fingerprint.yml rename to removed/detections/kubernetes_azure_scan_fingerprint.yml index 8a6b44473d..1604bee2ce 100644 --- a/detections/deprecated/kubernetes_azure_scan_fingerprint.yml +++ b/removed/detections/kubernetes_azure_scan_fingerprint.yml @@ -3,7 +3,7 @@ id: c5e5bd5c-1013-4841-8b23-e7b3253c840a version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster in diff --git a/detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml b/removed/detections/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml similarity index 98% rename from detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml rename to removed/detections/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml index 0d3a4cdf11..32d73fe7a4 100644 --- a/detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml +++ b/removed/detections/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml @@ -3,7 +3,7 @@ id: 7f5c2779-88a0-4824-9caa-0f606c8f260f version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes service accounts,accessing pods by IP address, verb and decision diff --git a/detections/deprecated/kubernetes_gcp_detect_rbac_authorizations_by_account.yml b/removed/detections/kubernetes_gcp_detect_rbac_authorizations_by_account.yml similarity index 98% rename from detections/deprecated/kubernetes_gcp_detect_rbac_authorizations_by_account.yml rename to removed/detections/kubernetes_gcp_detect_rbac_authorizations_by_account.yml index 09a26684ce..a73ac757ba 100644 --- a/detections/deprecated/kubernetes_gcp_detect_rbac_authorizations_by_account.yml +++ b/removed/detections/kubernetes_gcp_detect_rbac_authorizations_by_account.yml @@ -3,7 +3,7 @@ id: 99487de3-7192-4b41-939d-fbe9acfb1340 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding top to see both extremes of RBAC diff --git a/detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml b/removed/detections/kubernetes_gcp_detect_sensitive_object_access.yml similarity index 98% rename from detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml rename to removed/detections/kubernetes_gcp_detect_sensitive_object_access.yml index 557ab8a5c3..f6d58fb55d 100644 --- a/detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml +++ b/removed/detections/kubernetes_gcp_detect_sensitive_object_access.yml @@ -3,7 +3,7 @@ id: bdb6d596-86a0-4aba-8369-418ae8b9963a version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets diff --git a/detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml b/removed/detections/kubernetes_gcp_detect_sensitive_role_access.yml similarity index 98% rename from detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml rename to removed/detections/kubernetes_gcp_detect_sensitive_role_access.yml index da1b2cf148..97f65baf4a 100644 --- a/detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml +++ b/removed/detections/kubernetes_gcp_detect_sensitive_role_access.yml @@ -3,7 +3,7 @@ id: a46923f6-36b9-4806-a681-31f314907c30 version: 5 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets diff --git a/detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml b/removed/detections/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml similarity index 98% rename from detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml rename to removed/detections/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml index fff4730076..830d71836c 100644 --- a/detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml +++ b/removed/detections/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml @@ -3,7 +3,7 @@ id: 7094808d-432a-48e7-bb3c-77e96c894f3b version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on Kubernetes service accounts with failure or forbidden access status, this search can be extended by using top or diff --git a/detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml b/removed/detections/kubernetes_gcp_detect_suspicious_kubectl_calls.yml similarity index 98% rename from detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml rename to removed/detections/kubernetes_gcp_detect_suspicious_kubectl_calls.yml index a78e967c70..d3893b3ba1 100644 --- a/detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml +++ b/removed/detections/kubernetes_gcp_detect_suspicious_kubectl_calls.yml @@ -3,7 +3,7 @@ id: a5bed417-070a-41f2-a1e4-82b6aa281557 version: 4 date: '2024-11-14' author: Rod Soto, Splunk -status: deprecated +status: removed type: Hunting description: This search provides information on anonymous Kubectl calls with IP, verb namespace and object access context diff --git a/detections/deprecated/linux_auditd_find_private_keys.yml b/removed/detections/linux_auditd_find_private_keys.yml similarity index 99% rename from detections/deprecated/linux_auditd_find_private_keys.yml rename to removed/detections/linux_auditd_find_private_keys.yml index d45b98a890..225211371a 100644 --- a/detections/deprecated/linux_auditd_find_private_keys.yml +++ b/removed/detections/linux_auditd_find_private_keys.yml @@ -3,7 +3,7 @@ id: 80bb9988-190b-4ee0-a3c3-509545a8f678 version: 6 date: '2025-02-10' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects suspicious attempts to find private keys, which may indicate an attacker's effort diff --git a/detections/deprecated/local_account_discovery_with_net.yml b/removed/detections/local_account_discovery_with_net.yml similarity index 99% rename from detections/deprecated/local_account_discovery_with_net.yml rename to removed/detections/local_account_discovery_with_net.yml index 69f3af6598..2203098764 100644 --- a/detections/deprecated/local_account_discovery_with_net.yml +++ b/removed/detections/local_account_discovery_with_net.yml @@ -3,7 +3,7 @@ id: 5d0d4830-0133-11ec-bae3-acde48001122 version: 7 date: '2025-02-10' author: Mauricio Velazco, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic has been deprecated. The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments `user` or `users` diff --git a/detections/deprecated/monitor_dns_for_brand_abuse.yml b/removed/detections/monitor_dns_for_brand_abuse.yml similarity index 98% rename from detections/deprecated/monitor_dns_for_brand_abuse.yml rename to removed/detections/monitor_dns_for_brand_abuse.yml index 9ad520f284..23a96ac7d0 100644 --- a/detections/deprecated/monitor_dns_for_brand_abuse.yml +++ b/removed/detections/monitor_dns_for_brand_abuse.yml @@ -3,7 +3,7 @@ id: 24dd17b1-e2fb-4c31-878c-d4f746595bfa version: 4 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: TTP description: This search looks for DNS requests for faux domains similar to the domains that you want to have monitored for abuse. diff --git a/detections/deprecated/mshtml_module_load_in_office_product.yml b/removed/detections/mshtml_module_load_in_office_product.yml similarity index 99% rename from detections/deprecated/mshtml_module_load_in_office_product.yml rename to removed/detections/mshtml_module_load_in_office_product.yml index 833a24a872..03be60e1c7 100644 --- a/detections/deprecated/mshtml_module_load_in_office_product.yml +++ b/removed/detections/mshtml_module_load_in_office_product.yml @@ -3,7 +3,7 @@ id: 5f1c168e-118b-11ec-84ff-acde48001122 version: 8 date: '2025-02-10' author: Michael Haag, Mauricio Velazco, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects the loading of the mshtml.dll module into an Office product, which is indicative diff --git a/detections/deprecated/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml b/removed/detections/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml similarity index 99% rename from detections/deprecated/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml rename to removed/detections/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml index 1ebadf8ebc..96b3b69893 100644 --- a/detections/deprecated/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml +++ b/removed/detections/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml @@ -3,7 +3,7 @@ id: 19cba45f-cad3-4032-8911-0c09e0444552 version: 6 date: '2025-02-10' author: Michael Haag, Mauricio Velazco, Rico Valdez, Splunk -status: deprecated +status: removed type: TTP description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta Multiple Users Failing To Authenticate From Ip`. This analytic identifies diff --git a/detections/deprecated/net_localgroup_discovery.yml b/removed/detections/net_localgroup_discovery.yml similarity index 99% rename from detections/deprecated/net_localgroup_discovery.yml rename to removed/detections/net_localgroup_discovery.yml index 31b775f015..261b7b7902 100644 --- a/detections/deprecated/net_localgroup_discovery.yml +++ b/removed/detections/net_localgroup_discovery.yml @@ -3,7 +3,7 @@ id: 54f5201e-155b-11ec-a6e2-acde48001122 version: 6 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: Hunting description: This search has been deprecated in favour of the more generic analytic "c5c8e0f3-147a-43da-bf04-4cfaec27dc44". The following analytic detects the execution diff --git a/detections/deprecated/network_connection_discovery_with_net.yml b/removed/detections/network_connection_discovery_with_net.yml similarity index 99% rename from detections/deprecated/network_connection_discovery_with_net.yml rename to removed/detections/network_connection_discovery_with_net.yml index 0002699f31..b90d9bdde6 100644 --- a/detections/deprecated/network_connection_discovery_with_net.yml +++ b/removed/detections/network_connection_discovery_with_net.yml @@ -3,7 +3,7 @@ id: 640337e5-6e41-4b7f-af06-9d9eab5e1e2d version: 6 date: '2025-01-24' author: Mauricio Velazco, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic has been deprecated. The following analytic identifies the execution of `net.exe` or `net1.exe` diff --git a/detections/deprecated/o365_suspicious_admin_email_forwarding.yml b/removed/detections/o365_suspicious_admin_email_forwarding.yml similarity index 98% rename from detections/deprecated/o365_suspicious_admin_email_forwarding.yml rename to removed/detections/o365_suspicious_admin_email_forwarding.yml index b706b2d0a8..7d67c799b3 100644 --- a/detections/deprecated/o365_suspicious_admin_email_forwarding.yml +++ b/removed/detections/o365_suspicious_admin_email_forwarding.yml @@ -3,7 +3,7 @@ id: 7f398cfb-918d-41f4-8db8-2e2474e02c28 version: 4 date: '2025-02-10' author: Patrick Bareiss, Splunk -status: deprecated +status: removed type: Anomaly description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with `O365 Mailbox Email Forwarding Enabled`. This search detects when an admin diff --git a/detections/deprecated/o365_suspicious_rights_delegation.yml b/removed/detections/o365_suspicious_rights_delegation.yml similarity index 99% rename from detections/deprecated/o365_suspicious_rights_delegation.yml rename to removed/detections/o365_suspicious_rights_delegation.yml index 716fd6289c..f2ed6c205b 100644 --- a/detections/deprecated/o365_suspicious_rights_delegation.yml +++ b/removed/detections/o365_suspicious_rights_delegation.yml @@ -3,7 +3,7 @@ id: b25d2973-303e-47c8-bacd-52b61604c6a7 version: 5 date: '2025-02-10' author: Patrick Bareiss, Mauricio Velazco, Splunk -status: deprecated +status: removed type: TTP description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with `O365 Elevated Mailbox Permission Assigned`. This analytic identifies instances diff --git a/detections/deprecated/o365_suspicious_user_email_forwarding.yml b/removed/detections/o365_suspicious_user_email_forwarding.yml similarity index 99% rename from detections/deprecated/o365_suspicious_user_email_forwarding.yml rename to removed/detections/o365_suspicious_user_email_forwarding.yml index 4ea5ecc88d..534b319903 100644 --- a/detections/deprecated/o365_suspicious_user_email_forwarding.yml +++ b/removed/detections/o365_suspicious_user_email_forwarding.yml @@ -3,7 +3,7 @@ id: f8dfe015-dbb3-4569-ba75-b13787e06aa4 version: 5 date: '2025-02-10' author: Patrick Bareiss, Splunk -status: deprecated +status: removed type: Anomaly description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with `O365 Mailbox Email Forwarding Enabled`. The following analytic detects when diff --git a/detections/deprecated/office_application_drop_executable.yml b/removed/detections/office_application_drop_executable.yml similarity index 99% rename from detections/deprecated/office_application_drop_executable.yml rename to removed/detections/office_application_drop_executable.yml index c87210ccf6..6289572cc2 100644 --- a/detections/deprecated/office_application_drop_executable.yml +++ b/removed/detections/office_application_drop_executable.yml @@ -3,7 +3,7 @@ id: 73ce70c4-146d-11ec-9184-acde48001122 version: 10 date: '2025-02-10' author: Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects Microsoft Office applications dropping or creating executables or scripts on a Windows diff --git a/detections/deprecated/office_application_spawn_regsvr32_process.yml b/removed/detections/office_application_spawn_regsvr32_process.yml similarity index 99% rename from detections/deprecated/office_application_spawn_regsvr32_process.yml rename to removed/detections/office_application_spawn_regsvr32_process.yml index 8aa07a2de3..305da934ed 100644 --- a/detections/deprecated/office_application_spawn_regsvr32_process.yml +++ b/removed/detections/office_application_spawn_regsvr32_process.yml @@ -3,7 +3,7 @@ id: 2d9fc90c-f11f-11eb-9300-acde48001122 version: 9 date: '2025-02-10' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/office_application_spawn_rundll32_process.yml b/removed/detections/office_application_spawn_rundll32_process.yml similarity index 99% rename from detections/deprecated/office_application_spawn_rundll32_process.yml rename to removed/detections/office_application_spawn_rundll32_process.yml index e648095cc9..6fb15cde36 100644 --- a/detections/deprecated/office_application_spawn_rundll32_process.yml +++ b/removed/detections/office_application_spawn_rundll32_process.yml @@ -3,7 +3,7 @@ id: 958751e4-9c5f-11eb-b103-acde48001122 version: 9 date: '2025-02-10' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/office_document_creating_schedule_task.yml b/removed/detections/office_document_creating_schedule_task.yml similarity index 99% rename from detections/deprecated/office_document_creating_schedule_task.yml rename to removed/detections/office_document_creating_schedule_task.yml index ef59131ecc..75fbcf448d 100644 --- a/detections/deprecated/office_document_creating_schedule_task.yml +++ b/removed/detections/office_document_creating_schedule_task.yml @@ -3,7 +3,7 @@ id: cc8b7b74-9d0f-11eb-8342-acde48001122 version: 11 date: '2025-02-10' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects an Office document creating a scheduled task, either through a macro VBA API or diff --git a/detections/deprecated/office_document_executing_macro_code.yml b/removed/detections/office_document_executing_macro_code.yml similarity index 99% rename from detections/deprecated/office_document_executing_macro_code.yml rename to removed/detections/office_document_executing_macro_code.yml index 8d74ea1aa2..503de3d2b6 100644 --- a/detections/deprecated/office_document_executing_macro_code.yml +++ b/removed/detections/office_document_executing_macro_code.yml @@ -3,7 +3,7 @@ id: b12c89bc-9d06-11eb-a592-acde48001122 version: 10 date: '2025-02-10' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic identifies office documents executing macro code. It leverages Sysmon EventCode 7 to detect diff --git a/detections/deprecated/office_document_spawned_child_process_to_download.yml b/removed/detections/office_document_spawned_child_process_to_download.yml similarity index 99% rename from detections/deprecated/office_document_spawned_child_process_to_download.yml rename to removed/detections/office_document_spawned_child_process_to_download.yml index 2e78ed372c..9579d186f0 100644 --- a/detections/deprecated/office_document_spawned_child_process_to_download.yml +++ b/removed/detections/office_document_spawned_child_process_to_download.yml @@ -3,7 +3,7 @@ id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3 version: 11 date: '2025-02-10' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic identifies Office applications spawning child processes to download content via HTTP/HTTPS. diff --git a/detections/deprecated/office_product_spawn_cmd_process.yml b/removed/detections/office_product_spawn_cmd_process.yml similarity index 99% rename from detections/deprecated/office_product_spawn_cmd_process.yml rename to removed/detections/office_product_spawn_cmd_process.yml index 4893d60d9f..949962d43e 100644 --- a/detections/deprecated/office_product_spawn_cmd_process.yml +++ b/removed/detections/office_product_spawn_cmd_process.yml @@ -3,7 +3,7 @@ id: b8b19420-e892-11eb-9244-acde48001122 version: 10 date: '2025-02-10' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/office_product_spawning_bitsadmin.yml b/removed/detections/office_product_spawning_bitsadmin.yml similarity index 99% rename from detections/deprecated/office_product_spawning_bitsadmin.yml rename to removed/detections/office_product_spawning_bitsadmin.yml index 28ee0cc811..e4a1cd88ff 100644 --- a/detections/deprecated/office_product_spawning_bitsadmin.yml +++ b/removed/detections/office_product_spawning_bitsadmin.yml @@ -3,7 +3,7 @@ id: e8c591f4-a6d7-11eb-8cf7-acde48001122 version: 10 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/office_product_spawning_certutil.yml b/removed/detections/office_product_spawning_certutil.yml similarity index 99% rename from detections/deprecated/office_product_spawning_certutil.yml rename to removed/detections/office_product_spawning_certutil.yml index 698343c8ae..d1819873df 100644 --- a/detections/deprecated/office_product_spawning_certutil.yml +++ b/removed/detections/office_product_spawning_certutil.yml @@ -3,7 +3,7 @@ id: 6925fe72-a6d5-11eb-9e17-acde48001122 version: 10 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/office_product_spawning_mshta.yml b/removed/detections/office_product_spawning_mshta.yml similarity index 99% rename from detections/deprecated/office_product_spawning_mshta.yml rename to removed/detections/office_product_spawning_mshta.yml index 9c8c8ae1ce..e21d9688c5 100644 --- a/detections/deprecated/office_product_spawning_mshta.yml +++ b/removed/detections/office_product_spawning_mshta.yml @@ -3,7 +3,7 @@ id: 6078fa20-a6d2-11eb-b662-acde48001122 version: 9 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/office_product_spawning_rundll32_with_no_dll.yml b/removed/detections/office_product_spawning_rundll32_with_no_dll.yml similarity index 99% rename from detections/deprecated/office_product_spawning_rundll32_with_no_dll.yml rename to removed/detections/office_product_spawning_rundll32_with_no_dll.yml index 41f3f9df66..2e4c38fdd5 100644 --- a/detections/deprecated/office_product_spawning_rundll32_with_no_dll.yml +++ b/removed/detections/office_product_spawning_rundll32_with_no_dll.yml @@ -3,7 +3,7 @@ id: c661f6be-a38c-11eb-be57-acde48001122 version: 11 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects any Windows Office Product spawning `rundll32.exe` without a `.dll` file extension. diff --git a/detections/deprecated/office_product_spawning_windows_script_host.yml b/removed/detections/office_product_spawning_windows_script_host.yml similarity index 99% rename from detections/deprecated/office_product_spawning_windows_script_host.yml rename to removed/detections/office_product_spawning_windows_script_host.yml index b4da3bfa8e..b33dc038c5 100644 --- a/detections/deprecated/office_product_spawning_windows_script_host.yml +++ b/removed/detections/office_product_spawning_windows_script_host.yml @@ -3,7 +3,7 @@ id: b3628a5b-8d02-42fa-a891-eebf2351cbe1 version: 12 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/office_product_spawning_wmic.yml b/removed/detections/office_product_spawning_wmic.yml similarity index 99% rename from detections/deprecated/office_product_spawning_wmic.yml rename to removed/detections/office_product_spawning_wmic.yml index 0e60c6e32f..f8f0be00c5 100644 --- a/detections/deprecated/office_product_spawning_wmic.yml +++ b/removed/detections/office_product_spawning_wmic.yml @@ -3,7 +3,7 @@ id: ffc236d6-a6c9-11eb-95f1-acde48001122 version: 11 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/office_product_writing_cab_or_inf.yml b/removed/detections/office_product_writing_cab_or_inf.yml similarity index 99% rename from detections/deprecated/office_product_writing_cab_or_inf.yml rename to removed/detections/office_product_writing_cab_or_inf.yml index 9d29d2a888..7b6f06bb42 100644 --- a/detections/deprecated/office_product_writing_cab_or_inf.yml +++ b/removed/detections/office_product_writing_cab_or_inf.yml @@ -3,7 +3,7 @@ id: f48cd1d4-125a-11ec-a447-acde48001122 version: 11 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects Office products writing .cab or .inf files, indicative of CVE-2021-40444 exploitation. diff --git a/detections/deprecated/office_spawning_control.yml b/removed/detections/office_spawning_control.yml similarity index 99% rename from detections/deprecated/office_spawning_control.yml rename to removed/detections/office_spawning_control.yml index f141b89519..37487e24a7 100644 --- a/detections/deprecated/office_spawning_control.yml +++ b/removed/detections/office_spawning_control.yml @@ -3,7 +3,7 @@ id: 053e027c-10c7-11ec-8437-acde48001122 version: 12 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic identifies instances where `control.exe` is spawned by a Microsoft Office product. It leverages diff --git a/detections/deprecated/okta_account_locked_out.yml b/removed/detections/okta_account_locked_out.yml similarity index 99% rename from detections/deprecated/okta_account_locked_out.yml rename to removed/detections/okta_account_locked_out.yml index 0ad8243973..827f3fd86a 100644 --- a/detections/deprecated/okta_account_locked_out.yml +++ b/removed/detections/okta_account_locked_out.yml @@ -3,7 +3,7 @@ id: d650c0ae-bdc5-400e-9f0f-f7aa0a010ef1 version: 3 date: '2024-11-14' author: Michael Haag, Splunk -status: deprecated +status: removed type: Anomaly description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta Multiple Accounts Locked Out`. The following analytic utilizes the user.acount.lock diff --git a/detections/deprecated/okta_account_lockout_events.yml b/removed/detections/okta_account_lockout_events.yml similarity index 99% rename from detections/deprecated/okta_account_lockout_events.yml rename to removed/detections/okta_account_lockout_events.yml index b2ec1f14ef..cacf38cb37 100644 --- a/detections/deprecated/okta_account_lockout_events.yml +++ b/removed/detections/okta_account_lockout_events.yml @@ -3,7 +3,7 @@ id: 62b70968-a0a5-4724-8ac4-67871e6f544d version: 5 date: '2025-02-10' author: Michael Haag, Rico Valdez, Splunk -status: deprecated +status: removed type: Anomaly description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta Multiple Accounts Locked Out`. The following anomaly will generate based diff --git a/detections/deprecated/okta_failed_sso_attempts.yml b/removed/detections/okta_failed_sso_attempts.yml similarity index 98% rename from detections/deprecated/okta_failed_sso_attempts.yml rename to removed/detections/okta_failed_sso_attempts.yml index 3c1d92c759..7ab6ebad6c 100644 --- a/detections/deprecated/okta_failed_sso_attempts.yml +++ b/removed/detections/okta_failed_sso_attempts.yml @@ -3,7 +3,7 @@ id: 371a6545-2618-4032-ad84-93386b8698c5 version: 6 date: '2025-02-10' author: Michael Haag, Rico Valdez, Splunk -status: deprecated +status: removed type: Anomaly description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with this detection `Okta Unauthorized Access to Application - DM`. The following diff --git a/detections/deprecated/okta_threatinsight_login_failure_with_high_unknown_users.yml b/removed/detections/okta_threatinsight_login_failure_with_high_unknown_users.yml similarity index 98% rename from detections/deprecated/okta_threatinsight_login_failure_with_high_unknown_users.yml rename to removed/detections/okta_threatinsight_login_failure_with_high_unknown_users.yml index 00af9d0aa5..865053caa9 100644 --- a/detections/deprecated/okta_threatinsight_login_failure_with_high_unknown_users.yml +++ b/removed/detections/okta_threatinsight_login_failure_with_high_unknown_users.yml @@ -4,7 +4,7 @@ version: 5 date: '2025-02-10' author: Okta, Inc, Michael Haag, Splunk type: TTP -status: deprecated +status: removed data_source: [] description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta ThreatInsight Threat Detected`. The following analytic utilizes Oktas diff --git a/detections/deprecated/okta_threatinsight_suspected_passwordspray_attack.yml b/removed/detections/okta_threatinsight_suspected_passwordspray_attack.yml similarity index 98% rename from detections/deprecated/okta_threatinsight_suspected_passwordspray_attack.yml rename to removed/detections/okta_threatinsight_suspected_passwordspray_attack.yml index e68cf87729..4a6f29d878 100644 --- a/detections/deprecated/okta_threatinsight_suspected_passwordspray_attack.yml +++ b/removed/detections/okta_threatinsight_suspected_passwordspray_attack.yml @@ -4,7 +4,7 @@ version: 5 date: '2025-02-10' author: Okta, Inc, Michael Haag, Splunk type: TTP -status: deprecated +status: removed data_source: [] description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta ThreatInsight Threat Detected`. The following analytic utilizes Oktas diff --git a/detections/deprecated/okta_two_or_more_rejected_okta_pushes.yml b/removed/detections/okta_two_or_more_rejected_okta_pushes.yml similarity index 99% rename from detections/deprecated/okta_two_or_more_rejected_okta_pushes.yml rename to removed/detections/okta_two_or_more_rejected_okta_pushes.yml index 9817b5f845..cd09e9e972 100644 --- a/detections/deprecated/okta_two_or_more_rejected_okta_pushes.yml +++ b/removed/detections/okta_two_or_more_rejected_okta_pushes.yml @@ -3,7 +3,7 @@ id: d93f785e-4c2c-4262-b8c7-12b77a13fd39 version: 4 date: '2024-11-14' author: Michael Haag, Marissa Bower, Splunk -status: deprecated +status: removed type: TTP description: '**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta Multiple Failed MFA Requests For User`. The following analytic identifies diff --git a/detections/deprecated/osquery_pack___coldroot_detection.yml b/removed/detections/osquery_pack___coldroot_detection.yml similarity index 98% rename from detections/deprecated/osquery_pack___coldroot_detection.yml rename to removed/detections/osquery_pack___coldroot_detection.yml index 369173b8fd..7b3a494261 100644 --- a/detections/deprecated/osquery_pack___coldroot_detection.yml +++ b/removed/detections/osquery_pack___coldroot_detection.yml @@ -3,7 +3,7 @@ id: a6fffe5e-05c3-4c04-badc-887607fbb8dc version: 5 date: '2024-11-14' author: Rico Valdez, Splunk -status: deprecated +status: removed type: TTP description: This search looks for ColdRoot events from the osx-attacks osquery pack. data_source: [] diff --git a/detections/deprecated/password_policy_discovery_with_net.yml b/removed/detections/password_policy_discovery_with_net.yml similarity index 99% rename from detections/deprecated/password_policy_discovery_with_net.yml rename to removed/detections/password_policy_discovery_with_net.yml index 0656e661c8..527907ea6f 100644 --- a/detections/deprecated/password_policy_discovery_with_net.yml +++ b/removed/detections/password_policy_discovery_with_net.yml @@ -3,7 +3,7 @@ id: 09336538-065a-11ec-8665-acde48001122 version: 7 date: '2025-01-24' author: Teoderick Contreras, Mauricio Velazco, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic has been deprecated. The following analytic identifies the execution of `net.exe` or `net1.exe` diff --git a/detections/deprecated/processes_created_by_netsh.yml b/removed/detections/processes_created_by_netsh.yml similarity index 99% rename from detections/deprecated/processes_created_by_netsh.yml rename to removed/detections/processes_created_by_netsh.yml index cb947299d8..a7ff65c024 100644 --- a/detections/deprecated/processes_created_by_netsh.yml +++ b/removed/detections/processes_created_by_netsh.yml @@ -3,7 +3,7 @@ id: b89919ed-fe5f-492c-b139-95dbb162041e version: 8 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: This search looks for processes launching netsh.exe to execute various commands via the netsh command-line utility. Netsh.exe is a command-line scripting diff --git a/detections/deprecated/prohibited_software_on_endpoint.yml b/removed/detections/prohibited_software_on_endpoint.yml similarity index 98% rename from detections/deprecated/prohibited_software_on_endpoint.yml rename to removed/detections/prohibited_software_on_endpoint.yml index 243c1c8374..0572b6f2bf 100644 --- a/detections/deprecated/prohibited_software_on_endpoint.yml +++ b/removed/detections/prohibited_software_on_endpoint.yml @@ -3,7 +3,7 @@ id: a51bfe1a-94f0-48cc-b4e4-b6ae50145893 version: 5 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: Hunting description: This search looks for applications on the endpoint that you have marked as prohibited. diff --git a/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml b/removed/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml similarity index 99% rename from detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml rename to removed/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml index b003f3bd58..bc776d7e9a 100644 --- a/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml +++ b/removed/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml @@ -3,7 +3,7 @@ id: 61a7d1e6-f5d4-41d9-a9be-39a1ffe69459 version: 5 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: The search looks for command-line arguments used to hide a file or directory using the reg add command. diff --git a/detections/deprecated/remote_registry_key_modifications.yml b/removed/detections/remote_registry_key_modifications.yml similarity index 98% rename from detections/deprecated/remote_registry_key_modifications.yml rename to removed/detections/remote_registry_key_modifications.yml index 71f902a8ad..ffd7eff675 100644 --- a/detections/deprecated/remote_registry_key_modifications.yml +++ b/removed/detections/remote_registry_key_modifications.yml @@ -3,7 +3,7 @@ id: c9f4b923-f8af-4155-b697-1354f5dcbc5e version: 6 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: This search monitors for remote modifications to registry keys. data_source: diff --git a/detections/deprecated/remote_system_discovery_with_net.yml b/removed/detections/remote_system_discovery_with_net.yml similarity index 99% rename from detections/deprecated/remote_system_discovery_with_net.yml rename to removed/detections/remote_system_discovery_with_net.yml index 2377264b52..8961d33627 100644 --- a/detections/deprecated/remote_system_discovery_with_net.yml +++ b/removed/detections/remote_system_discovery_with_net.yml @@ -3,7 +3,7 @@ id: 9df16706-04a2-41e2-bbfe-9b38b34409d3 version: 5 date: '2025-01-13' author: Mauricio Velazco, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic has been deprecated in favour of two dedicated analytics "4dc3951f-b3f8-4f46-b412-76a483f72277" and "a23a0e20-0b1b-4a07-82e5-ec5f70811e7a" .The following analytic identifies the execution of `net.exe` or `net1.exe` with command-line arguments used to discover remote systems, such as `domain computers /domain`. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it indicates potential reconnaissance efforts by adversaries or Red Teams to map out networked systems and Active Directory structures. If confirmed malicious, this behavior could lead to further network exploitation, privilege escalation, or lateral movement within the environment. data_source: diff --git a/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml b/removed/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml similarity index 99% rename from detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml rename to removed/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml index 0197ba45a3..19aaa1b2c4 100644 --- a/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml +++ b/removed/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml @@ -3,7 +3,7 @@ id: 1297fb80-f42a-4b4a-9c8b-78c066437cf6 version: 6 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: TTP description: This search looks for flags passed to schtasks.exe on the command-line that indicate that task names related to the execution of Bad Rabbit ransomware diff --git a/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml b/removed/detections/spectre_and_meltdown_vulnerable_systems.yml similarity index 98% rename from detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml rename to removed/detections/spectre_and_meltdown_vulnerable_systems.yml index 1f4a043402..1859af0f86 100644 --- a/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml +++ b/removed/detections/spectre_and_meltdown_vulnerable_systems.yml @@ -3,7 +3,7 @@ id: 354be8e0-32cd-4da0-8c47-796de13b60ea version: 4 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: TTP description: The search is used to detect systems that are still vulnerable to the Spectre and Meltdown vulnerabilities. diff --git a/detections/deprecated/suspicious_changes_to_file_associations.yml b/removed/detections/suspicious_changes_to_file_associations.yml similarity index 99% rename from detections/deprecated/suspicious_changes_to_file_associations.yml rename to removed/detections/suspicious_changes_to_file_associations.yml index e9438be5a1..9b9a6fa348 100644 --- a/detections/deprecated/suspicious_changes_to_file_associations.yml +++ b/removed/detections/suspicious_changes_to_file_associations.yml @@ -3,7 +3,7 @@ id: 1b989a0e-0129-4446-a695-f193a5b746fc version: 7 date: '2024-11-14' author: Rico Valdez, Splunk -status: deprecated +status: removed type: TTP description: This search looks for changes to registry values that control Windows file associations, executed by a process that is not typical for legitimate, routine diff --git a/detections/deprecated/suspicious_email___uba_anomaly.yml b/removed/detections/suspicious_email___uba_anomaly.yml similarity index 99% rename from detections/deprecated/suspicious_email___uba_anomaly.yml rename to removed/detections/suspicious_email___uba_anomaly.yml index 0e3a3f31d6..7399390137 100644 --- a/detections/deprecated/suspicious_email___uba_anomaly.yml +++ b/removed/detections/suspicious_email___uba_anomaly.yml @@ -3,7 +3,7 @@ id: 56e877a6-1455-4479-ad16-0550dc1e33f8 version: 6 date: '2024-11-14' author: Bhavin Patel, Splunk -status: deprecated +status: removed type: Anomaly description: This detection looks for emails that are suspicious because of their sender, domain rareness, or behavior differences. This is an anomaly generated by diff --git a/detections/deprecated/suspicious_file_write.yml b/removed/detections/suspicious_file_write.yml similarity index 99% rename from detections/deprecated/suspicious_file_write.yml rename to removed/detections/suspicious_file_write.yml index 8630632e57..12e9533132 100644 --- a/detections/deprecated/suspicious_file_write.yml +++ b/removed/detections/suspicious_file_write.yml @@ -3,7 +3,7 @@ id: 57f76b8a-32f0-42ed-b358-d9fa3ca7bac8 version: 6 date: '2024-11-14' author: Rico Valdez, Splunk -status: deprecated +status: removed type: Hunting description: The search looks for files created with names that have been linked to malicious activity. diff --git a/detections/deprecated/suspicious_powershell_command_line_arguments.yml b/removed/detections/suspicious_powershell_command_line_arguments.yml similarity index 99% rename from detections/deprecated/suspicious_powershell_command_line_arguments.yml rename to removed/detections/suspicious_powershell_command_line_arguments.yml index b2efc4ee51..c7a8ffa35b 100644 --- a/detections/deprecated/suspicious_powershell_command_line_arguments.yml +++ b/removed/detections/suspicious_powershell_command_line_arguments.yml @@ -3,7 +3,7 @@ id: 2cdb91d2-542c-497f-b252-be495e71f38c version: 9 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: TTP description: This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the diff --git a/detections/deprecated/suspicious_rundll32_rename.yml b/removed/detections/suspicious_rundll32_rename.yml similarity index 99% rename from detections/deprecated/suspicious_rundll32_rename.yml rename to removed/detections/suspicious_rundll32_rename.yml index eee4228129..81ead5651f 100644 --- a/detections/deprecated/suspicious_rundll32_rename.yml +++ b/removed/detections/suspicious_rundll32_rename.yml @@ -3,7 +3,7 @@ id: 7360137f-abad-473e-8189-acbdaa34d114 version: 8 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: Hunting description: The following hunting analytic identifies renamed instances of rundll32.exe executing. rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. diff --git a/detections/deprecated/suspicious_writes_to_system_volume_information.yml b/removed/detections/suspicious_writes_to_system_volume_information.yml similarity index 98% rename from detections/deprecated/suspicious_writes_to_system_volume_information.yml rename to removed/detections/suspicious_writes_to_system_volume_information.yml index 866160575b..e9c1f20721 100644 --- a/detections/deprecated/suspicious_writes_to_system_volume_information.yml +++ b/removed/detections/suspicious_writes_to_system_volume_information.yml @@ -3,7 +3,7 @@ id: cd6297cd-2bdd-4aa1-84aa-5d2f84228fac version: 5 date: '2024-11-14' author: Rico Valdez, Splunk -status: deprecated +status: removed type: Hunting description: This search detects writes to the 'System Volume Information' folder by something other than the System process. diff --git a/detections/deprecated/uncommon_processes_on_endpoint.yml b/removed/detections/uncommon_processes_on_endpoint.yml similarity index 98% rename from detections/deprecated/uncommon_processes_on_endpoint.yml rename to removed/detections/uncommon_processes_on_endpoint.yml index e0378b0e1f..fa6e1d6c2d 100644 --- a/detections/deprecated/uncommon_processes_on_endpoint.yml +++ b/removed/detections/uncommon_processes_on_endpoint.yml @@ -3,7 +3,7 @@ id: 29ccce64-a10c-4389-a45f-337cb29ba1f7 version: 7 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: Hunting description: This search looks for applications on the endpoint that you have marked as uncommon. diff --git a/detections/deprecated/unsigned_image_loaded_by_lsass.yml b/removed/detections/unsigned_image_loaded_by_lsass.yml similarity index 98% rename from detections/deprecated/unsigned_image_loaded_by_lsass.yml rename to removed/detections/unsigned_image_loaded_by_lsass.yml index db021a2bf3..bda913376f 100644 --- a/detections/deprecated/unsigned_image_loaded_by_lsass.yml +++ b/removed/detections/unsigned_image_loaded_by_lsass.yml @@ -3,7 +3,7 @@ id: 56ef054c-76ef-45f9-af4a-a634695dcd65 version: 4 date: '2024-11-14' author: Patrick Bareiss, Splunk -status: deprecated +status: removed type: TTP description: This search detects loading of unsigned images by LSASS. Deprecated because too noisy. diff --git a/detections/deprecated/unsuccessful_netbackup_backups.yml b/removed/detections/unsuccessful_netbackup_backups.yml similarity index 98% rename from detections/deprecated/unsuccessful_netbackup_backups.yml rename to removed/detections/unsuccessful_netbackup_backups.yml index 3e8fc0b5af..afa6f95673 100644 --- a/detections/deprecated/unsuccessful_netbackup_backups.yml +++ b/removed/detections/unsuccessful_netbackup_backups.yml @@ -3,7 +3,7 @@ id: a34aae96-ccf8-4aaa-952c-3ea21444444f version: 4 date: '2024-11-14' author: David Dorsey, Splunk -status: deprecated +status: removed type: Hunting description: This search gives you the hosts where a backup was attempted and then failed. diff --git a/detections/deprecated/web_fraud___account_harvesting.yml b/removed/detections/web_fraud___account_harvesting.yml similarity index 99% rename from detections/deprecated/web_fraud___account_harvesting.yml rename to removed/detections/web_fraud___account_harvesting.yml index 4fb3b3b784..ba78a3fa1a 100644 --- a/detections/deprecated/web_fraud___account_harvesting.yml +++ b/removed/detections/web_fraud___account_harvesting.yml @@ -3,7 +3,7 @@ id: bf1d7b5c-df2f-4249-a401-c09fdc221ddf version: 4 date: '2024-11-14' author: Jim Apger, Splunk -status: deprecated +status: removed type: TTP description: This search is used to identify the creation of multiple user accounts using the same email domain name. diff --git a/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml b/removed/detections/web_fraud___anomalous_user_clickspeed.yml similarity index 99% rename from detections/deprecated/web_fraud___anomalous_user_clickspeed.yml rename to removed/detections/web_fraud___anomalous_user_clickspeed.yml index 518a5be28e..c084525674 100644 --- a/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml +++ b/removed/detections/web_fraud___anomalous_user_clickspeed.yml @@ -3,7 +3,7 @@ id: 31337bbb-bc22-4752-b599-ef192df2dc7a version: 4 date: '2024-11-14' author: Jim Apger, Splunk -status: deprecated +status: removed type: Anomaly description: This search is used to examine web sessions to identify those where the clicks are occurring too quickly for a human or are occurring with a near-perfect diff --git a/detections/deprecated/web_fraud___password_sharing_across_accounts.yml b/removed/detections/web_fraud___password_sharing_across_accounts.yml similarity index 98% rename from detections/deprecated/web_fraud___password_sharing_across_accounts.yml rename to removed/detections/web_fraud___password_sharing_across_accounts.yml index 48c9b3908c..c1ac8d3080 100644 --- a/detections/deprecated/web_fraud___password_sharing_across_accounts.yml +++ b/removed/detections/web_fraud___password_sharing_across_accounts.yml @@ -3,7 +3,7 @@ id: 31337a1a-53b9-4e05-96e9-55c934cb71d3 version: 4 date: '2024-11-14' author: Jim Apger, Splunk -status: deprecated +status: removed type: Anomaly description: This search is used to identify user accounts that share a common password. data_source: [] diff --git a/detections/deprecated/windows_command_shell_fetch_env_variables.yml b/removed/detections/windows_command_shell_fetch_env_variables.yml similarity index 99% rename from detections/deprecated/windows_command_shell_fetch_env_variables.yml rename to removed/detections/windows_command_shell_fetch_env_variables.yml index 90618ba3e5..f604adbab8 100644 --- a/detections/deprecated/windows_command_shell_fetch_env_variables.yml +++ b/removed/detections/windows_command_shell_fetch_env_variables.yml @@ -3,7 +3,7 @@ id: 048839e4-1eaa-43ff-8a22-86d17f6fcc13 version: 5 date: '2025-01-24' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic identifies a suspicious process command line fetching diff --git a/detections/deprecated/windows_connhost_exe_started_forcefully.yml b/removed/detections/windows_connhost_exe_started_forcefully.yml similarity index 99% rename from detections/deprecated/windows_connhost_exe_started_forcefully.yml rename to removed/detections/windows_connhost_exe_started_forcefully.yml index 2718083864..5574cb0440 100644 --- a/detections/deprecated/windows_connhost_exe_started_forcefully.yml +++ b/removed/detections/windows_connhost_exe_started_forcefully.yml @@ -3,7 +3,7 @@ id: c114aaca-68ee-41c2-ad8c-32bf21db8769 version: 5 date: '2024-11-14' author: Rod Soto, Jose Hernandez, Splunk -status: deprecated +status: removed type: TTP description: The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1. This is not regular behavior in the Windows OS and diff --git a/detections/deprecated/windows_dll_search_order_hijacking_hunt.yml b/removed/detections/windows_dll_search_order_hijacking_hunt.yml similarity index 99% rename from detections/deprecated/windows_dll_search_order_hijacking_hunt.yml rename to removed/detections/windows_dll_search_order_hijacking_hunt.yml index 6149fc746d..a2b4d5bffc 100644 --- a/detections/deprecated/windows_dll_search_order_hijacking_hunt.yml +++ b/removed/detections/windows_dll_search_order_hijacking_hunt.yml @@ -3,7 +3,7 @@ id: 79c7d0fc-60c7-41be-a616-ccda752efe89 version: 6 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: Hunting description: The following hunting analytic is an experimental query built against a accidental feature using the latest Sysmon TA 3.0 (https://splunkbase.splunk.com/app/5709/) diff --git a/detections/deprecated/windows_hosts_file_modification.yml b/removed/detections/windows_hosts_file_modification.yml similarity index 98% rename from detections/deprecated/windows_hosts_file_modification.yml rename to removed/detections/windows_hosts_file_modification.yml index 0c7453eab3..7f40e5ea32 100644 --- a/detections/deprecated/windows_hosts_file_modification.yml +++ b/removed/detections/windows_hosts_file_modification.yml @@ -3,7 +3,7 @@ id: 06a6fc63-a72d-41dc-8736-7e3dd9612116 version: 4 date: '2024-11-14' author: Rico Valdez, Splunk -status: deprecated +status: removed type: TTP description: The search looks for modifications to the hosts file on all Windows endpoints across your environment. diff --git a/detections/deprecated/windows_lateral_tool_transfer_remcom.yml b/removed/detections/windows_lateral_tool_transfer_remcom.yml similarity index 99% rename from detections/deprecated/windows_lateral_tool_transfer_remcom.yml rename to removed/detections/windows_lateral_tool_transfer_remcom.yml index 47789c6b30..e1d64bf004 100644 --- a/detections/deprecated/windows_lateral_tool_transfer_remcom.yml +++ b/removed/detections/windows_lateral_tool_transfer_remcom.yml @@ -4,7 +4,7 @@ version: 6 date: '2024-12-10' author: Michael Haag, Splunk type: TTP -status: deprecated +status: removed data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/deprecated/windows_modify_registry_reg_restore.yml b/removed/detections/windows_modify_registry_reg_restore.yml similarity index 99% rename from detections/deprecated/windows_modify_registry_reg_restore.yml rename to removed/detections/windows_modify_registry_reg_restore.yml index f63d1b0214..8045b06c1e 100644 --- a/detections/deprecated/windows_modify_registry_reg_restore.yml +++ b/removed/detections/windows_modify_registry_reg_restore.yml @@ -3,7 +3,7 @@ id: d0072bd2-6d73-4c1b-bc77-ded6d2da3a4e version: 5 date: '2025-01-24' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic has been deprecated. The following analytic detects the execution of reg.exe with the "restore" diff --git a/detections/deprecated/windows_msiexec_with_network_connections.yml b/removed/detections/windows_msiexec_with_network_connections.yml similarity index 99% rename from detections/deprecated/windows_msiexec_with_network_connections.yml rename to removed/detections/windows_msiexec_with_network_connections.yml index 5c17518468..e8ace70d6d 100644 --- a/detections/deprecated/windows_msiexec_with_network_connections.yml +++ b/removed/detections/windows_msiexec_with_network_connections.yml @@ -3,7 +3,7 @@ id: 827409a1-5393-4d8d-8da4-bbb297c262a7 version: 7 date: '2025-01-24' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects MSIExec making network connections over diff --git a/detections/deprecated/windows_network_share_interaction_with_net.yml b/removed/detections/windows_network_share_interaction_with_net.yml similarity index 99% rename from detections/deprecated/windows_network_share_interaction_with_net.yml rename to removed/detections/windows_network_share_interaction_with_net.yml index fea71519c1..d07e5475c4 100644 --- a/detections/deprecated/windows_network_share_interaction_with_net.yml +++ b/removed/detections/windows_network_share_interaction_with_net.yml @@ -3,7 +3,7 @@ id: 4dc3951f-b3f8-4f46-b412-76a483f72277 version: 6 date: '2025-01-24' author: Dean Luxton -status: deprecated +status: removed type: TTP data_source: - Sysmon EventID 1 diff --git a/detections/deprecated/windows_office_product_spawning_msdt.yml b/removed/detections/windows_office_product_spawning_msdt.yml similarity index 99% rename from detections/deprecated/windows_office_product_spawning_msdt.yml rename to removed/detections/windows_office_product_spawning_msdt.yml index 9415352231..7938c379ea 100644 --- a/detections/deprecated/windows_office_product_spawning_msdt.yml +++ b/removed/detections/windows_office_product_spawning_msdt.yml @@ -3,7 +3,7 @@ id: 127eba64-c981-40bf-8589-1830638864a7 version: 11 date: '2025-02-10' author: Michael Haag, Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects a Microsoft Office product spawning the Windows msdt.exe process. This detection diff --git a/detections/deprecated/windows_query_registry_reg_save.yml b/removed/detections/windows_query_registry_reg_save.yml similarity index 99% rename from detections/deprecated/windows_query_registry_reg_save.yml rename to removed/detections/windows_query_registry_reg_save.yml index 291c0cf7a0..b72b968b31 100644 --- a/detections/deprecated/windows_query_registry_reg_save.yml +++ b/removed/detections/windows_query_registry_reg_save.yml @@ -3,7 +3,7 @@ id: cbee60c1-b776-456f-83c2-faa56bdbe6c6 version: 6 date: '2025-01-24' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic has been deprecated. The following analytic detects the execution of the reg.exe process with diff --git a/detections/deprecated/windows_service_stop_via_net__and_sc_application.yml b/removed/detections/windows_service_stop_via_net__and_sc_application.yml similarity index 99% rename from detections/deprecated/windows_service_stop_via_net__and_sc_application.yml rename to removed/detections/windows_service_stop_via_net__and_sc_application.yml index 00ff416650..2a90df0a04 100644 --- a/detections/deprecated/windows_service_stop_via_net__and_sc_application.yml +++ b/removed/detections/windows_service_stop_via_net__and_sc_application.yml @@ -3,7 +3,7 @@ id: 827af04b-0d08-479b-9b84-b7d4644e4b80 version: 5 date: '2025-01-24' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: Anomaly description: The following analytic has been deprecated. The following analytic identifies attempts to stop services on a system diff --git a/detections/deprecated/windows_valid_account_with_never_expires_password.yml b/removed/detections/windows_valid_account_with_never_expires_password.yml similarity index 99% rename from detections/deprecated/windows_valid_account_with_never_expires_password.yml rename to removed/detections/windows_valid_account_with_never_expires_password.yml index 01b416d1d5..3e3a6be6b4 100644 --- a/detections/deprecated/windows_valid_account_with_never_expires_password.yml +++ b/removed/detections/windows_valid_account_with_never_expires_password.yml @@ -3,7 +3,7 @@ id: 73a931db-1830-48b3-8296-cd9cfa09c3c8 version: 6 date: '2025-01-24' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated. The following analytic detects the use of net.exe to update user account diff --git a/detections/deprecated/winword_spawning_cmd.yml b/removed/detections/winword_spawning_cmd.yml similarity index 99% rename from detections/deprecated/winword_spawning_cmd.yml rename to removed/detections/winword_spawning_cmd.yml index 2d65e01f22..b9ec89bd35 100644 --- a/detections/deprecated/winword_spawning_cmd.yml +++ b/removed/detections/winword_spawning_cmd.yml @@ -3,7 +3,7 @@ id: 6fcbaedc-a37b-11eb-956b-acde48001122 version: 8 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/winword_spawning_powershell.yml b/removed/detections/winword_spawning_powershell.yml similarity index 99% rename from detections/deprecated/winword_spawning_powershell.yml rename to removed/detections/winword_spawning_powershell.yml index 4164d64cf7..d9dd1b7902 100644 --- a/detections/deprecated/winword_spawning_powershell.yml +++ b/removed/detections/winword_spawning_powershell.yml @@ -3,7 +3,7 @@ id: b2c950b8-9be2-11eb-8658-acde48001122 version: 8 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic diff --git a/detections/deprecated/winword_spawning_windows_script_host.yml b/removed/detections/winword_spawning_windows_script_host.yml similarity index 99% rename from detections/deprecated/winword_spawning_windows_script_host.yml rename to removed/detections/winword_spawning_windows_script_host.yml index 47feee0635..736daa38b8 100644 --- a/detections/deprecated/winword_spawning_windows_script_host.yml +++ b/removed/detections/winword_spawning_windows_script_host.yml @@ -3,7 +3,7 @@ id: 637e1b5c-9be1-11eb-9c32-acde48001122 version: 7 date: '2025-02-10' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic has been deprecated in favour of a more generic approach. The following analytic identifies instances where Microsoft Winword.exe diff --git a/investigations/all_backup_logs_for_host.yml b/removed/investigations/all_backup_logs_for_host.yml similarity index 96% rename from investigations/all_backup_logs_for_host.yml rename to removed/investigations/all_backup_logs_for_host.yml index 526e0760f2..b6bfc3dfb0 100644 --- a/investigations/all_backup_logs_for_host.yml +++ b/removed/investigations/all_backup_logs_for_host.yml @@ -4,7 +4,7 @@ version: 1 date: '2017-09-12' author: Rico Valdez, Splunk type: Investigation -status: deprecated +status: removed description: Retrieve the backup logs for the last 2 weeks for a specific host in order to investigate why backups are not completing successfully. search: '| search `netbackup` dest=$dest$' diff --git a/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml b/removed/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml similarity index 98% rename from investigations/amazon_eks_kubernetes_activity_by_src_ip.yml rename to removed/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml index fdd85fd8e0..e1462cd64e 100644 --- a/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml +++ b/removed/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml @@ -4,7 +4,7 @@ version: 1 date: '2020-04-13' author: Rod Soto, Splunk type: Investigation -status: deprecated +status: removed description: This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address diff --git a/investigations/aws_investigate_security_hub_alerts_by_dest.yml b/removed/investigations/aws_investigate_security_hub_alerts_by_dest.yml similarity index 98% rename from investigations/aws_investigate_security_hub_alerts_by_dest.yml rename to removed/investigations/aws_investigate_security_hub_alerts_by_dest.yml index c68fadb66c..2159c1a135 100644 --- a/investigations/aws_investigate_security_hub_alerts_by_dest.yml +++ b/removed/investigations/aws_investigate_security_hub_alerts_by_dest.yml @@ -4,7 +4,7 @@ version: 1 date: '2020-06-08' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search retrieves the all the alerts created by AWS Security Hub for a specific dest(instance_id). search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance | diff --git a/investigations/aws_investigate_user_activities_by_accesskeyid.yml b/removed/investigations/aws_investigate_user_activities_by_accesskeyid.yml similarity index 98% rename from investigations/aws_investigate_user_activities_by_accesskeyid.yml rename to removed/investigations/aws_investigate_user_activities_by_accesskeyid.yml index c9523dd2fd..59a95196e1 100644 --- a/investigations/aws_investigate_user_activities_by_accesskeyid.yml +++ b/removed/investigations/aws_investigate_user_activities_by_accesskeyid.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-06-08' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search retrieves the times, ARN, source IPs, AWS regions, event names, and the result of the event for specific credentials. search: '`cloudtrail` | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ diff --git a/investigations/aws_investigate_user_activities_by_arn.yml b/removed/investigations/aws_investigate_user_activities_by_arn.yml similarity index 98% rename from investigations/aws_investigate_user_activities_by_arn.yml rename to removed/investigations/aws_investigate_user_activities_by_arn.yml index d15290547a..4646dfe30a 100644 --- a/investigations/aws_investigate_user_activities_by_arn.yml +++ b/removed/investigations/aws_investigate_user_activities_by_arn.yml @@ -4,7 +4,7 @@ version: 2 date: '2019-04-30' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's diff --git a/investigations/aws_network_acl_details_from_id.yml b/removed/investigations/aws_network_acl_details_from_id.yml similarity index 97% rename from investigations/aws_network_acl_details_from_id.yml rename to removed/investigations/aws_network_acl_details_from_id.yml index 71ef17baf8..de00a587d7 100644 --- a/investigations/aws_network_acl_details_from_id.yml +++ b/removed/investigations/aws_network_acl_details_from_id.yml @@ -4,7 +4,7 @@ version: 1 date: '2017-01-22' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search queries AWS description logs and returns all the information about a specific network ACL via network ACL ID search: '`aws_description` | rename id as networkAclId | search networkAclId=$networkAclId$ diff --git a/investigations/aws_network_interface_details_via_resourceid.yml b/removed/investigations/aws_network_interface_details_via_resourceid.yml similarity index 98% rename from investigations/aws_network_interface_details_via_resourceid.yml rename to removed/investigations/aws_network_interface_details_via_resourceid.yml index 081ba1bdc4..6ae2a743e0 100644 --- a/investigations/aws_network_interface_details_via_resourceid.yml +++ b/removed/investigations/aws_network_interface_details_via_resourceid.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-05-07' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search queries AWS configuration logs and returns the information about a specific network interface via network interface ID. The information will include the ARN of the network interface, its relationships with other AWS resources, diff --git a/investigations/aws_s3_bucket_details_via_bucketname.yml b/removed/investigations/aws_s3_bucket_details_via_bucketname.yml similarity index 98% rename from investigations/aws_s3_bucket_details_via_bucketname.yml rename to removed/investigations/aws_s3_bucket_details_via_bucketname.yml index 86946b4438..30ba740556 100644 --- a/investigations/aws_s3_bucket_details_via_bucketname.yml +++ b/removed/investigations/aws_s3_bucket_details_via_bucketname.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-06-26' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search queries AWS configuration logs and returns the information about a specific S3 bucket. The information returned includes the time the S3 bucket was created, the resource ID, the region it belongs to, the value of action performed, diff --git a/investigations/gcp_kubernetes_activity_by_src_ip.yml b/removed/investigations/gcp_kubernetes_activity_by_src_ip.yml similarity index 98% rename from investigations/gcp_kubernetes_activity_by_src_ip.yml rename to removed/investigations/gcp_kubernetes_activity_by_src_ip.yml index d4359faeb0..ea800a69ab 100644 --- a/investigations/gcp_kubernetes_activity_by_src_ip.yml +++ b/removed/investigations/gcp_kubernetes_activity_by_src_ip.yml @@ -4,7 +4,7 @@ version: 1 date: '2020-04-13' author: Rod Soto, Splunk type: Investigation -status: deprecated +status: removed description: This search provides investigation data about requests via user agent, authentication request URI, resource path and cluster name data against Kubernetes cluster from a specific IP address diff --git a/investigations/get_all_aws_activity_from_city.yml b/removed/investigations/get_all_aws_activity_from_city.yml similarity index 98% rename from investigations/get_all_aws_activity_from_city.yml rename to removed/investigations/get_all_aws_activity_from_city.yml index 4e9d0f79a9..53a66d3aa7 100644 --- a/investigations/get_all_aws_activity_from_city.yml +++ b/removed/investigations/get_all_aws_activity_from_city.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-03-19' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search retrieves all the activity from a specific city and will create a table containing the time, city, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not diff --git a/investigations/get_all_aws_activity_from_country.yml b/removed/investigations/get_all_aws_activity_from_country.yml similarity index 98% rename from investigations/get_all_aws_activity_from_country.yml rename to removed/investigations/get_all_aws_activity_from_country.yml index aef67b8395..de55cb7b02 100644 --- a/investigations/get_all_aws_activity_from_country.yml +++ b/removed/investigations/get_all_aws_activity_from_country.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-03-19' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search retrieves all the activity from a specific country and will create a table containing the time, country, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether diff --git a/investigations/get_all_aws_activity_from_ip_address.yml b/removed/investigations/get_all_aws_activity_from_ip_address.yml similarity index 98% rename from investigations/get_all_aws_activity_from_ip_address.yml rename to removed/investigations/get_all_aws_activity_from_ip_address.yml index ad00e31621..52af123579 100644 --- a/investigations/get_all_aws_activity_from_ip_address.yml +++ b/removed/investigations/get_all_aws_activity_from_ip_address.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-03-19' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search retrieves all the activity from a specific IP address and will create a table containing the time, ARN, username, the type of user, the IP address, the AWS region the activity was in, the API called, and whether or not diff --git a/investigations/get_all_aws_activity_from_region.yml b/removed/investigations/get_all_aws_activity_from_region.yml similarity index 98% rename from investigations/get_all_aws_activity_from_region.yml rename to removed/investigations/get_all_aws_activity_from_region.yml index a9be04ab63..383729b151 100644 --- a/investigations/get_all_aws_activity_from_region.yml +++ b/removed/investigations/get_all_aws_activity_from_region.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-03-19' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search retrieves all the activity from a specific geographic region and will create a table containing the time, geographic region, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API diff --git a/investigations/get_backup_logs_for_endpoint.yml b/removed/investigations/get_backup_logs_for_endpoint.yml similarity index 97% rename from investigations/get_backup_logs_for_endpoint.yml rename to removed/investigations/get_backup_logs_for_endpoint.yml index 92c86ed03a..ba01f79f92 100644 --- a/investigations/get_backup_logs_for_endpoint.yml +++ b/removed/investigations/get_backup_logs_for_endpoint.yml @@ -4,7 +4,7 @@ version: 1 date: '2017-09-14' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search will tell you the backup status from your netbackup_logs of a specific endpoint for the last week. search: '`netbackup` COMPUTERNAME=$dest$ | rename COMPUTERNAME as dest, MESSAGE as diff --git a/investigations/get_certificate_logs_for_a_domain.yml b/removed/investigations/get_certificate_logs_for_a_domain.yml similarity index 98% rename from investigations/get_certificate_logs_for_a_domain.yml rename to removed/investigations/get_certificate_logs_for_a_domain.yml index f0b2aa4a3d..1dc65d87e5 100644 --- a/investigations/get_certificate_logs_for_a_domain.yml +++ b/removed/investigations/get_certificate_logs_for_a_domain.yml @@ -4,7 +4,7 @@ version: 2 date: '2019-04-29' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search queries the Certificates datamodel and give you all the information for a specific domain. Please note that the certificates issued by "Let's Encrypt" are widely used by attackers. diff --git a/investigations/get_dns_server_history_for_a_host.yml b/removed/investigations/get_dns_server_history_for_a_host.yml similarity index 98% rename from investigations/get_dns_server_history_for_a_host.yml rename to removed/investigations/get_dns_server_history_for_a_host.yml index 58ba43d1c1..f6b7e5c1c0 100644 --- a/investigations/get_dns_server_history_for_a_host.yml +++ b/removed/investigations/get_dns_server_history_for_a_host.yml @@ -4,7 +4,7 @@ version: 1 date: '2017-11-09' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: While investigating any detections it is important to understand which and how many DNS servers a host has connected to in the past. This search uses data that is tagged as DNS and gives you a count and list of DNS servers that a particular diff --git a/investigations/get_dns_traffic_ratio.yml b/removed/investigations/get_dns_traffic_ratio.yml similarity index 98% rename from investigations/get_dns_traffic_ratio.yml rename to removed/investigations/get_dns_traffic_ratio.yml index ede0480799..99247a4007 100644 --- a/investigations/get_dns_traffic_ratio.yml +++ b/removed/investigations/get_dns_traffic_ratio.yml @@ -4,7 +4,7 @@ version: 2 date: '2024-09-24' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search calculates the ratio of DNS traffic originating and coming from a host to a list of DNS servers over the last 24 hours. A high value of this ratio could be very useful to quickly understand if a src_ip (host) is sending a diff --git a/investigations/get_ec2_instance_details_by_instanceid.yml b/removed/investigations/get_ec2_instance_details_by_instanceid.yml similarity index 98% rename from investigations/get_ec2_instance_details_by_instanceid.yml rename to removed/investigations/get_ec2_instance_details_by_instanceid.yml index ed0ddf0c52..800e16d849 100644 --- a/investigations/get_ec2_instance_details_by_instanceid.yml +++ b/removed/investigations/get_ec2_instance_details_by_instanceid.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-02-12' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search queries AWS description logs and returns all the information about a specific instance via the instanceId field search: '`aws_description` | dedup id sortby -_time |rename id as instanceId| search diff --git a/investigations/get_ec2_launch_details.yml b/removed/investigations/get_ec2_launch_details.yml similarity index 98% rename from investigations/get_ec2_launch_details.yml rename to removed/investigations/get_ec2_launch_details.yml index 46432d9945..e9b715feb1 100644 --- a/investigations/get_ec2_launch_details.yml +++ b/removed/investigations/get_ec2_launch_details.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-03-12' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search returns some of the launch details for a EC2 instance. search: '`cloudtrail` dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, diff --git a/investigations/get_email_info.yml b/removed/investigations/get_email_info.yml similarity index 97% rename from investigations/get_email_info.yml rename to removed/investigations/get_email_info.yml index 247576a7cc..fc572aad29 100644 --- a/investigations/get_email_info.yml +++ b/removed/investigations/get_email_info.yml @@ -4,7 +4,7 @@ version: 1 date: '2017-11-09' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search returns all the information Splunk might have collected a specific email message over the last 2 hours. search: '| from datamodel Email.All_Email | search message_id=$message_id$' diff --git a/investigations/get_emails_from_specific_sender.yml b/removed/investigations/get_emails_from_specific_sender.yml similarity index 97% rename from investigations/get_emails_from_specific_sender.yml rename to removed/investigations/get_emails_from_specific_sender.yml index c4e5b0389a..b10b60a45a 100644 --- a/investigations/get_emails_from_specific_sender.yml +++ b/removed/investigations/get_emails_from_specific_sender.yml @@ -4,7 +4,7 @@ version: 1 date: '2017-11-09' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search returns all the emails from a specific sender over the last 24 and next hours. search: '| from datamodel Email.All_Email | search src_user=$src_user$' diff --git a/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml b/removed/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml similarity index 98% rename from investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml rename to removed/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml index 22da000f97..d1f48ff599 100644 --- a/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml +++ b/removed/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml @@ -4,7 +4,7 @@ version: 1 date: '2017-09-13' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search allows you to gather more context around a notable which has detected a new device connecting to your network. Use this search to determine the first and last occurrences of the suspicious device attempting to connect with diff --git a/investigations/get_history_of_email_sources.yml b/removed/investigations/get_history_of_email_sources.yml similarity index 98% rename from investigations/get_history_of_email_sources.yml rename to removed/investigations/get_history_of_email_sources.yml index 6b5b7d83af..8b03896433 100644 --- a/investigations/get_history_of_email_sources.yml +++ b/removed/investigations/get_history_of_email_sources.yml @@ -4,7 +4,7 @@ version: 1 date: '2019-02-21' author: Rico Valdez, Splunk type: Investigation -status: deprecated +status: removed description: This search returns a list of all email sources seen in the 48 hours prior to the notable event to 24 hours after, and the number of emails from each source. diff --git a/investigations/get_logon_rights_modifications_for_endpoint.yml b/removed/investigations/get_logon_rights_modifications_for_endpoint.yml similarity index 97% rename from investigations/get_logon_rights_modifications_for_endpoint.yml rename to removed/investigations/get_logon_rights_modifications_for_endpoint.yml index 42405d395a..55a7a805d3 100644 --- a/investigations/get_logon_rights_modifications_for_endpoint.yml +++ b/removed/investigations/get_logon_rights_modifications_for_endpoint.yml @@ -4,7 +4,7 @@ version: 2 date: '2017-09-12' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search allows you to retrieve any modifications to logon rights associated with a specific host. search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717) dest=$dest$ diff --git a/investigations/get_logon_rights_modifications_for_user.yml b/removed/investigations/get_logon_rights_modifications_for_user.yml similarity index 97% rename from investigations/get_logon_rights_modifications_for_user.yml rename to removed/investigations/get_logon_rights_modifications_for_user.yml index 10d81579af..5ef3f59e75 100644 --- a/investigations/get_logon_rights_modifications_for_user.yml +++ b/removed/investigations/get_logon_rights_modifications_for_user.yml @@ -4,7 +4,7 @@ version: 2 date: '2019-02-27' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search allows you to retrieve any modifications to logon rights for a specific user account. search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717) user=$user$ diff --git a/investigations/get_notable_history.yml b/removed/investigations/get_notable_history.yml similarity index 99% rename from investigations/get_notable_history.yml rename to removed/investigations/get_notable_history.yml index 0263940a86..fdd158e5a3 100644 --- a/investigations/get_notable_history.yml +++ b/removed/investigations/get_notable_history.yml @@ -4,7 +4,7 @@ version: 2 date: '2017-09-20' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search queries the notable index and returns all the Notable Events for the particular destination host, giving the analyst an overview of the incidents that may have occurred with the host under investigation. diff --git a/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml b/removed/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml similarity index 98% rename from investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml rename to removed/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml index eb30eaa867..3ba36659b0 100644 --- a/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml +++ b/removed/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-06-14' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: 'This search returns the information of the users that sent emails to the accounts controlled by the Hidden Cobra Threat Actors: specifically to `misswang8107@gmail.com`, and from `redhat@gmail.com`.' diff --git a/investigations/get_parent_process_info.yml b/removed/investigations/get_parent_process_info.yml similarity index 99% rename from investigations/get_parent_process_info.yml rename to removed/investigations/get_parent_process_info.yml index 54a97aea2b..e42faa26af 100644 --- a/investigations/get_parent_process_info.yml +++ b/removed/investigations/get_parent_process_info.yml @@ -4,7 +4,7 @@ version: 2 date: '2019-02-28' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest diff --git a/investigations/get_process_file_activity.yml b/removed/investigations/get_process_file_activity.yml similarity index 98% rename from investigations/get_process_file_activity.yml rename to removed/investigations/get_process_file_activity.yml index 04450db005..88dc720dac 100644 --- a/investigations/get_process_file_activity.yml +++ b/removed/investigations/get_process_file_activity.yml @@ -4,7 +4,7 @@ version: 2 date: '2019-11-06' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search returns the file activity for a specific process on a specific endpoint search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) as diff --git a/investigations/get_process_info.yml b/removed/investigations/get_process_info.yml similarity index 99% rename from investigations/get_process_info.yml rename to removed/investigations/get_process_info.yml index c5e6c10d84..8d03f447e0 100644 --- a/investigations/get_process_info.yml +++ b/removed/investigations/get_process_info.yml @@ -4,7 +4,7 @@ version: 2 date: '2019-04-01' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search queries the Endpoint data model to give you details about the process running on a host which is under investigation. To gather the process info, enter the values for the process name in question and the destination IP address. diff --git a/investigations/get_process_information_for_port_activity.yml b/removed/investigations/get_process_information_for_port_activity.yml similarity index 98% rename from investigations/get_process_information_for_port_activity.yml rename to removed/investigations/get_process_information_for_port_activity.yml index de14541ff3..4b0ae45559 100644 --- a/investigations/get_process_information_for_port_activity.yml +++ b/removed/investigations/get_process_information_for_port_activity.yml @@ -4,7 +4,7 @@ version: 2 date: '2019-04-01' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search will return information about the process associated with observed network traffic to a specific destination port from a specific host. search: '| tstats `security_content_summariesonly` count min(_time) max(_time) as diff --git a/investigations/get_process_responsible_for_the_dns_traffic.yml b/removed/investigations/get_process_responsible_for_the_dns_traffic.yml similarity index 98% rename from investigations/get_process_responsible_for_the_dns_traffic.yml rename to removed/investigations/get_process_responsible_for_the_dns_traffic.yml index 09b50690c7..86e2ad11be 100644 --- a/investigations/get_process_responsible_for_the_dns_traffic.yml +++ b/removed/investigations/get_process_responsible_for_the_dns_traffic.yml @@ -4,7 +4,7 @@ version: 2 date: '2019-04-01' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: While investigating, an analyst will want to know what process and parent_process is responsible for generating suspicious DNS traffic. Use the following search and enter the value of `dest` in the search to get specific details on the process responsible diff --git a/investigations/get_sysmon_wmi_activity_for_host.yml b/removed/investigations/get_sysmon_wmi_activity_for_host.yml similarity index 97% rename from investigations/get_sysmon_wmi_activity_for_host.yml rename to removed/investigations/get_sysmon_wmi_activity_for_host.yml index e066466664..166013dd2a 100644 --- a/investigations/get_sysmon_wmi_activity_for_host.yml +++ b/removed/investigations/get_sysmon_wmi_activity_for_host.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-10-23' author: Rico Valdez, Splunk type: Investigation -status: deprecated +status: removed description: This search queries Sysmon WMI events for the host of interest. search: '`sysmon` EventCode>18 EventCode<22 | rename host as dest | search dest=$dest$| table _time, dest, user, Name, Operation, EventType, Type, Query, Consumer, Filter' diff --git a/investigations/get_web_session_information_via_session_id.yml b/removed/investigations/get_web_session_information_via_session_id.yml similarity index 97% rename from investigations/get_web_session_information_via_session_id.yml rename to removed/investigations/get_web_session_information_via_session_id.yml index 955b678802..5952077391 100644 --- a/investigations/get_web_session_information_via_session_id.yml +++ b/removed/investigations/get_web_session_information_via_session_id.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-10-08' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search helps an analyst investigate a notable event to find out more about a specific web session. The search looks for a specific web session ID in the HTTP web traffic and outputs the URL and user agents, grouped by source IP diff --git a/investigations/investigate_aws_activities_via_region_name.yml b/removed/investigations/investigate_aws_activities_via_region_name.yml similarity index 98% rename from investigations/investigate_aws_activities_via_region_name.yml rename to removed/investigations/investigate_aws_activities_via_region_name.yml index d1f8bd0bbb..335daad51e 100644 --- a/investigations/investigate_aws_activities_via_region_name.yml +++ b/removed/investigations/investigate_aws_activities_via_region_name.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-02-09' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search lists all the user activities logged by CloudTrail for a specific region in question and will create a table of the values of parameters requested, the type of the event and the response from the AWS API by each user diff --git a/investigations/investigate_aws_user_activities_by_user_field.yml b/removed/investigations/investigate_aws_user_activities_by_user_field.yml similarity index 98% rename from investigations/investigate_aws_user_activities_by_user_field.yml rename to removed/investigations/investigate_aws_user_activities_by_user_field.yml index 84f4231bcd..d0932da712 100644 --- a/investigations/investigate_aws_user_activities_by_user_field.yml +++ b/removed/investigations/investigate_aws_user_activities_by_user_field.yml @@ -4,7 +4,7 @@ version: 2 date: '2024-09-24' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity diff --git a/investigations/investigate_failed_logins_for_multiple_destinations.yml b/removed/investigations/investigate_failed_logins_for_multiple_destinations.yml similarity index 98% rename from investigations/investigate_failed_logins_for_multiple_destinations.yml rename to removed/investigations/investigate_failed_logins_for_multiple_destinations.yml index 929d971fd4..fbd88dcfb6 100644 --- a/investigations/investigate_failed_logins_for_multiple_destinations.yml +++ b/removed/investigations/investigate_failed_logins_for_multiple_destinations.yml @@ -4,7 +4,7 @@ version: 1 date: '2019-12-10' author: Patrick Bareiss, Splunk type: Investigation -status: deprecated +status: removed description: This search returns failed logins to multiple destinations by user. search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login dc(Authentication.dest) AS distinct_count_dest values(Authentication.dest) diff --git a/investigations/investigate_network_traffic_from_src_ip.yml b/removed/investigations/investigate_network_traffic_from_src_ip.yml similarity index 97% rename from investigations/investigate_network_traffic_from_src_ip.yml rename to removed/investigations/investigate_network_traffic_from_src_ip.yml index ba7875b78f..3fc46d2dbe 100644 --- a/investigations/investigate_network_traffic_from_src_ip.yml +++ b/removed/investigations/investigate_network_traffic_from_src_ip.yml @@ -4,7 +4,7 @@ version: 1 date: '2018-06-15' author: David Dorsey, Splunk type: Investigation -status: deprecated +status: removed description: This search allows you to find all the network traffic from a specific IP address. search: '| from datamodel Network_Traffic.All_Traffic | search src_ip=$src_ip$' diff --git a/investigations/investigate_okta_activity_by_app.yml b/removed/investigations/investigate_okta_activity_by_app.yml similarity index 97% rename from investigations/investigate_okta_activity_by_app.yml rename to removed/investigations/investigate_okta_activity_by_app.yml index 9c9111a9aa..40a8e95697 100644 --- a/investigations/investigate_okta_activity_by_app.yml +++ b/removed/investigations/investigate_okta_activity_by_app.yml @@ -4,7 +4,7 @@ version: 1 date: '2020-04-02' author: Rico Valdez, Splunk type: Investigation -status: deprecated +status: removed description: This search returns all okta events associated with a specific app search: '`okta` app=$app$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city diff --git a/investigations/investigate_okta_activity_by_ip_address.yml b/removed/investigations/investigate_okta_activity_by_ip_address.yml similarity index 97% rename from investigations/investigate_okta_activity_by_ip_address.yml rename to removed/investigations/investigate_okta_activity_by_ip_address.yml index a3a945fed5..0f5fbab9f9 100644 --- a/investigations/investigate_okta_activity_by_ip_address.yml +++ b/removed/investigations/investigate_okta_activity_by_ip_address.yml @@ -4,7 +4,7 @@ version: 1 date: '2020-04-02' author: Rico Valdez, Splunk type: Investigation -status: deprecated +status: removed description: This search returns all okta events from a specific IP address. search: '`okta` src_ip={src_ip} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city diff --git a/investigations/investigate_pass_the_hash_attempts.yml b/removed/investigations/investigate_pass_the_hash_attempts.yml similarity index 98% rename from investigations/investigate_pass_the_hash_attempts.yml rename to removed/investigations/investigate_pass_the_hash_attempts.yml index e4a495f05f..5f62609ac9 100644 --- a/investigations/investigate_pass_the_hash_attempts.yml +++ b/removed/investigations/investigate_pass_the_hash_attempts.yml @@ -4,7 +4,7 @@ version: 1 date: '2019-12-10' author: Patrick Bareiss, Splunk type: Investigation -status: deprecated +status: removed description: This search hunts for dumped NTLM hashes used for pass the hash. search: '`wineventlog_security` EventCode=4624 Logon_Type=9 AuthenticationPackageName=Negotiate | stats count earliest(_time) as first_login latest(_time) as last_login by src_user diff --git a/investigations/investigate_pass_the_ticket_attempts.yml b/removed/investigations/investigate_pass_the_ticket_attempts.yml similarity index 98% rename from investigations/investigate_pass_the_ticket_attempts.yml rename to removed/investigations/investigate_pass_the_ticket_attempts.yml index 3e971419a5..e341b89e92 100644 --- a/investigations/investigate_pass_the_ticket_attempts.yml +++ b/removed/investigations/investigate_pass_the_ticket_attempts.yml @@ -4,7 +4,7 @@ version: 2 date: '2024-09-24' author: Patrick Bareiss, Splunk type: Investigation -status: deprecated +status: removed description: This search hunts for dumped kerberos ticket from LSASS memory. search: '`wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user "(?[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count) diff --git a/investigations/investigate_previous_unseen_user.yml b/removed/investigations/investigate_previous_unseen_user.yml similarity index 98% rename from investigations/investigate_previous_unseen_user.yml rename to removed/investigations/investigate_previous_unseen_user.yml index 1e70b07b01..9b9e865fc4 100644 --- a/investigations/investigate_previous_unseen_user.yml +++ b/removed/investigations/investigate_previous_unseen_user.yml @@ -4,7 +4,7 @@ version: 1 date: '2019-12-10' author: Patrick Bareiss, Splunk type: Investigation -status: deprecated +status: removed description: This search returns previous unseen user, which didn't log in for 30 days. search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login diff --git a/investigations/investigate_successful_remote_desktop_authentications.yml b/removed/investigations/investigate_successful_remote_desktop_authentications.yml similarity index 98% rename from investigations/investigate_successful_remote_desktop_authentications.yml rename to removed/investigations/investigate_successful_remote_desktop_authentications.yml index b5c02044c6..5f4109c67c 100644 --- a/investigations/investigate_successful_remote_desktop_authentications.yml +++ b/removed/investigations/investigate_successful_remote_desktop_authentications.yml @@ -4,7 +4,7 @@ version: 2 date: '2024-09-24' author: Jose Hernandez, Splunk type: Investigation -status: deprecated +status: removed description: This search returns the source, destination, and user for all successful remote-desktop authentications. A successful authentication after a brute-force attack on a destination machine is suspicious behavior. diff --git a/investigations/investigate_suspicious_strings_in_http_header.yml b/removed/investigations/investigate_suspicious_strings_in_http_header.yml similarity index 98% rename from investigations/investigate_suspicious_strings_in_http_header.yml rename to removed/investigations/investigate_suspicious_strings_in_http_header.yml index d2d83857e1..6aa7a6cefd 100644 --- a/investigations/investigate_suspicious_strings_in_http_header.yml +++ b/removed/investigations/investigate_suspicious_strings_in_http_header.yml @@ -4,7 +4,7 @@ version: 1 date: '2017-10-20' author: Bhavin Patel, Splunk type: Investigation -status: deprecated +status: removed description: This search helps an analyst investigate a notable event related to a potential Apache Struts exploitation. To investigate, we will want to isolate and analyze the "payload" or the commands that were passed to the vulnerable hosts by diff --git a/investigations/investigate_user_activities_in_okta.yml b/removed/investigations/investigate_user_activities_in_okta.yml similarity index 97% rename from investigations/investigate_user_activities_in_okta.yml rename to removed/investigations/investigate_user_activities_in_okta.yml index 522e019822..cb133eb7e5 100644 --- a/investigations/investigate_user_activities_in_okta.yml +++ b/removed/investigations/investigate_user_activities_in_okta.yml @@ -4,7 +4,7 @@ version: 1 date: '2020-04-02' author: Rico Valdez, Splunk type: Investigation -status: deprecated +status: removed description: This search returns all okta events by a specific user search: '`okta` user=$user$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city diff --git a/investigations/investigate_web_posts_from_src.yml b/removed/investigations/investigate_web_posts_from_src.yml similarity index 98% rename from investigations/investigate_web_posts_from_src.yml rename to removed/investigations/investigate_web_posts_from_src.yml index 89d2b23432..0ca5d92202 100644 --- a/investigations/investigate_web_posts_from_src.yml +++ b/removed/investigations/investigate_web_posts_from_src.yml @@ -4,7 +4,7 @@ version: 2 date: '2024-09-24' author: Jose Hernandez, Splunk type: Investigation -status: deprecated +status: removed description: This investigative search retrieves POST requests from a specified source IP or hostname. Identifying the POST requests, as well as their associated destination URLs and user agent(s), may help you scope and characterize the suspicious traffic. diff --git a/stories/deprecated/aws_cryptomining.yml b/removed/stories/aws_cryptomining.yml similarity index 99% rename from stories/deprecated/aws_cryptomining.yml rename to removed/stories/aws_cryptomining.yml index abd30eff4d..67599b5632 100644 --- a/stories/deprecated/aws_cryptomining.yml +++ b/removed/stories/aws_cryptomining.yml @@ -3,7 +3,7 @@ id: ced74200-8465-4bc3-bd2c-9a782eec6750 version: 1 date: '2018-03-08' author: David Dorsey, Splunk -status: deprecated +status: removed description: Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are diff --git a/stories/deprecated/aws_suspicious_provisioning_activities.yml b/removed/stories/aws_suspicious_provisioning_activities.yml similarity index 98% rename from stories/deprecated/aws_suspicious_provisioning_activities.yml rename to removed/stories/aws_suspicious_provisioning_activities.yml index c5403b49fa..d6d7def438 100644 --- a/stories/deprecated/aws_suspicious_provisioning_activities.yml +++ b/removed/stories/aws_suspicious_provisioning_activities.yml @@ -3,7 +3,7 @@ id: 3338b567-3804-4261-9889-cf0ca4753c7f version: 1 date: '2018-03-16' author: David Dorsey, Splunk -status: deprecated +status: removed description: Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network. diff --git a/stories/deprecated/common_phishing_frameworks.yml b/removed/stories/common_phishing_frameworks.yml similarity index 99% rename from stories/deprecated/common_phishing_frameworks.yml rename to removed/stories/common_phishing_frameworks.yml index 055ff6b43a..6c8f0279d1 100644 --- a/stories/deprecated/common_phishing_frameworks.yml +++ b/removed/stories/common_phishing_frameworks.yml @@ -3,7 +3,7 @@ id: 9a64ab44-9214-4639-8163-7eaa2621bd61 version: 2 date: '2024-09-24' author: Splunk Research Team, Splunk -status: deprecated +status: removed description: 'Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email.' diff --git a/stories/deprecated/container_implantation_monitoring_and_investigation.yml b/removed/stories/container_implantation_monitoring_and_investigation.yml similarity index 98% rename from stories/deprecated/container_implantation_monitoring_and_investigation.yml rename to removed/stories/container_implantation_monitoring_and_investigation.yml index 53ee1b98a8..8fc04b5754 100644 --- a/stories/deprecated/container_implantation_monitoring_and_investigation.yml +++ b/removed/stories/container_implantation_monitoring_and_investigation.yml @@ -3,7 +3,7 @@ id: aa0e28b1-0521-4b6f-9d2a-7b87e34af246 version: 1 date: '2020-02-20' author: Rod Soto, Rico Valdez, Splunk -status: deprecated +status: removed description: Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container diff --git a/stories/deprecated/host_redirection.yml b/removed/stories/host_redirection.yml similarity index 98% rename from stories/deprecated/host_redirection.yml rename to removed/stories/host_redirection.yml index 90953fb738..8a3c52c671 100644 --- a/stories/deprecated/host_redirection.yml +++ b/removed/stories/host_redirection.yml @@ -3,7 +3,7 @@ id: 2e8948a5-5239-406b-b56b-6c50fe268af4 version: 1 date: '2017-09-14' author: Rico Valdez, Splunk -status: deprecated +status: removed description: Detect evidence of tactics used to redirect traffic from a host to a destination other than the one intended--potentially one that is part of an adversary's attack infrastructure. An example is redirecting communications regarding patches diff --git a/stories/deprecated/kubernetes_sensitive_role_activity.yml b/removed/stories/kubernetes_sensitive_role_activity.yml similarity index 97% rename from stories/deprecated/kubernetes_sensitive_role_activity.yml rename to removed/stories/kubernetes_sensitive_role_activity.yml index 735eb620fa..3e4aea5653 100644 --- a/stories/deprecated/kubernetes_sensitive_role_activity.yml +++ b/removed/stories/kubernetes_sensitive_role_activity.yml @@ -3,7 +3,7 @@ id: 8b3984d2-17b6-47e9-ba43-a3376e70fdcc version: 1 date: '2020-05-20' author: Rod Soto, Splunk -status: deprecated +status: removed description: This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces. narrative: Kubernetes is the most used container orchestration platform, this orchestration diff --git a/stories/deprecated/lateral_movement.yml b/removed/stories/lateral_movement.yml similarity index 99% rename from stories/deprecated/lateral_movement.yml rename to removed/stories/lateral_movement.yml index 20c7ee6a69..6fbf027832 100644 --- a/stories/deprecated/lateral_movement.yml +++ b/removed/stories/lateral_movement.yml @@ -3,7 +3,7 @@ id: 399d65dc-1f08-499b-a259-abd9051f38ad version: 3 date: '2024-09-24' author: David Dorsey, Splunk -status: deprecated +status: removed description: "DEPRECATED IN FAVOR OF ACTIVE DIRECTORY LATERAL MOVEMENT. Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts." narrative: "Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation. Indications of lateral movement can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash, or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or \"crown jewels\" to a persistent threat actor. An adversary can use lateral movement for multiple purposes, including remote execution of tools, pivoting to additional systems, obtaining access to specific information or files, access to additional credentials, exfiltrating data, or delivering a secondary effect. Adversaries may use legitimate credentials alongside inherent network and operating-system functionality to remotely connect to other systems and remain under the radar of network defenders. If there is evidence of lateral movement, it is imperative for analysts to collect evidence of the associated offending hosts. For example, an attacker might leverage host A to gain access to host B. From there, the attacker may try to move laterally to host C. In this example, the analyst should gather as much information as possible from all three hosts. It is also important to collect authentication logs for each host, to ensure that the offending accounts are well-documented. Analysts should account for all processes to ensure that the attackers did not install unauthorized software." references: diff --git a/stories/deprecated/monitor_backup_solution.yml b/removed/stories/monitor_backup_solution.yml similarity index 98% rename from stories/deprecated/monitor_backup_solution.yml rename to removed/stories/monitor_backup_solution.yml index c3f2dc7a32..3b0074346d 100644 --- a/stories/deprecated/monitor_backup_solution.yml +++ b/removed/stories/monitor_backup_solution.yml @@ -3,7 +3,7 @@ id: abe807c7-1eb6-4304-ac32-6e7aacdb891d version: 1 date: '2017-09-12' author: David Dorsey, Splunk -status: deprecated +status: removed description: Address common concerns when monitoring your backup processes. These searches can help you reduce risks from ransomware, device theft, or denial of physical access to a host by backing up data on endpoints. diff --git a/stories/deprecated/monitor_for_unauthorized_software.yml b/removed/stories/monitor_for_unauthorized_software.yml similarity index 98% rename from stories/deprecated/monitor_for_unauthorized_software.yml rename to removed/stories/monitor_for_unauthorized_software.yml index a9e7d9688d..62b812f61c 100644 --- a/stories/deprecated/monitor_for_unauthorized_software.yml +++ b/removed/stories/monitor_for_unauthorized_software.yml @@ -3,7 +3,7 @@ id: 8892a655-6205-43f7-abba-06460e38c8ae version: 2 date: '2024-09-24' author: David Dorsey, Splunk -status: deprecated +status: removed description: 'Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment.' narrative: 'It is critical to identify unauthorized software and processes running diff --git a/stories/deprecated/office_365_detections.yml b/removed/stories/office_365_detections.yml similarity index 98% rename from stories/deprecated/office_365_detections.yml rename to removed/stories/office_365_detections.yml index d2fb3d09b7..00b0764a96 100644 --- a/stories/deprecated/office_365_detections.yml +++ b/removed/stories/office_365_detections.yml @@ -3,7 +3,7 @@ id: 1a51dd71-effc-48b2-abc4-3e9cdb61e5b9 version: 2 date: '2020-12-16' author: Patrick Bareiss, Mauricio Velazco, Splunk -status: deprecated +status: removed description: Monitor for activities and anomalies indicative of potential threats within Office 365 environments. narrative: Office 365 (O365) is Microsoft's cloud-based suite of productivity tools, encompassing email, collaboration platforms, and office applications, all integrated with Azure Active Directory for identity and access management. Given the centralized storage of sensitive organizational data within O365 and its widespread adoption, it has become a focal point for cybersecurity efforts. The platform's complexity, combined with its ubiquity, makes it both a valuable asset and a prime target for potential threats. As O365's importance grows, it increasingly becomes a target for attackers seeking to exploit organizational data and systems. Security teams should prioritize monitoring O365 not just because of the sensitive data it often holds, but also due to the myriad ways the platform can be exploited. Understanding and monitoring O365's security landscape is crucial for organizations to detect, respond to, and mitigate potential threats in a timely manner. references: diff --git a/stories/deprecated/spectre_and_meltdown_vulnerabilities.yml b/removed/stories/spectre_and_meltdown_vulnerabilities.yml similarity index 97% rename from stories/deprecated/spectre_and_meltdown_vulnerabilities.yml rename to removed/stories/spectre_and_meltdown_vulnerabilities.yml index 3b0bbf9c8d..baa7d5b14c 100644 --- a/stories/deprecated/spectre_and_meltdown_vulnerabilities.yml +++ b/removed/stories/spectre_and_meltdown_vulnerabilities.yml @@ -3,7 +3,7 @@ id: 6d3306f6-bb2b-4219-8609-8efad64032f2 version: 1 date: '2018-01-08' author: David Dorsey, Splunk -status: deprecated +status: removed description: Assess and mitigate your systems' vulnerability to Spectre and Meltdown exploitation with the searches in this Analytic Story. narrative: Meltdown and Spectre exploit critical vulnerabilities in modern CPUs that diff --git a/stories/deprecated/suspicious_aws_ec2_activities.yml b/removed/stories/suspicious_aws_ec2_activities.yml similarity index 98% rename from stories/deprecated/suspicious_aws_ec2_activities.yml rename to removed/stories/suspicious_aws_ec2_activities.yml index 89b5348253..06649b6670 100644 --- a/stories/deprecated/suspicious_aws_ec2_activities.yml +++ b/removed/stories/suspicious_aws_ec2_activities.yml @@ -3,7 +3,7 @@ id: 2e8948a5-5239-406b-b56b-6c50f1268af3 version: 1 date: '2018-02-09' author: Bhavin Patel, Splunk -status: deprecated +status: removed description: Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users diff --git a/stories/deprecated/unusual_aws_ec2_modifications.yml b/removed/stories/unusual_aws_ec2_modifications.yml similarity index 98% rename from stories/deprecated/unusual_aws_ec2_modifications.yml rename to removed/stories/unusual_aws_ec2_modifications.yml index f0f1fc4b54..98eb84e135 100644 --- a/stories/deprecated/unusual_aws_ec2_modifications.yml +++ b/removed/stories/unusual_aws_ec2_modifications.yml @@ -3,7 +3,7 @@ id: 73de57ef-0dfc-411f-b1e7-fa24428aeae0 version: 1 date: '2018-04-09' author: David Dorsey, Splunk -status: deprecated +status: removed description: Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation. diff --git a/stories/deprecated/web_fraud_detection.yml b/removed/stories/web_fraud_detection.yml similarity index 99% rename from stories/deprecated/web_fraud_detection.yml rename to removed/stories/web_fraud_detection.yml index 81d8ee3448..7e066b1e4c 100644 --- a/stories/deprecated/web_fraud_detection.yml +++ b/removed/stories/web_fraud_detection.yml @@ -3,7 +3,7 @@ id: 18bb45b9-7684-45c6-9e97-1fdd0d98c0a7 version: 1 date: '2018-10-08' author: Jim Apger, Splunk -status: deprecated +status: removed description: Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets. narrative: 'The Federal Bureau of Investigations (FBI) defines Internet fraud as the diff --git a/stories/deprecated/.gitkeep b/stories/deprecated/.gitkeep new file mode 100644 index 0000000000..e69de29bb2