diff --git a/contentctl.yml b/contentctl.yml index ec3b14e5f4..664b5839ec 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 5.25.0 + version: 5.26.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU diff --git a/baselines/deprecated/baseline_of_cloud_infrastructure_api_calls_per_user.yml b/removed/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml similarity index 99% rename from baselines/deprecated/baseline_of_cloud_infrastructure_api_calls_per_user.yml rename to removed/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml index 5dfd478484..ab4c75050b 100644 --- a/baselines/deprecated/baseline_of_cloud_infrastructure_api_calls_per_user.yml +++ b/removed/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml @@ -4,7 +4,7 @@ version: 3 date: '2026-02-25' author: David Dorsey, Splunk type: Baseline -status: deprecated +status: removed description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model diff --git a/baselines/deprecated/baseline_of_cloud_instances_destroyed.yml b/removed/baselines/baseline_of_cloud_instances_destroyed.yml similarity index 99% rename from baselines/deprecated/baseline_of_cloud_instances_destroyed.yml rename to removed/baselines/baseline_of_cloud_instances_destroyed.yml index 737e874a46..9b06a3f6e6 100644 --- a/baselines/deprecated/baseline_of_cloud_instances_destroyed.yml +++ b/removed/baselines/baseline_of_cloud_instances_destroyed.yml @@ -4,7 +4,7 @@ version: 3 date: '2026-02-25' author: David Dorsey, Splunk type: Baseline -status: deprecated +status: removed description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search diff --git a/baselines/deprecated/baseline_of_cloud_instances_launched.yml b/removed/baselines/baseline_of_cloud_instances_launched.yml similarity index 99% rename from baselines/deprecated/baseline_of_cloud_instances_launched.yml rename to removed/baselines/baseline_of_cloud_instances_launched.yml index b1b65e765b..02226213c7 100644 --- a/baselines/deprecated/baseline_of_cloud_instances_launched.yml +++ b/removed/baselines/baseline_of_cloud_instances_launched.yml @@ -4,7 +4,7 @@ version: 3 date: '2026-02-25' author: David Dorsey, Splunk type: Baseline -status: deprecated +status: removed description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses diff --git a/baselines/deprecated/baseline_of_cloud_security_group_api_calls_per_user.yml b/removed/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml similarity index 99% rename from baselines/deprecated/baseline_of_cloud_security_group_api_calls_per_user.yml rename to removed/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml index f6bc14fc18..1a1755f323 100644 --- a/baselines/deprecated/baseline_of_cloud_security_group_api_calls_per_user.yml +++ b/removed/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml @@ -4,7 +4,7 @@ version: 3 date: '2026-02-25' author: David Dorsey, Splunk type: Baseline -status: deprecated +status: removed description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt diff --git a/baselines/deprecated/baseline_of_command_line_length___mltk.yml b/removed/baselines/baseline_of_command_line_length___mltk.yml similarity index 99% rename from baselines/deprecated/baseline_of_command_line_length___mltk.yml rename to removed/baselines/baseline_of_command_line_length___mltk.yml index ccd517f506..4cb74e1452 100644 --- a/baselines/deprecated/baseline_of_command_line_length___mltk.yml +++ b/removed/baselines/baseline_of_command_line_length___mltk.yml @@ -4,7 +4,7 @@ version: 3 date: '2026-02-25' author: Rico Valdez, Splunk type: Baseline -status: deprecated +status: removed description: This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. diff --git a/baselines/deprecated/baseline_of_dns_query_length___mltk.yml b/removed/baselines/baseline_of_dns_query_length___mltk.yml similarity index 99% rename from baselines/deprecated/baseline_of_dns_query_length___mltk.yml rename to removed/baselines/baseline_of_dns_query_length___mltk.yml index ad1905c0db..3bca67cb16 100644 --- a/baselines/deprecated/baseline_of_dns_query_length___mltk.yml +++ b/removed/baselines/baseline_of_dns_query_length___mltk.yml @@ -4,7 +4,7 @@ version: 3 date: '2026-02-25' author: Rico Valdez, Splunk type: Baseline -status: deprecated +status: removed description: This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed diff --git a/baselines/deprecated/baseline_of_smb_traffic___mltk.yml b/removed/baselines/baseline_of_smb_traffic___mltk.yml similarity index 99% rename from baselines/deprecated/baseline_of_smb_traffic___mltk.yml rename to removed/baselines/baseline_of_smb_traffic___mltk.yml index 8a0177c059..6fd3949989 100644 --- a/baselines/deprecated/baseline_of_smb_traffic___mltk.yml +++ b/removed/baselines/baseline_of_smb_traffic___mltk.yml @@ -4,7 +4,7 @@ version: 3 date: '2026-02-25' author: Rico Valdez, Splunk type: Baseline -status: deprecated +status: removed description: This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of diff --git a/detections/deprecated/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/removed/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml similarity index 99% rename from detections/deprecated/abnormally_high_number_of_cloud_infrastructure_api_calls.yml rename to removed/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml index 5cb5c8ca7a..59419cb795 100644 --- a/detections/deprecated/abnormally_high_number_of_cloud_infrastructure_api_calls.yml +++ b/removed/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml @@ -3,7 +3,7 @@ id: 0840ddf1-8c89-46ff-b730-c8d6722478c0 version: 12 date: '2026-03-10' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: The following analytic detects a spike in the number of API calls made to your cloud infrastructure by a user. It leverages cloud infrastructure logs and compares the current API call volume against a baseline probability density function to identify anomalies. This activity is significant because an unusual increase in API calls can indicate potential misuse or compromise of cloud resources. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or disruption of cloud services, posing a significant risk to the organization's cloud environment. data_source: diff --git a/detections/deprecated/abnormally_high_number_of_cloud_instances_destroyed.yml b/removed/detections/abnormally_high_number_of_cloud_instances_destroyed.yml similarity index 99% rename from detections/deprecated/abnormally_high_number_of_cloud_instances_destroyed.yml rename to removed/detections/abnormally_high_number_of_cloud_instances_destroyed.yml index a38dacd7b0..e3610a0b3b 100644 --- a/detections/deprecated/abnormally_high_number_of_cloud_instances_destroyed.yml +++ b/removed/detections/abnormally_high_number_of_cloud_instances_destroyed.yml @@ -3,7 +3,7 @@ id: ef629fc9-1583-4590-b62a-f2247fbf7bbf version: 9 date: '2026-03-10' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: The following analytic identifies an abnormally high number of cloud instances being destroyed within a 4-hour period. It leverages cloud infrastructure logs and applies a probability density model to detect outliers. This activity is significant for a SOC because a sudden spike in destroyed instances could indicate malicious activity, such as an insider threat or a compromised account attempting to disrupt services. If confirmed malicious, this could lead to significant operational disruptions, data loss, and potential financial impact due to the destruction of critical cloud resources. data_source: diff --git a/detections/deprecated/abnormally_high_number_of_cloud_instances_launched.yml b/removed/detections/abnormally_high_number_of_cloud_instances_launched.yml similarity index 99% rename from detections/deprecated/abnormally_high_number_of_cloud_instances_launched.yml rename to removed/detections/abnormally_high_number_of_cloud_instances_launched.yml index 071d8cf462..983b731edf 100644 --- a/detections/deprecated/abnormally_high_number_of_cloud_instances_launched.yml +++ b/removed/detections/abnormally_high_number_of_cloud_instances_launched.yml @@ -3,7 +3,7 @@ id: f2361e9f-3928-496c-a556-120cd4223a65 version: 10 date: '2026-03-10' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: The following analytic detects an abnormally high number of cloud instances launched within a 4-hour period. It leverages cloud infrastructure logs and applies a probability density model to identify outliers based on historical data. This activity is significant for a SOC because a sudden spike in instance creation could indicate unauthorized access or misuse of cloud resources. If confirmed malicious, this behavior could lead to resource exhaustion, increased costs, or provide attackers with additional compute resources to further their objectives. data_source: diff --git a/detections/deprecated/abnormally_high_number_of_cloud_security_group_api_calls.yml b/removed/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml similarity index 99% rename from detections/deprecated/abnormally_high_number_of_cloud_security_group_api_calls.yml rename to removed/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml index 9bfe4d1350..3cb6e5e574 100644 --- a/detections/deprecated/abnormally_high_number_of_cloud_security_group_api_calls.yml +++ b/removed/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml @@ -3,7 +3,7 @@ id: d4dfb7f3-7a37-498a-b5df-f19334e871af version: 11 date: '2026-03-10' author: David Dorsey, Splunk -status: deprecated +status: removed type: Anomaly description: The following analytic detects a spike in the number of API calls made to cloud security groups by a user. It leverages data from the Change data model, focusing on successful firewall-related changes. This activity is significant because an abnormal increase in security group API calls can indicate potential malicious activity, such as unauthorized access or configuration changes. If confirmed malicious, this could allow an attacker to manipulate security group settings, potentially exposing sensitive resources or disrupting network security controls. data_source: diff --git a/detections/deprecated/detect_dga_domains_using_pretrained_model_in_dsdl.yml b/removed/detections/detect_dga_domains_using_pretrained_model_in_dsdl.yml similarity index 99% rename from detections/deprecated/detect_dga_domains_using_pretrained_model_in_dsdl.yml rename to removed/detections/detect_dga_domains_using_pretrained_model_in_dsdl.yml index bc02eed1f5..210a2d669f 100644 --- a/detections/deprecated/detect_dga_domains_using_pretrained_model_in_dsdl.yml +++ b/removed/detections/detect_dga_domains_using_pretrained_model_in_dsdl.yml @@ -3,7 +3,7 @@ id: 92e24f32-9b9a-4060-bba2-2a0eb31f3493 version: 7 date: '2026-03-10' author: Abhinav Mishra, Kumar Sharad and Namratha Sreekanta, Splunk -status: deprecated +status: removed type: Anomaly description: The following analytic identifies Domain Generation Algorithm (DGA) generated domains using a pre-trained deep learning model. It leverages the Network Resolution data model to analyze domain names and detect unusual character sequences indicative of DGA activity. This behavior is significant as adversaries often use DGAs to generate numerous domain names for command-and-control servers, making it harder to block malicious traffic. If confirmed malicious, this activity could enable attackers to maintain persistent communication with compromised systems, evade detection, and execute further malicious actions. data_source: [] diff --git a/detections/deprecated/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml b/removed/detections/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml similarity index 99% rename from detections/deprecated/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml rename to removed/detections/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml index 7cb36acce8..caf6f4b47d 100644 --- a/detections/deprecated/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml +++ b/removed/detections/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml @@ -2,7 +2,7 @@ name: Detect DNS Data Exfiltration using pretrained model in DSDL id: 92f65c3a-168c-11ed-71eb-0242ac120012 version: 8 date: '2026-02-25' -status: deprecated +status: removed author: Abhinav Mishra, Kumar Sharad and Namratha Sreekanta, Splunk type: Anomaly data_source: [] diff --git a/detections/deprecated/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml b/removed/detections/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml similarity index 99% rename from detections/deprecated/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml rename to removed/detections/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml index 038cf369c5..c80464ecb2 100644 --- a/detections/deprecated/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml +++ b/removed/detections/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml @@ -3,7 +3,7 @@ id: 92f65c3a-968c-11ed-a1eb-0242ac120002 version: 8 date: '2026-03-10' author: Abhinav Mishra, Kumar Sharad and Namratha Sreekanta, Splunk -status: deprecated +status: removed type: Anomaly description: The following analytic identifies suspicious DNS TXT records using a pre-trained deep learning model. It leverages DNS response data from the Network Resolution data model, categorizing TXT records into known types via regular expressions. Records that do not match known patterns are flagged as suspicious. This activity is significant as DNS TXT records can be used for data exfiltration or command-and-control communication. If confirmed malicious, attackers could use these records to covertly transfer data or receive instructions, posing a severe threat to network security. data_source: [] diff --git a/detections/deprecated/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml b/removed/detections/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml similarity index 99% rename from detections/deprecated/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml rename to removed/detections/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml index 2eda6489e1..49bb9386e1 100644 --- a/detections/deprecated/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml +++ b/removed/detections/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml @@ -4,7 +4,7 @@ version: 9 date: '2026-03-10' author: Abhinav Mishra, Kumar Sharad and Namratha Sreekanta, Splunk type: Anomaly -status: deprecated +status: removed data_source: - Sysmon EventID 1 description: The following analytic identifies suspicious process names using a pre-trained Deep Learning model. It leverages Endpoint Detection and Response (EDR) telemetry to analyze process names and predict their likelihood of being malicious. The model, a character-level Recurrent Neural Network (RNN), classifies process names as benign or suspicious based on a threshold score of 0.5. This detection is significant as it helps identify malware, such as TrickBot, which often uses randomly generated filenames to evade detection. If confirmed malicious, this activity could indicate the presence of malware capable of propagating across the network and executing harmful actions. diff --git a/detections/deprecated/dns_query_length_outliers___mltk.yml b/removed/detections/dns_query_length_outliers___mltk.yml similarity index 99% rename from detections/deprecated/dns_query_length_outliers___mltk.yml rename to removed/detections/dns_query_length_outliers___mltk.yml index e5eff084b8..e203124570 100644 --- a/detections/deprecated/dns_query_length_outliers___mltk.yml +++ b/removed/detections/dns_query_length_outliers___mltk.yml @@ -3,7 +3,7 @@ id: 85fbcfe8-9718-4911-adf6-7000d077a3a9 version: 10 date: '2026-03-10' author: Rico Valdez, Splunk -status: deprecated +status: removed type: Anomaly description: The following analytic identifies DNS requests with unusually large query lengths for the record type being requested. It leverages the Network_Resolution data model and applies a machine learning model to detect outliers in DNS query lengths. This activity is significant because unusually large DNS queries can indicate data exfiltration or command-and-control communication attempts. If confirmed malicious, this activity could allow attackers to exfiltrate sensitive data or maintain persistent communication channels with compromised systems. data_source: [] diff --git a/detections/deprecated/linux_docker_privilege_escalation.yml b/removed/detections/linux_docker_privilege_escalation.yml similarity index 99% rename from detections/deprecated/linux_docker_privilege_escalation.yml rename to removed/detections/linux_docker_privilege_escalation.yml index 4fc496d0d9..591e49173b 100644 --- a/detections/deprecated/linux_docker_privilege_escalation.yml +++ b/removed/detections/linux_docker_privilege_escalation.yml @@ -3,7 +3,7 @@ id: 2e7bfb78-85f6-47b5-bc2f-15813a4ef2b3 version: 11 date: '2026-03-03' author: Gowthamaraj Rajendran, Splunk -status: deprecated +status: removed type: Anomaly description: The following analytic detects attempts to escalate privileges on a Linux system using Docker. It identifies processes where Docker commands are used to mount the root directory or execute shell commands within a container. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names, command-line arguments, and parent processes. This activity is significant because it can allow an attacker with Docker privileges to modify critical system files, such as /etc/passwd, to create a superuser. If confirmed malicious, this could lead to full system compromise and persistent unauthorized access. data_source: diff --git a/detections/deprecated/potentially_malicious_code_on_commandline.yml b/removed/detections/potentially_malicious_code_on_commandline.yml similarity index 99% rename from detections/deprecated/potentially_malicious_code_on_commandline.yml rename to removed/detections/potentially_malicious_code_on_commandline.yml index b056f6c149..328326fd25 100644 --- a/detections/deprecated/potentially_malicious_code_on_commandline.yml +++ b/removed/detections/potentially_malicious_code_on_commandline.yml @@ -3,7 +3,7 @@ id: 9c53c446-757e-11ec-871d-acde48001122 version: 7 date: '2026-03-10' author: Michael Hart, Splunk -status: deprecated +status: removed type: Anomaly description: The following analytic detects potentially malicious command lines using a pretrained machine learning text classifier. It identifies unusual keyword combinations in command lines, such as "streamreader," "webclient," "mutex," "function," and "computehash," which are often associated with adversarial PowerShell code execution for C2 communication. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command lines longer than 200 characters. This activity is significant as it can indicate an attempt to execute malicious scripts, potentially leading to unauthorized code execution, data exfiltration, or further system compromise. data_source: diff --git a/detections/deprecated/smb_traffic_spike___mltk.yml b/removed/detections/smb_traffic_spike___mltk.yml similarity index 99% rename from detections/deprecated/smb_traffic_spike___mltk.yml rename to removed/detections/smb_traffic_spike___mltk.yml index 621a75ce6f..13fec99508 100644 --- a/detections/deprecated/smb_traffic_spike___mltk.yml +++ b/removed/detections/smb_traffic_spike___mltk.yml @@ -3,7 +3,7 @@ id: d25773ba-9ad8-48d1-858e-07ad0bbeb828 version: 11 date: '2026-03-10' author: Rico Valdez, Splunk -status: deprecated +status: removed type: Anomaly description: The following analytic identifies spikes in the number of Server Message Block (SMB) connections using the Machine Learning Toolkit (MLTK). It leverages the Network_Traffic data model to monitor SMB traffic on ports 139 and 445, applying a machine learning model to detect anomalies. This activity is significant because sudden increases in SMB traffic can indicate lateral movement or data exfiltration attempts by attackers. If confirmed malicious, this behavior could lead to unauthorized access, data theft, or further compromise of the network. data_source: [] diff --git a/detections/deprecated/unusually_long_command_line___mltk.yml b/removed/detections/unusually_long_command_line___mltk.yml similarity index 99% rename from detections/deprecated/unusually_long_command_line___mltk.yml rename to removed/detections/unusually_long_command_line___mltk.yml index 21dd94ecc6..a9ebc0a963 100644 --- a/detections/deprecated/unusually_long_command_line___mltk.yml +++ b/removed/detections/unusually_long_command_line___mltk.yml @@ -3,7 +3,7 @@ id: 57edaefa-a73b-45e5-bbae-f39c1473f941 version: 9 date: '2026-03-10' author: Rico Valdez, Splunk -status: deprecated +status: removed type: Anomaly description: The following analytic identifies unusually long command lines executed on hosts, which may indicate malicious activity. It leverages the Machine Learning Toolkit (MLTK) to detect command lines with lengths that deviate from the norm for a given user. This is significant for a SOC as unusually long command lines can be a sign of obfuscation or complex malicious scripts. If confirmed malicious, this activity could allow attackers to execute sophisticated commands, potentially leading to unauthorized access, data exfiltration, or further compromise of the system. data_source: diff --git a/detections/deprecated/windows_excel_activemicrosoftapp_child_process.yml b/removed/detections/windows_excel_activemicrosoftapp_child_process.yml similarity index 99% rename from detections/deprecated/windows_excel_activemicrosoftapp_child_process.yml rename to removed/detections/windows_excel_activemicrosoftapp_child_process.yml index 3ba81e342c..6b01b4b6d6 100644 --- a/detections/deprecated/windows_excel_activemicrosoftapp_child_process.yml +++ b/removed/detections/windows_excel_activemicrosoftapp_child_process.yml @@ -3,7 +3,7 @@ id: 4dfd6a58-93b2-4012-bb33-038bb63652b3 version: 3 date: '2026-03-16' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: Anomaly description: The following analytic identifies the execution of the ActiveMicrosoftApp process as a child of Microsoft Excel. Under normal conditions, Excel primarily spawns internal Office-related processes, and the creation of ActiveMicrosoftApp is uncommon in day-to-day business workflows. Adversaries may abuse this behavior to blend malicious activity within trusted applications, execute unauthorized code, or bypass application control mechanisms. This technique aligns with common tradecraft where Office applications are leveraged as initial access or execution vectors due to their prevalence in enterprise environments. Detecting this relationship helps defenders spot suspicious child processes that may indicate malware execution, persistence mechanisms, or attempts to establish command-and-control. Security teams should investigate the parent Excel process, the context of the ActiveMicrosoftApp execution, and any subsequent network or file activity. While certain legitimate Office features could trigger this process in specific environments, its occurrence generally warrants further scrutiny to validate intent and rule out compromise. data_source: