From b18a0da5714c2fd0347b41c8db8e870c77e6b02f Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Fri, 2 Oct 2026 10:22:08 -0700 Subject: [PATCH 1/5] deprecating --- .../detect_large_icmp_traffic.yml | 10 +++++++--- .../web/detect_remote_access_software_usage_url.yml | 13 +++++-------- 2 files changed, 12 insertions(+), 11 deletions(-) rename detections/{network => deprecated}/detect_large_icmp_traffic.yml (95%) diff --git a/detections/network/detect_large_icmp_traffic.yml b/detections/deprecated/detect_large_icmp_traffic.yml similarity index 95% rename from detections/network/detect_large_icmp_traffic.yml rename to detections/deprecated/detect_large_icmp_traffic.yml index 98f14307a8c..af7df01d37b 100644 --- a/detections/network/detect_large_icmp_traffic.yml +++ b/detections/deprecated/detect_large_icmp_traffic.yml @@ -1,10 +1,10 @@ name: Detect Large ICMP Traffic id: 9cd6d066-94d5-4ccd-a8b9-28c03ca91be8 -version: 8 +version: 9 creation_date: '2020-01-19' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Rico Valdez, Dean Luxton, Bhavin Patel, Splunk -status: production +status: deprecated type: TTP description: | The following analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes. @@ -95,3 +95,7 @@ tests: source: cisco_cloud_security_addon sourcetype: cisco:cloud_security:firewall test_type: unit +deprecation_info: + reason: Detection deprecated as it is determined to be very noisy in a production environment. + removed_in_version: 6.10.0 + replacement_content: [] diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml index 1a8700de2a4..867bfa8b3c6 100644 --- a/detections/web/detect_remote_access_software_usage_url.yml +++ b/detections/web/detect_remote_access_software_usage_url.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage URL id: 9296f515-073c-43a5-88ec-eda5a4626654 -version: 16 +version: 17 creation_date: '2024-03-06' -modification_date: '2026-05-13' +modification_date: '2026-10-02' author: Steven Dick status: production type: Anomaly @@ -21,13 +21,10 @@ search: | latest(Web.url) as url latest(Web.user) as user latest(Web.dest) as dest - from datamodel=Web where - Web.url_domain=* NOT Web.url_domain IN ( - "-", - "unknown" + "-", "unknown", "*tanium.com", "*tailscale.com", "*rapid7.com", "*sophos.com","*sophosupd.com","*beyondtrustcloud.com","*nordcdn.com","*amazonaws.com" ) by Web.action Web.src Web.category Web.url_domain Web.url_length @@ -39,11 +36,11 @@ search: | as desc, category | search isutility = True | `remote_access_software_usage_exceptions` - | `detect_remote_access_software_usage_url_filter` + | `detect_remote_access_software_usage_url_filter` | stats count values(dest) by url_domain how_to_implement: | The detection is based on data that originates from network logs. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the network logs. The logs must also be mapped to the `Web` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections. known_false_positives: | - It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content + It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content. Also, we have added some url_domains to exclude from the detection to help reduce false positives. references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ From 0a67e12eb9560a996fe300e3078b905d97ddcb01 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 5 Oct 2026 14:21:20 +0200 Subject: [PATCH 2/5] Update detections/deprecated/detect_large_icmp_traffic.yml --- detections/deprecated/detect_large_icmp_traffic.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/deprecated/detect_large_icmp_traffic.yml b/detections/deprecated/detect_large_icmp_traffic.yml index af7df01d37b..f491f9d89e6 100644 --- a/detections/deprecated/detect_large_icmp_traffic.yml +++ b/detections/deprecated/detect_large_icmp_traffic.yml @@ -97,5 +97,5 @@ tests: test_type: unit deprecation_info: reason: Detection deprecated as it is determined to be very noisy in a production environment. - removed_in_version: 6.10.0 + removed_in_version: 6.12.0 replacement_content: [] From 6c9b7909950a68e0f69db2c92fc88d7580fed17d Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 13 Oct 2026 09:14:12 -0700 Subject: [PATCH 3/5] remove incorrectstats --- detections/web/detect_remote_access_software_usage_url.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml index 7d96e6e3ec5..d1df7b274fc 100644 --- a/detections/web/detect_remote_access_software_usage_url.yml +++ b/detections/web/detect_remote_access_software_usage_url.yml @@ -36,7 +36,7 @@ search: | as desc, category | search isutility = True | `remote_access_software_usage_exceptions` - | `detect_remote_access_software_usage_url_filter` | stats count values(dest) by url_domain + | `detect_remote_access_software_usage_url_filter` how_to_implement: | The detection is based on data that originates from network logs. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the network logs. The logs must also be mapped to the `Web` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections. known_false_positives: | From 5078418d4de480100f5b6bc61bc88fa1a9a9e540 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 13 Oct 2026 09:14:42 -0700 Subject: [PATCH 4/5] version bumo --- detections/web/detect_remote_access_software_usage_url.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml index d1df7b274fc..6758ba2692f 100644 --- a/detections/web/detect_remote_access_software_usage_url.yml +++ b/detections/web/detect_remote_access_software_usage_url.yml @@ -1,6 +1,6 @@ name: Detect Remote Access Software Usage URL id: 9296f515-073c-43a5-88ec-eda5a4626654 -version: 17 +version: 18 creation_date: '2024-03-06' modification_date: '2026-10-02' author: Steven Dick From e1cc226fc1245cc491699c1873ac03c2b462beb6 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Tue, 13 Oct 2026 19:09:35 +0200 Subject: [PATCH 5/5] Update detect_remote_access_software_usage_url.yml --- .../web/detect_remote_access_software_usage_url.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml index 6758ba2692f..228dd2e6a28 100644 --- a/detections/web/detect_remote_access_software_usage_url.yml +++ b/detections/web/detect_remote_access_software_usage_url.yml @@ -1,8 +1,8 @@ name: Detect Remote Access Software Usage URL id: 9296f515-073c-43a5-88ec-eda5a4626654 -version: 18 +version: 17 creation_date: '2024-03-06' -modification_date: '2026-10-02' +modification_date: '2026-09-22' author: Steven Dick status: production type: Anomaly @@ -21,10 +21,13 @@ search: | latest(Web.url) as url latest(Web.user) as user latest(Web.dest) as dest + from datamodel=Web where + Web.url_domain=* NOT Web.url_domain IN ( - "-", "unknown", "*tanium.com", "*tailscale.com", "*rapid7.com", "*sophos.com","*sophosupd.com","*beyondtrustcloud.com","*nordcdn.com","*amazonaws.com" + "-", + "unknown" ) by Web.action Web.src Web.category Web.url_domain Web.url_length @@ -40,7 +43,7 @@ search: | how_to_implement: | The detection is based on data that originates from network logs. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the network logs. The logs must also be mapped to the `Web` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections. known_false_positives: | - It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content. Also, we have added some url_domains to exclude from the detection to help reduce false positives. + It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/