Loading story…
Splunk has removed several security analytics from its Threat Research content library after the underlying vulnerabilities were patched in current releases, including detections tied to path traversal, SPL injection, CSRF, unauthorized admin account creation, and Analytics Workspace data exfiltration. The retired content covered CVE-2022-26889, CVE-2022-43566, CVE-2023-22942, and CVE-2023-22933, with detections aimed at spotting exploitation attempts in on-premises deployments through internal access logs, audit searches, and REST API queries.
The withdrawn detections had been designed to identify attacks such as crafted ../ traversal requests, abuse of the Splunk Secure Gateway kvstore_client endpoint, suspicious sid query activity in Analytics Workspace, and the presence of nonstandard administrative accounts that could indicate persistence or privilege escalation. Splunk said some analytics were deprecated because they were patched and no longer maintained, while at least one lookup file editing path traversal detection was removed because it did not accurately detect malicious activity and was ineffective against obfuscated requests; several notices also warned of false positives, disabled-by-default status, and limited usefulness without manual investigation.
See real exploitation activity before you spend the cycle.
7 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-29, Splunk Threat Research removed the detection "Splunk Path Traversal In Splunk App For Lookup File Edit" from its content library. Splunk said the analytic was deprecated and did not accurately detect the malicious activity it was intended to find.
On 2026-05-14, Splunk Threat Research removed the hunting detection 'Splunk SG Information Disclosure for Low Privs User' from content library version 5.6.0 because the associated vulnerability, CVE-2024-45735, had been patched in current Splunk releases. The analytic had been designed to identify non-admin access to Splunk Secure Gateway KV Store deployment configuration and keys via the /splunkd/__raw/services/ssg/kvstore/ path.
On 2026-05-14, Splunk Threat Research removed the hunting detection 'Splunk RCE via Splunk Secure Gateway Splunk Mobile alerts feature' from content library version 5.6.0 because the associated vulnerability, CVE-2022-43567, had been patched in the latest Splunk release. The analytic had been designed to identify exploitation attempts against the Splunk Secure Gateway Mobile Alerts feature.
On 2026-05-14, Splunk Threat Research removed four detections from its content library because the associated vulnerabilities had been patched: "Path traversal SPL injection," "Splunk CSRF in the SSG kvstore Client Endpoint," "Splunk Data exfiltration from Analytics Workspace using sid query," and "Splunk list all nonstandard admin accounts." The removals were recorded in content library version 5.6.0.
Splunk released fixes for several vulnerabilities that later caused related detections to be retired, including CVE-2022-26889, CVE-2022-43566, CVE-2023-22933, and CVE-2023-22942. The references state these CVEs had been patched in the latest Splunk release.
Splunk published security advisory SVD-2023-0212 for the Splunk Secure Gateway kvstore_client endpoint vulnerability. The related detection content associates the issue with CVE-2023-22942.
Splunk published security advisory SVD-2022-0506 covering the vulnerability later referenced by the "Path traversal SPL injection" detection. The detection content maps the issue to CVE-2022-26889.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
8 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourceresearch.splunk.com
Open sourceresearch.splunk.com
Open sourceresearch.splunk.com
Open sourceresearch.splunk.com
Open sourceresearch.splunk.com
Open sourceresearch.splunk.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk has removed several Enterprise Security detections that were built to identify abuse of risky Search Processing Language (SPL) commands, including **"Splunk Command and Scripting Interpreter Risky SPL MLTK"**, **"Detect Risky SPL using Pretrained ML Model"**, and **"Splunk risky Command Abuse disclosed february 2023"**. The analytics monitored `Splunk_Audit.Search_Activity` data for ad hoc searches using commands such as `collect`, `delete`, `fit`, `outputcsv`, `outputlookup`, `run`, `script`, `sendalert`, `sendemail`, and `tscollect`, which could be abused to bypass warnings, escalate privileges, delete data, exfiltrate information, or support arbitrary code execution and persistence. Splunk said the detections were disabled by default and mapped to ATT&CK techniques including `T1059`, `T1202`, and `T1548`. The retired content relied on the **Machine Learning Toolkit (MLTK)** and, in some cases, pretrained models or per-user baselines to flag anomalous long-running risky searches or suspicious command text. Splunk originally promoted the approach as a way to complement rule-based detections for exploitation tied to **`CVE-2022-32154`** and later risky-command vulnerabilities, but the company has since withdrawn the analytics from its Threat Research library because the affected flaws have been patched in current Splunk releases. Splunk also noted operational drawbacks, including false positives from legitimate long-running searches and added compute requirements for model training in larger environments.
Aug 15, 2026
Splunk removed two security analytics tied to `CVE-2022-32151` after stating the underlying issues were patched in current releases. The retired detections had been designed to flag Splunk forwarder connections where `ssl=false` and to identify weak TLS certificate-validation settings in Python `httplib` and `urllib` components across search heads and peers. Splunk warned that these conditions could expose sensitive data, allow interception or manipulation of traffic, and in some cases enable attackers to download or publish forwarder bundles, creating a path to arbitrary code execution. The risks align with the broader ATT&CK technique **T1001.003: Protocol or Service Impersonation**, which covers malware and intrusion sets that disguise command-and-control traffic as legitimate services or protocols such as TLS and HTTP. MITRE documents how adversaries use fake TLS handshakes, spoofed record headers, and benign-looking HTTP headers, cookies, URI parameters, and POST bodies to evade inspection. In Splunk environments, weak or absent encryption can make that kind of impersonation harder to distinguish from normal traffic, which is why the detections had focused on missing encryption and certificate-validation weaknesses before being deprecated in version `5.6.0`.
Aug 12, 2026
Splunk removed several Windows-focused detections from its Threat Research content library and Enterprise Security workflows, citing renamed analytics, overly broad logic, excessive noise, or reduced effectiveness against current attacker tradecraft. The retired content covered **local administrator account creation** with `net.exe`, **domain and local account discovery**, **domain and privileged group enumeration**, **Excel spawning PowerShell**, **Mimikatz-related credential dumping**, and an **Investigation** for pass-the-hash activity based on Windows Event ID `4624` with `Logon_Type 9`. Splunk said most of the detections were removed in content library version `5.2.0`, while the pass-the-hash investigation was dropped because Enterprise Security `8.0` no longer supports Investigations. The affected detections mapped to common ATT&CK behaviors including `T1136.001` (local account creation), `T1087.001` and `T1087.002` (account discovery), `T1069.002` (domain group discovery), `T1003.001` (LSASS memory), and pass-the-hash activity involving dumped **NTLM** credentials. The changes reflect the difficulty of reliably detecting Windows credential access and reconnaissance techniques that remain widely used by threat actors, including **SAM** hive dumping (`T1003.002`) with tools such as **Mimikatz**, **Impacket/SecretsDump**, **CrackMapExec**, and **Cobalt Strike**, as documented by MITRE ATT&CK. Splunk directed users to newer replacements such as **Windows Create Local Administrator Account Via Net**, **Windows User Discovery Via Net**, **Windows Group Discovery Via Net**, **Windows Sensitive Group Discovery With Net**, and **Windows Office Product Spawned Uncommon Process**.
Aug 12, 2026