Loading story…
Splunk Threat Research has removed several endpoint analytics from its Security Content library, retiring detections for chcp.com execution, account discovery with the Windows net utility, and execution of files padded with spaces before the extension. Splunk said the CHCP Command Execution analytic was deprecated because chcp.com alone is not inherently malicious, while Account Discovery With Net App was withdrawn due to overlap with other detections and replaced by Windows Excessive Usage Of Net App. The filename-obfuscation analytic was also removed and superseded by Execution of File with Multiple Extensions.
The retired rules had mapped to MITRE ATT&CK techniques T1087.002 for domain account discovery and T1036.003 for masquerading through renamed or disguised utilities. Those ATT&CK entries describe common adversary tradecraft including use of net user /domain, net group "Domain Admins" /domain, PowerShell AD cmdlets, and tools such as AdFind and BloodHound to enumerate domain accounts, as well as renaming or disguising legitimate binaries like rundll32.exe, mshta.exe, cmd.exe, and wscript.exe to evade detection. Splunk noted the removed analytics depended on endpoint process telemetry such as EDR and Sysmon data, were disabled by default, and could generate false positives from legitimate administrative activity.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Splunk Threat Research removed the 'CHCP Command Execution' detection from its content library and said it was no longer maintained or supported. Splunk stated the analytic was deprecated because execution of chcp.com by itself is not inherently malicious.
Splunk Threat Research removed the 'Windows Service Stop Via Net and SC Application' analytic from its content library, saying it no longer effectively identified the intended malicious activity. Splunk said the detection is no longer maintained or supported and noted the removal in version 5.2.0.
Splunk Threat Research removed the 'Execution of File With Spaces Before Extension' detection from its content library and marked it no longer maintained or supported. The entry says it was updated to the replacement detection 'Execution of File with Multiple Extensions.'
Splunk Threat Research removed the 'Account Discovery With Net App' analytic from its content library, said it was no longer maintained or supported, and replaced it with 'Windows Excessive Usage Of Net App.' Splunk said the detection was deprecated because it covered unrelated behaviors and overlapped with other detections.
Microsoft published technical details on Prestige ransomware activity affecting organizations in Ukraine and Poland. The post disclosed a distinct ransomware campaign and identified impacted countries, adding a new incident not reflected in the existing timeline.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourceresearch.splunk.com
Open sourceresearch.splunk.com
Open sourceresearch.splunk.com
Open sourceattack.mitre.org
Open sourcemicrosoft.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk removed several Windows-focused detections from its Threat Research content library and Enterprise Security workflows, citing renamed analytics, overly broad logic, excessive noise, or reduced effectiveness against current attacker tradecraft. The retired content covered **local administrator account creation** with `net.exe`, **domain and local account discovery**, **domain and privileged group enumeration**, **Excel spawning PowerShell**, **Mimikatz-related credential dumping**, and an **Investigation** for pass-the-hash activity based on Windows Event ID `4624` with `Logon_Type 9`. Splunk said most of the detections were removed in content library version `5.2.0`, while the pass-the-hash investigation was dropped because Enterprise Security `8.0` no longer supports Investigations. The affected detections mapped to common ATT&CK behaviors including `T1136.001` (local account creation), `T1087.001` and `T1087.002` (account discovery), `T1069.002` (domain group discovery), `T1003.001` (LSASS memory), and pass-the-hash activity involving dumped **NTLM** credentials. The changes reflect the difficulty of reliably detecting Windows credential access and reconnaissance techniques that remain widely used by threat actors, including **SAM** hive dumping (`T1003.002`) with tools such as **Mimikatz**, **Impacket/SecretsDump**, **CrackMapExec**, and **Cobalt Strike**, as documented by MITRE ATT&CK. Splunk directed users to newer replacements such as **Windows Create Local Administrator Account Via Net**, **Windows User Discovery Via Net**, **Windows Group Discovery Via Net**, **Windows Sensitive Group Discovery With Net**, and **Windows Office Product Spawned Uncommon Process**.
Aug 12, 2026
Splunk has removed two Windows discovery analytics from its Threat Research content library and replaced them with updated detections for attacker use of built-in `net` commands to enumerate users and groups. The deprecated rules, **Local Account Discovery with Net** and **Net Localgroup Discovery**, identified execution of `net.exe` or `net1.exe` with arguments such as `user`, `users`, and `localgroup`, activity commonly used to list local accounts and group memberships on compromised hosts. The changes align with well-documented adversary behavior in **MITRE ATT&CK** techniques `T1087.001` and `T1069.001`, where threat actors use commands like `net user`, `net user /domain`, and `net localgroup administrators` to gather account and privilege information that can support privilege escalation and lateral movement. Splunk said the removed analytics were deprecated in version `5.2.0` in favor of **Windows User Discovery Via Net** and **Windows Group Discovery Via Net**, with the original detections having relied on EDR process telemetry, Sysmon `Event ID 1`, Windows Security `Event ID 4688`, and related endpoint data sources.
Aug 12, 2026
Splunk has removed its deprecated **"Network Connection Discovery With Net"** analytic and replaced it with **"Windows Network Connection Discovery Via Net"**, updating the detection logic for suspicious use of `net.exe` and `net1.exe` on Windows systems. The analytic is designed to surface command-line activity associated with **MITRE ATT&CK `T1049`**, which covers adversary reconnaissance of active network connections, open ports, sessions, and reachable resources after initial compromise. MITRE documents `T1049` as a common post-compromise behavior used by APT groups, ransomware operators, and malware families to map local network connectivity through utilities such as `netstat`, `net use`, and `net session`, as well as Windows networking APIs. Splunk said the detection relies on telemetry including **Sysmon Event ID 1**, **Windows Security Event ID 4688**, and **CrowdStrike ProcessRollup2** normalized into the Splunk Endpoint data model, and noted that while the activity can indicate reconnaissance supporting lateral movement or data exfiltration, administrators may also trigger it during legitimate troubleshooting.
Aug 12, 2026