Loading story…
Splunk has removed or deprecated several DNS-focused detections and investigations from its Threat Research content library, including analytics for DNS tunnels, DNS data exfiltration, suspicious TXT records, long TXT responses, clients querying multiple DNS servers, dynamic DNS provider traffic, and investigations for DNS traffic ratios and the process responsible for DNS traffic. Splunk said some content no longer effectively detected the intended activity, overlapped with newer analytics, depended on unsupported Enterprise Security investigation features, or broke because of compatibility issues with Splunk AI Toolkit 5.7.0 and related data science components; in some cases, Splunk pointed users to replacement rules such as DNS query length outlier detections or updated dynamic-DNS analytics.
The removals affect detections tied to well-known attacker tradecraft in which adversaries use DNS for command-and-control and exfiltration, including DNS tunneling, abuse of TXT, A, and AAAA records, and infrastructure-hiding techniques such as dynamic DNS and domain generation algorithms (DGAs). MITRE ATT&CK documents these behaviors under techniques including T1071.004 for DNS-based application-layer C2 and T1568.002 for DGAs, while prior threat research has shown malware and intrusion sets using DNS because it is widely allowed through firewalls and can conceal beaconing, payload delivery, and data theft inside normal-looking name-resolution traffic.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Splunk Threat Research updated and published removal notices for multiple deprecated DNS-related detections and investigations in its content library, documenting their unsupported status and replacement guidance where applicable.
Palo Alto Networks Unit 42 published a report describing how attackers abuse DNS for command-and-control, data exfiltration, and payload delivery, and outlined defensive recommendations and common tunneling tools.
MITRE ATT&CK published the Enterprise sub-technique entry for Domain Generation Algorithms (T1568.002), cataloging malware and threat groups that use DGAs for command-and-control communications.
Splunk Threat Research removed the detections Detect suspicious DNS TXT records using pretrained model in DSDL and Detect DNS Data Exfiltration using pretrained model in DSDL in content library version 5.26.0. Splunk said both were no longer maintained because they did not work with Splunk AI Toolkit 5.7.0 and Python for Scientific Computing for Linux 64-bit 4.3.0.
Splunk Threat Research removed several DNS-related detections and investigations in content version 5.2.0, including Clients Connecting to Multiple DNS Servers, Detection of DNS Tunnels, Detect Long DNS TXT Record Response, Detect web traffic to dynamic domain providers, Get DNS traffic ratio, and Get Process Responsible For The DNS Traffic. Reasons included ineffective detection logic, duplicate coverage, replacement by other content, log-source changes, and deprecation of Investigations in Splunk Enterprise Security 8.0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
11 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourceresearch.splunk.com
Open sourceresearch.splunk.com
Open sourceresearch.splunk.com
Open sourceresearch.splunk.com
Open sourceunit42.paloaltonetworks.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk Threat Research has removed several endpoint analytics from its Security Content library, retiring detections for `chcp.com` execution, account discovery with the Windows `net` utility, and execution of files padded with spaces before the extension. Splunk said the `CHCP Command Execution` analytic was deprecated because `chcp.com` alone is not inherently malicious, while `Account Discovery With Net App` was withdrawn due to overlap with other detections and replaced by **Windows Excessive Usage Of Net App**. The filename-obfuscation analytic was also removed and superseded by **Execution of File with Multiple Extensions**. The retired rules had mapped to MITRE ATT&CK techniques **T1087.002** for domain account discovery and **T1036.003** for masquerading through renamed or disguised utilities. Those ATT&CK entries describe common adversary tradecraft including use of `net user /domain`, `net group "Domain Admins" /domain`, PowerShell AD cmdlets, and tools such as AdFind and BloodHound to enumerate domain accounts, as well as renaming or disguising legitimate binaries like `rundll32.exe`, `mshta.exe`, `cmd.exe`, and `wscript.exe` to evade detection. Splunk noted the removed analytics depended on endpoint process telemetry such as EDR and Sysmon data, were disabled by default, and could generate false positives from legitimate administrative activity.
Aug 12, 2026
Splunk removed several Windows-focused detections from its Threat Research content library and Enterprise Security workflows, citing renamed analytics, overly broad logic, excessive noise, or reduced effectiveness against current attacker tradecraft. The retired content covered **local administrator account creation** with `net.exe`, **domain and local account discovery**, **domain and privileged group enumeration**, **Excel spawning PowerShell**, **Mimikatz-related credential dumping**, and an **Investigation** for pass-the-hash activity based on Windows Event ID `4624` with `Logon_Type 9`. Splunk said most of the detections were removed in content library version `5.2.0`, while the pass-the-hash investigation was dropped because Enterprise Security `8.0` no longer supports Investigations. The affected detections mapped to common ATT&CK behaviors including `T1136.001` (local account creation), `T1087.001` and `T1087.002` (account discovery), `T1069.002` (domain group discovery), `T1003.001` (LSASS memory), and pass-the-hash activity involving dumped **NTLM** credentials. The changes reflect the difficulty of reliably detecting Windows credential access and reconnaissance techniques that remain widely used by threat actors, including **SAM** hive dumping (`T1003.002`) with tools such as **Mimikatz**, **Impacket/SecretsDump**, **CrackMapExec**, and **Cobalt Strike**, as documented by MITRE ATT&CK. Splunk directed users to newer replacements such as **Windows Create Local Administrator Account Via Net**, **Windows User Discovery Via Net**, **Windows Group Discovery Via Net**, **Windows Sensitive Group Discovery With Net**, and **Windows Office Product Spawned Uncommon Process**.
Aug 12, 2026
Splunk has removed several security analytics from its Threat Research content library after the underlying vulnerabilities were patched in current releases, including detections tied to path traversal, SPL injection, CSRF, unauthorized admin account creation, and Analytics Workspace data exfiltration. The retired content covered **CVE-2022-26889**, **CVE-2022-43566**, **CVE-2023-22942**, and **CVE-2023-22933**, with detections aimed at spotting exploitation attempts in on-premises deployments through internal access logs, audit searches, and REST API queries. The withdrawn detections had been designed to identify attacks such as crafted `../` traversal requests, abuse of the Splunk Secure Gateway `kvstore_client` endpoint, suspicious `sid` query activity in Analytics Workspace, and the presence of nonstandard administrative accounts that could indicate persistence or privilege escalation. Splunk said some analytics were deprecated because they were patched and no longer maintained, while at least one lookup file editing path traversal detection was removed because it did not accurately detect malicious activity and was ineffective against obfuscated requests; several notices also warned of false positives, disabled-by-default status, and limited usefulness without manual investigation.
Aug 12, 2026