diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml index baeba46177..608929175e 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml @@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_indirect_command_execution_via_pcaluafilter`' + | `windows_indirect_command_execution_via_pcalua_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 599b52e09d..3d3cf545f9 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,3342 +1,10 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-24T08:24:11 UTC +# On Date: 2022-03-03T18:16:55 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# -[abnormally_high_number_of_cloud_infrastructure_api_calls_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[abnormally_high_number_of_cloud_security_group_api_calls_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_create_policy_version_to_allow_all_resources_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_createaccesskey_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_createloginprofile_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_cross_account_activity_from_previously_unseen_account_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_detect_users_with_kms_keys_performing_encryption_s3_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_ecr_container_scanning_findings_high_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_ecr_container_scanning_findings_low_informational_unknown_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_ecr_container_scanning_findings_medium_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_ecr_container_upload_outside_business_hours_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_ecr_container_upload_unknown_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_excessive_security_scanning_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_iam_accessdenied_discovery_events_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_iam_assume_role_policy_brute_force_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_iam_delete_policy_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_iam_failure_group_deletion_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_iam_successful_group_deletion_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_lambda_updatefunctioncode_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_network_access_control_list_created_with_all_open_ports_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_network_access_control_list_deleted_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_saml_access_by_provider_user_and_principal_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_saml_update_identity_provider_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_setdefaultpolicyversion_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_updateloginprofile_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[circle_ci_disable_security_job_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[circle_ci_disable_security_step_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_api_calls_from_previously_unseen_user_roles_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_compute_instance_created_by_previously_unseen_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_compute_instance_created_in_previously_unused_region_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_compute_instance_created_with_previously_unseen_image_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_compute_instance_created_with_previously_unseen_instance_type_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_instance_modified_by_previously_unseen_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_provisioning_activity_from_previously_unseen_city_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_provisioning_activity_from_previously_unseen_country_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_provisioning_activity_from_previously_unseen_ip_address_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_provisioning_activity_from_previously_unseen_region_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[correlation_by_repository_and_risk_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[correlation_by_user_and_risk_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_aws_console_login_by_new_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_aws_console_login_by_user_from_new_city_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_aws_console_login_by_user_from_new_country_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_aws_console_login_by_user_from_new_region_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_new_open_s3_buckets_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_new_open_s3_buckets_over_aws_cli_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_shared_ec2_snapshot_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[github_commit_changes_in_master_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[github_commit_in_develop_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[github_dependabot_alert_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[github_pull_request_from_unknown_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gsuite_drive_share_in_external_email_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gsuite_email_suspicious_attachment_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gsuite_email_suspicious_subject_with_attachment_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gsuite_email_with_known_abuse_web_service_link_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gsuite_outbound_email_with_attachment_to_external_domain_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gsuite_suspicious_shared_file_name_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_nginx_ingress_lfi_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_nginx_ingress_rfi_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_scanner_image_pulling_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_add_app_role_assignment_grant_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_added_service_principal_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_bypass_mfa_via_trusted_ip_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_disable_mfa_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_excessive_authentication_failures_alert_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_excessive_sso_logon_errors_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_new_federated_domain_added_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_pst_export_alert_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_suspicious_admin_email_forwarding_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_suspicious_rights_delegation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_suspicious_user_email_forwarding_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[abnormally_high_aws_instances_launched_by_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[abnormally_high_aws_instances_launched_by_user___mltk_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[abnormally_high_aws_instances_terminated_by_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[abnormally_high_aws_instances_terminated_by_user___mltk_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_cloud_provisioning_from_previously_unseen_city_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_cloud_provisioning_from_previously_unseen_country_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_cloud_provisioning_from_previously_unseen_ip_address_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_cloud_provisioning_from_previously_unseen_region_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[clients_connecting_to_multiple_dns_servers_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_network_access_control_list_deleted_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_api_activity_from_users_without_mfa_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_aws_api_activities_from_unapproved_accounts_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_long_dns_txt_record_response_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_mimikatz_via_powershell_and_eventcode_4703_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_new_api_calls_from_user_roles_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_new_user_aws_console_login_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_spike_in_aws_api_activity_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_spike_in_network_acl_activity_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_spike_in_security_group_activity_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_usb_device_insertion_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_web_traffic_to_dynamic_domain_providers_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detection_of_dns_tunnels_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[dns_query_requests_resolved_by_unauthorized_dns_servers_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[dns_record_changed_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[dump_lsass_via_procdump_rename_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ec2_instance_modified_with_previously_unseen_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ec2_instance_started_in_previously_unseen_region_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ec2_instance_started_with_previously_unseen_ami_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ec2_instance_started_with_previously_unseen_instance_type_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ec2_instance_started_with_previously_unseen_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[execution_of_file_with_spaces_before_extension_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[extended_period_without_successful_netbackup_backups_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[first_time_seen_command_line_argument_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gcp_detect_accounts_with_high_risk_roles_by_project_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gcp_detect_high_risk_permissions_by_resource_and_account_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gcp_detect_oauth_token_abuse_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gcp_gcr_container_uploaded_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gcp_kubernetes_cluster_scan_detection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[identify_new_user_accounts_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_aws_detect_most_active_service_accounts_by_pod_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_aws_detect_rbac_authorization_by_account_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_eks_kubernetes_cluster_sensitive_object_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_aws_detect_sensitive_role_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_azure_active_service_accounts_by_pod_namespace_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_azure_detect_rbac_authorization_by_account_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_azure_detect_sensitive_object_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_azure_detect_sensitive_role_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_azure_detect_suspicious_kubectl_calls_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_azure_pod_scan_fingerprint_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_azure_scan_fingerprint_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_gcp_detect_rbac_authorizations_by_account_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_gcp_detect_sensitive_object_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_gcp_detect_sensitive_role_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_gcp_detect_service_accounts_forbidden_failure_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_gcp_detect_suspicious_kubectl_calls_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[monitor_dns_for_brand_abuse_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[open_redirect_in_splunk_web_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[osquery_pack___coldroot_detection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[processes_created_by_netsh_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[prohibited_software_on_endpoint_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[reg_exe_used_to_hide_files_directories_via_registry_keys_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_registry_key_modifications_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[scheduled_tasks_used_in_badrabbit_ransomware_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[spectre_and_meltdown_vulnerable_systems_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[splunk_enterprise_information_disclosure_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_changes_to_file_associations_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_email___uba_anomaly_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_file_write_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_powershell_command_line_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_rundll32_rename_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_writes_to_system_volume_information_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[uncommon_processes_on_endpoint_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unsigned_image_loaded_by_lsass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unsuccessful_netbackup_backups_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[web_fraud___account_harvesting_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[web_fraud___anomalous_user_clickspeed_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[web_fraud___password_sharing_across_accounts_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_connhost_exe_started_forcefully_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_hosts_file_modification_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[7zip_commandline_to_smb_share_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[access_lsass_memory_for_dump_creation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[account_discovery_with_net_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[active_setup_registry_autostart_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[add_defaultuser_and_password_in_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[add_or_set_windows_defender_exclusion_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[adsisearcher_account_discovery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[allow_file_and_printing_sharing_in_firewall_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[allow_inbound_traffic_by_firewall_rule_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[allow_inbound_traffic_in_firewall_rule_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[allow_network_discovery_in_firewall_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[allow_operation_with_consent_admin_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[anomalous_usage_of_7zip_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[any_powershell_downloadfile_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[any_powershell_downloadstring_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[attacker_tools_on_endpoint_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[attempt_to_add_certificate_to_untrusted_store_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[attempt_to_stop_security_service_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[attempted_credential_dump_from_registry_via_reg_exe_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[auto_admin_logon_registry_entry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[batch_file_write_to_system32_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[bcdedit_command_back_to_normal_mode_boot_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[bcdedit_failure_recovery_modification_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[bits_job_persistence_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[bitsadmin_download_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[certutil_download_with_urlcache_and_split_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[certutil_download_with_verifyctl_and_split_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[certutil_exe_certificate_extraction_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[certutil_with_decode_argument_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[change_default_file_association_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[change_to_safe_mode_with_network_config_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[chcp_command_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[check_elevated_cmd_using_whoami_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[clear_unallocated_sector_using_cipher_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[clop_common_exec_parameter_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[clop_ransomware_known_service_name_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cmd_carry_out_string_command_parameter_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cmd_echo_pipe___escalation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cmdline_tool_not_executed_in_cmd_shell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cmlua_or_cmstplua_uac_bypass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cobalt_strike_named_pipes_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[common_ransomware_extensions_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[common_ransomware_notes_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[conti_common_exec_parameter_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[control_loading_from_world_writable_directory_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[create_local_admin_accounts_using_net_exe_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[create_or_delete_windows_shares_using_net_exe_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[create_remote_thread_in_shell_application_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[create_remote_thread_into_lsass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[creation_of_lsass_dump_with_taskmgr_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[creation_of_shadow_copy_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[creation_of_shadow_copy_with_wmic_and_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[credential_dumping_via_copy_command_from_shadow_copy_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[credential_dumping_via_symlink_to_shadow_copy_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[csc_net_on_the_fly_compilation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[curl_download_and_bash_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[delete_shadowcopy_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[deleting_of_net_users_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[deleting_shadow_copies_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_activity_related_to_pass_the_hash_attacks_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_azurehound_command_line_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_azurehound_file_modifications_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_copy_of_shadowcopy_with_script_block_logging_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_credential_dumping_through_lsass_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_empire_with_powershell_script_block_logging_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_excessive_account_lockouts_from_endpoint_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_excessive_user_account_lockouts_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_exchange_web_shell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_html_help_renamed_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_html_help_spawn_child_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_html_help_url_in_command_line_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_html_help_using_infotech_storage_handlers_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_mimikatz_using_loaded_images_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_mimikatz_with_powershell_script_block_logging_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_mshta_inline_hta_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_mshta_renamed_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_mshta_url_in_command_line_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_new_local_admin_account_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_path_interception_by_creation_of_program_exe_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_processes_used_for_system_network_configuration_discovery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_prohibited_applications_spawning_cmd_exe_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_psexec_with_accepteula_flag_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_rclone_command_line_usage_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_regasm_spawning_a_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_regasm_with_network_connection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_regasm_with_no_command_line_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_regsvcs_spawning_a_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_regsvcs_with_network_connection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_regsvcs_with_no_command_line_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_regsvr32_application_control_bypass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_renamed_7_zip_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_renamed_psexec_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_renamed_rclone_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_renamed_winrar_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_rundll32_application_control_bypass___advpack_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_rundll32_application_control_bypass___setupapi_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_rundll32_application_control_bypass___syssetup_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_rundll32_inline_hta_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_sharphound_command_line_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_sharphound_file_modifications_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_sharphound_usage_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_use_of_cmd_exe_to_launch_script_interpreters_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_wmi_event_subscription_persistence_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_amsi_through_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_defender_antivirus_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_defender_blockatfirstseen_feature_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_defender_enhanced_notification_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_defender_mpengine_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_defender_spynet_reporting_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_defender_submit_samples_consent_feature_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_etw_through_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_logs_using_wevtutil_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_registry_tool_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_schedule_task_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_security_logs_using_minint_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_show_hidden_files_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_uac_remote_restriction_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_windows_app_hotkeys_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_windows_behavior_monitoring_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_windows_smartscreen_protection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabled_kerberos_pre_authentication_discovery_with_powerview_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabling_cmd_application_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabling_controlpanel_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabling_defender_services_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabling_firewall_with_netsh_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabling_folderoptions_windows_feature_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabling_net_user_account_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabling_norun_windows_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabling_remote_user_account_control_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabling_systemrestore_in_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabling_task_manager_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[dllhost_with_no_command_line_arguments_with_network_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[dns_exfiltration_using_nslookup_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[domain_account_discovery_with_dsquery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[domain_account_discovery_with_net_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[domain_account_discovery_with_wmic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[domain_controller_discovery_with_nltest_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[domain_controller_discovery_with_wmic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[domain_group_discovery_with_adsisearcher_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[domain_group_discovery_with_dsquery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[domain_group_discovery_with_net_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[domain_group_discovery_with_wmic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[download_files_using_telegram_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[drop_icedid_license_dat_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[dsquery_domain_discovery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[dump_lsass_via_comsvcs_dll_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[dump_lsass_via_procdump_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[elevated_group_discovery_with_net_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[elevated_group_discovery_with_powerview_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[elevated_group_discovery_with_wmic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[enable_rdp_in_other_port_number_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[enable_wdigest_uselogoncredential_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[enumerate_users_local_group_using_telegram_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[esentutl_sam_copy_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[etw_registry_disabled_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[eventvwr_uac_bypass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excel_spawning_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excel_spawning_windows_script_host_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_attempt_to_disable_services_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_distinct_processes_from_windows_temp_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_file_deletion_in_windefender_folder_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_number_of_service_control_start_as_disabled_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_number_of_taskhost_processes_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_service_stop_attempt_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_usage_of_cacls_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_usage_of_net_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_usage_of_nslookup_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_usage_of_sc_service_utility_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_usage_of_taskkill_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[executable_file_written_in_administrative_smb_share_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[executables_or_script_creation_in_suspicious_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[execute_javascript_with_jscript_com_clsid_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[execution_of_file_with_multiple_extensions_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[extraction_of_registry_hives_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[file_with_samsam_extension_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[firewall_allowed_program_enable_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[fodhelper_uac_bypass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[fsutil_zeroing_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_addefaultdomainpasswordpolicy_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_aduser_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_aduser_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_aduserresultantpasswordpolicy_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_aduserresultantpasswordpolicy_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_domainpolicy_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_domainpolicy_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_domaintrust_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_domaintrust_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_domainuser_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_domainuser_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_foresttrust_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_foresttrust_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_wmiobject_group_discovery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_wmiobject_group_discovery_with_script_block_logging_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getadcomputer_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getadcomputer_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getadgroup_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getadgroup_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getcurrent_user_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getcurrent_user_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getdomaincomputer_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getdomaincomputer_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getdomaincontroller_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getdomaincontroller_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getdomaingroup_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getdomaingroup_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getlocaluser_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getlocaluser_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getnettcpconnection_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getnettcpconnection_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getwmiobject_ds_computer_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getwmiobject_ds_computer_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getwmiobject_ds_group_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getwmiobject_ds_group_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getwmiobject_ds_user_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getwmiobject_ds_user_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getwmiobject_user_account_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getwmiobject_user_account_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gpupdate_with_no_command_line_arguments_with_network_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[hide_user_account_from_sign_in_screen_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[hiding_files_and_directories_with_attrib_exe_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[high_frequency_copy_of_files_in_network_share_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[high_process_termination_frequency_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[hunting_for_log4shell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[icacls_deny_command_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[icacls_grant_command_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[icedid_exfiltrated_archived_file_creation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[impacket_lateral_movement_commandline_parameters_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[interactive_session_on_remote_endpoint_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[java_class_file_download_by_java_user_agent_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[jscript_execution_using_cscript_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kerberoasting_spn_request_with_rc4_encryption_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kerberos_pre_authentication_flag_disabled_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[known_services_killed_by_ransomware_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_add_files_in_known_crontab_directories_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_add_user_account_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_at_allow_config_file_creation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_at_application_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_change_file_owner_to_root_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_common_process_for_elevation_control_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_dd_file_overwrite_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_doas_conf_file_creation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_doas_tool_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_edit_cron_table_parameter_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_file_created_in_kernel_driver_directory_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_file_creation_in_init_boot_directory_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_file_creation_in_profile_directory_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_insert_kernel_module_using_insmod_utility_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_install_kernel_module_using_modprobe_utility_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_java_spawning_shell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_nopasswd_entry_in_sudoers_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_pkexec_privilege_escalation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_possible_access_or_modification_of_sshd_config_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_possible_access_to_credential_files_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_possible_access_to_sudoers_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_possible_append_command_to_at_allow_config_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_possible_append_command_to_profile_config_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_possible_cronjob_modification_with_editor_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_possible_ssh_key_file_creation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_preload_hijack_library_calls_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_service_file_created_in_systemd_directory_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_service_restarted_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_service_started_or_enabled_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_setuid_using_chmod_utility_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_setuid_using_setcap_utility_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_sudo_or_su_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_sudoers_tmp_file_creation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_system_network_discovery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_visudo_utility_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[loading_of_dynwrapx_module_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[local_account_discovery_with_net_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[local_account_discovery_with_wmic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[log4shell_cve_2021_44228_exploitation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[logon_script_event_trigger_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[macos_lolbin_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[mailsniper_invoke_functions_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[malicious_inprocserver32_modification_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[malicious_powershell_executed_as_a_service_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[malicious_powershell_process___encoded_command_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[malicious_powershell_process___execution_policy_bypass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[malicious_powershell_process_with_obfuscation_techniques_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[mimikatz_passtheticket_commandline_parameters_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[mmc_lolbas_execution_process_spawn_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[modification_of_wallpaper_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[modify_acl_permission_to_files_or_folder_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[monitor_registry_keys_for_print_monitors_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ms_scripting_process_loading_ldap_module_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ms_scripting_process_loading_wmi_module_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[msbuild_suspicious_spawned_by_script_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[mshta_spawning_rundll32_or_regsvr32_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[mshtml_module_load_in_office_product_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[msi_module_loaded_by_non_system_binary_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[msmpeng_application_dll_side_loading_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[multiple_users_failing_to_authenticate_from_host_using_kerberos_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[multiple_users_failing_to_authenticate_from_host_using_ntlm_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[multiple_users_failing_to_authenticate_from_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[multiple_users_remotely_failing_to_authenticate_from_host_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[net_localgroup_discovery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[net_profiler_uac_bypass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[network_connection_discovery_with_arp_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[network_connection_discovery_with_net_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[network_connection_discovery_with_netstat_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[network_discovery_using_route_windows_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[nishang_powershelltcponeline_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[nltest_domain_trust_discovery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[non_chrome_process_accessing_chrome_default_dir_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[non_firefox_process_access_firefox_profile_dir_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ntdsutil_export_ntds_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_application_drop_executable_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_application_spawn_regsvr32_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_application_spawn_rundll32_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_document_creating_schedule_task_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_document_executing_macro_code_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_document_spawned_child_process_to_download_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_product_spawn_cmd_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_product_spawning_bitsadmin_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_product_spawning_certutil_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_product_spawning_mshta_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_product_spawning_rundll32_with_no_dll_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_product_spawning_wmic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_product_writing_cab_or_inf_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_spawning_control_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[outbound_network_connection_from_java_using_default_ports_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[overwriting_accessibility_binaries_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[password_policy_discovery_with_net_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[permission_modification_using_takeown_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[petitpotam_network_share_access_request_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[petitpotam_suspicious_kerberos_tgt_request_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ping_sleep_batch_command_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[possible_browser_pass_view_parameter_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[possible_lateral_movement_powershell_spawn_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[potentially_malicious_code_on_commandline_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_4104_hunting_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell___connect_to_internet_with_hidden_window_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_creating_thread_mutex_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_disable_security_monitoring_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_domain_enumeration_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_enable_smb1protocol_feature_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_execute_com_object_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_fileless_process_injection_via_getprocaddress_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_fileless_script_contains_base64_encoded_content_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_get_localgroup_discovery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_get_localgroup_discovery_with_script_block_logging_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_loading_dotnet_into_memory_via_reflection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_processing_stream_of_data_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_remote_thread_to_known_windows_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_remove_windows_defender_directory_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_start_bitstransfer_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_using_memory_as_backing_store_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_windows_defender_exclusion_commands_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[prevent_automatic_repair_mode_using_bcdedit_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[print_spooler_adding_a_printer_driver_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[print_spooler_failed_to_load_a_plug_in_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[process_creating_lnk_file_in_suspicious_location_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[process_deleting_its_process_file_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[process_execution_via_wmi_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[process_kill_base_on_file_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[process_writing_dynamicwrapperx_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[processes_launching_netsh_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ransomware_notes_bulk_creation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[recon_avproduct_through_pwh_or_wmi_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[recon_using_wmi_class_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[recursive_delete_of_directory_in_batch_cmd_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[reg_exe_manipulating_windows_services_registry_keys_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[registry_keys_for_creating_shim_databases_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[registry_keys_used_for_persistence_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[registry_keys_used_for_privilege_escalation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[regsvr32_silent_and_install_param_dll_loading_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[regsvr32_with_known_silent_switch_cmdline_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remcos_client_registry_install_entry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remcos_rat_file_creation_in_remcos_folder_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_process_instantiation_via_dcom_and_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_process_instantiation_via_dcom_and_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_process_instantiation_via_winrm_and_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_process_instantiation_via_winrm_and_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_process_instantiation_via_winrm_and_winrs_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_process_instantiation_via_wmi_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_process_instantiation_via_wmi_and_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_process_instantiation_via_wmi_and_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_system_discovery_with_adsisearcher_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_system_discovery_with_dsquery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_system_discovery_with_net_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_system_discovery_with_wmic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_wmi_command_attempt_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[resize_shadowstorage_volume_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[revil_common_exec_parameter_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[revil_registry_entry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rubeus_command_line_parameters_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rubeus_kerberos_ticket_exports_through_winlogon_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[runas_execution_in_commandline_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rundll32_control_rundll_hunt_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rundll32_control_rundll_world_writable_directory_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rundll32_create_remote_thread_to_a_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rundll32_createremotethread_in_browser_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rundll32_dnsquery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rundll32_process_creating_exe_dll_files_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rundll32_shimcache_flush_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rundll32_with_no_command_line_arguments_with_network_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rundll_loading_dll_by_ordinal_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ryuk_test_files_detected_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ryuk_wake_on_lan_command_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[sam_database_file_access_attempt_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[samsam_test_file_write_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[sc_exe_manipulating_windows_services_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[schcache_change_by_app_connect_and_create_adsi_object_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[schedule_task_with_http_command_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[schedule_task_with_rundll32_command_trigger_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[scheduled_task_creation_on_remote_endpoint_using_at_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[scheduled_task_deleted_or_created_via_cmd_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[scheduled_task_initiation_on_remote_endpoint_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[schtasks_run_task_on_demand_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[schtasks_scheduling_job_on_remote_system_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[schtasks_used_for_forcing_a_reboot_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[screensaver_event_trigger_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[script_execution_via_wmi_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[sdclt_uac_bypass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[sdelete_application_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[searchprotocolhost_with_no_command_line_with_network_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[secretdumps_offline_ntds_dumping_tool_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[serviceprincipalnames_discovery_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[serviceprincipalnames_discovery_with_setspn_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[services_escalate_exe_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[services_lolbas_execution_process_spawn_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[shim_database_file_creation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[shim_database_installation_with_suspicious_parameters_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[short_lived_scheduled_task_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[short_lived_windows_accounts_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[silentcleanup_uac_bypass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[single_letter_process_on_endpoint_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[slui_runas_elevated_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[slui_spawning_a_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[spoolsv_spawning_rundll32_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[spoolsv_suspicious_loaded_modules_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[spoolsv_suspicious_process_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[spoolsv_writing_a_dll_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[spoolsv_writing_a_dll___sysmon_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[sqlite_module_in_temp_folder_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[start_up_during_safe_mode_boot_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_computer_account_name_change_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_copy_on_system32_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_dllhost_no_command_line_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_driver_loaded_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_event_log_service_behavior_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_gpupdate_no_command_line_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_icedid_rundll32_cmdline_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_image_creation_in_appdata_folder_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_kerberos_service_ticket_request_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_linux_discovery_commands_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_microsoft_workflow_compiler_rename_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_microsoft_workflow_compiler_usage_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_msbuild_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_msbuild_rename_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_msbuild_spawn_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_mshta_child_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_mshta_spawn_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_process_dns_query_known_abuse_web_services_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_process_file_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_process_with_discord_dns_query_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_reg_exe_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_regsvr32_register_suspicious_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_rundll32_dllregisterserver_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_rundll32_plugininit_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_rundll32_startw_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_rundll32_no_command_line_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_scheduled_task_from_public_directory_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_searchprotocolhost_no_command_line_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_ticket_granting_ticket_request_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_wav_file_in_appdata_folder_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_wevtutil_usage_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_writes_to_windows_recycle_bin_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[svchost_lolbas_execution_process_spawn_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[system_info_gathering_using_dxdiag_application_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[system_information_discovery_detection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[system_processes_run_from_unexpected_locations_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[system_user_discovery_with_query_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[system_user_discovery_with_whoami_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[time_provider_persistence_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[trickbot_named_pipe_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[uac_bypass_mmc_load_unsigned_dll_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[uac_bypass_with_colorui_com_object_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unified_messaging_service_spawning_a_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[uninstall_app_using_msiexec_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unload_sysmon_filter_driver_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unloading_amsi_via_reflection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unusual_number_of_kerberos_service_tickets_requested_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[user_discovery_with_env_vars_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[user_discovery_with_env_vars_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[usn_journal_deletion_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[vbscript_execution_using_wscript_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[verclsid_clsid_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[w3wp_spawning_shell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wbadmin_delete_system_backups_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wbemprox_com_object_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wermgr_process_connecting_to_ip_check_web_services_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wermgr_process_create_executable_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wermgr_process_spawned_cmd_or_powershell_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wget_download_and_bash_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_adfind_exe_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_curl_download_to_suspicious_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_curl_upload_to_remote_destination_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_defender_exclusion_registry_entry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_disable_change_password_through_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_disable_lock_workstation_feature_through_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_disable_logoff_button_through_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_disable_memory_crash_dump_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_disable_notification_center_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_disable_shutdown_button_through_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_disable_windows_group_policy_features_through_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_disableantispyware_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_disabled_users_failing_to_authenticate_kerberos_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_diskcryptor_usage_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_diskshadow_proxy_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_dism_remove_defender_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_dotnet_binary_in_non_standard_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_event_for_service_disabled_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_event_log_cleared_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_excessive_disabled_services_event_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_file_without_extension_in_critical_folder_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_hide_notification_features_through_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_high_file_deletion_frequency_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_hunting_system_account_targeting_lsass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_installutil_credential_theft_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_installutil_in_non_standard_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_installutil_remote_network_connection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_installutil_uninstall_option_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_installutil_uninstall_option_with_network_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_installutil_url_in_command_line_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_invalid_users_failed_authentication_via_kerberos_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_modify_show_compress_color_and_info_tip_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_nirsoft_advancedrun_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_nirsoft_utilities_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_non_system_account_targeting_lsass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_possible_credential_dumping_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_process_with_namedpipe_commandline_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_raccine_scheduled_task_deletion_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_rasautou_dll_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_raw_access_to_disk_volume_partition_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_raw_access_to_master_boot_record_drive_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_remote_assistance_spawning_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_schtasks_create_run_as_system_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_security_account_manager_stopped_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_service_created_with_suspicious_service_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_service_created_within_public_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_service_creation_on_remote_endpoint_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_service_creation_using_registry_entry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_service_initiation_on_remote_endpoint_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_users_authenticate_using_explicit_credentials_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_wmi_process_call_create_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[winevent_scheduled_task_created_to_spawn_shell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[winevent_scheduled_task_created_within_public_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[winevent_windows_task_scheduler_event_action_started_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[winhlp32_spawning_a_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[winword_spawning_cmd_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[winword_spawning_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[winword_spawning_windows_script_host_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wmi_permanent_event_subscription___sysmon_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wmi_recon_running_process_or_services_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wmic_group_discovery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wmic_noninteractive_app_uninstallation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wmic_xsl_execution_via_url_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wmiprsve_lolbas_execution_process_spawn_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wscript_or_cscript_suspicious_child_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wsmprovhost_lolbas_execution_process_spawn_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wsreset_uac_bypass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[xmrig_driver_loaded_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[xsl_script_execution_with_wmic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_new_login_attempts_to_routers_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[email_attachments_with_lots_of_spaces_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[email_files_written_outside_of_the_outlook_directory_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[email_servers_sending_high_volume_traffic_to_hosts_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[monitor_email_for_brand_abuse_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[no_windows_updates_in_a_time_frame_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[okta_account_lockout_events_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[okta_failed_sso_attempts_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[okta_user_logins_from_multiple_cities_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_email_attachment_extensions_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_java_classes_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[web_servers_executing_suspicious_processes_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[abnormally_high_number_of_cloud_instances_destroyed_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[abnormally_high_number_of_cloud_instances_launched_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[amazon_eks_kubernetes_cluster_scan_detection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[amazon_eks_kubernetes_pod_scan_detection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_detect_attach_to_role_policy_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_detect_permanent_key_creation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_detect_role_creation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_detect_sts_assume_role_abuse_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_detect_sts_get_session_token_abuse_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_gcp_storage_access_from_a_new_ip_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_new_open_gcp_storage_buckets_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_s3_access_from_a_new_ip_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_spike_in_aws_security_hub_alerts_for_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_spike_in_blocked_outbound_traffic_from_your_aws_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_spike_in_s3_bucket_deletion_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gcp_detect_gcploit_framework_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gcp_kubernetes_cluster_pod_scan_detection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gdrive_suspicious_file_sharing_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gsuite_suspicious_calendar_invite_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[high_number_of_login_failures_from_a_single_source_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_aws_detect_suspicious_kubectl_calls_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[new_container_uploaded_to_aws_ecr_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[child_processes_of_spoolsv_exe_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_baron_samedit_cve_2021_3156_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_baron_samedit_cve_2021_3156_segfault_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_baron_samedit_cve_2021_3156_via_osquery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_computer_changed_with_anonymous_account_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_outlook_exe_writing_a_zip_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_rare_executables_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detection_of_tools_built_by_nirsoft_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[exchange_powershell_abuse_via_ssrf_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[exchange_powershell_module_usage_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[first_time_seen_child_process_of_zoom_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[first_time_seen_running_windows_service_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[macos___re_opened_applications_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ms_exchange_mailbox_replication_service_writing_active_server_pages_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[print_processor_registry_autostart_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[processes_tapping_keyboard_events_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[randomly_generated_scheduled_task_name_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[randomly_generated_windows_service_name_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_desktop_process_running_on_system_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[spike_in_file_writes_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[sunburst_correlation_dll_and_network_event_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_curl_network_connection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_plistbuddy_usage_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_plistbuddy_usage_via_osquery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_sqlite3_lsquarantine_behavior_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unusual_number_of_computer_service_tickets_requested_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unusual_number_of_remote_endpoint_authentication_events_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unusually_long_command_line_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unusually_long_command_line___mltk_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_java_spawning_shells_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[winrm_spawning_a_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wmi_permanent_event_subscription_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wmi_temporary_event_subscription_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_arp_poisoning_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_ipv6_network_infrastructure_threats_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_large_outbound_icmp_packets_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_outbound_smb_traffic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_port_security_violation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_rogue_dhcp_server_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_snicat_sni_exfiltration_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_software_download_to_network_device_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_traffic_mirroring_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_unauthorized_assets_by_mac_address_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_windows_dns_sigred_via_splunk_stream_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_windows_dns_sigred_via_zeek_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_zerologon_via_zeek_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[dns_query_length_outliers___mltk_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_dns_failures_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[hosts_receiving_high_volume_of_network_traffic_from_email_server_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[large_volume_of_dns_any_queries_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[prohibited_network_traffic_allowed_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[protocol_or_port_mismatch_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[protocols_passing_authentication_in_cleartext_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_desktop_network_bruteforce_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_desktop_network_traffic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[smb_traffic_spike_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[smb_traffic_spike___mltk_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[tor_traffic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unusually_long_content_type_length_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_attackers_scanning_for_vulnerable_jboss_servers_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_f5_tmui_rce_cve_2020_5902_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_malicious_requests_to_exploit_jboss_servers_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[monitor_web_traffic_for_brand_abuse_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[sql_injection_with_long_urls_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[supernova_webshell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_hosts_connecting_to_dynamic_domain_providers_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_outbound_ldap_traffic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[dns_query_length_with_high_standard_deviation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[multiple_archive_files_http_post_traffic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[plain_http_post_exfiltrated_data_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[log4shell_jndi_payload_injection_attempt_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[log4shell_jndi_payload_injection_with_outbound_connection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - [aws_cloudwatchlogs_eks] definition = sourcetype="aws:cloudwatchlogs:eks" @@ -3538,10 +206,6 @@ description = customer specific splunk configurations(eg- index, source, sourcet definition = eventtype=okta_log description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. -[osquery] -definition = sourcetype=osquery:results -description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. - [osquery_process] definition = eventtype="osquery-process" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. @@ -3883,3 +547,3751 @@ description = customer specific splunk configurations(eg- index, source, sourcet definition = index=zeek sourcetype="zeek:ssl:json" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +[7zip_commandline_to_smb_share_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_cloud_provisioning_from_previously_unseen_city_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_cloud_provisioning_from_previously_unseen_country_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_cloud_provisioning_from_previously_unseen_ip_address_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_cloud_provisioning_from_previously_unseen_region_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_create_policy_version_to_allow_all_resources_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_createaccesskey_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_createloginprofile_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_cross_account_activity_from_previously_unseen_account_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_detect_users_with_kms_keys_performing_encryption_s3_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_ecr_container_scanning_findings_high_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_ecr_container_scanning_findings_low_informational_unknown_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_ecr_container_scanning_findings_medium_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_ecr_container_upload_outside_business_hours_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_ecr_container_upload_unknown_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_eks_kubernetes_cluster_sensitive_object_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_excessive_security_scanning_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_iam_accessdenied_discovery_events_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_iam_assume_role_policy_brute_force_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_iam_delete_policy_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_iam_failure_group_deletion_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_iam_successful_group_deletion_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_investigate_security_hub_alerts_by_dest_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_investigate_user_activities_by_arn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_investigate_user_activities_by_accesskeyid_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_lambda_updatefunctioncode_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_network_acl_details_from_id_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_network_access_control_list_created_with_all_open_ports_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_network_access_control_list_deleted_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_network_interface_details_via_resourceid_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_s3_bucket_details_via_bucketname_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_saml_access_by_provider_user_and_principal_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_saml_update_identity_provider_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_setdefaultpolicyversion_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_updateloginprofile_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[abnormally_high_aws_instances_launched_by_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[abnormally_high_aws_instances_launched_by_user___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[abnormally_high_aws_instances_terminated_by_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[abnormally_high_aws_instances_terminated_by_user___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[abnormally_high_number_of_cloud_infrastructure_api_calls_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[abnormally_high_number_of_cloud_instances_destroyed_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[abnormally_high_number_of_cloud_instances_launched_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[abnormally_high_number_of_cloud_security_group_api_calls_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[access_lsass_memory_for_dump_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[account_discovery_with_net_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[active_setup_registry_autostart_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[add_defaultuser_and_password_in_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[add_prohibited_processes_to_enterprise_security_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[add_or_set_windows_defender_exclusion_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[adsisearcher_account_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[all_backup_logs_for_host_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[allow_file_and_printing_sharing_in_firewall_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[allow_inbound_traffic_by_firewall_rule_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[allow_inbound_traffic_in_firewall_rule_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[allow_network_discovery_in_firewall_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[allow_operation_with_consent_admin_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[amazon_eks_kubernetes_pod_scan_detection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[amazon_eks_kubernetes_activity_by_src_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[amazon_eks_kubernetes_cluster_scan_detection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[anomalous_usage_of_7zip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[any_powershell_downloadfile_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[any_powershell_downloadstring_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[attacker_tools_on_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[attempt_to_add_certificate_to_untrusted_store_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[attempt_to_stop_security_service_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[attempted_credential_dump_from_registry_via_reg_exe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[auto_admin_logon_registry_entry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[bcdedit_failure_recovery_modification_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[bits_job_persistence_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[bitsadmin_download_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_cloud_infrastructure_api_calls_per_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_cloud_instances_destroyed_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_cloud_instances_launched_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_cloud_security_group_api_calls_per_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_api_calls_per_user_arn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_command_line_length___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_dns_query_length___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_excessive_aws_instances_launched_by_user___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_excessive_aws_instances_terminated_by_user___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_network_acl_activity_by_arn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_s3_bucket_deletion_activity_by_arn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_smb_traffic___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_security_group_activity_by_arn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_blocked_outbound_traffic_from_aws_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[batch_file_write_to_system32_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[bcdedit_command_back_to_normal_mode_boot_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[chcp_command_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cmd_carry_out_string_command_parameter_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cmd_echo_pipe___escalation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cmlua_or_cmstplua_uac_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[csc_net_on_the_fly_compilation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[certutil_download_with_urlcache_and_split_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[certutil_download_with_verifyctl_and_split_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[certutil_with_decode_argument_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[certutil_exe_certificate_extraction_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[change_default_file_association_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[change_to_safe_mode_with_network_config_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[check_elevated_cmd_using_whoami_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[child_processes_of_spoolsv_exe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[circle_ci_disable_security_job_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[circle_ci_disable_security_step_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[clear_unallocated_sector_using_cipher_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[clients_connecting_to_multiple_dns_servers_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[clop_common_exec_parameter_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[clop_ransomware_known_service_name_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_api_calls_from_previously_unseen_user_roles_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_compute_instance_created_by_previously_unseen_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_compute_instance_created_in_previously_unused_region_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_compute_instance_created_with_previously_unseen_image_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_compute_instance_created_with_previously_unseen_instance_type_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_instance_modified_by_previously_unseen_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_network_access_control_list_deleted_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_provisioning_activity_from_previously_unseen_city_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_provisioning_activity_from_previously_unseen_country_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_provisioning_activity_from_previously_unseen_ip_address_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_provisioning_activity_from_previously_unseen_region_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cmdline_tool_not_executed_in_cmd_shell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cobalt_strike_named_pipes_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[common_ransomware_extensions_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[common_ransomware_notes_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[conti_common_exec_parameter_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[control_loading_from_world_writable_directory_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[correlation_by_repository_and_risk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[correlation_by_user_and_risk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[count_of_unique_ips_connecting_to_ports_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[count_of_assets_by_category_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[create_remote_thread_in_shell_application_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[create_remote_thread_into_lsass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[create_a_list_of_approved_aws_service_accounts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[create_local_admin_accounts_using_net_exe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[create_or_delete_windows_shares_using_net_exe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[creation_of_shadow_copy_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[creation_of_shadow_copy_with_wmic_and_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[creation_of_lsass_dump_with_taskmgr_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[credential_dumping_via_copy_command_from_shadow_copy_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[credential_dumping_via_symlink_to_shadow_copy_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[curl_download_and_bash_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dllhost_with_no_command_line_arguments_with_network_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dns_exfiltration_using_nslookup_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dns_query_length_outliers___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dns_query_length_with_high_standard_deviation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dns_query_requests_resolved_by_unauthorized_dns_servers_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dns_record_changed_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dnstwist_domain_names_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dsquery_domain_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[delete_shadowcopy_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[deleting_of_net_users_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[deleting_shadow_copies_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_api_activity_from_users_without_mfa_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_arp_poisoning_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_aws_api_activities_from_unapproved_accounts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_aws_console_login_by_new_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_aws_console_login_by_user_from_new_city_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_aws_console_login_by_user_from_new_country_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_aws_console_login_by_user_from_new_region_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_activity_related_to_pass_the_hash_attacks_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_azurehound_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_azurehound_file_modifications_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_baron_samedit_cve_2021_3156_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_baron_samedit_cve_2021_3156_segfault_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_baron_samedit_cve_2021_3156_via_osquery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_computer_changed_with_anonymous_account_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_copy_of_shadowcopy_with_script_block_logging_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_credential_dumping_through_lsass_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_empire_with_powershell_script_block_logging_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_excessive_account_lockouts_from_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_excessive_user_account_lockouts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_exchange_web_shell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_f5_tmui_rce_cve_2020_5902_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_gcp_storage_access_from_a_new_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_html_help_renamed_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_html_help_spawn_child_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_html_help_url_in_command_line_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_html_help_using_infotech_storage_handlers_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_ipv6_network_infrastructure_threats_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_large_outbound_icmp_packets_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_long_dns_txt_record_response_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_mshta_url_in_command_line_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_mimikatz_using_loaded_images_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_mimikatz_via_powershell_and_eventcode_4703_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_mimikatz_with_powershell_script_block_logging_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_new_local_admin_account_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_new_login_attempts_to_routers_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_new_open_gcp_storage_buckets_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_new_open_s3_buckets_over_aws_cli_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_new_open_s3_buckets_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_outbound_ldap_traffic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_outbound_smb_traffic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_outlook_exe_writing_a_zip_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_path_interception_by_creation_of_program_exe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_port_security_violation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_prohibited_applications_spawning_cmd_exe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_psexec_with_accepteula_flag_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_rclone_command_line_usage_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_rare_executables_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_regasm_spawning_a_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_regasm_with_network_connection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_regasm_with_no_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_regsvcs_spawning_a_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_regsvcs_with_network_connection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_regsvcs_with_no_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_regsvr32_application_control_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_renamed_7_zip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_renamed_psexec_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_renamed_rclone_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_renamed_winrar_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_rogue_dhcp_server_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_rundll32_application_control_bypass___advpack_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_rundll32_application_control_bypass___setupapi_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_rundll32_application_control_bypass___syssetup_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_rundll32_inline_hta_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_s3_access_from_a_new_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_snicat_sni_exfiltration_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_sharphound_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_sharphound_file_modifications_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_sharphound_usage_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_software_download_to_network_device_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_spike_in_aws_api_activity_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_spike_in_aws_security_hub_alerts_for_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_spike_in_network_acl_activity_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_spike_in_s3_bucket_deletion_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_spike_in_security_group_activity_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_spike_in_blocked_outbound_traffic_from_your_aws_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_traffic_mirroring_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_usb_device_insertion_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_unauthorized_assets_by_mac_address_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_use_of_cmd_exe_to_launch_script_interpreters_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_wmi_event_subscription_persistence_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_windows_dns_sigred_via_splunk_stream_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_windows_dns_sigred_via_zeek_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_zerologon_via_zeek_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_attackers_scanning_for_vulnerable_jboss_servers_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_hosts_connecting_to_dynamic_domain_providers_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_malicious_requests_to_exploit_jboss_servers_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_mshta_inline_hta_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_mshta_renamed_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_new_api_calls_from_user_roles_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_new_user_aws_console_login_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_processes_used_for_system_network_configuration_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_shared_ec2_snapshot_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_web_traffic_to_dynamic_domain_providers_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detection_of_dns_tunnels_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detection_of_tools_built_by_nirsoft_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_amsi_through_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_defender_antivirus_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_defender_blockatfirstseen_feature_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_defender_enhanced_notification_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_defender_mpengine_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_defender_spynet_reporting_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_defender_submit_samples_consent_feature_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_etw_through_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_logs_using_wevtutil_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_registry_tool_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_schedule_task_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_security_logs_using_minint_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_show_hidden_files_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_uac_remote_restriction_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_windows_app_hotkeys_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_windows_behavior_monitoring_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_windows_smartscreen_protection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabled_kerberos_pre_authentication_discovery_with_powerview_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabling_cmd_application_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabling_controlpanel_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabling_defender_services_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabling_firewall_with_netsh_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabling_folderoptions_windows_feature_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabling_net_user_account_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabling_norun_windows_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabling_remote_user_account_control_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabling_systemrestore_in_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabling_task_manager_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[discover_dns_records_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_account_discovery_with_net_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_account_discovery_with_dsquery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_account_discovery_with_wmic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_controller_discovery_with_nltest_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_controller_discovery_with_wmic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_group_discovery_with_dsquery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_group_discovery_with_net_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_group_discovery_with_wmic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_group_discovery_with_adsisearcher_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[download_files_using_telegram_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[drop_icedid_license_dat_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dump_lsass_via_comsvcs_dll_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dump_lsass_via_procdump_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dump_lsass_via_procdump_rename_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ec2_instance_modified_with_previously_unseen_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ec2_instance_started_in_previously_unseen_region_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ec2_instance_started_with_previously_unseen_ami_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ec2_instance_started_with_previously_unseen_instance_type_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ec2_instance_started_with_previously_unseen_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[etw_registry_disabled_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[elevated_group_discovery_with_net_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[elevated_group_discovery_with_wmic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[elevated_group_discovery_with_powerview_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[email_attachments_with_lots_of_spaces_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[email_files_written_outside_of_the_outlook_directory_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[email_servers_sending_high_volume_traffic_to_hosts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[enable_rdp_in_other_port_number_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[enable_wdigest_uselogoncredential_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[enumerate_users_local_group_using_telegram_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[esentutl_sam_copy_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[eventvwr_uac_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excel_spawning_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excel_spawning_windows_script_host_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_attempt_to_disable_services_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_dns_failures_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_file_deletion_in_windefender_folder_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_service_stop_attempt_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_usage_of_cacls_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_usage_of_net_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_usage_of_sc_service_utility_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_usage_of_taskkill_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_usage_of_nslookup_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_number_of_service_control_start_as_disabled_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_number_of_taskhost_processes_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[exchange_powershell_abuse_via_ssrf_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[exchange_powershell_module_usage_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[executable_file_written_in_administrative_smb_share_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[executables_or_script_creation_in_suspicious_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[execute_javascript_with_jscript_com_clsid_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[execution_of_file_with_spaces_before_extension_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[execution_of_file_with_multiple_extensions_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[extended_period_without_successful_netbackup_backups_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[extraction_of_registry_hives_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[file_with_samsam_extension_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[firewall_allowed_program_enable_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[first_time_seen_child_process_of_zoom_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[first_time_seen_running_windows_service_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[first_time_seen_command_line_argument_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[fodhelper_uac_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[fsutil_zeroing_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gcp_detect_accounts_with_high_risk_roles_by_project_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gcp_detect_gcploit_framework_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gcp_detect_high_risk_permissions_by_resource_and_account_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gcp_gcr_container_uploaded_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gcp_kubernetes_activity_by_src_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gcp_kubernetes_cluster_pod_scan_detection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gcp_kubernetes_cluster_scan_detection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gpupdate_with_no_command_line_arguments_with_network_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gsuite_email_suspicious_attachment_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gdrive_suspicious_file_sharing_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_addefaultdomainpasswordpolicy_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_aduser_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_aduser_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_aduserresultantpasswordpolicy_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_aduserresultantpasswordpolicy_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_all_aws_activity_from_city_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_all_aws_activity_from_country_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_all_aws_activity_from_ip_address_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_all_aws_activity_from_region_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_backup_logs_for_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_certificate_logs_for_a_domain_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_dns_server_history_for_a_host_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_dns_traffic_ratio_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_domainpolicy_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_domainpolicy_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_domainuser_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_domainuser_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_ec2_instance_details_by_instanceid_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_ec2_launch_details_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_email_info_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_emails_from_specific_sender_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_first_occurrence_and_last_occurrence_of_a_mac_address_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_history_of_email_sources_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_logon_rights_modifications_for_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_logon_rights_modifications_for_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_notable_history_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_outbound_emails_to_hidden_cobra_threat_actors_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_parent_process_info_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_process_file_activity_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_process_info_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_process_information_for_port_activity_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_process_responsible_for_the_dns_traffic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_sysmon_wmi_activity_for_host_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_wmiobject_group_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_wmiobject_group_discovery_with_script_block_logging_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_web_session_information_via_session_id_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_domaintrust_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_domaintrust_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_foresttrust_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_foresttrust_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getadcomputer_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getadcomputer_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getadgroup_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getadgroup_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getcurrent_user_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getcurrent_user_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getdomaincomputer_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getdomaincomputer_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getdomaincontroller_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getdomaincontroller_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getdomaingroup_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getdomaingroup_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getlocaluser_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getlocaluser_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getnettcpconnection_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getnettcpconnection_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getwmiobject_ds_user_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getwmiobject_ds_user_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getwmiobject_ds_computer_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getwmiobject_ds_computer_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getwmiobject_ds_group_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getwmiobject_ds_group_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getwmiobject_user_account_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getwmiobject_user_account_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[github_dependabot_alert_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[github_pull_request_from_unknown_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[github_commit_changes_in_master_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[github_commit_in_develop_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gsuite_drive_share_in_external_email_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gsuite_email_suspicious_subject_with_attachment_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gsuite_email_with_known_abuse_web_service_link_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gsuite_outbound_email_with_attachment_to_external_domain_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gsuite_suspicious_shared_file_name_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gsuite_suspicious_calendar_invite_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[hide_user_account_from_sign_in_screen_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[hiding_files_and_directories_with_attrib_exe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[high_frequency_copy_of_files_in_network_share_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[high_number_of_login_failures_from_a_single_source_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[high_process_termination_frequency_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[hosts_receiving_high_volume_of_network_traffic_from_email_server_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[hunting_for_log4shell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[icacls_grant_command_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[icacls_deny_command_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[icedid_exfiltrated_archived_file_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[identify_new_user_accounts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[identify_systems_creating_remote_desktop_traffic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[identify_systems_receiving_remote_desktop_traffic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[identify_systems_using_remote_desktop_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[impacket_lateral_movement_commandline_parameters_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[interactive_session_on_remote_endpoint_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_aws_user_activities_by_user_field_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_aws_activities_via_region_name_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_failed_logins_for_multiple_destinations_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_network_traffic_from_src_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_okta_activity_by_ip_address_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_okta_activity_by_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_pass_the_hash_attempts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_pass_the_ticket_attempts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_previous_unseen_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_successful_remote_desktop_authentications_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_suspicious_strings_in_http_header_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_user_activities_in_okta_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_web_posts_from_src_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[java_class_file_download_by_java_user_agent_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[jscript_execution_using_cscript_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kerberoasting_spn_request_with_rc4_encryption_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kerberos_pre_authentication_flag_disabled_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[known_services_killed_by_ransomware_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_aws_detect_rbac_authorization_by_account_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_aws_detect_most_active_service_accounts_by_pod_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_aws_detect_sensitive_role_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_aws_detect_suspicious_kubectl_calls_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_azure_detect_rbac_authorization_by_account_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_azure_detect_sensitive_object_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_azure_detect_sensitive_role_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_azure_detect_suspicious_kubectl_calls_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_azure_pod_scan_fingerprint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_azure_scan_fingerprint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_gcp_detect_rbac_authorizations_by_account_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_gcp_detect_sensitive_object_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_gcp_detect_sensitive_role_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_gcp_detect_service_accounts_forbidden_failure_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_gcp_detect_suspicious_kubectl_calls_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_nginx_ingress_lfi_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_nginx_ingress_rfi_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_scanner_image_pulling_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[large_volume_of_dns_any_queries_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_add_files_in_known_crontab_directories_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_add_user_account_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_at_allow_config_file_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_at_application_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_change_file_owner_to_root_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_common_process_for_elevation_control_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_dd_file_overwrite_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_doas_conf_file_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_doas_tool_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_edit_cron_table_parameter_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_file_created_in_kernel_driver_directory_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_file_creation_in_init_boot_directory_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_file_creation_in_profile_directory_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_insert_kernel_module_using_insmod_utility_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_install_kernel_module_using_modprobe_utility_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_java_spawning_shell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_nopasswd_entry_in_sudoers_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_possible_access_or_modification_of_sshd_config_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_possible_access_to_credential_files_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_possible_access_to_sudoers_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_possible_append_command_to_at_allow_config_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_possible_append_command_to_profile_config_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_possible_cronjob_modification_with_editor_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_possible_ssh_key_file_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_preload_hijack_library_calls_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_service_file_created_in_systemd_directory_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_service_restarted_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_service_started_or_enabled_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_setuid_using_chmod_utility_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_setuid_using_setcap_utility_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_sudo_or_su_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_sudoers_tmp_file_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_system_network_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_visudo_utility_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_pkexec_privilege_escalation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[loading_of_dynwrapx_module_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[local_account_discovery_with_wmic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[local_account_discovery_with_net_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[log4shell_cve_2021_44228_exploitation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[log4shell_jndi_payload_injection_attempt_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[log4shell_jndi_payload_injection_with_outbound_connection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[logon_script_event_trigger_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ms_scripting_process_loading_ldap_module_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ms_scripting_process_loading_wmi_module_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[msbuild_suspicious_spawned_by_script_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[mshtml_module_load_in_office_product_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[msi_module_loaded_by_non_system_binary_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[macos___re_opened_applications_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[mailsniper_invoke_functions_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[malicious_inprocserver32_modification_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[malicious_powershell_process___encoded_command_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[malicious_powershell_process___execution_policy_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[malicious_powershell_process___multiple_suspicious_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[malicious_powershell_process_with_obfuscation_techniques_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[malicious_powershell_executed_as_a_service_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[microsoft_exchange_mailbox_replication_service_writing_active_server_pages_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[mimikatz_passtheticket_commandline_parameters_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[mmc_lolbas_execution_process_spawn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[modification_of_wallpaper_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[modify_acl_permission_to_files_or_folder_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[monitor_dns_for_brand_abuse_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[monitor_email_for_brand_abuse_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[monitor_registry_keys_for_print_monitors_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[monitor_successful_backups_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[monitor_unsuccessful_backups_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[monitor_web_traffic_for_brand_abuse_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[mshta_spawning_rundll32_or_regsvr32_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[msmpeng_application_dll_side_loading_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_archive_files_http_post_traffic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_users_attempting_to_authenticate_using_explicit_credentials_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_users_failing_to_authenticate_from_host_using_kerberos_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_users_failing_to_authenticate_from_host_using_ntlm_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_users_failing_to_authenticate_from_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_users_remotely_failing_to_authenticate_from_host_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[net_profiler_uac_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[nltest_domain_trust_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[net_localgroup_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[network_connection_discovery_with_arp_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[network_connection_discovery_with_net_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[network_connection_discovery_with_netstat_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[network_discovery_using_route_windows_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[new_container_uploaded_to_aws_ecr_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[nishang_powershelltcponeline_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[no_windows_updates_in_a_time_frame_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[non_chrome_process_accessing_chrome_default_dir_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[non_firefox_process_access_firefox_profile_dir_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ntdsutil_export_ntds_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_add_app_role_assignment_grant_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_added_service_principal_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_bypass_mfa_via_trusted_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_disable_mfa_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_excessive_authentication_failures_alert_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_excessive_sso_logon_errors_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_new_federated_domain_added_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_pst_export_alert_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_suspicious_admin_email_forwarding_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_suspicious_rights_delegation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_suspicious_user_email_forwarding_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_application_drop_executable_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_application_spawn_regsvr32_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_application_spawn_rundll32_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_document_creating_schedule_task_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_document_executing_macro_code_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_document_spawned_child_process_to_download_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_product_spawn_cmd_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_product_spawning_bitsadmin_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_product_spawning_certutil_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_product_spawning_mshta_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_product_spawning_rundll32_with_no_dll_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_product_spawning_wmic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_product_writing_cab_or_inf_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_spawning_control_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[okta_account_lockout_events_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[okta_failed_sso_attempts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[okta_user_logins_from_multiple_cities_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[open_redirect_in_splunk_web_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[osquery_pack___coldroot_detection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[outbound_network_connection_from_java_using_default_ports_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[overwriting_accessibility_binaries_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[password_policy_discovery_with_net_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[permission_modification_using_takeown_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[petitpotam_network_share_access_request_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[petitpotam_suspicious_kerberos_tgt_request_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ping_sleep_batch_command_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[plain_http_post_exfiltrated_data_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[possible_browser_pass_view_parameter_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[possible_lateral_movement_powershell_spawn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[potentially_malicious_code_on_commandline_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell___connect_to_internet_with_hidden_window_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_4104_hunting_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_domain_enumeration_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_get_localgroup_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_start_bitstransfer_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_creating_thread_mutex_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_disable_security_monitoring_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_enable_smb1protocol_feature_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_execute_com_object_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_fileless_process_injection_via_getprocaddress_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_fileless_script_contains_base64_encoded_content_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_get_localgroup_discovery_with_script_block_logging_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_processing_stream_of_data_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_remote_thread_to_known_windows_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_remove_windows_defender_directory_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_using_memory_as_backing_store_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_windows_defender_exclusion_commands_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[prevent_automatic_repair_mode_using_bcdedit_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_aws_cross_account_activity_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_aws_cross_account_activity___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_aws_cross_account_activity___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_aws_provisioning_activity_sources_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_aws_regions_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_api_calls_per_user_role___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_api_calls_per_user_role___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_creations_by_user___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_creations_by_user___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_images___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_images___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_instance_types___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_instance_types___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_instance_modifications_by_user___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_instance_modifications_by_user___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_provisioning_activity_sources___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_provisioning_activity_sources___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_regions___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_regions___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_ec2_amis_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_ec2_instance_types_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_ec2_launches_by_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_ec2_modifications_by_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_running_windows_services___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_running_windows_services___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_users_in_cloudtrail___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_users_in_cloudtrail___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_zoom_child_processes___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_zoom_child_processes___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_api_call_per_user_roles_in_cloudtrail_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_s3_bucket_access_by_remote_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_users_in_cloudtrail_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[print_processor_registry_autostart_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[print_spooler_adding_a_printer_driver_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[print_spooler_failed_to_load_a_plug_in_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[process_creating_lnk_file_in_suspicious_location_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[process_deleting_its_process_file_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[process_execution_via_wmi_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[process_kill_base_on_file_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[process_writing_dynamicwrapperx_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[processes_tapping_keyboard_events_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[processes_created_by_netsh_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[processes_launching_netsh_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[prohibited_network_traffic_allowed_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[prohibited_software_on_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[protocol_or_port_mismatch_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[protocols_passing_authentication_in_cleartext_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[randomly_generated_scheduled_task_name_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[randomly_generated_windows_service_name_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ransomware_notes_bulk_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[recon_avproduct_through_pwh_or_wmi_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[recon_using_wmi_class_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[recursive_delete_of_directory_in_batch_cmd_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[reg_exe_manipulating_windows_services_registry_keys_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[reg_exe_used_to_hide_files_directories_via_registry_keys_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[registry_keys_used_for_persistence_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[registry_keys_used_for_privilege_escalation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[registry_keys_for_creating_shim_databases_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[regsvr32_silent_and_install_param_dll_loading_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[regsvr32_with_known_silent_switch_cmdline_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remcos_rat_file_creation_in_remcos_folder_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remcos_client_registry_install_entry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_desktop_network_bruteforce_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_desktop_network_traffic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_desktop_process_running_on_system_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_process_instantiation_via_dcom_and_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_process_instantiation_via_dcom_and_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_process_instantiation_via_wmi_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_process_instantiation_via_wmi_and_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_process_instantiation_via_wmi_and_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_process_instantiation_via_winrm_and_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_process_instantiation_via_winrm_and_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_process_instantiation_via_winrm_and_winrs_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_registry_key_modifications_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_system_discovery_with_adsisearcher_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_system_discovery_with_dsquery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_system_discovery_with_net_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_system_discovery_with_wmic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_wmi_command_attempt_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[resize_shadowstorage_volume_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[revil_common_exec_parameter_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[revil_registry_entry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rubeus_command_line_parameters_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rubeus_kerberos_ticket_exports_through_winlogon_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rundll_loading_dll_by_ordinal_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[runas_execution_in_commandline_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rundll32_control_rundll_hunt_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rundll32_control_rundll_world_writable_directory_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rundll32_create_remote_thread_to_a_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rundll32_createremotethread_in_browser_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rundll32_dnsquery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rundll32_lockworkstation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rundll32_process_creating_exe_dll_files_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rundll32_shimcache_flush_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rundll32_with_no_command_line_arguments_with_network_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ryuk_test_files_detected_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ryuk_wake_on_lan_command_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[sam_database_file_access_attempt_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[slui_runas_elevated_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[slui_spawning_a_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[smb_traffic_spike_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[smb_traffic_spike___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[sql_injection_with_long_urls_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[samsam_test_file_write_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[sc_exe_manipulating_windows_services_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[schcache_change_by_app_connect_and_create_adsi_object_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[schedule_task_with_http_command_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[schedule_task_with_rundll32_command_trigger_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[scheduled_task_creation_on_remote_endpoint_using_at_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[scheduled_task_deleted_or_created_via_cmd_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[scheduled_task_initiation_on_remote_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[scheduled_tasks_used_in_badrabbit_ransomware_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[schtasks_run_task_on_demand_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[schtasks_scheduling_job_on_remote_system_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[schtasks_used_for_forcing_a_reboot_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[screensaver_event_trigger_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[script_execution_via_wmi_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[sdclt_uac_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[sdelete_application_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[searchprotocolhost_with_no_command_line_with_network_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[secretdumps_offline_ntds_dumping_tool_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[serviceprincipalnames_discovery_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[serviceprincipalnames_discovery_with_setspn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[services_escalate_exe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[services_lolbas_execution_process_spawn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[shim_database_file_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[shim_database_installation_with_suspicious_parameters_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[short_lived_scheduled_task_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[short_lived_windows_accounts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[silentcleanup_uac_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[single_letter_process_on_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[spectre_and_meltdown_vulnerable_systems_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[spike_in_file_writes_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[splunk_enterprise_information_disclosure_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[spoolsv_spawning_rundll32_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[spoolsv_suspicious_loaded_modules_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[spoolsv_suspicious_process_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[spoolsv_writing_a_dll_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[spoolsv_writing_a_dll___sysmon_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[sqlite_module_in_temp_folder_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[start_up_during_safe_mode_boot_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[sunburst_correlation_dll_and_network_event_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[supernova_webshell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_changes_to_file_associations_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_computer_account_name_change_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_copy_on_system32_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_curl_network_connection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_dllhost_no_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_driver_loaded_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_email___uba_anomaly_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_email_attachment_extensions_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_event_log_service_behavior_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_file_write_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_gpupdate_no_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_icedid_rundll32_cmdline_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_image_creation_in_appdata_folder_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_java_classes_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_kerberos_service_ticket_request_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_linux_discovery_commands_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_msbuild_rename_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_msbuild_spawn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_plistbuddy_usage_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_plistbuddy_usage_via_osquery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_process_dns_query_known_abuse_web_services_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_process_file_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_process_with_discord_dns_query_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_reg_exe_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_regsvr32_register_suspicious_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_rundll32_plugininit_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_rundll32_rename_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_rundll32_startw_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_rundll32_dllregisterserver_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_rundll32_no_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_sqlite3_lsquarantine_behavior_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_scheduled_task_from_public_directory_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_searchprotocolhost_no_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_ticket_granting_ticket_request_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_wav_file_in_appdata_folder_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_microsoft_workflow_compiler_rename_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_microsoft_workflow_compiler_usage_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_msbuild_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_mshta_child_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_mshta_spawn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_wevtutil_usage_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_writes_to_system_volume_information_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_writes_to_windows_recycle_bin_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[svchost_lolbas_execution_process_spawn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[system_info_gathering_using_dxdiag_application_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[system_information_discovery_detection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[system_processes_run_from_unexpected_locations_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[system_user_discovery_with_query_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[system_user_discovery_with_whoami_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[systems_ready_for_spectre_meltdown_windows_patch_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[tor_traffic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[time_provider_persistence_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[trickbot_named_pipe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[uac_bypass_mmc_load_unsigned_dll_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[uac_bypass_with_colorui_com_object_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[usn_journal_deletion_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[uncommon_processes_on_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unified_messaging_service_spawning_a_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[uninstall_app_using_msiexec_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unload_sysmon_filter_driver_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unloading_amsi_via_reflection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unsigned_image_loaded_by_lsass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unsuccessful_netbackup_backups_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unusual_number_of_computer_service_tickets_requested_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unusual_number_of_kerberos_service_tickets_requested_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unusual_number_of_remote_endpoint_authentication_events_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unusually_long_command_line_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unusually_long_command_line___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unusually_long_content_type_length_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[update_previously_seen_users_in_cloudtrail_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[user_discovery_with_env_vars_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[user_discovery_with_env_vars_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[vbscript_execution_using_wscript_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[verclsid_clsid_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[w3wp_spawning_shell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wbadmin_delete_system_backups_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wmi_permanent_event_subscription_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wmi_permanent_event_subscription___sysmon_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wmi_recon_running_process_or_services_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wmi_temporary_event_subscription_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wmic_xsl_execution_via_url_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wsreset_uac_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wbemprox_com_object_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[web_fraud___account_harvesting_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[web_fraud___anomalous_user_clickspeed_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[web_fraud___password_sharing_across_accounts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[web_servers_executing_suspicious_processes_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wermgr_process_connecting_to_ip_check_web_services_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wermgr_process_create_executable_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wermgr_process_spawned_cmd_or_powershell_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wget_download_and_bash_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[winevent_scheduled_task_created_within_public_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[winevent_scheduled_task_created_to_spawn_shell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[winevent_windows_task_scheduler_event_action_started_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[winrm_spawning_a_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_adfind_exe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_curl_download_to_suspicious_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_curl_upload_to_remote_destination_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_dism_remove_defender_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_defender_exclusion_registry_entry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_disable_memory_crash_dump_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_disableantispyware_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_diskcryptor_usage_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_diskshadow_proxy_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_dotnet_binary_in_non_standard_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_event_for_service_disabled_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_event_log_cleared_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_excessive_disabled_services_event_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_file_without_extension_in_critical_folder_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_high_file_deletion_frequency_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_hunting_system_account_targeting_lsass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_indirect_command_execution_via_forfiles_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_indirect_command_execution_via_pcalua_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_installutil_credential_theft_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_installutil_remote_network_connection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_installutil_url_in_command_line_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_installutil_uninstall_option_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_installutil_uninstall_option_with_network_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_installutil_in_non_standard_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_java_spawning_shells_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_modify_show_compress_color_and_info_tip_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_nirsoft_advancedrun_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_nirsoft_utilities_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_non_system_account_targeting_lsass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_possible_credential_dumping_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_process_with_namedpipe_commandline_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_raccine_scheduled_task_deletion_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_rasautou_dll_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_raw_access_to_disk_volume_partition_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_raw_access_to_master_boot_record_drive_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_remote_assistance_spawning_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_schtasks_create_run_as_system_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_security_account_manager_stopped_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_service_created_with_suspicious_service_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_service_created_within_public_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_service_creation_using_registry_entry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_service_creation_on_remote_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_service_initiation_on_remote_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_updates_install_failures_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_updates_install_successes_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_wmi_process_call_create_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_connhost_exe_started_forcefully_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_hosts_file_modification_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[winhlp32_spawning_a_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[winword_spawning_cmd_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[winword_spawning_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[winword_spawning_windows_script_host_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wmic_group_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wmic_noninteractive_app_uninstallation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wmiprsve_lolbas_execution_process_spawn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wscript_or_cscript_suspicious_child_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wsmprovhost_lolbas_execution_process_spawn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[xmrig_driver_loaded_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[xsl_script_execution_with_wmic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_detect_attach_to_role_policy_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_detect_permanent_key_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_detect_role_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_detect_sts_assume_role_abuse_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_detect_sts_get_session_token_abuse_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gcp_detect_oauth_token_abuse_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. +